[gentoo-commits] proj/linux-patches:4.9 commit in: /

[Mike Pagano]

commit:     a8f461abd40e77004316d61525d65e25fc114e93
Author:     Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Thu Oct  4 10:40:00 2018 +0000
Commit:     Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Thu Oct  4 10:40:00 2018 +0000
URL:        https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=a8f461ab

Linux patch 4.9.131

Signed-off-by: Mike Pagano <mpagano <AT> gentoo.org>

 0000_README              |    4 +
 1130_linux-4.9.131.patch | 2733 ++++++++++++++++++++++++++++++++++++++++++++++
 2 files changed, 2737 insertions(+)

diff --git a/0000_README b/0000_README
index 776fab9..5b6207f 100644
--- a/0000_README
+++ b/0000_README
@@ -563,6 +563,10 @@ Patch:  1129_linux-4.9.130.patch
 From:   http://www.kernel.org
 Desc:   Linux 4.9.130
 
+Patch:  1130_linux-4.9.131.patch
+From:   http://www.kernel.org
+Desc:   Linux 4.9.131
+
 Patch:  1500_XATTR_USER_PREFIX.patch
 From:   https://bugs.gentoo.org/show_bug.cgi?id=470644
 Desc:   Support for namespace user.pax.* on tmpfs.

diff --git a/1130_linux-4.9.131.patch b/1130_linux-4.9.131.patch
new file mode 100644
index 0000000..118d823
--- /dev/null
+++ b/1130_linux-4.9.131.patch
@@ -0,0 +1,2733 @@
+diff --git a/Documentation/hwmon/ina2xx b/Documentation/hwmon/ina2xx
+index cfd31d94c872..f8bf14055c2f 100644
+--- a/Documentation/hwmon/ina2xx
++++ b/Documentation/hwmon/ina2xx
+@@ -32,7 +32,7 @@ Supported chips:
+     Datasheet: Publicly available at the Texas Instruments website
+                http://www.ti.com/
+ 
+-Author: Lothar Felten <l-felten@××.com>
++Author: Lothar Felten <lothar.felten@×××××.com>
+ 
+ Description
+ -----------
+diff --git a/Makefile b/Makefile
+index b98e04a5e1e5..73c4e9a8c127 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,6 +1,6 @@
+ VERSION = 4
+ PATCHLEVEL = 9
+-SUBLEVEL = 130
++SUBLEVEL = 131
+ EXTRAVERSION =
+ NAME = Roaring Lionus
+ 
+diff --git a/arch/arm/boot/dts/dra7.dtsi b/arch/arm/boot/dts/dra7.dtsi
+index ce54a70b7695..a1a928064b53 100644
+--- a/arch/arm/boot/dts/dra7.dtsi
++++ b/arch/arm/boot/dts/dra7.dtsi
+@@ -1770,7 +1770,7 @@
+ 			};
+ 		};
+ 
+-		dcan1: can@481cc000 {
++		dcan1: can@4ae3c000 {
+ 			compatible = "ti,dra7-d_can";
+ 			ti,hwmods = "dcan1";
+ 			reg = <0x4ae3c000 0x2000>;
+@@ -1780,7 +1780,7 @@
+ 			status = "disabled";
+ 		};
+ 
+-		dcan2: can@481d0000 {
++		dcan2: can@48480000 {
+ 			compatible = "ti,dra7-d_can";
+ 			ti,hwmods = "dcan2";
+ 			reg = <0x48480000 0x2000>;
+diff --git a/arch/arm/mach-mvebu/pmsu.c b/arch/arm/mach-mvebu/pmsu.c
+index f39bd51bce18..faaf7c3aaf9f 100644
+--- a/arch/arm/mach-mvebu/pmsu.c
++++ b/arch/arm/mach-mvebu/pmsu.c
+@@ -116,8 +116,8 @@ void mvebu_pmsu_set_cpu_boot_addr(int hw_cpu, void *boot_addr)
+ 		PMSU_BOOT_ADDR_REDIRECT_OFFSET(hw_cpu));
+ }
+ 
+-extern unsigned char mvebu_boot_wa_start;
+-extern unsigned char mvebu_boot_wa_end;
++extern unsigned char mvebu_boot_wa_start[];
++extern unsigned char mvebu_boot_wa_end[];
+ 
+ /*
+  * This function sets up the boot address workaround needed for SMP
+@@ -130,7 +130,7 @@ int mvebu_setup_boot_addr_wa(unsigned int crypto_eng_target,
+ 			     phys_addr_t resume_addr_reg)
+ {
+ 	void __iomem *sram_virt_base;
+-	u32 code_len = &mvebu_boot_wa_end - &mvebu_boot_wa_start;
++	u32 code_len = mvebu_boot_wa_end - mvebu_boot_wa_start;
+ 
+ 	mvebu_mbus_del_window(BOOTROM_BASE, BOOTROM_SIZE);
+ 	mvebu_mbus_add_window_by_id(crypto_eng_target, crypto_eng_attribute,
+diff --git a/arch/arm/mach-omap2/omap_hwmod_reset.c b/arch/arm/mach-omap2/omap_hwmod_reset.c
+index b68f9c0aff0b..d5ddba00bb73 100644
+--- a/arch/arm/mach-omap2/omap_hwmod_reset.c
++++ b/arch/arm/mach-omap2/omap_hwmod_reset.c
+@@ -92,11 +92,13 @@ static void omap_rtc_wait_not_busy(struct omap_hwmod *oh)
+  */
+ void omap_hwmod_rtc_unlock(struct omap_hwmod *oh)
+ {
+-	local_irq_disable();
++	unsigned long flags;
++
++	local_irq_save(flags);
+ 	omap_rtc_wait_not_busy(oh);
+ 	omap_hwmod_write(OMAP_RTC_KICK0_VALUE, oh, OMAP_RTC_KICK0_REG);
+ 	omap_hwmod_write(OMAP_RTC_KICK1_VALUE, oh, OMAP_RTC_KICK1_REG);
+-	local_irq_enable();
++	local_irq_restore(flags);
+ }
+ 
+ /**
+@@ -110,9 +112,11 @@ void omap_hwmod_rtc_unlock(struct omap_hwmod *oh)
+  */
+ void omap_hwmod_rtc_lock(struct omap_hwmod *oh)
+ {
+-	local_irq_disable();
++	unsigned long flags;
++
++	local_irq_save(flags);
+ 	omap_rtc_wait_not_busy(oh);
+ 	omap_hwmod_write(0x0, oh, OMAP_RTC_KICK0_REG);
+ 	omap_hwmod_write(0x0, oh, OMAP_RTC_KICK1_REG);
+-	local_irq_enable();
++	local_irq_restore(flags);
+ }
+diff --git a/arch/arm64/include/asm/kvm_emulate.h b/arch/arm64/include/asm/kvm_emulate.h
+index fe39e6841326..ba0d52c22b50 100644
+--- a/arch/arm64/include/asm/kvm_emulate.h
++++ b/arch/arm64/include/asm/kvm_emulate.h
+@@ -42,6 +42,11 @@ void kvm_inject_vabt(struct kvm_vcpu *vcpu);
+ void kvm_inject_dabt(struct kvm_vcpu *vcpu, unsigned long addr);
+ void kvm_inject_pabt(struct kvm_vcpu *vcpu, unsigned long addr);
+ 
++static inline bool vcpu_el1_is_32bit(struct kvm_vcpu *vcpu)
++{
++	return !(vcpu->arch.hcr_el2 & HCR_RW);
++}
++
+ static inline void vcpu_reset_hcr(struct kvm_vcpu *vcpu)
+ {
+ 	vcpu->arch.hcr_el2 = HCR_GUEST_FLAGS;
+diff --git a/arch/arm64/kvm/guest.c b/arch/arm64/kvm/guest.c
+index d3e0a2ffb383..e41a7b4f3a9b 100644
+--- a/arch/arm64/kvm/guest.c
++++ b/arch/arm64/kvm/guest.c
+@@ -57,6 +57,45 @@ static u64 core_reg_offset_from_id(u64 id)
+ 	return id & ~(KVM_REG_ARCH_MASK | KVM_REG_SIZE_MASK | KVM_REG_ARM_CORE);
+ }
+ 
++static int validate_core_offset(const struct kvm_one_reg *reg)
++{
++	u64 off = core_reg_offset_from_id(reg->id);
++	int size;
++
++	switch (off) {
++	case KVM_REG_ARM_CORE_REG(regs.regs[0]) ...
++	     KVM_REG_ARM_CORE_REG(regs.regs[30]):
++	case KVM_REG_ARM_CORE_REG(regs.sp):
++	case KVM_REG_ARM_CORE_REG(regs.pc):
++	case KVM_REG_ARM_CORE_REG(regs.pstate):
++	case KVM_REG_ARM_CORE_REG(sp_el1):
++	case KVM_REG_ARM_CORE_REG(elr_el1):
++	case KVM_REG_ARM_CORE_REG(spsr[0]) ...
++	     KVM_REG_ARM_CORE_REG(spsr[KVM_NR_SPSR - 1]):
++		size = sizeof(__u64);
++		break;
++
++	case KVM_REG_ARM_CORE_REG(fp_regs.vregs[0]) ...
++	     KVM_REG_ARM_CORE_REG(fp_regs.vregs[31]):
++		size = sizeof(__uint128_t);
++		break;
++
++	case KVM_REG_ARM_CORE_REG(fp_regs.fpsr):
++	case KVM_REG_ARM_CORE_REG(fp_regs.fpcr):
++		size = sizeof(__u32);
++		break;
++
++	default:
++		return -EINVAL;
++	}
++
++	if (KVM_REG_SIZE(reg->id) == size &&
++	    IS_ALIGNED(off, size / sizeof(__u32)))
++		return 0;
++
++	return -EINVAL;
++}
++
+ static int get_core_reg(struct kvm_vcpu *vcpu, const struct kvm_one_reg *reg)
+ {
+ 	/*
+@@ -76,6 +115,9 @@ static int get_core_reg(struct kvm_vcpu *vcpu, const struct kvm_one_reg *reg)
+ 	    (off + (KVM_REG_SIZE(reg->id) / sizeof(__u32))) >= nr_regs)
+ 		return -ENOENT;
+ 
++	if (validate_core_offset(reg))
++		return -EINVAL;
++
+ 	if (copy_to_user(uaddr, ((u32 *)regs) + off, KVM_REG_SIZE(reg->id)))
+ 		return -EFAULT;
+ 
+@@ -98,6 +140,9 @@ static int set_core_reg(struct kvm_vcpu *vcpu, const struct kvm_one_reg *reg)
+ 	    (off + (KVM_REG_SIZE(reg->id) / sizeof(__u32))) >= nr_regs)
+ 		return -ENOENT;
+ 
++	if (validate_core_offset(reg))
++		return -EINVAL;
++
+ 	if (KVM_REG_SIZE(reg->id) > sizeof(tmp))
+ 		return -EINVAL;
+ 
+@@ -107,17 +152,25 @@ static int set_core_reg(struct kvm_vcpu *vcpu, const struct kvm_one_reg *reg)
+ 	}
+ 
+ 	if (off == KVM_REG_ARM_CORE_REG(regs.pstate)) {
+-		u32 mode = (*(u32 *)valp) & COMPAT_PSR_MODE_MASK;
++		u64 mode = (*(u64 *)valp) & COMPAT_PSR_MODE_MASK;
+ 		switch (mode) {
+ 		case COMPAT_PSR_MODE_USR:
++			if (!system_supports_32bit_el0())
++				return -EINVAL;
++			break;
+ 		case COMPAT_PSR_MODE_FIQ:
+ 		case COMPAT_PSR_MODE_IRQ:
+ 		case COMPAT_PSR_MODE_SVC:
+ 		case COMPAT_PSR_MODE_ABT:
+ 		case COMPAT_PSR_MODE_UND:
++			if (!vcpu_el1_is_32bit(vcpu))
++				return -EINVAL;
++			break;
+ 		case PSR_MODE_EL0t:
+ 		case PSR_MODE_EL1t:
+ 		case PSR_MODE_EL1h:
++			if (vcpu_el1_is_32bit(vcpu))
++				return -EINVAL;
+ 			break;
+ 		default:
+ 			err = -EINVAL;
+diff --git a/arch/powerpc/kernel/machine_kexec.c b/arch/powerpc/kernel/machine_kexec.c
+index 2694d078741d..9dafd7af39b8 100644
+--- a/arch/powerpc/kernel/machine_kexec.c
++++ b/arch/powerpc/kernel/machine_kexec.c
+@@ -186,7 +186,12 @@ void __init reserve_crashkernel(void)
+ 			(unsigned long)(crashk_res.start >> 20),
+ 			(unsigned long)(memblock_phys_mem_size() >> 20));
+ 
+-	memblock_reserve(crashk_res.start, crash_size);
++	if (!memblock_is_region_memory(crashk_res.start, crash_size) ||
++	    memblock_reserve(crashk_res.start, crash_size)) {
++		pr_err("Failed to reserve memory for crashkernel!\n");
++		crashk_res.start = crashk_res.end = 0;
++		return;
++	}
+ }
+ 
+ int overlaps_crashkernel(unsigned long start, unsigned long size)
+diff --git a/arch/powerpc/platforms/powernv/pci-ioda.c b/arch/powerpc/platforms/powernv/pci-ioda.c
+index f52cc6fd4290..8015e40bc7ee 100644
+--- a/arch/powerpc/platforms/powernv/pci-ioda.c
++++ b/arch/powerpc/platforms/powernv/pci-ioda.c
+@@ -2623,7 +2623,7 @@ static long pnv_pci_ioda2_table_alloc_pages(int nid, __u64 bus_offset,
+ 	level_shift = entries_shift + 3;
+ 	level_shift = max_t(unsigned, level_shift, PAGE_SHIFT);
+ 
+-	if ((level_shift - 3) * levels + page_shift >= 60)
++	if ((level_shift - 3) * levels + page_shift >= 55)
+ 		return -EINVAL;
+ 
+ 	/* Allocate TCE table */
+diff --git a/arch/s390/mm/extmem.c b/arch/s390/mm/extmem.c
+index 02042b6b66bf..e6665a6e105e 100644
+--- a/arch/s390/mm/extmem.c
++++ b/arch/s390/mm/extmem.c
+@@ -79,7 +79,7 @@ struct qin64 {
+ struct dcss_segment {
+ 	struct list_head list;
+ 	char dcss_name[8];
+-	char res_name[15];
++	char res_name[16];
+ 	unsigned long start_addr;
+ 	unsigned long end;
+ 	atomic_t ref_count;
+@@ -432,7 +432,7 @@ __segment_load (char *name, int do_nonshared, unsigned long *addr, unsigned long
+ 	memcpy(&seg->res_name, seg->dcss_name, 8);
+ 	EBCASC(seg->res_name, 8);
+ 	seg->res_name[8] = '\0';
+-	strncat(seg->res_name, " (DCSS)", 7);
++	strlcat(seg->res_name, " (DCSS)", sizeof(seg->res_name));
+ 	seg->res->name = seg->res_name;
+ 	rc = seg->vm_segtype;
+ 	if (rc == SEG_TYPE_SC ||
+diff --git a/arch/s390/mm/pgalloc.c b/arch/s390/mm/pgalloc.c
+index 995f78532cc2..781a044e1702 100644
+--- a/arch/s390/mm/pgalloc.c
++++ b/arch/s390/mm/pgalloc.c
+@@ -26,7 +26,7 @@ static struct ctl_table page_table_sysctl[] = {
+ 		.data		= &page_table_allocate_pgste,
+ 		.maxlen		= sizeof(int),
+ 		.mode		= S_IRUGO | S_IWUSR,
+-		.proc_handler	= proc_dointvec,
++		.proc_handler	= proc_dointvec_minmax,
+ 		.extra1		= &page_table_allocate_pgste_min,
+ 		.extra2		= &page_table_allocate_pgste_max,
+ 	},
+diff --git a/arch/x86/entry/entry_64.S b/arch/x86/entry/entry_64.S
+index 76c1d85e749b..870e941c1947 100644
+--- a/arch/x86/entry/entry_64.S
++++ b/arch/x86/entry/entry_64.S
+@@ -91,7 +91,7 @@ ENDPROC(native_usergs_sysret64)
+ .endm
+ 
+ .macro TRACE_IRQS_IRETQ_DEBUG
+-	bt	$9, EFLAGS(%rsp)		/* interrupts off? */
++	btl	$9, EFLAGS(%rsp)		/* interrupts off? */
+ 	jnc	1f
+ 	TRACE_IRQS_ON_DEBUG
+ 1:
+@@ -485,7 +485,7 @@ retint_kernel:
+ #ifdef CONFIG_PREEMPT
+ 	/* Interrupts are off */
+ 	/* Check if we need preemption */
+-	bt	$9, EFLAGS(%rsp)		/* were interrupts off? */
++	btl	$9, EFLAGS(%rsp)		/* were interrupts off? */
+ 	jnc	1f
+ 0:	cmpl	$0, PER_CPU_VAR(__preempt_count)
+ 	jnz	1f
+diff --git a/arch/x86/events/intel/lbr.c b/arch/x86/events/intel/lbr.c
+index 5d103a87e984..2c3c7abf678b 100644
+--- a/arch/x86/events/intel/lbr.c
++++ b/arch/x86/events/intel/lbr.c
+@@ -342,7 +342,7 @@ static void __intel_pmu_lbr_restore(struct x86_perf_task_context *task_ctx)
+ 
+ 	mask = x86_pmu.lbr_nr - 1;
+ 	tos = task_ctx->tos;
+-	for (i = 0; i < tos; i++) {
++	for (i = 0; i < task_ctx->valid_lbrs; i++) {
+ 		lbr_idx = (tos - i) & mask;
+ 		wrlbr_from(lbr_idx, task_ctx->lbr_from[i]);
+ 		wrlbr_to  (lbr_idx, task_ctx->lbr_to[i]);
+@@ -350,6 +350,15 @@ static void __intel_pmu_lbr_restore(struct x86_perf_task_context *task_ctx)
+ 		if (x86_pmu.intel_cap.lbr_format == LBR_FORMAT_INFO)
+ 			wrmsrl(MSR_LBR_INFO_0 + lbr_idx, task_ctx->lbr_info[i]);
+ 	}
++
++	for (; i < x86_pmu.lbr_nr; i++) {
++		lbr_idx = (tos - i) & mask;
++		wrlbr_from(lbr_idx, 0);
++		wrlbr_to(lbr_idx, 0);
++		if (x86_pmu.intel_cap.lbr_format == LBR_FORMAT_INFO)
++			wrmsrl(MSR_LBR_INFO_0 + lbr_idx, 0);
++	}
++
+ 	wrmsrl(x86_pmu.lbr_tos, tos);
+ 	task_ctx->lbr_stack_state = LBR_NONE;
+ }
+@@ -357,7 +366,7 @@ static void __intel_pmu_lbr_restore(struct x86_perf_task_context *task_ctx)
+ static void __intel_pmu_lbr_save(struct x86_perf_task_context *task_ctx)
+ {
+ 	unsigned lbr_idx, mask;
+-	u64 tos;
++	u64 tos, from;
+ 	int i;
+ 
+ 	if (task_ctx->lbr_callstack_users == 0) {
+@@ -367,13 +376,17 @@ static void __intel_pmu_lbr_save(struct x86_perf_task_context *task_ctx)
+ 
+ 	mask = x86_pmu.lbr_nr - 1;
+ 	tos = intel_pmu_lbr_tos();
+-	for (i = 0; i < tos; i++) {
++	for (i = 0; i < x86_pmu.lbr_nr; i++) {
+ 		lbr_idx = (tos - i) & mask;
+-		task_ctx->lbr_from[i] = rdlbr_from(lbr_idx);
++		from = rdlbr_from(lbr_idx);
++		if (!from)
++			break;
++		task_ctx->lbr_from[i] = from;
+ 		task_ctx->lbr_to[i]   = rdlbr_to(lbr_idx);
+ 		if (x86_pmu.intel_cap.lbr_format == LBR_FORMAT_INFO)
+ 			rdmsrl(MSR_LBR_INFO_0 + lbr_idx, task_ctx->lbr_info[i]);
+ 	}
++	task_ctx->valid_lbrs = i;
+ 	task_ctx->tos = tos;
+ 	task_ctx->lbr_stack_state = LBR_VALID;
+ }
+@@ -522,7 +535,7 @@ static void intel_pmu_lbr_read_32(struct cpu_hw_events *cpuc)
+  */
+ static void intel_pmu_lbr_read_64(struct cpu_hw_events *cpuc)
+ {
+-	bool need_info = false;
++	bool need_info = false, call_stack = false;
+ 	unsigned long mask = x86_pmu.lbr_nr - 1;
+ 	int lbr_format = x86_pmu.intel_cap.lbr_format;
+ 	u64 tos = intel_pmu_lbr_tos();
+@@ -533,7 +546,7 @@ static void intel_pmu_lbr_read_64(struct cpu_hw_events *cpuc)
+ 	if (cpuc->lbr_sel) {
+ 		need_info = !(cpuc->lbr_sel->config & LBR_NO_INFO);
+ 		if (cpuc->lbr_sel->config & LBR_CALL_STACK)
+-			num = tos;
++			call_stack = true;
+ 	}
+ 
+ 	for (i = 0; i < num; i++) {
+@@ -546,6 +559,13 @@ static void intel_pmu_lbr_read_64(struct cpu_hw_events *cpuc)
+ 		from = rdlbr_from(lbr_idx);
+ 		to   = rdlbr_to(lbr_idx);
+ 
++		/*
++		 * Read LBR call stack entries
++		 * until invalid entry (0s) is detected.
++		 */
++		if (call_stack && !from)
++			break;
++
+ 		if (lbr_format == LBR_FORMAT_INFO && need_info) {
+ 			u64 info;
+ 
+diff --git a/arch/x86/events/perf_event.h b/arch/x86/events/perf_event.h
+index f3563179290b..1bfebbc4d156 100644
+--- a/arch/x86/events/perf_event.h
++++ b/arch/x86/events/perf_event.h
+@@ -633,6 +633,7 @@ struct x86_perf_task_context {
+ 	u64 lbr_to[MAX_LBR_ENTRIES];
+ 	u64 lbr_info[MAX_LBR_ENTRIES];
+ 	int tos;
++	int valid_lbrs;
+ 	int lbr_callstack_users;
+ 	int lbr_stack_state;
+ };
+diff --git a/arch/x86/kernel/tsc_msr.c b/arch/x86/kernel/tsc_msr.c
+index 0fe720d64fef..3f818ce985c0 100644
+--- a/arch/x86/kernel/tsc_msr.c
++++ b/arch/x86/kernel/tsc_msr.c
+@@ -12,6 +12,7 @@
+ #include <asm/setup.h>
+ #include <asm/apic.h>
+ #include <asm/param.h>
++#include <asm/tsc.h>
+ 
+ #define MAX_NUM_FREQS	9
+ 
+diff --git a/arch/x86/mm/numa_emulation.c b/arch/x86/mm/numa_emulation.c
+index a8f90ce3dedf..dc6d99017f3f 100644
+--- a/arch/x86/mm/numa_emulation.c
++++ b/arch/x86/mm/numa_emulation.c
+@@ -60,7 +60,7 @@ static int __init emu_setup_memblk(struct numa_meminfo *ei,
+ 	eb->nid = nid;
+ 
+ 	if (emu_nid_to_phys[nid] == NUMA_NO_NODE)
+-		emu_nid_to_phys[nid] = nid;
++		emu_nid_to_phys[nid] = pb->nid;
+ 
+ 	pb->start += size;
+ 	if (pb->start >= pb->end) {
+diff --git a/crypto/ablkcipher.c b/crypto/ablkcipher.c
+index 860c9e5dfd7a..3bc0e76eaaef 100644
+--- a/crypto/ablkcipher.c
++++ b/crypto/ablkcipher.c
+@@ -367,6 +367,7 @@ static int crypto_ablkcipher_report(struct sk_buff *skb, struct crypto_alg *alg)
+ 	strncpy(rblkcipher.type, "ablkcipher", sizeof(rblkcipher.type));
+ 	strncpy(rblkcipher.geniv, alg->cra_ablkcipher.geniv ?: "<default>",
+ 		sizeof(rblkcipher.geniv));
++	rblkcipher.geniv[sizeof(rblkcipher.geniv) - 1] = '\0';
+ 
+ 	rblkcipher.blocksize = alg->cra_blocksize;
+ 	rblkcipher.min_keysize = alg->cra_ablkcipher.min_keysize;
+@@ -441,6 +442,7 @@ static int crypto_givcipher_report(struct sk_buff *skb, struct crypto_alg *alg)
+ 	strncpy(rblkcipher.type, "givcipher", sizeof(rblkcipher.type));
+ 	strncpy(rblkcipher.geniv, alg->cra_ablkcipher.geniv ?: "<built-in>",
+ 		sizeof(rblkcipher.geniv));
++	rblkcipher.geniv[sizeof(rblkcipher.geniv) - 1] = '\0';
+ 
+ 	rblkcipher.blocksize = alg->cra_blocksize;
+ 	rblkcipher.min_keysize = alg->cra_ablkcipher.min_keysize;
+diff --git a/crypto/blkcipher.c b/crypto/blkcipher.c
+index 27f98666763a..59a0936ed8bc 100644
+--- a/crypto/blkcipher.c
++++ b/crypto/blkcipher.c
+@@ -510,6 +510,7 @@ static int crypto_blkcipher_report(struct sk_buff *skb, struct crypto_alg *alg)
+ 	strncpy(rblkcipher.type, "blkcipher", sizeof(rblkcipher.type));
+ 	strncpy(rblkcipher.geniv, alg->cra_blkcipher.geniv ?: "<default>",
+ 		sizeof(rblkcipher.geniv));
++	rblkcipher.geniv[sizeof(rblkcipher.geniv) - 1] = '\0';
+ 
+ 	rblkcipher.blocksize = alg->cra_blocksize;
+ 	rblkcipher.min_keysize = alg->cra_blkcipher.min_keysize;
+diff --git a/drivers/block/floppy.c b/drivers/block/floppy.c
+index e3d8e4ced4a2..a321d7d849c6 100644
+--- a/drivers/block/floppy.c
++++ b/drivers/block/floppy.c
+@@ -3459,6 +3459,9 @@ static int fd_locked_ioctl(struct block_device *bdev, fmode_t mode, unsigned int
+ 					  (struct floppy_struct **)&outparam);
+ 		if (ret)
+ 			return ret;
++		memcpy(&inparam.g, outparam,
++				offsetof(struct floppy_struct, name));
++		outparam = &inparam.g;
+ 		break;
+ 	case FDMSGON:
+ 		UDP->flags |= FTD_MSG;
+diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c
+index 44bccb1afa06..8dce1a890078 100644
+--- a/drivers/bluetooth/btusb.c
++++ b/drivers/bluetooth/btusb.c
+@@ -349,6 +349,7 @@ static const struct usb_device_id blacklist_table[] = {
+ 	{ USB_DEVICE(0x7392, 0xa611), .driver_info = BTUSB_REALTEK },
+ 
+ 	/* Additional Realtek 8723DE Bluetooth devices */
++	{ USB_DEVICE(0x0bda, 0xb009), .driver_info = BTUSB_REALTEK },
+ 	{ USB_DEVICE(0x2ff8, 0xb011), .driver_info = BTUSB_REALTEK },
+ 
+ 	/* Additional Realtek 8821AE Bluetooth devices */
+diff --git a/drivers/edac/edac_mc_sysfs.c b/drivers/edac/edac_mc_sysfs.c
+index 4e0f8e720ad9..40d792e96b75 100644
+--- a/drivers/edac/edac_mc_sysfs.c
++++ b/drivers/edac/edac_mc_sysfs.c
+@@ -1059,14 +1059,14 @@ int __init edac_mc_sysfs_init(void)
+ 
+ 	err = device_add(mci_pdev);
+ 	if (err < 0)
+-		goto out_dev_free;
++		goto out_put_device;
+ 
+ 	edac_dbg(0, "device %s created\n", dev_name(mci_pdev));
+ 
+ 	return 0;
+ 
+- out_dev_free:
+-	kfree(mci_pdev);
++ out_put_device:
++	put_device(mci_pdev);
+  out:
+ 	return err;
+ }
+diff --git a/drivers/edac/i7core_edac.c b/drivers/edac/i7core_edac.c
+index 8a68a5e943ea..b60932026e34 100644
+--- a/drivers/edac/i7core_edac.c
++++ b/drivers/edac/i7core_edac.c
+@@ -1177,15 +1177,14 @@ static int i7core_create_sysfs_devices(struct mem_ctl_info *mci)
+ 
+ 	rc = device_add(pvt->addrmatch_dev);
+ 	if (rc < 0)
+-		return rc;
++		goto err_put_addrmatch;
+ 
+ 	if (!pvt->is_registered) {
+ 		pvt->chancounts_dev = kzalloc(sizeof(*pvt->chancounts_dev),
+ 					      GFP_KERNEL);
+ 		if (!pvt->chancounts_dev) {
+-			put_device(pvt->addrmatch_dev);
+-			device_del(pvt->addrmatch_dev);
+-			return -ENOMEM;
++			rc = -ENOMEM;
++			goto err_del_addrmatch;
+ 		}
+ 
+ 		pvt->chancounts_dev->type = &all_channel_counts_type;
+@@ -1199,9 +1198,18 @@ static int i7core_create_sysfs_devices(struct mem_ctl_info *mci)
+ 
+ 		rc = device_add(pvt->chancounts_dev);
+ 		if (rc < 0)
+-			return rc;
++			goto err_put_chancounts;
+ 	}
+ 	return 0;
++
++err_put_chancounts:
++	put_device(pvt->chancounts_dev);
++err_del_addrmatch:
++	device_del(pvt->addrmatch_dev);
++err_put_addrmatch:
++	put_device(pvt->addrmatch_dev);
++
++	return rc;
+ }
+ 
+ static void i7core_delete_sysfs_devices(struct mem_ctl_info *mci)
+@@ -1211,11 +1219,11 @@ static void i7core_delete_sysfs_devices(struct mem_ctl_info *mci)
+ 	edac_dbg(1, "\n");
+ 
+ 	if (!pvt->is_registered) {
+-		put_device(pvt->chancounts_dev);
+ 		device_del(pvt->chancounts_dev);
++		put_device(pvt->chancounts_dev);
+ 	}
+-	put_device(pvt->addrmatch_dev);
+ 	device_del(pvt->addrmatch_dev);
++	put_device(pvt->addrmatch_dev);
+ }
+ 
+ /****************************************************************************
+diff --git a/drivers/gpio/gpio-menz127.c b/drivers/gpio/gpio-menz127.c
+index a1210e330571..95061d25895b 100644
+--- a/drivers/gpio/gpio-menz127.c
++++ b/drivers/gpio/gpio-menz127.c
+@@ -56,9 +56,9 @@ static int men_z127_debounce(struct gpio_chip *gc, unsigned gpio,
+ 		rnd = fls(debounce) - 1;
+ 
+ 		if (rnd && (debounce & BIT(rnd - 1)))
+-			debounce = round_up(debounce, MEN_Z127_DB_MIN_US);
++			debounce = roundup(debounce, MEN_Z127_DB_MIN_US);
+ 		else
+-			debounce = round_down(debounce, MEN_Z127_DB_MIN_US);
++			debounce = rounddown(debounce, MEN_Z127_DB_MIN_US);
+ 
+ 		if (debounce > MEN_Z127_DB_MAX_US)
+ 			debounce = MEN_Z127_DB_MAX_US;
+diff --git a/drivers/gpu/drm/amd/amdgpu/gfx_v8_0.c b/drivers/gpu/drm/amd/amdgpu/gfx_v8_0.c
+index 564362e8b486..c8a5cf5365a9 100644
+--- a/drivers/gpu/drm/amd/amdgpu/gfx_v8_0.c
++++ b/drivers/gpu/drm/amd/amdgpu/gfx_v8_0.c
+@@ -5551,6 +5551,11 @@ static int gfx_v8_0_set_powergating_state(void *handle,
+ 	if (!(adev->pg_flags & AMD_PG_SUPPORT_GFX_PG))
+ 		return 0;
+ 
++	if (adev->pg_flags & (AMD_PG_SUPPORT_GFX_SMG |
++				AMD_PG_SUPPORT_RLC_SMU_HS |
++				AMD_PG_SUPPORT_CP |
++				AMD_PG_SUPPORT_GFX_DMG))
++		adev->gfx.rlc.funcs->enter_safe_mode(adev);
+ 	switch (adev->asic_type) {
+ 	case CHIP_CARRIZO:
+ 	case CHIP_STONEY:
+@@ -5586,7 +5591,11 @@ static int gfx_v8_0_set_powergating_state(void *handle,
+ 	default:
+ 		break;
+ 	}
+-
++	if (adev->pg_flags & (AMD_PG_SUPPORT_GFX_SMG |
++				AMD_PG_SUPPORT_RLC_SMU_HS |
++				AMD_PG_SUPPORT_CP |
++				AMD_PG_SUPPORT_GFX_DMG))
++		adev->gfx.rlc.funcs->exit_safe_mode(adev);
+ 	return 0;
+ }
+ 
+diff --git a/drivers/gpu/drm/amd/amdgpu/kv_dpm.c b/drivers/gpu/drm/amd/amdgpu/kv_dpm.c
+index 71d2856222fa..f61c489e5f6d 100644
+--- a/drivers/gpu/drm/amd/amdgpu/kv_dpm.c
++++ b/drivers/gpu/drm/amd/amdgpu/kv_dpm.c
+@@ -1350,8 +1350,6 @@ static int kv_dpm_enable(struct amdgpu_device *adev)
+ 		return ret;
+ 	}
+ 
+-	kv_update_current_ps(adev, adev->pm.dpm.boot_ps);
+-
+ 	if (adev->irq.installed &&
+ 	    amdgpu_is_internal_thermal_sensor(adev->pm.int_thermal_type)) {
+ 		ret = kv_set_thermal_temperature_range(adev, KV_TEMP_RANGE_MIN, KV_TEMP_RANGE_MAX);
+@@ -3086,7 +3084,7 @@ static int kv_dpm_hw_init(void *handle)
+ 	else
+ 		adev->pm.dpm_enabled = true;
+ 	mutex_unlock(&adev->pm.mutex);
+-
++	amdgpu_pm_compute_clocks(adev);
+ 	return ret;
+ }
+ 
+diff --git a/drivers/gpu/drm/amd/amdgpu/si_dpm.c b/drivers/gpu/drm/amd/amdgpu/si_dpm.c
+index 3fa8320e49c1..4826befc1bc3 100644
+--- a/drivers/gpu/drm/amd/amdgpu/si_dpm.c
++++ b/drivers/gpu/drm/amd/amdgpu/si_dpm.c
+@@ -6959,7 +6959,6 @@ static int si_dpm_enable(struct amdgpu_device *adev)
+ 
+ 	si_enable_auto_throttle_source(adev, AMDGPU_DPM_AUTO_THROTTLE_SRC_THERMAL, true);
+ 	si_thermal_start_thermal_controller(adev);
+-	ni_update_current_ps(adev, boot_ps);
+ 
+ 	return 0;
+ }
+@@ -7836,7 +7835,7 @@ static int si_dpm_hw_init(void *handle)
+ 	else
+ 		adev->pm.dpm_enabled = true;
+ 	mutex_unlock(&adev->pm.mutex);
+-
++	amdgpu_pm_compute_clocks(adev);
+ 	return ret;
+ }
+ 
+diff --git a/drivers/gpu/drm/sun4i/sun4i_drv.c b/drivers/gpu/drm/sun4i/sun4i_drv.c
+index aad2f4a2a0ef..97828faf2a1f 100644
+--- a/drivers/gpu/drm/sun4i/sun4i_drv.c
++++ b/drivers/gpu/drm/sun4i/sun4i_drv.c
+@@ -283,7 +283,6 @@ static int sun4i_drv_add_endpoints(struct device *dev,
+ 		remote = of_graph_get_remote_port_parent(ep);
+ 		if (!remote) {
+ 			DRM_DEBUG_DRIVER("Error retrieving the output node\n");
+-			of_node_put(remote);
+ 			continue;
+ 		}
+ 
+@@ -297,11 +296,13 @@ static int sun4i_drv_add_endpoints(struct device *dev,
+ 
+ 			if (of_graph_parse_endpoint(ep, &endpoint)) {
+ 				DRM_DEBUG_DRIVER("Couldn't parse endpoint\n");
++				of_node_put(remote);
+ 				continue;
+ 			}
+ 
+ 			if (!endpoint.id) {
+ 				DRM_DEBUG_DRIVER("Endpoint is our panel... skipping\n");
++				of_node_put(remote);
+ 				continue;
+ 			}
+ 		}
+diff --git a/drivers/hid/hid-ntrig.c b/drivers/hid/hid-ntrig.c
+index 1b0084d4af2e..28373dab60ae 100644
+--- a/drivers/hid/hid-ntrig.c
++++ b/drivers/hid/hid-ntrig.c
+@@ -955,6 +955,8 @@ static int ntrig_probe(struct hid_device *hdev, const struct hid_device_id *id)
+ 
+ 	ret = sysfs_create_group(&hdev->dev.kobj,
+ 			&ntrig_attribute_group);
++	if (ret)
++		hid_err(hdev, "cannot create sysfs group\n");
+ 
+ 	return 0;
+ err_free:
+diff --git a/drivers/hwmon/adt7475.c b/drivers/hwmon/adt7475.c
+index 3cefd1aeb24f..9c262d955331 100644
+--- a/drivers/hwmon/adt7475.c
++++ b/drivers/hwmon/adt7475.c
+@@ -274,14 +274,18 @@ static inline u16 volt2reg(int channel, long volt, u8 bypass_attn)
+ 	return clamp_val(reg, 0, 1023) & (0xff << 2);
+ }
+ 
+-static u16 adt7475_read_word(struct i2c_client *client, int reg)
++static int adt7475_read_word(struct i2c_client *client, int reg)
+ {
+-	u16 val;
++	int val1, val2;
+ 
+-	val = i2c_smbus_read_byte_data(client, reg);
+-	val |= (i2c_smbus_read_byte_data(client, reg + 1) << 8);
++	val1 = i2c_smbus_read_byte_data(client, reg);
++	if (val1 < 0)
++		return val1;
++	val2 = i2c_smbus_read_byte_data(client, reg + 1);
++	if (val2 < 0)
++		return val2;
+ 
+-	return val;
++	return val1 | (val2 << 8);
+ }
+ 
+ static void adt7475_write_word(struct i2c_client *client, int reg, u16 val)
+diff --git a/drivers/hwmon/ina2xx.c b/drivers/hwmon/ina2xx.c
+index ac63e562071f..9ac6e1673375 100644
+--- a/drivers/hwmon/ina2xx.c
++++ b/drivers/hwmon/ina2xx.c
+@@ -17,7 +17,7 @@
+  * Bi-directional Current/Power Monitor with I2C Interface
+  * Datasheet: http://www.ti.com/product/ina230
+  *
+- * Copyright (C) 2012 Lothar Felten <l-felten@××.com>
++ * Copyright (C) 2012 Lothar Felten <lothar.felten@×××××.com>
+  * Thanks to Jan Volkering
+  *
+  * This program is free software; you can redistribute it and/or modify
+@@ -328,6 +328,15 @@ static int ina2xx_set_shunt(struct ina2xx_data *data, long val)
+ 	return 0;
+ }
+ 
++static ssize_t ina2xx_show_shunt(struct device *dev,
++			      struct device_attribute *da,
++			      char *buf)
++{
++	struct ina2xx_data *data = dev_get_drvdata(dev);
++
++	return snprintf(buf, PAGE_SIZE, "%li\n", data->rshunt);
++}
++
+ static ssize_t ina2xx_store_shunt(struct device *dev,
+ 				  struct device_attribute *da,
+ 				  const char *buf, size_t count)
+@@ -402,7 +411,7 @@ static SENSOR_DEVICE_ATTR(power1_input, S_IRUGO, ina2xx_show_value, NULL,
+ 
+ /* shunt resistance */
+ static SENSOR_DEVICE_ATTR(shunt_resistor, S_IRUGO | S_IWUSR,
+-			  ina2xx_show_value, ina2xx_store_shunt,
++			  ina2xx_show_shunt, ina2xx_store_shunt,
+ 			  INA2XX_CALIBRATION);
+ 
+ /* update interval (ina226 only) */
+diff --git a/drivers/i2c/busses/i2c-i801.c b/drivers/i2c/busses/i2c-i801.c
+index 663017f1d078..26f1691f67ab 100644
+--- a/drivers/i2c/busses/i2c-i801.c
++++ b/drivers/i2c/busses/i2c-i801.c
+@@ -1408,6 +1408,13 @@ static void i801_add_tco(struct i801_priv *priv)
+ }
+ 
+ #ifdef CONFIG_ACPI
++static bool i801_acpi_is_smbus_ioport(const struct i801_priv *priv,
++				      acpi_physical_address address)
++{
++	return address >= priv->smba &&
++	       address <= pci_resource_end(priv->pci_dev, SMBBAR);
++}
++
+ static acpi_status
+ i801_acpi_io_handler(u32 function, acpi_physical_address address, u32 bits,
+ 		     u64 *value, void *handler_context, void *region_context)
+@@ -1423,7 +1430,7 @@ i801_acpi_io_handler(u32 function, acpi_physical_address address, u32 bits,
+ 	 */
+ 	mutex_lock(&priv->acpi_lock);
+ 
+-	if (!priv->acpi_reserved) {
++	if (!priv->acpi_reserved && i801_acpi_is_smbus_ioport(priv, address)) {
+ 		priv->acpi_reserved = true;
+ 
+ 		dev_warn(&pdev->dev, "BIOS is accessing SMBus registers\n");
+diff --git a/drivers/infiniband/core/rw.c b/drivers/infiniband/core/rw.c
+index dbfd854c32c9..1d90a122fe5e 100644
+--- a/drivers/infiniband/core/rw.c
++++ b/drivers/infiniband/core/rw.c
+@@ -87,7 +87,7 @@ static int rdma_rw_init_one_mr(struct ib_qp *qp, u8 port_num,
+ 	}
+ 
+ 	ret = ib_map_mr_sg(reg->mr, sg, nents, &offset, PAGE_SIZE);
+-	if (ret < nents) {
++	if (ret < 0 || ret < nents) {
+ 		ib_mr_pool_put(qp, &qp->rdma_mrs, reg->mr);
+ 		return -EINVAL;
+ 	}
+diff --git a/drivers/infiniband/hw/hfi1/pio.c b/drivers/infiniband/hw/hfi1/pio.c
+index d89b8745d4c1..c2982bbc82b3 100644
+--- a/drivers/infiniband/hw/hfi1/pio.c
++++ b/drivers/infiniband/hw/hfi1/pio.c
+@@ -88,6 +88,7 @@ void pio_send_control(struct hfi1_devdata *dd, int op)
+ 	unsigned long flags;
+ 	int write = 1;	/* write sendctrl back */
+ 	int flush = 0;	/* re-read sendctrl to make sure it is flushed */
++	int i;
+ 
+ 	spin_lock_irqsave(&dd->sendctrl_lock, flags);
+ 
+@@ -97,9 +98,13 @@ void pio_send_control(struct hfi1_devdata *dd, int op)
+ 		reg |= SEND_CTRL_SEND_ENABLE_SMASK;
+ 	/* Fall through */
+ 	case PSC_DATA_VL_ENABLE:
++		mask = 0;
++		for (i = 0; i < ARRAY_SIZE(dd->vld); i++)
++			if (!dd->vld[i].mtu)
++				mask |= BIT_ULL(i);
+ 		/* Disallow sending on VLs not enabled */
+-		mask = (((~0ull) << num_vls) & SEND_CTRL_UNSUPPORTED_VL_MASK) <<
+-				SEND_CTRL_UNSUPPORTED_VL_SHIFT;
++		mask = (mask & SEND_CTRL_UNSUPPORTED_VL_MASK) <<
++			SEND_CTRL_UNSUPPORTED_VL_SHIFT;
+ 		reg = (reg & ~SEND_CTRL_UNSUPPORTED_VL_SMASK) | mask;
+ 		break;
+ 	case PSC_GLOBAL_DISABLE:
+diff --git a/drivers/infiniband/hw/hfi1/user_sdma.c b/drivers/infiniband/hw/hfi1/user_sdma.c
+index 77697d690f3e..018a41562704 100644
+--- a/drivers/infiniband/hw/hfi1/user_sdma.c
++++ b/drivers/infiniband/hw/hfi1/user_sdma.c
+@@ -956,7 +956,7 @@ static int user_sdma_send_pkts(struct user_sdma_request *req, unsigned maxpkts)
+ 			if (ACCESS_ONCE(iovec->offset) == iovec->iov.iov_len) {
+ 				if (++req->iov_idx == req->data_iovs) {
+ 					ret = -EFAULT;
+-					goto free_txreq;
++					goto free_tx;
+ 				}
+ 				iovec = &req->iovs[req->iov_idx];
+ 				WARN_ON(iovec->offset);
+diff --git a/drivers/infiniband/hw/hfi1/verbs.c b/drivers/infiniband/hw/hfi1/verbs.c
+index 01a380efea6b..14ddb7506085 100644
+--- a/drivers/infiniband/hw/hfi1/verbs.c
++++ b/drivers/infiniband/hw/hfi1/verbs.c
+@@ -1511,12 +1511,18 @@ static int hfi1_check_ah(struct ib_device *ibdev, struct ib_ah_attr *ah_attr)
+ 	struct hfi1_pportdata *ppd;
+ 	struct hfi1_devdata *dd;
+ 	u8 sc5;
++	u8 sl;
+ 
+ 	/* test the mapping for validity */
+ 	ibp = to_iport(ibdev, ah_attr->port_num);
+ 	ppd = ppd_from_ibp(ibp);
+-	sc5 = ibp->sl_to_sc[ah_attr->sl];
+ 	dd = dd_from_ppd(ppd);
++
++	sl = ah_attr->sl;
++	if (sl >= ARRAY_SIZE(ibp->sl_to_sc))
++		return -EINVAL;
++
++	sc5 = ibp->sl_to_sc[sl];
+ 	if (sc_to_vlt(dd, sc5) > num_vls && sc_to_vlt(dd, sc5) != 0xf)
+ 		return -EINVAL;
+ 	return 0;
+diff --git a/drivers/infiniband/ulp/srp/ib_srp.c b/drivers/infiniband/ulp/srp/ib_srp.c
+index 463ea592a42a..646359025574 100644
+--- a/drivers/infiniband/ulp/srp/ib_srp.c
++++ b/drivers/infiniband/ulp/srp/ib_srp.c
+@@ -2639,7 +2639,7 @@ static int srp_reset_device(struct scsi_cmnd *scmnd)
+ {
+ 	struct srp_target_port *target = host_to_target(scmnd->device->host);
+ 	struct srp_rdma_ch *ch;
+-	int i;
++	int i, j;
+ 	u8 status;
+ 
+ 	shost_printk(KERN_ERR, target->scsi_host, "SRP reset_device called\n");
+@@ -2653,8 +2653,8 @@ static int srp_reset_device(struct scsi_cmnd *scmnd)
+ 
+ 	for (i = 0; i < target->ch_count; i++) {
+ 		ch = &target->ch[i];
+-		for (i = 0; i < target->req_ring_size; ++i) {
+-			struct srp_request *req = &ch->req_ring[i];
++		for (j = 0; j < target->req_ring_size; ++j) {
++			struct srp_request *req = &ch->req_ring[j];
+ 
+ 			srp_finish_req(ch, req, scmnd->device, DID_RESET << 16);
+ 		}
+diff --git a/drivers/input/mouse/elantech.c b/drivers/input/mouse/elantech.c
+index 4e77adbfa835..c120afd9c46a 100644
+--- a/drivers/input/mouse/elantech.c
++++ b/drivers/input/mouse/elantech.c
+@@ -1176,6 +1176,8 @@ static const struct dmi_system_id elantech_dmi_has_middle_button[] = {
+ static const char * const middle_button_pnp_ids[] = {
+ 	"LEN2131", /* ThinkPad P52 w/ NFC */
+ 	"LEN2132", /* ThinkPad P52 */
++	"LEN2133", /* ThinkPad P72 w/ NFC */
++	"LEN2134", /* ThinkPad P72 */
+ 	NULL
+ };
+ 
+diff --git a/drivers/iommu/amd_iommu.c b/drivers/iommu/amd_iommu.c
+index 0c910a863581..16199b36a11e 100644
+--- a/drivers/iommu/amd_iommu.c
++++ b/drivers/iommu/amd_iommu.c
+@@ -2452,9 +2452,9 @@ static void __unmap_single(struct dma_ops_domain *dma_dom,
+ 	}
+ 
+ 	if (amd_iommu_unmap_flush) {
+-		dma_ops_free_iova(dma_dom, dma_addr, pages);
+ 		domain_flush_tlb(&dma_dom->domain);
+ 		domain_flush_complete(&dma_dom->domain);
++		dma_ops_free_iova(dma_dom, dma_addr, pages);
+ 	} else {
+ 		queue_add(dma_dom, dma_addr, pages);
+ 	}
+diff --git a/drivers/md/md-cluster.c b/drivers/md/md-cluster.c
+index fcc2b5746a9f..e870b09b2c84 100644
+--- a/drivers/md/md-cluster.c
++++ b/drivers/md/md-cluster.c
+@@ -302,15 +302,6 @@ static void recover_bitmaps(struct md_thread *thread)
+ 	while (cinfo->recovery_map) {
+ 		slot = fls64((u64)cinfo->recovery_map) - 1;
+ 
+-		/* Clear suspend_area associated with the bitmap */
+-		spin_lock_irq(&cinfo->suspend_lock);
+-		list_for_each_entry_safe(s, tmp, &cinfo->suspend_list, list)
+-			if (slot == s->slot) {
+-				list_del(&s->list);
+-				kfree(s);
+-			}
+-		spin_unlock_irq(&cinfo->suspend_lock);
+-
+ 		snprintf(str, 64, "bitmap%04d", slot);
+ 		bm_lockres = lockres_init(mddev, str, NULL, 1);
+ 		if (!bm_lockres) {
+@@ -329,6 +320,16 @@ static void recover_bitmaps(struct md_thread *thread)
+ 			pr_err("md-cluster: Could not copy data from bitmap %d\n", slot);
+ 			goto clear_bit;
+ 		}
++
++		/* Clear suspend_area associated with the bitmap */
++		spin_lock_irq(&cinfo->suspend_lock);
++		list_for_each_entry_safe(s, tmp, &cinfo->suspend_list, list)
++			if (slot == s->slot) {
++				list_del(&s->list);
++				kfree(s);
++			}
++		spin_unlock_irq(&cinfo->suspend_lock);
++
+ 		if (hi > 0) {
+ 			if (lo < mddev->recovery_cp)
+ 				mddev->recovery_cp = lo;
+diff --git a/drivers/media/i2c/soc_camera/ov772x.c b/drivers/media/i2c/soc_camera/ov772x.c
+index 7e68762b3a4b..fa1cb246a66a 100644
+--- a/drivers/media/i2c/soc_camera/ov772x.c
++++ b/drivers/media/i2c/soc_camera/ov772x.c
+@@ -834,7 +834,7 @@ static int ov772x_set_params(struct ov772x_priv *priv,
+ 	 * set COM8
+ 	 */
+ 	if (priv->band_filter) {
+-		ret = ov772x_mask_set(client, COM8, BNDF_ON_OFF, 1);
++		ret = ov772x_mask_set(client, COM8, BNDF_ON_OFF, BNDF_ON_OFF);
+ 		if (!ret)
+ 			ret = ov772x_mask_set(client, BDBASE,
+ 					      0xff, 256 - priv->band_filter);
+diff --git a/drivers/media/platform/exynos4-is/fimc-isp-video.c b/drivers/media/platform/exynos4-is/fimc-isp-video.c
+index 400ce0cb0c0d..e00fa03ddc3e 100644
+--- a/drivers/media/platform/exynos4-is/fimc-isp-video.c
++++ b/drivers/media/platform/exynos4-is/fimc-isp-video.c
+@@ -384,12 +384,17 @@ static void __isp_video_try_fmt(struct fimc_isp *isp,
+ 				struct v4l2_pix_format_mplane *pixm,
+ 				const struct fimc_fmt **fmt)
+ {
+-	*fmt = fimc_isp_find_format(&pixm->pixelformat, NULL, 2);
++	const struct fimc_fmt *__fmt;
++
++	__fmt = fimc_isp_find_format(&pixm->pixelformat, NULL, 2);
++
++	if (fmt)
++		*fmt = __fmt;
+ 
+ 	pixm->colorspace = V4L2_COLORSPACE_SRGB;
+ 	pixm->field = V4L2_FIELD_NONE;
+-	pixm->num_planes = (*fmt)->memplanes;
+-	pixm->pixelformat = (*fmt)->fourcc;
++	pixm->num_planes = __fmt->memplanes;
++	pixm->pixelformat = __fmt->fourcc;
+ 	/*
+ 	 * TODO: double check with the docmentation these width/height
+ 	 * constraints are correct.
+diff --git a/drivers/media/platform/fsl-viu.c b/drivers/media/platform/fsl-viu.c
+index ae8c6b35a357..7f0ed5a26da9 100644
+--- a/drivers/media/platform/fsl-viu.c
++++ b/drivers/media/platform/fsl-viu.c
+@@ -1417,7 +1417,7 @@ static int viu_of_probe(struct platform_device *op)
+ 				     sizeof(struct viu_reg), DRV_NAME)) {
+ 		dev_err(&op->dev, "Error while requesting mem region\n");
+ 		ret = -EBUSY;
+-		goto err;
++		goto err_irq;
+ 	}
+ 
+ 	/* remap registers */
+@@ -1425,7 +1425,7 @@ static int viu_of_probe(struct platform_device *op)
+ 	if (!viu_regs) {
+ 		dev_err(&op->dev, "Can't map register set\n");
+ 		ret = -ENOMEM;
+-		goto err;
++		goto err_irq;
+ 	}
+ 
+ 	/* Prepare our private structure */
+@@ -1433,7 +1433,7 @@ static int viu_of_probe(struct platform_device *op)
+ 	if (!viu_dev) {
+ 		dev_err(&op->dev, "Can't allocate private structure\n");
+ 		ret = -ENOMEM;
+-		goto err;
++		goto err_irq;
+ 	}
+ 
+ 	viu_dev->vr = viu_regs;
+@@ -1449,16 +1449,21 @@ static int viu_of_probe(struct platform_device *op)
+ 	ret = v4l2_device_register(viu_dev->dev, &viu_dev->v4l2_dev);
+ 	if (ret < 0) {
+ 		dev_err(&op->dev, "v4l2_device_register() failed: %d\n", ret);
+-		goto err;
++		goto err_irq;
+ 	}
+ 
+ 	ad = i2c_get_adapter(0);
++	if (!ad) {
++		ret = -EFAULT;
++		dev_err(&op->dev, "couldn't get i2c adapter\n");
++		goto err_v4l2;
++	}
+ 
+ 	v4l2_ctrl_handler_init(&viu_dev->hdl, 5);
+ 	if (viu_dev->hdl.error) {
+ 		ret = viu_dev->hdl.error;
+ 		dev_err(&op->dev, "couldn't register control\n");
+-		goto err_vdev;
++		goto err_i2c;
+ 	}
+ 	/* This control handler will inherit the control(s) from the
+ 	   sub-device(s). */
+@@ -1476,7 +1481,7 @@ static int viu_of_probe(struct platform_device *op)
+ 	vdev = video_device_alloc();
+ 	if (vdev == NULL) {
+ 		ret = -ENOMEM;
+-		goto err_vdev;
++		goto err_hdl;
+ 	}
+ 
+ 	*vdev = viu_template;
+@@ -1497,7 +1502,7 @@ static int viu_of_probe(struct platform_device *op)
+ 	ret = video_register_device(viu_dev->vdev, VFL_TYPE_GRABBER, -1);
+ 	if (ret < 0) {
+ 		video_device_release(viu_dev->vdev);
+-		goto err_vdev;
++		goto err_unlock;
+ 	}
+ 
+ 	/* enable VIU clock */
+@@ -1505,12 +1510,12 @@ static int viu_of_probe(struct platform_device *op)
+ 	if (IS_ERR(clk)) {
+ 		dev_err(&op->dev, "failed to lookup the clock!\n");
+ 		ret = PTR_ERR(clk);
+-		goto err_clk;
++		goto err_vdev;
+ 	}
+ 	ret = clk_prepare_enable(clk);
+ 	if (ret) {
+ 		dev_err(&op->dev, "failed to enable the clock!\n");
+-		goto err_clk;
++		goto err_vdev;
+ 	}
+ 	viu_dev->clk = clk;
+ 
+@@ -1521,7 +1526,7 @@ static int viu_of_probe(struct platform_device *op)
+ 	if (request_irq(viu_dev->irq, viu_intr, 0, "viu", (void *)viu_dev)) {
+ 		dev_err(&op->dev, "Request VIU IRQ failed.\n");
+ 		ret = -ENODEV;
+-		goto err_irq;
++		goto err_clk;
+ 	}
+ 
+ 	mutex_unlock(&viu_dev->lock);
+@@ -1529,16 +1534,19 @@ static int viu_of_probe(struct platform_device *op)
+ 	dev_info(&op->dev, "Freescale VIU Video Capture Board\n");
+ 	return ret;
+ 
+-err_irq:
+-	clk_disable_unprepare(viu_dev->clk);
+ err_clk:
+-	video_unregister_device(viu_dev->vdev);
++	clk_disable_unprepare(viu_dev->clk);
+ err_vdev:
+-	v4l2_ctrl_handler_free(&viu_dev->hdl);
++	video_unregister_device(viu_dev->vdev);
++err_unlock:
+ 	mutex_unlock(&viu_dev->lock);
++err_hdl:
++	v4l2_ctrl_handler_free(&viu_dev->hdl);
++err_i2c:
+ 	i2c_put_adapter(ad);
++err_v4l2:
+ 	v4l2_device_unregister(&viu_dev->v4l2_dev);
+-err:
++err_irq:
+ 	irq_dispose_mapping(viu_irq);
+ 	return ret;
+ }
+diff --git a/drivers/media/platform/omap3isp/isp.c b/drivers/media/platform/omap3isp/isp.c
+index 15a86bb4e61c..1e98b4845ea1 100644
+--- a/drivers/media/platform/omap3isp/isp.c
++++ b/drivers/media/platform/omap3isp/isp.c
+@@ -304,7 +304,7 @@ static struct clk *isp_xclk_src_get(struct of_phandle_args *clkspec, void *data)
+ static int isp_xclk_init(struct isp_device *isp)
+ {
+ 	struct device_node *np = isp->dev->of_node;
+-	struct clk_init_data init;
++	struct clk_init_data init = { 0 };
+ 	unsigned int i;
+ 
+ 	for (i = 0; i < ARRAY_SIZE(isp->xclks); ++i)
+diff --git a/drivers/media/platform/s3c-camif/camif-capture.c b/drivers/media/platform/s3c-camif/camif-capture.c
+index 5c9db0910a76..d9710b5dd375 100644
+--- a/drivers/media/platform/s3c-camif/camif-capture.c
++++ b/drivers/media/platform/s3c-camif/camif-capture.c
+@@ -117,6 +117,8 @@ static int sensor_set_power(struct camif_dev *camif, int on)
+ 
+ 	if (camif->sensor.power_count == !on)
+ 		err = v4l2_subdev_call(sensor->sd, core, s_power, on);
++	if (err == -ENOIOCTLCMD)
++		err = 0;
+ 	if (!err)
+ 		sensor->power_count += on ? 1 : -1;
+ 
+diff --git a/drivers/media/usb/tm6000/tm6000-dvb.c b/drivers/media/usb/tm6000/tm6000-dvb.c
+index 0426b210383b..ee88ae83230c 100644
+--- a/drivers/media/usb/tm6000/tm6000-dvb.c
++++ b/drivers/media/usb/tm6000/tm6000-dvb.c
+@@ -273,6 +273,11 @@ static int register_dvb(struct tm6000_core *dev)
+ 
+ 	ret = dvb_register_adapter(&dvb->adapter, "Trident TVMaster 6000 DVB-T",
+ 					THIS_MODULE, &dev->udev->dev, adapter_nr);
++	if (ret < 0) {
++		pr_err("tm6000: couldn't register the adapter!\n");
++		goto err;
++	}
++
+ 	dvb->adapter.priv = dev;
+ 
+ 	if (dvb->frontend) {
+diff --git a/drivers/media/usb/uvc/uvc_video.c b/drivers/media/usb/uvc/uvc_video.c
+index b5589d5f5da4..48503f30b3a2 100644
+--- a/drivers/media/usb/uvc/uvc_video.c
++++ b/drivers/media/usb/uvc/uvc_video.c
+@@ -163,14 +163,27 @@ static void uvc_fixup_video_ctrl(struct uvc_streaming *stream,
+ 	}
+ }
+ 
++static size_t uvc_video_ctrl_size(struct uvc_streaming *stream)
++{
++	/*
++	 * Return the size of the video probe and commit controls, which depends
++	 * on the protocol version.
++	 */
++	if (stream->dev->uvc_version < 0x0110)
++		return 26;
++	else if (stream->dev->uvc_version < 0x0150)
++		return 34;
++	else
++		return 48;
++}
++
+ static int uvc_get_video_ctrl(struct uvc_streaming *stream,
+ 	struct uvc_streaming_control *ctrl, int probe, __u8 query)
+ {
++	__u16 size = uvc_video_ctrl_size(stream);
+ 	__u8 *data;
+-	__u16 size;
+ 	int ret;
+ 
+-	size = stream->dev->uvc_version >= 0x0110 ? 34 : 26;
+ 	if ((stream->dev->quirks & UVC_QUIRK_PROBE_DEF) &&
+ 			query == UVC_GET_DEF)
+ 		return -EIO;
+@@ -225,7 +238,7 @@ static int uvc_get_video_ctrl(struct uvc_streaming *stream,
+ 	ctrl->dwMaxVideoFrameSize = get_unaligned_le32(&data[18]);
+ 	ctrl->dwMaxPayloadTransferSize = get_unaligned_le32(&data[22]);
+ 
+-	if (size == 34) {
++	if (size >= 34) {
+ 		ctrl->dwClockFrequency = get_unaligned_le32(&data[26]);
+ 		ctrl->bmFramingInfo = data[30];
+ 		ctrl->bPreferedVersion = data[31];
+@@ -254,11 +267,10 @@ out:
+ static int uvc_set_video_ctrl(struct uvc_streaming *stream,
+ 	struct uvc_streaming_control *ctrl, int probe)
+ {
++	__u16 size = uvc_video_ctrl_size(stream);
+ 	__u8 *data;
+-	__u16 size;
+ 	int ret;
+ 
+-	size = stream->dev->uvc_version >= 0x0110 ? 34 : 26;
+ 	data = kzalloc(size, GFP_KERNEL);
+ 	if (data == NULL)
+ 		return -ENOMEM;
+@@ -275,7 +287,7 @@ static int uvc_set_video_ctrl(struct uvc_streaming *stream,
+ 	put_unaligned_le32(ctrl->dwMaxVideoFrameSize, &data[18]);
+ 	put_unaligned_le32(ctrl->dwMaxPayloadTransferSize, &data[22]);
+ 
+-	if (size == 34) {
++	if (size >= 34) {
+ 		put_unaligned_le32(ctrl->dwClockFrequency, &data[26]);
+ 		data[30] = ctrl->bmFramingInfo;
+ 		data[31] = ctrl->bPreferedVersion;
+diff --git a/drivers/media/v4l2-core/v4l2-event.c b/drivers/media/v4l2-core/v4l2-event.c
+index 8d3171c6bee8..567d86835f00 100644
+--- a/drivers/media/v4l2-core/v4l2-event.c
++++ b/drivers/media/v4l2-core/v4l2-event.c
+@@ -119,14 +119,6 @@ static void __v4l2_event_queue_fh(struct v4l2_fh *fh, const struct v4l2_event *e
+ 	if (sev == NULL)
+ 		return;
+ 
+-	/*
+-	 * If the event has been added to the fh->subscribed list, but its
+-	 * add op has not completed yet elems will be 0, treat this as
+-	 * not being subscribed.
+-	 */
+-	if (!sev->elems)
+-		return;
+-
+ 	/* Increase event sequence number on fh. */
+ 	fh->sequence++;
+ 
+@@ -212,6 +204,7 @@ int v4l2_event_subscribe(struct v4l2_fh *fh,
+ 	struct v4l2_subscribed_event *sev, *found_ev;
+ 	unsigned long flags;
+ 	unsigned i;
++	int ret = 0;
+ 
+ 	if (sub->type == V4L2_EVENT_ALL)
+ 		return -EINVAL;
+@@ -229,31 +222,36 @@ int v4l2_event_subscribe(struct v4l2_fh *fh,
+ 	sev->flags = sub->flags;
+ 	sev->fh = fh;
+ 	sev->ops = ops;
++	sev->elems = elems;
++
++	mutex_lock(&fh->subscribe_lock);
+ 
+ 	spin_lock_irqsave(&fh->vdev->fh_lock, flags);
+ 	found_ev = v4l2_event_subscribed(fh, sub->type, sub->id);
+-	if (!found_ev)
+-		list_add(&sev->list, &fh->subscribed);
+ 	spin_unlock_irqrestore(&fh->vdev->fh_lock, flags);
+ 
+ 	if (found_ev) {
++		/* Already listening */
+ 		kfree(sev);
+-		return 0; /* Already listening */
++		goto out_unlock;
+ 	}
+ 
+ 	if (sev->ops && sev->ops->add) {
+-		int ret = sev->ops->add(sev, elems);
++		ret = sev->ops->add(sev, elems);
+ 		if (ret) {
+-			sev->ops = NULL;
+-			v4l2_event_unsubscribe(fh, sub);
+-			return ret;
++			kfree(sev);
++			goto out_unlock;
+ 		}
+ 	}
+ 
+-	/* Mark as ready for use */
+-	sev->elems = elems;
++	spin_lock_irqsave(&fh->vdev->fh_lock, flags);
++	list_add(&sev->list, &fh->subscribed);
++	spin_unlock_irqrestore(&fh->vdev->fh_lock, flags);
+ 
+-	return 0;
++out_unlock:
++	mutex_unlock(&fh->subscribe_lock);
++
++	return ret;
+ }
+ EXPORT_SYMBOL_GPL(v4l2_event_subscribe);
+ 
+@@ -292,6 +290,8 @@ int v4l2_event_unsubscribe(struct v4l2_fh *fh,
+ 		return 0;
+ 	}
+ 
++	mutex_lock(&fh->subscribe_lock);
++
+ 	spin_lock_irqsave(&fh->vdev->fh_lock, flags);
+ 
+ 	sev = v4l2_event_subscribed(fh, sub->type, sub->id);
+@@ -309,6 +309,8 @@ int v4l2_event_unsubscribe(struct v4l2_fh *fh,
+ 	if (sev && sev->ops && sev->ops->del)
+ 		sev->ops->del(sev);
+ 
++	mutex_unlock(&fh->subscribe_lock);
++
+ 	kfree(sev);
+ 
+ 	return 0;
+diff --git a/drivers/media/v4l2-core/v4l2-fh.c b/drivers/media/v4l2-core/v4l2-fh.c
+index c183f0996fa1..0c5e69070586 100644
+--- a/drivers/media/v4l2-core/v4l2-fh.c
++++ b/drivers/media/v4l2-core/v4l2-fh.c
+@@ -50,6 +50,7 @@ void v4l2_fh_init(struct v4l2_fh *fh, struct video_device *vdev)
+ 	INIT_LIST_HEAD(&fh->available);
+ 	INIT_LIST_HEAD(&fh->subscribed);
+ 	fh->sequence = -1;
++	mutex_init(&fh->subscribe_lock);
+ }
+ EXPORT_SYMBOL_GPL(v4l2_fh_init);
+ 
+@@ -95,6 +96,7 @@ void v4l2_fh_exit(struct v4l2_fh *fh)
+ 		return;
+ 	v4l_disable_media_source(fh->vdev);
+ 	v4l2_event_unsubscribe_all(fh);
++	mutex_destroy(&fh->subscribe_lock);
+ 	fh->vdev = NULL;
+ }
+ EXPORT_SYMBOL_GPL(v4l2_fh_exit);
+diff --git a/drivers/misc/tsl2550.c b/drivers/misc/tsl2550.c
+index 87a13374fdc0..eb5761067310 100644
+--- a/drivers/misc/tsl2550.c
++++ b/drivers/misc/tsl2550.c
+@@ -177,7 +177,7 @@ static int tsl2550_calculate_lux(u8 ch0, u8 ch1)
+ 		} else
+ 			lux = 0;
+ 	else
+-		return -EAGAIN;
++		return 0;
+ 
+ 	/* LUX range check */
+ 	return lux > TSL2550_MAX_LUX ? TSL2550_MAX_LUX : lux;
+diff --git a/drivers/misc/vmw_vmci/vmci_queue_pair.c b/drivers/misc/vmw_vmci/vmci_queue_pair.c
+index f735ab4ba84e..5927db046a87 100644
+--- a/drivers/misc/vmw_vmci/vmci_queue_pair.c
++++ b/drivers/misc/vmw_vmci/vmci_queue_pair.c
+@@ -755,7 +755,7 @@ static int qp_host_get_user_memory(u64 produce_uva,
+ 	retval = get_user_pages_fast((uintptr_t) produce_uva,
+ 				     produce_q->kernel_if->num_pages, 1,
+ 				     produce_q->kernel_if->u.h.header_page);
+-	if (retval < produce_q->kernel_if->num_pages) {
++	if (retval < (int)produce_q->kernel_if->num_pages) {
+ 		pr_debug("get_user_pages_fast(produce) failed (retval=%d)",
+ 			retval);
+ 		qp_release_pages(produce_q->kernel_if->u.h.header_page,
+@@ -767,7 +767,7 @@ static int qp_host_get_user_memory(u64 produce_uva,
+ 	retval = get_user_pages_fast((uintptr_t) consume_uva,
+ 				     consume_q->kernel_if->num_pages, 1,
+ 				     consume_q->kernel_if->u.h.header_page);
+-	if (retval < consume_q->kernel_if->num_pages) {
++	if (retval < (int)consume_q->kernel_if->num_pages) {
+ 		pr_debug("get_user_pages_fast(consume) failed (retval=%d)",
+ 			retval);
+ 		qp_release_pages(consume_q->kernel_if->u.h.header_page,
+diff --git a/drivers/net/ethernet/hisilicon/hns/hnae.h b/drivers/net/ethernet/hisilicon/hns/hnae.h
+index e093cbf26c8c..f9d68453c81d 100644
+--- a/drivers/net/ethernet/hisilicon/hns/hnae.h
++++ b/drivers/net/ethernet/hisilicon/hns/hnae.h
+@@ -213,10 +213,10 @@ struct hnae_desc_cb {
+ 
+ 	/* priv data for the desc, e.g. skb when use with ip stack*/
+ 	void *priv;
+-	u16 page_offset;
+-	u16 reuse_flag;
++	u32 page_offset;
++	u32 length;     /* length of the buffer */
+ 
+-	u16 length;     /* length of the buffer */
++	u16 reuse_flag;
+ 
+        /* desc type, used by the ring user to mark the type of the priv data */
+ 	u16 type;
+diff --git a/drivers/net/ethernet/hisilicon/hns/hns_enet.c b/drivers/net/ethernet/hisilicon/hns/hns_enet.c
+index 111e1aab7d83..8a2a07e21324 100644
+--- a/drivers/net/ethernet/hisilicon/hns/hns_enet.c
++++ b/drivers/net/ethernet/hisilicon/hns/hns_enet.c
+@@ -529,7 +529,7 @@ static void hns_nic_reuse_page(struct sk_buff *skb, int i,
+ 	}
+ 
+ 	skb_add_rx_frag(skb, i, desc_cb->priv, desc_cb->page_offset + pull_len,
+-			size - pull_len, truesize - pull_len);
++			size - pull_len, truesize);
+ 
+ 	 /* avoid re-using remote pages,flag default unreuse */
+ 	if (unlikely(page_to_nid(desc_cb->priv) != numa_node_id()))
+diff --git a/drivers/net/ethernet/intel/e1000/e1000_ethtool.c b/drivers/net/ethernet/intel/e1000/e1000_ethtool.c
+index 975eeb885ca2..e84574b1eae7 100644
+--- a/drivers/net/ethernet/intel/e1000/e1000_ethtool.c
++++ b/drivers/net/ethernet/intel/e1000/e1000_ethtool.c
+@@ -645,14 +645,14 @@ static int e1000_set_ringparam(struct net_device *netdev,
+ 		adapter->tx_ring = tx_old;
+ 		e1000_free_all_rx_resources(adapter);
+ 		e1000_free_all_tx_resources(adapter);
+-		kfree(tx_old);
+-		kfree(rx_old);
+ 		adapter->rx_ring = rxdr;
+ 		adapter->tx_ring = txdr;
+ 		err = e1000_up(adapter);
+ 		if (err)
+ 			goto err_setup;
+ 	}
++	kfree(tx_old);
++	kfree(rx_old);
+ 
+ 	clear_bit(__E1000_RESETTING, &adapter->flags);
+ 	return 0;
+@@ -665,7 +665,8 @@ err_setup_rx:
+ err_alloc_rx:
+ 	kfree(txdr);
+ err_alloc_tx:
+-	e1000_up(adapter);
++	if (netif_running(adapter->netdev))
++		e1000_up(adapter);
+ err_setup:
+ 	clear_bit(__E1000_RESETTING, &adapter->flags);
+ 	return err;
+diff --git a/drivers/net/ethernet/qlogic/qed/qed_mcp.c b/drivers/net/ethernet/qlogic/qed/qed_mcp.c
+index eaa242df4131..e175fcd73739 100644
+--- a/drivers/net/ethernet/qlogic/qed/qed_mcp.c
++++ b/drivers/net/ethernet/qlogic/qed/qed_mcp.c
+@@ -97,18 +97,57 @@ int qed_mcp_free(struct qed_hwfn *p_hwfn)
+ 	return 0;
+ }
+ 
++/* Maximum of 1 sec to wait for the SHMEM ready indication */
++#define QED_MCP_SHMEM_RDY_MAX_RETRIES	20
++#define QED_MCP_SHMEM_RDY_ITER_MS	50
++
+ static int qed_load_mcp_offsets(struct qed_hwfn *p_hwfn, struct qed_ptt *p_ptt)
+ {
+ 	struct qed_mcp_info *p_info = p_hwfn->mcp_info;
++	u8 cnt = QED_MCP_SHMEM_RDY_MAX_RETRIES;
++	u8 msec = QED_MCP_SHMEM_RDY_ITER_MS;
+ 	u32 drv_mb_offsize, mfw_mb_offsize;
+ 	u32 mcp_pf_id = MCP_PF_ID(p_hwfn);
+ 
+ 	p_info->public_base = qed_rd(p_hwfn, p_ptt, MISC_REG_SHARED_MEM_ADDR);
+-	if (!p_info->public_base)
+-		return 0;
++	if (!p_info->public_base) {
++		DP_NOTICE(p_hwfn,
++			  "The address of the MCP scratch-pad is not configured\n");
++		return -EINVAL;
++	}
+ 
+ 	p_info->public_base |= GRCBASE_MCP;
+ 
++	/* Get the MFW MB address and number of supported messages */
++	mfw_mb_offsize = qed_rd(p_hwfn, p_ptt,
++				SECTION_OFFSIZE_ADDR(p_info->public_base,
++						     PUBLIC_MFW_MB));
++	p_info->mfw_mb_addr = SECTION_ADDR(mfw_mb_offsize, mcp_pf_id);
++	p_info->mfw_mb_length = (u16)qed_rd(p_hwfn, p_ptt,
++					    p_info->mfw_mb_addr +
++					    offsetof(struct public_mfw_mb,
++						     sup_msgs));
++
++	/* The driver can notify that there was an MCP reset, and might read the
++	 * SHMEM values before the MFW has completed initializing them.
++	 * To avoid this, the "sup_msgs" field in the MFW mailbox is used as a
++	 * data ready indication.
++	 */
++	while (!p_info->mfw_mb_length && --cnt) {
++		msleep(msec);
++		p_info->mfw_mb_length =
++			(u16)qed_rd(p_hwfn, p_ptt,
++				    p_info->mfw_mb_addr +
++				    offsetof(struct public_mfw_mb, sup_msgs));
++	}
++
++	if (!cnt) {
++		DP_NOTICE(p_hwfn,
++			  "Failed to get the SHMEM ready notification after %d msec\n",
++			  QED_MCP_SHMEM_RDY_MAX_RETRIES * msec);
++		return -EBUSY;
++	}
++
+ 	/* Calculate the driver and MFW mailbox address */
+ 	drv_mb_offsize = qed_rd(p_hwfn, p_ptt,
+ 				SECTION_OFFSIZE_ADDR(p_info->public_base,
+@@ -118,13 +157,6 @@ static int qed_load_mcp_offsets(struct qed_hwfn *p_hwfn, struct qed_ptt *p_ptt)
+ 		   "drv_mb_offsiz = 0x%x, drv_mb_addr = 0x%x mcp_pf_id = 0x%x\n",
+ 		   drv_mb_offsize, p_info->drv_mb_addr, mcp_pf_id);
+ 
+-	/* Set the MFW MB address */
+-	mfw_mb_offsize = qed_rd(p_hwfn, p_ptt,
+-				SECTION_OFFSIZE_ADDR(p_info->public_base,
+-						     PUBLIC_MFW_MB));
+-	p_info->mfw_mb_addr = SECTION_ADDR(mfw_mb_offsize, mcp_pf_id);
+-	p_info->mfw_mb_length =	(u16)qed_rd(p_hwfn, p_ptt, p_info->mfw_mb_addr);
+-
+ 	/* Get the current driver mailbox sequence before sending
+ 	 * the first command
+ 	 */
+@@ -1198,31 +1230,61 @@ qed_mcp_send_drv_version(struct qed_hwfn *p_hwfn,
+ 	return rc;
+ }
+ 
++/* A maximal 100 msec waiting time for the MCP to halt */
++#define QED_MCP_HALT_SLEEP_MS		10
++#define QED_MCP_HALT_MAX_RETRIES	10
++
+ int qed_mcp_halt(struct qed_hwfn *p_hwfn, struct qed_ptt *p_ptt)
+ {
+-	u32 resp = 0, param = 0;
++	u32 resp = 0, param = 0, cpu_state, cnt = 0;
+ 	int rc;
+ 
+ 	rc = qed_mcp_cmd(p_hwfn, p_ptt, DRV_MSG_CODE_MCP_HALT, 0, &resp,
+ 			 &param);
+-	if (rc)
++	if (rc) {
+ 		DP_ERR(p_hwfn, "MCP response failure, aborting\n");
++		return rc;
++	}
+ 
+-	return rc;
++	do {
++		msleep(QED_MCP_HALT_SLEEP_MS);
++		cpu_state = qed_rd(p_hwfn, p_ptt, MCP_REG_CPU_STATE);
++		if (cpu_state & MCP_REG_CPU_STATE_SOFT_HALTED)
++			break;
++	} while (++cnt < QED_MCP_HALT_MAX_RETRIES);
++
++	if (cnt == QED_MCP_HALT_MAX_RETRIES) {
++		DP_NOTICE(p_hwfn,
++			  "Failed to halt the MCP [CPU_MODE = 0x%08x, CPU_STATE = 0x%08x]\n",
++			  qed_rd(p_hwfn, p_ptt, MCP_REG_CPU_MODE), cpu_state);
++		return -EBUSY;
++	}
++
++	return 0;
+ }
+ 
++#define QED_MCP_RESUME_SLEEP_MS	10
++
+ int qed_mcp_resume(struct qed_hwfn *p_hwfn, struct qed_ptt *p_ptt)
+ {
+-	u32 value, cpu_mode;
++	u32 cpu_mode, cpu_state;
+ 
+ 	qed_wr(p_hwfn, p_ptt, MCP_REG_CPU_STATE, 0xffffffff);
+ 
+-	value = qed_rd(p_hwfn, p_ptt, MCP_REG_CPU_MODE);
+-	value &= ~MCP_REG_CPU_MODE_SOFT_HALT;
+-	qed_wr(p_hwfn, p_ptt, MCP_REG_CPU_MODE, value);
+ 	cpu_mode = qed_rd(p_hwfn, p_ptt, MCP_REG_CPU_MODE);
++	cpu_mode &= ~MCP_REG_CPU_MODE_SOFT_HALT;
++	qed_wr(p_hwfn, p_ptt, MCP_REG_CPU_MODE, cpu_mode);
++	msleep(QED_MCP_RESUME_SLEEP_MS);
++	cpu_state = qed_rd(p_hwfn, p_ptt, MCP_REG_CPU_STATE);
+ 
+-	return (cpu_mode & MCP_REG_CPU_MODE_SOFT_HALT) ? -EAGAIN : 0;
++	if (cpu_state & MCP_REG_CPU_STATE_SOFT_HALTED) {
++		DP_NOTICE(p_hwfn,
++			  "Failed to resume the MCP [CPU_MODE = 0x%08x, CPU_STATE = 0x%08x]\n",
++			  cpu_mode, cpu_state);
++		return -EBUSY;
++	}
++
++	return 0;
+ }
+ 
+ int qed_mcp_set_led(struct qed_hwfn *p_hwfn,
+diff --git a/drivers/net/ethernet/qlogic/qed/qed_reg_addr.h b/drivers/net/ethernet/qlogic/qed/qed_reg_addr.h
+index b414a0542177..56be1d6adfcc 100644
+--- a/drivers/net/ethernet/qlogic/qed/qed_reg_addr.h
++++ b/drivers/net/ethernet/qlogic/qed/qed_reg_addr.h
+@@ -510,6 +510,7 @@
+ 	0
+ #define MCP_REG_CPU_STATE \
+ 	0xe05004UL
++#define MCP_REG_CPU_STATE_SOFT_HALTED	(0x1UL << 10)
+ #define MCP_REG_CPU_EVENT_MASK \
+ 	0xe05008UL
+ #define PGLUE_B_REG_PF_BAR0_SIZE \
+diff --git a/drivers/net/phy/xilinx_gmii2rgmii.c b/drivers/net/phy/xilinx_gmii2rgmii.c
+index 2e5150b0b8d5..7a14e8170e82 100644
+--- a/drivers/net/phy/xilinx_gmii2rgmii.c
++++ b/drivers/net/phy/xilinx_gmii2rgmii.c
+@@ -40,8 +40,11 @@ static int xgmiitorgmii_read_status(struct phy_device *phydev)
+ {
+ 	struct gmii2rgmii *priv = phydev->priv;
+ 	u16 val = 0;
++	int err;
+ 
+-	priv->phy_drv->read_status(phydev);
++	err = priv->phy_drv->read_status(phydev);
++	if (err < 0)
++		return err;
+ 
+ 	val = mdiobus_read(phydev->mdio.bus, priv->addr, XILINX_GMII2RGMII_REG);
+ 	val &= ~XILINX_GMII2RGMII_SPEED_MASK;
+@@ -81,6 +84,11 @@ static int xgmiitorgmii_probe(struct mdio_device *mdiodev)
+ 		return -EPROBE_DEFER;
+ 	}
+ 
++	if (!priv->phy_dev->drv) {
++		dev_info(dev, "Attached phy not ready\n");
++		return -EPROBE_DEFER;
++	}
++
+ 	priv->addr = mdiodev->addr;
+ 	priv->phy_drv = priv->phy_dev->drv;
+ 	memcpy(&priv->conv_phy_drv, priv->phy_dev->drv,
+diff --git a/drivers/net/wireless/ath/ath10k/htt_rx.c b/drivers/net/wireless/ath/ath10k/htt_rx.c
+index ba1fe61e6ea6..a3c218047597 100644
+--- a/drivers/net/wireless/ath/ath10k/htt_rx.c
++++ b/drivers/net/wireless/ath/ath10k/htt_rx.c
+@@ -214,11 +214,12 @@ int ath10k_htt_rx_ring_refill(struct ath10k *ar)
+ 	spin_lock_bh(&htt->rx_ring.lock);
+ 	ret = ath10k_htt_rx_ring_fill_n(htt, (htt->rx_ring.fill_level -
+ 					      htt->rx_ring.fill_cnt));
+-	spin_unlock_bh(&htt->rx_ring.lock);
+ 
+ 	if (ret)
+ 		ath10k_htt_rx_ring_free(htt);
+ 
++	spin_unlock_bh(&htt->rx_ring.lock);
++
+ 	return ret;
+ }
+ 
+@@ -230,7 +231,9 @@ void ath10k_htt_rx_free(struct ath10k_htt *htt)
+ 	skb_queue_purge(&htt->rx_in_ord_compl_q);
+ 	skb_queue_purge(&htt->tx_fetch_ind_q);
+ 
++	spin_lock_bh(&htt->rx_ring.lock);
+ 	ath10k_htt_rx_ring_free(htt);
++	spin_unlock_bh(&htt->rx_ring.lock);
+ 
+ 	dma_free_coherent(htt->ar->dev,
+ 			  (htt->rx_ring.size *
+diff --git a/drivers/net/wireless/rndis_wlan.c b/drivers/net/wireless/rndis_wlan.c
+index 15b2350d9f45..c9f8847dc123 100644
+--- a/drivers/net/wireless/rndis_wlan.c
++++ b/drivers/net/wireless/rndis_wlan.c
+@@ -2921,6 +2921,8 @@ static void rndis_wlan_auth_indication(struct usbnet *usbdev,
+ 
+ 	while (buflen >= sizeof(*auth_req)) {
+ 		auth_req = (void *)buf;
++		if (buflen < le32_to_cpu(auth_req->length))
++			return;
+ 		type = "unknown";
+ 		flags = le32_to_cpu(auth_req->flags);
+ 		pairwise_error = false;
+diff --git a/drivers/net/wireless/ti/wlcore/cmd.c b/drivers/net/wireless/ti/wlcore/cmd.c
+index 7f4da727bb7b..96f83f09b8c5 100644
+--- a/drivers/net/wireless/ti/wlcore/cmd.c
++++ b/drivers/net/wireless/ti/wlcore/cmd.c
+@@ -35,6 +35,7 @@
+ #include "wl12xx_80211.h"
+ #include "cmd.h"
+ #include "event.h"
++#include "ps.h"
+ #include "tx.h"
+ #include "hw_ops.h"
+ 
+@@ -191,6 +192,10 @@ int wlcore_cmd_wait_for_event_or_timeout(struct wl1271 *wl,
+ 
+ 	timeout_time = jiffies + msecs_to_jiffies(WL1271_EVENT_TIMEOUT);
+ 
++	ret = wl1271_ps_elp_wakeup(wl);
++	if (ret < 0)
++		return ret;
++
+ 	do {
+ 		if (time_after(jiffies, timeout_time)) {
+ 			wl1271_debug(DEBUG_CMD, "timeout waiting for event %d",
+@@ -222,6 +227,7 @@ int wlcore_cmd_wait_for_event_or_timeout(struct wl1271 *wl,
+ 	} while (!event);
+ 
+ out:
++	wl1271_ps_elp_sleep(wl);
+ 	kfree(events_vector);
+ 	return ret;
+ }
+diff --git a/drivers/power/reset/vexpress-poweroff.c b/drivers/power/reset/vexpress-poweroff.c
+index 102f95a09460..e9e749f87517 100644
+--- a/drivers/power/reset/vexpress-poweroff.c
++++ b/drivers/power/reset/vexpress-poweroff.c
+@@ -35,6 +35,7 @@ static void vexpress_reset_do(struct device *dev, const char *what)
+ }
+ 
+ static struct device *vexpress_power_off_device;
++static atomic_t vexpress_restart_nb_refcnt = ATOMIC_INIT(0);
+ 
+ static void vexpress_power_off(void)
+ {
+@@ -99,10 +100,13 @@ static int _vexpress_register_restart_handler(struct device *dev)
+ 	int err;
+ 
+ 	vexpress_restart_device = dev;
+-	err = register_restart_handler(&vexpress_restart_nb);
+-	if (err) {
+-		dev_err(dev, "cannot register restart handler (err=%d)\n", err);
+-		return err;
++	if (atomic_inc_return(&vexpress_restart_nb_refcnt) == 1) {
++		err = register_restart_handler(&vexpress_restart_nb);
++		if (err) {
++			dev_err(dev, "cannot register restart handler (err=%d)\n", err);
++			atomic_dec(&vexpress_restart_nb_refcnt);
++			return err;
++		}
+ 	}
+ 	device_create_file(dev, &dev_attr_active);
+ 
+diff --git a/drivers/power/supply/power_supply_core.c b/drivers/power/supply/power_supply_core.c
+index a74d8ca383a1..9e05ae0430a9 100644
+--- a/drivers/power/supply/power_supply_core.c
++++ b/drivers/power/supply/power_supply_core.c
+@@ -14,6 +14,7 @@
+ #include <linux/types.h>
+ #include <linux/init.h>
+ #include <linux/slab.h>
++#include <linux/delay.h>
+ #include <linux/device.h>
+ #include <linux/notifier.h>
+ #include <linux/err.h>
+@@ -138,8 +139,13 @@ static void power_supply_deferred_register_work(struct work_struct *work)
+ 	struct power_supply *psy = container_of(work, struct power_supply,
+ 						deferred_register_work.work);
+ 
+-	if (psy->dev.parent)
+-		mutex_lock(&psy->dev.parent->mutex);
++	if (psy->dev.parent) {
++		while (!mutex_trylock(&psy->dev.parent->mutex)) {
++			if (psy->removing)
++				return;
++			msleep(10);
++		}
++	}
+ 
+ 	power_supply_changed(psy);
+ 
+@@ -944,6 +950,7 @@ EXPORT_SYMBOL_GPL(devm_power_supply_register_no_ws);
+ void power_supply_unregister(struct power_supply *psy)
+ {
+ 	WARN_ON(atomic_dec_return(&psy->use_cnt));
++	psy->removing = true;
+ 	cancel_work_sync(&psy->changed_work);
+ 	cancel_delayed_work_sync(&psy->deferred_register_work);
+ 	sysfs_remove_link(&psy->dev.kobj, "powers");
+diff --git a/drivers/regulator/core.c b/drivers/regulator/core.c
+index 178fcda12cec..18d57c0efe9f 100644
+--- a/drivers/regulator/core.c
++++ b/drivers/regulator/core.c
+@@ -4054,13 +4054,13 @@ regulator_register(const struct regulator_desc *regulator_desc,
+ 	    !rdev->desc->fixed_uV)
+ 		rdev->is_switch = true;
+ 
++	dev_set_drvdata(&rdev->dev, rdev);
+ 	ret = device_register(&rdev->dev);
+ 	if (ret != 0) {
+ 		put_device(&rdev->dev);
+ 		goto unset_supplies;
+ 	}
+ 
+-	dev_set_drvdata(&rdev->dev, rdev);
+ 	rdev_init_debugfs(rdev);
+ 
+ 	/* try to resolve regulators supply since a new one was registered */
+diff --git a/drivers/scsi/bnx2i/bnx2i_hwi.c b/drivers/scsi/bnx2i/bnx2i_hwi.c
+index 42921dbba927..4ca10501647b 100644
+--- a/drivers/scsi/bnx2i/bnx2i_hwi.c
++++ b/drivers/scsi/bnx2i/bnx2i_hwi.c
+@@ -2742,6 +2742,8 @@ int bnx2i_map_ep_dbell_regs(struct bnx2i_endpoint *ep)
+ 					      BNX2X_DOORBELL_PCI_BAR);
+ 		reg_off = (1 << BNX2X_DB_SHIFT) * (cid_num & 0x1FFFF);
+ 		ep->qp.ctx_base = ioremap_nocache(reg_base + reg_off, 4);
++		if (!ep->qp.ctx_base)
++			return -ENOMEM;
+ 		goto arm_cq;
+ 	}
+ 
+diff --git a/drivers/scsi/ibmvscsi/ibmvscsi.c b/drivers/scsi/ibmvscsi/ibmvscsi.c
+index d9534ee6ef52..e1730227b448 100644
+--- a/drivers/scsi/ibmvscsi/ibmvscsi.c
++++ b/drivers/scsi/ibmvscsi/ibmvscsi.c
+@@ -93,7 +93,7 @@ static int max_requests = IBMVSCSI_MAX_REQUESTS_DEFAULT;
+ static int max_events = IBMVSCSI_MAX_REQUESTS_DEFAULT + 2;
+ static int fast_fail = 1;
+ static int client_reserve = 1;
+-static char partition_name[97] = "UNKNOWN";
++static char partition_name[96] = "UNKNOWN";
+ static unsigned int partition_number = -1;
+ 
+ static struct scsi_transport_template *ibmvscsi_transport_template;
+@@ -259,7 +259,7 @@ static void gather_partition_info(void)
+ 
+ 	ppartition_name = of_get_property(of_root, "ibm,partition-name", NULL);
+ 	if (ppartition_name)
+-		strncpy(partition_name, ppartition_name,
++		strlcpy(partition_name, ppartition_name,
+ 				sizeof(partition_name));
+ 	p_number_ptr = of_get_property(of_root, "ibm,partition-no", NULL);
+ 	if (p_number_ptr)
+diff --git a/drivers/scsi/megaraid/megaraid_sas_base.c b/drivers/scsi/megaraid/megaraid_sas_base.c
+index 35cbd36f8d3b..090fdcdd15c9 100644
+--- a/drivers/scsi/megaraid/megaraid_sas_base.c
++++ b/drivers/scsi/megaraid/megaraid_sas_base.c
+@@ -6193,6 +6193,9 @@ megasas_resume(struct pci_dev *pdev)
+ 			goto fail_init_mfi;
+ 	}
+ 
++	if (megasas_get_ctrl_info(instance) != DCMD_SUCCESS)
++		goto fail_init_mfi;
++
+ 	tasklet_init(&instance->isr_tasklet, instance->instancet->tasklet,
+ 		     (unsigned long)instance);
+ 
+diff --git a/drivers/spi/spi-rspi.c b/drivers/spi/spi-rspi.c
+index a816f07e168e..093c9cf92bfd 100644
+--- a/drivers/spi/spi-rspi.c
++++ b/drivers/spi/spi-rspi.c
+@@ -597,11 +597,13 @@ static int rspi_dma_transfer(struct rspi_data *rspi, struct sg_table *tx,
+ 
+ 	ret = wait_event_interruptible_timeout(rspi->wait,
+ 					       rspi->dma_callbacked, HZ);
+-	if (ret > 0 && rspi->dma_callbacked)
++	if (ret > 0 && rspi->dma_callbacked) {
+ 		ret = 0;
+-	else if (!ret) {
+-		dev_err(&rspi->master->dev, "DMA timeout\n");
+-		ret = -ETIMEDOUT;
++	} else {
++		if (!ret) {
++			dev_err(&rspi->master->dev, "DMA timeout\n");
++			ret = -ETIMEDOUT;
++		}
+ 		if (tx)
+ 			dmaengine_terminate_all(rspi->master->dma_tx);
+ 		if (rx)
+@@ -1313,12 +1315,36 @@ static const struct platform_device_id spi_driver_ids[] = {
+ 
+ MODULE_DEVICE_TABLE(platform, spi_driver_ids);
+ 
++#ifdef CONFIG_PM_SLEEP
++static int rspi_suspend(struct device *dev)
++{
++	struct platform_device *pdev = to_platform_device(dev);
++	struct rspi_data *rspi = platform_get_drvdata(pdev);
++
++	return spi_master_suspend(rspi->master);
++}
++
++static int rspi_resume(struct device *dev)
++{
++	struct platform_device *pdev = to_platform_device(dev);
++	struct rspi_data *rspi = platform_get_drvdata(pdev);
++
++	return spi_master_resume(rspi->master);
++}
++
++static SIMPLE_DEV_PM_OPS(rspi_pm_ops, rspi_suspend, rspi_resume);
++#define DEV_PM_OPS	&rspi_pm_ops
++#else
++#define DEV_PM_OPS	NULL
++#endif /* CONFIG_PM_SLEEP */
++
+ static struct platform_driver rspi_driver = {
+ 	.probe =	rspi_probe,
+ 	.remove =	rspi_remove,
+ 	.id_table =	spi_driver_ids,
+ 	.driver		= {
+ 		.name = "renesas_spi",
++		.pm = DEV_PM_OPS,
+ 		.of_match_table = of_match_ptr(rspi_of_match),
+ 	},
+ };
+diff --git a/drivers/spi/spi-sh-msiof.c b/drivers/spi/spi-sh-msiof.c
+index cbf02ebb30a2..711ea523b325 100644
+--- a/drivers/spi/spi-sh-msiof.c
++++ b/drivers/spi/spi-sh-msiof.c
+@@ -373,7 +373,8 @@ static void sh_msiof_spi_set_mode_regs(struct sh_msiof_spi_priv *p,
+ 
+ static void sh_msiof_reset_str(struct sh_msiof_spi_priv *p)
+ {
+-	sh_msiof_write(p, STR, sh_msiof_read(p, STR));
++	sh_msiof_write(p, STR,
++		       sh_msiof_read(p, STR) & ~(STR_TDREQ | STR_RDREQ));
+ }
+ 
+ static void sh_msiof_spi_write_fifo_8(struct sh_msiof_spi_priv *p,
+@@ -1275,12 +1276,37 @@ static const struct platform_device_id spi_driver_ids[] = {
+ };
+ MODULE_DEVICE_TABLE(platform, spi_driver_ids);
+ 
++#ifdef CONFIG_PM_SLEEP
++static int sh_msiof_spi_suspend(struct device *dev)
++{
++	struct platform_device *pdev = to_platform_device(dev);
++	struct sh_msiof_spi_priv *p = platform_get_drvdata(pdev);
++
++	return spi_master_suspend(p->master);
++}
++
++static int sh_msiof_spi_resume(struct device *dev)
++{
++	struct platform_device *pdev = to_platform_device(dev);
++	struct sh_msiof_spi_priv *p = platform_get_drvdata(pdev);
++
++	return spi_master_resume(p->master);
++}
++
++static SIMPLE_DEV_PM_OPS(sh_msiof_spi_pm_ops, sh_msiof_spi_suspend,
++			 sh_msiof_spi_resume);
++#define DEV_PM_OPS	&sh_msiof_spi_pm_ops
++#else
++#define DEV_PM_OPS	NULL
++#endif /* CONFIG_PM_SLEEP */
++
+ static struct platform_driver sh_msiof_spi_drv = {
+ 	.probe		= sh_msiof_spi_probe,
+ 	.remove		= sh_msiof_spi_remove,
+ 	.id_table	= spi_driver_ids,
+ 	.driver		= {
+ 		.name		= "spi_sh_msiof",
++		.pm		= DEV_PM_OPS,
+ 		.of_match_table = of_match_ptr(sh_msiof_match),
+ 	},
+ };
+diff --git a/drivers/spi/spi-tegra20-slink.c b/drivers/spi/spi-tegra20-slink.c
+index 85c91f58b42f..af2880d0c112 100644
+--- a/drivers/spi/spi-tegra20-slink.c
++++ b/drivers/spi/spi-tegra20-slink.c
+@@ -1063,6 +1063,24 @@ static int tegra_slink_probe(struct platform_device *pdev)
+ 		goto exit_free_master;
+ 	}
+ 
++	/* disabled clock may cause interrupt storm upon request */
++	tspi->clk = devm_clk_get(&pdev->dev, NULL);
++	if (IS_ERR(tspi->clk)) {
++		ret = PTR_ERR(tspi->clk);
++		dev_err(&pdev->dev, "Can not get clock %d\n", ret);
++		goto exit_free_master;
++	}
++	ret = clk_prepare(tspi->clk);
++	if (ret < 0) {
++		dev_err(&pdev->dev, "Clock prepare failed %d\n", ret);
++		goto exit_free_master;
++	}
++	ret = clk_enable(tspi->clk);
++	if (ret < 0) {
++		dev_err(&pdev->dev, "Clock enable failed %d\n", ret);
++		goto exit_free_master;
++	}
++
+ 	spi_irq = platform_get_irq(pdev, 0);
+ 	tspi->irq = spi_irq;
+ 	ret = request_threaded_irq(tspi->irq, tegra_slink_isr,
+@@ -1071,14 +1089,7 @@ static int tegra_slink_probe(struct platform_device *pdev)
+ 	if (ret < 0) {
+ 		dev_err(&pdev->dev, "Failed to register ISR for IRQ %d\n",
+ 					tspi->irq);
+-		goto exit_free_master;
+-	}
+-
+-	tspi->clk = devm_clk_get(&pdev->dev, NULL);
+-	if (IS_ERR(tspi->clk)) {
+-		dev_err(&pdev->dev, "can not get clock\n");
+-		ret = PTR_ERR(tspi->clk);
+-		goto exit_free_irq;
++		goto exit_clk_disable;
+ 	}
+ 
+ 	tspi->rst = devm_reset_control_get(&pdev->dev, "spi");
+@@ -1138,6 +1149,8 @@ exit_rx_dma_free:
+ 	tegra_slink_deinit_dma_param(tspi, true);
+ exit_free_irq:
+ 	free_irq(spi_irq, tspi);
++exit_clk_disable:
++	clk_disable(tspi->clk);
+ exit_free_master:
+ 	spi_master_put(master);
+ 	return ret;
+@@ -1150,6 +1163,8 @@ static int tegra_slink_remove(struct platform_device *pdev)
+ 
+ 	free_irq(tspi->irq, tspi);
+ 
++	clk_disable(tspi->clk);
++
+ 	if (tspi->tx_dma_chan)
+ 		tegra_slink_deinit_dma_param(tspi, false);
+ 
+diff --git a/drivers/staging/android/ashmem.c b/drivers/staging/android/ashmem.c
+index 6d690e5fa9bb..c6314d1552ea 100644
+--- a/drivers/staging/android/ashmem.c
++++ b/drivers/staging/android/ashmem.c
+@@ -383,6 +383,12 @@ static int ashmem_mmap(struct file *file, struct vm_area_struct *vma)
+ 		goto out;
+ 	}
+ 
++	/* requested mapping size larger than object size */
++	if (vma->vm_end - vma->vm_start > PAGE_ALIGN(asma->size)) {
++		ret = -EINVAL;
++		goto out;
++	}
++
+ 	/* requested protection bits must match our allowed protection mask */
+ 	if (unlikely((vma->vm_flags & ~calc_vm_prot_bits(asma->prot_mask, 0)) &
+ 		     calc_vm_prot_bits(PROT_MASK, 0))) {
+diff --git a/drivers/staging/rts5208/sd.c b/drivers/staging/rts5208/sd.c
+index b0bbb36f8988..9e63bdf2afe7 100644
+--- a/drivers/staging/rts5208/sd.c
++++ b/drivers/staging/rts5208/sd.c
+@@ -4976,7 +4976,7 @@ int sd_execute_write_data(struct scsi_cmnd *srb, struct rtsx_chip *chip)
+ 			goto SD_Execute_Write_Cmd_Failed;
+ 		}
+ 
+-		rtsx_write_register(chip, SD_BYTE_CNT_L, 0xFF, 0x00);
++		retval = rtsx_write_register(chip, SD_BYTE_CNT_L, 0xFF, 0x00);
+ 		if (retval != STATUS_SUCCESS) {
+ 			rtsx_trace(chip);
+ 			goto SD_Execute_Write_Cmd_Failed;
+diff --git a/drivers/target/iscsi/iscsi_target_auth.c b/drivers/target/iscsi/iscsi_target_auth.c
+index f06e74ea10d3..f0d97305575d 100644
+--- a/drivers/target/iscsi/iscsi_target_auth.c
++++ b/drivers/target/iscsi/iscsi_target_auth.c
+@@ -26,15 +26,6 @@
+ #include "iscsi_target_nego.h"
+ #include "iscsi_target_auth.h"
+ 
+-static void chap_binaryhex_to_asciihex(char *dst, char *src, int src_len)
+-{
+-	int i;
+-
+-	for (i = 0; i < src_len; i++) {
+-		sprintf(&dst[i*2], "%02x", (int) src[i] & 0xff);
+-	}
+-}
+-
+ static void chap_gen_challenge(
+ 	struct iscsi_conn *conn,
+ 	int caller,
+@@ -47,7 +38,7 @@ static void chap_gen_challenge(
+ 	memset(challenge_asciihex, 0, CHAP_CHALLENGE_LENGTH * 2 + 1);
+ 
+ 	get_random_bytes(chap->challenge, CHAP_CHALLENGE_LENGTH);
+-	chap_binaryhex_to_asciihex(challenge_asciihex, chap->challenge,
++	bin2hex(challenge_asciihex, chap->challenge,
+ 				CHAP_CHALLENGE_LENGTH);
+ 	/*
+ 	 * Set CHAP_C, and copy the generated challenge into c_str.
+@@ -281,7 +272,7 @@ static int chap_server_compute_md5(
+ 		goto out;
+ 	}
+ 
+-	chap_binaryhex_to_asciihex(response, server_digest, MD5_SIGNATURE_SIZE);
++	bin2hex(response, server_digest, MD5_SIGNATURE_SIZE);
+ 	pr_debug("[server] MD5 Server Digest: %s\n", response);
+ 
+ 	if (memcmp(server_digest, client_digest, MD5_SIGNATURE_SIZE) != 0) {
+@@ -403,7 +394,7 @@ static int chap_server_compute_md5(
+ 	/*
+ 	 * Convert response from binary hex to ascii hext.
+ 	 */
+-	chap_binaryhex_to_asciihex(response, digest, MD5_SIGNATURE_SIZE);
++	bin2hex(response, digest, MD5_SIGNATURE_SIZE);
+ 	*nr_out_len += sprintf(nr_out_ptr + *nr_out_len, "CHAP_R=0x%s",
+ 			response);
+ 	*nr_out_len += 1;
+diff --git a/drivers/target/iscsi/iscsi_target_tpg.c b/drivers/target/iscsi/iscsi_target_tpg.c
+index 63e1dcc5914d..761b065a40bb 100644
+--- a/drivers/target/iscsi/iscsi_target_tpg.c
++++ b/drivers/target/iscsi/iscsi_target_tpg.c
+@@ -637,8 +637,7 @@ int iscsit_ta_authentication(struct iscsi_portal_group *tpg, u32 authentication)
+ 		none = strstr(buf1, NONE);
+ 		if (none)
+ 			goto out;
+-		strncat(buf1, ",", strlen(","));
+-		strncat(buf1, NONE, strlen(NONE));
++		strlcat(buf1, "," NONE, sizeof(buf1));
+ 		if (iscsi_update_param_value(param, buf1) < 0)
+ 			return -EINVAL;
+ 	}
+diff --git a/drivers/thermal/of-thermal.c b/drivers/thermal/of-thermal.c
+index d04ec3b9e5ff..8a70b57d129c 100644
+--- a/drivers/thermal/of-thermal.c
++++ b/drivers/thermal/of-thermal.c
+@@ -278,10 +278,13 @@ static int of_thermal_set_mode(struct thermal_zone_device *tz,
+ 
+ 	mutex_lock(&tz->lock);
+ 
+-	if (mode == THERMAL_DEVICE_ENABLED)
++	if (mode == THERMAL_DEVICE_ENABLED) {
+ 		tz->polling_delay = data->polling_delay;
+-	else
++		tz->passive_delay = data->passive_delay;
++	} else {
+ 		tz->polling_delay = 0;
++		tz->passive_delay = 0;
++	}
+ 
+ 	mutex_unlock(&tz->lock);
+ 
+diff --git a/drivers/tty/serial/8250/serial_cs.c b/drivers/tty/serial/8250/serial_cs.c
+index 933c2688dd7e..8106353ce7aa 100644
+--- a/drivers/tty/serial/8250/serial_cs.c
++++ b/drivers/tty/serial/8250/serial_cs.c
+@@ -637,8 +637,10 @@ static int serial_config(struct pcmcia_device *link)
+ 	    (link->has_func_id) &&
+ 	    (link->socket->pcmcia_pfc == 0) &&
+ 	    ((link->func_id == CISTPL_FUNCID_MULTI) ||
+-	     (link->func_id == CISTPL_FUNCID_SERIAL)))
+-		pcmcia_loop_config(link, serial_check_for_multi, info);
++	     (link->func_id == CISTPL_FUNCID_SERIAL))) {
++		if (pcmcia_loop_config(link, serial_check_for_multi, info))
++			goto failed;
++	}
+ 
+ 	/*
+ 	 * Apply any multi-port quirk.
+diff --git a/drivers/tty/serial/cpm_uart/cpm_uart_core.c b/drivers/tty/serial/cpm_uart/cpm_uart_core.c
+index d3e3d42c0c12..0040c29f651a 100644
+--- a/drivers/tty/serial/cpm_uart/cpm_uart_core.c
++++ b/drivers/tty/serial/cpm_uart/cpm_uart_core.c
+@@ -1068,8 +1068,8 @@ static int poll_wait_key(char *obuf, struct uart_cpm_port *pinfo)
+ 	/* Get the address of the host memory buffer.
+ 	 */
+ 	bdp = pinfo->rx_cur;
+-	while (bdp->cbd_sc & BD_SC_EMPTY)
+-		;
++	if (bdp->cbd_sc & BD_SC_EMPTY)
++		return NO_POLL_CHAR;
+ 
+ 	/* If the buffer address is in the CPM DPRAM, don't
+ 	 * convert it.
+@@ -1104,7 +1104,11 @@ static int cpm_get_poll_char(struct uart_port *port)
+ 		poll_chars = 0;
+ 	}
+ 	if (poll_chars <= 0) {
+-		poll_chars = poll_wait_key(poll_buf, pinfo);
++		int ret = poll_wait_key(poll_buf, pinfo);
++
++		if (ret == NO_POLL_CHAR)
++			return ret;
++		poll_chars = ret;
+ 		pollp = poll_buf;
+ 	}
+ 	poll_chars--;
+diff --git a/drivers/tty/serial/fsl_lpuart.c b/drivers/tty/serial/fsl_lpuart.c
+index 937f5e10f165..e2ec04904f54 100644
+--- a/drivers/tty/serial/fsl_lpuart.c
++++ b/drivers/tty/serial/fsl_lpuart.c
+@@ -833,7 +833,8 @@ static inline int lpuart_start_rx_dma(struct lpuart_port *sport)
+ 	struct circ_buf *ring = &sport->rx_ring;
+ 	int ret, nent;
+ 	int bits, baud;
+-	struct tty_struct *tty = tty_port_tty_get(&sport->port.state->port);
++	struct tty_port *port = &sport->port.state->port;
++	struct tty_struct *tty = port->tty;
+ 	struct ktermios *termios = &tty->termios;
+ 
+ 	baud = tty_get_baud_rate(tty);
+diff --git a/drivers/tty/serial/imx.c b/drivers/tty/serial/imx.c
+index b24edf634985..0d82be145c68 100644
+--- a/drivers/tty/serial/imx.c
++++ b/drivers/tty/serial/imx.c
+@@ -2197,6 +2197,14 @@ static int serial_imx_probe(struct platform_device *pdev)
+ 				ret);
+ 			return ret;
+ 		}
++
++		ret = devm_request_irq(&pdev->dev, rtsirq, imx_rtsint, 0,
++				       dev_name(&pdev->dev), sport);
++		if (ret) {
++			dev_err(&pdev->dev, "failed to request rts irq: %d\n",
++				ret);
++			return ret;
++		}
+ 	} else {
+ 		ret = devm_request_irq(&pdev->dev, rxirq, imx_int, 0,
+ 				       dev_name(&pdev->dev), sport);
+diff --git a/drivers/usb/class/cdc-wdm.c b/drivers/usb/class/cdc-wdm.c
+index adc0f78dc54d..9f001659807a 100644
+--- a/drivers/usb/class/cdc-wdm.c
++++ b/drivers/usb/class/cdc-wdm.c
+@@ -470,7 +470,7 @@ static int service_outstanding_interrupt(struct wdm_device *desc)
+ 
+ 	set_bit(WDM_RESPONDING, &desc->flags);
+ 	spin_unlock_irq(&desc->iuspin);
+-	rv = usb_submit_urb(desc->response, GFP_ATOMIC);
++	rv = usb_submit_urb(desc->response, GFP_KERNEL);
+ 	spin_lock_irq(&desc->iuspin);
+ 	if (rv) {
+ 		dev_err(&desc->intf->dev,
+diff --git a/drivers/usb/core/devio.c b/drivers/usb/core/devio.c
+index 893ebae51029..988240e3cb58 100644
+--- a/drivers/usb/core/devio.c
++++ b/drivers/usb/core/devio.c
+@@ -1450,10 +1450,13 @@ static int proc_do_submiturb(struct usb_dev_state *ps, struct usbdevfs_urb *uurb
+ 	struct async *as = NULL;
+ 	struct usb_ctrlrequest *dr = NULL;
+ 	unsigned int u, totlen, isofrmlen;
+-	int i, ret, is_in, num_sgs = 0, ifnum = -1;
++	int i, ret, num_sgs = 0, ifnum = -1;
+ 	int number_of_packets = 0;
+ 	unsigned int stream_id = 0;
+ 	void *buf;
++	bool is_in;
++	bool allow_short = false;
++	bool allow_zero = false;
+ 	unsigned long mask =	USBDEVFS_URB_SHORT_NOT_OK |
+ 				USBDEVFS_URB_BULK_CONTINUATION |
+ 				USBDEVFS_URB_NO_FSBR |
+@@ -1487,6 +1490,8 @@ static int proc_do_submiturb(struct usb_dev_state *ps, struct usbdevfs_urb *uurb
+ 	u = 0;
+ 	switch (uurb->type) {
+ 	case USBDEVFS_URB_TYPE_CONTROL:
++		if (is_in)
++			allow_short = true;
+ 		if (!usb_endpoint_xfer_control(&ep->desc))
+ 			return -EINVAL;
+ 		/* min 8 byte setup packet */
+@@ -1527,6 +1532,10 @@ static int proc_do_submiturb(struct usb_dev_state *ps, struct usbdevfs_urb *uurb
+ 		break;
+ 
+ 	case USBDEVFS_URB_TYPE_BULK:
++		if (!is_in)
++			allow_zero = true;
++		else
++			allow_short = true;
+ 		switch (usb_endpoint_type(&ep->desc)) {
+ 		case USB_ENDPOINT_XFER_CONTROL:
+ 		case USB_ENDPOINT_XFER_ISOC:
+@@ -1547,6 +1556,10 @@ static int proc_do_submiturb(struct usb_dev_state *ps, struct usbdevfs_urb *uurb
+ 		if (!usb_endpoint_xfer_int(&ep->desc))
+ 			return -EINVAL;
+  interrupt_urb:
++		if (!is_in)
++			allow_zero = true;
++		else
++			allow_short = true;
+ 		break;
+ 
+ 	case USBDEVFS_URB_TYPE_ISO:
+@@ -1691,16 +1704,21 @@ static int proc_do_submiturb(struct usb_dev_state *ps, struct usbdevfs_urb *uurb
+ 	u = (is_in ? URB_DIR_IN : URB_DIR_OUT);
+ 	if (uurb->flags & USBDEVFS_URB_ISO_ASAP)
+ 		u |= URB_ISO_ASAP;
+-	if (uurb->flags & USBDEVFS_URB_SHORT_NOT_OK && is_in)
++	if (allow_short && uurb->flags & USBDEVFS_URB_SHORT_NOT_OK)
+ 		u |= URB_SHORT_NOT_OK;
+ 	if (uurb->flags & USBDEVFS_URB_NO_FSBR)
+ 		u |= URB_NO_FSBR;
+-	if (uurb->flags & USBDEVFS_URB_ZERO_PACKET)
++	if (allow_zero && uurb->flags & USBDEVFS_URB_ZERO_PACKET)
+ 		u |= URB_ZERO_PACKET;
+ 	if (uurb->flags & USBDEVFS_URB_NO_INTERRUPT)
+ 		u |= URB_NO_INTERRUPT;
+ 	as->urb->transfer_flags = u;
+ 
++	if (!allow_short && uurb->flags & USBDEVFS_URB_SHORT_NOT_OK)
++		dev_warn(&ps->dev->dev, "Requested nonsensical USBDEVFS_URB_SHORT_NOT_OK.\n");
++	if (!allow_zero && uurb->flags & USBDEVFS_URB_ZERO_PACKET)
++		dev_warn(&ps->dev->dev, "Requested nonsensical USBDEVFS_URB_ZERO_PACKET.\n");
++
+ 	as->urb->transfer_buffer_length = uurb->buffer_length;
+ 	as->urb->setup_packet = (unsigned char *)dr;
+ 	dr = NULL;
+diff --git a/drivers/usb/core/driver.c b/drivers/usb/core/driver.c
+index 0bb380a9fcf7..e9d6cf146fcc 100644
+--- a/drivers/usb/core/driver.c
++++ b/drivers/usb/core/driver.c
+@@ -509,7 +509,6 @@ int usb_driver_claim_interface(struct usb_driver *driver,
+ 	struct device *dev;
+ 	struct usb_device *udev;
+ 	int retval = 0;
+-	int lpm_disable_error = -ENODEV;
+ 
+ 	if (!iface)
+ 		return -ENODEV;
+@@ -530,16 +529,6 @@ int usb_driver_claim_interface(struct usb_driver *driver,
+ 
+ 	iface->condition = USB_INTERFACE_BOUND;
+ 
+-	/* See the comment about disabling LPM in usb_probe_interface(). */
+-	if (driver->disable_hub_initiated_lpm) {
+-		lpm_disable_error = usb_unlocked_disable_lpm(udev);
+-		if (lpm_disable_error) {
+-			dev_err(&iface->dev, "%s Failed to disable LPM for driver %s\n.",
+-					__func__, driver->name);
+-			return -ENOMEM;
+-		}
+-	}
+-
+ 	/* Claimed interfaces are initially inactive (suspended) and
+ 	 * runtime-PM-enabled, but only if the driver has autosuspend
+ 	 * support.  Otherwise they are marked active, to prevent the
+@@ -558,9 +547,20 @@ int usb_driver_claim_interface(struct usb_driver *driver,
+ 	if (device_is_registered(dev))
+ 		retval = device_bind_driver(dev);
+ 
+-	/* Attempt to re-enable USB3 LPM, if the disable was successful. */
+-	if (!lpm_disable_error)
+-		usb_unlocked_enable_lpm(udev);
++	if (retval) {
++		dev->driver = NULL;
++		usb_set_intfdata(iface, NULL);
++		iface->needs_remote_wakeup = 0;
++		iface->condition = USB_INTERFACE_UNBOUND;
++
++		/*
++		 * Unbound interfaces are always runtime-PM-disabled
++		 * and runtime-PM-suspended
++		 */
++		if (driver->supports_autosuspend)
++			pm_runtime_disable(dev);
++		pm_runtime_set_suspended(dev);
++	}
+ 
+ 	return retval;
+ }
+diff --git a/drivers/usb/core/usb.c b/drivers/usb/core/usb.c
+index eaf1c3b06f02..891261b43c67 100644
+--- a/drivers/usb/core/usb.c
++++ b/drivers/usb/core/usb.c
+@@ -91,6 +91,8 @@ struct usb_host_interface *usb_find_alt_setting(
+ 	struct usb_interface_cache *intf_cache = NULL;
+ 	int i;
+ 
++	if (!config)
++		return NULL;
+ 	for (i = 0; i < config->desc.bNumInterfaces; i++) {
+ 		if (config->intf_cache[i]->altsetting[0].desc.bInterfaceNumber
+ 				== iface_num) {
+diff --git a/drivers/usb/serial/kobil_sct.c b/drivers/usb/serial/kobil_sct.c
+index 813035f51fe7..7d252678c55a 100644
+--- a/drivers/usb/serial/kobil_sct.c
++++ b/drivers/usb/serial/kobil_sct.c
+@@ -408,12 +408,20 @@ static int kobil_tiocmget(struct tty_struct *tty)
+ 			  transfer_buffer_length,
+ 			  KOBIL_TIMEOUT);
+ 
+-	dev_dbg(&port->dev, "%s - Send get_status_line_state URB returns: %i. Statusline: %02x\n",
+-		__func__, result, transfer_buffer[0]);
++	dev_dbg(&port->dev, "Send get_status_line_state URB returns: %i\n",
++			result);
++	if (result < 1) {
++		if (result >= 0)
++			result = -EIO;
++		goto out_free;
++	}
++
++	dev_dbg(&port->dev, "Statusline: %02x\n", transfer_buffer[0]);
+ 
+ 	result = 0;
+ 	if ((transfer_buffer[0] & SUSBCR_GSL_DSR) != 0)
+ 		result = TIOCM_DSR;
++out_free:
+ 	kfree(transfer_buffer);
+ 	return result;
+ }
+diff --git a/drivers/usb/wusbcore/security.c b/drivers/usb/wusbcore/security.c
+index 8c9421b69da0..6bf86ca950b3 100644
+--- a/drivers/usb/wusbcore/security.c
++++ b/drivers/usb/wusbcore/security.c
+@@ -230,7 +230,7 @@ int wusb_dev_sec_add(struct wusbhc *wusbhc,
+ 
+ 	result = usb_get_descriptor(usb_dev, USB_DT_SECURITY,
+ 				    0, secd, sizeof(*secd));
+-	if (result < sizeof(*secd)) {
++	if (result < (int)sizeof(*secd)) {
+ 		dev_err(dev, "Can't read security descriptor or "
+ 			"not enough data: %d\n", result);
+ 		goto out;
+diff --git a/drivers/uwb/hwa-rc.c b/drivers/uwb/hwa-rc.c
+index 9a53912bdfe9..5d3ba747ae17 100644
+--- a/drivers/uwb/hwa-rc.c
++++ b/drivers/uwb/hwa-rc.c
+@@ -873,6 +873,7 @@ error_get_version:
+ error_rc_add:
+ 	usb_put_intf(iface);
+ 	usb_put_dev(hwarc->usb_dev);
++	kfree(hwarc);
+ error_alloc:
+ 	uwb_rc_put(uwb_rc);
+ error_rc_alloc:
+diff --git a/fs/ext4/xattr.c b/fs/ext4/xattr.c
+index fdcbe0f2814f..c19c96840480 100644
+--- a/fs/ext4/xattr.c
++++ b/fs/ext4/xattr.c
+@@ -1426,6 +1426,11 @@ static int ext4_xattr_make_inode_space(handle_t *handle, struct inode *inode,
+ 		last = IFIRST(header);
+ 		/* Find the entry best suited to be pushed into EA block */
+ 		for (; !IS_LAST_ENTRY(last); last = EXT4_XATTR_NEXT(last)) {
++			/* never move system.data out of the inode */
++			if ((last->e_name_len == 4) &&
++			    (last->e_name_index == EXT4_XATTR_INDEX_SYSTEM) &&
++			    !memcmp(last->e_name, "data", 4))
++				continue;
+ 			total_size =
+ 			EXT4_XATTR_SIZE(le32_to_cpu(last->e_value_size)) +
+ 					EXT4_XATTR_LEN(last->e_name_len);
+diff --git a/fs/nfsd/nfs4proc.c b/fs/nfsd/nfs4proc.c
+index eef0caf6e67d..e9495516527d 100644
+--- a/fs/nfsd/nfs4proc.c
++++ b/fs/nfsd/nfs4proc.c
+@@ -1725,6 +1725,7 @@ nfsd4_proc_compound(struct svc_rqst *rqstp,
+ 	if (status) {
+ 		op = &args->ops[0];
+ 		op->status = status;
++		resp->opcnt = 1;
+ 		goto encode_op;
+ 	}
+ 
+diff --git a/include/linux/arm-smccc.h b/include/linux/arm-smccc.h
+index ca1d2cc2cdfa..18863d56273c 100644
+--- a/include/linux/arm-smccc.h
++++ b/include/linux/arm-smccc.h
+@@ -199,47 +199,57 @@ asmlinkage void __arm_smccc_hvc(unsigned long a0, unsigned long a1,
+ 
+ #define __declare_arg_0(a0, res)					\
+ 	struct arm_smccc_res   *___res = res;				\
+-	register u32           r0 asm("r0") = a0;			\
++	register unsigned long r0 asm("r0") = (u32)a0;			\
+ 	register unsigned long r1 asm("r1");				\
+ 	register unsigned long r2 asm("r2");				\
+ 	register unsigned long r3 asm("r3")
+ 
+ #define __declare_arg_1(a0, a1, res)					\
++	typeof(a1) __a1 = a1;						\
+ 	struct arm_smccc_res   *___res = res;				\
+-	register u32           r0 asm("r0") = a0;			\
+-	register typeof(a1)    r1 asm("r1") = a1;			\
++	register unsigned long r0 asm("r0") = (u32)a0;			\
++	register unsigned long r1 asm("r1") = __a1;			\
+ 	register unsigned long r2 asm("r2");				\
+ 	register unsigned long r3 asm("r3")
+ 
+ #define __declare_arg_2(a0, a1, a2, res)				\
++	typeof(a1) __a1 = a1;						\
++	typeof(a2) __a2 = a2;						\
+ 	struct arm_smccc_res   *___res = res;				\
+-	register u32           r0 asm("r0") = a0;			\
+-	register typeof(a1)    r1 asm("r1") = a1;			\
+-	register typeof(a2)    r2 asm("r2") = a2;			\
++	register unsigned long r0 asm("r0") = (u32)a0;			\
++	register unsigned long r1 asm("r1") = __a1;			\
++	register unsigned long r2 asm("r2") = __a2;			\
+ 	register unsigned long r3 asm("r3")
+ 
+ #define __declare_arg_3(a0, a1, a2, a3, res)				\
++	typeof(a1) __a1 = a1;						\
++	typeof(a2) __a2 = a2;						\
++	typeof(a3) __a3 = a3;						\
+ 	struct arm_smccc_res   *___res = res;				\
+-	register u32           r0 asm("r0") = a0;			\
+-	register typeof(a1)    r1 asm("r1") = a1;			\
+-	register typeof(a2)    r2 asm("r2") = a2;			\
+-	register typeof(a3)    r3 asm("r3") = a3
++	register unsigned long r0 asm("r0") = (u32)a0;			\
++	register unsigned long r1 asm("r1") = __a1;			\
++	register unsigned long r2 asm("r2") = __a2;			\
++	register unsigned long r3 asm("r3") = __a3
+ 
+ #define __declare_arg_4(a0, a1, a2, a3, a4, res)			\
++	typeof(a4) __a4 = a4;						\
+ 	__declare_arg_3(a0, a1, a2, a3, res);				\
+-	register typeof(a4) r4 asm("r4") = a4
++	register unsigned long r4 asm("r4") = __a4
+ 
+ #define __declare_arg_5(a0, a1, a2, a3, a4, a5, res)			\
++	typeof(a5) __a5 = a5;						\
+ 	__declare_arg_4(a0, a1, a2, a3, a4, res);			\
+-	register typeof(a5) r5 asm("r5") = a5
++	register unsigned long r5 asm("r5") = __a5
+ 
+ #define __declare_arg_6(a0, a1, a2, a3, a4, a5, a6, res)		\
++	typeof(a6) __a6 = a6;						\
+ 	__declare_arg_5(a0, a1, a2, a3, a4, a5, res);			\
+-	register typeof(a6) r6 asm("r6") = a6
++	register unsigned long r6 asm("r6") = __a6
+ 
+ #define __declare_arg_7(a0, a1, a2, a3, a4, a5, a6, a7, res)		\
++	typeof(a7) __a7 = a7;						\
+ 	__declare_arg_6(a0, a1, a2, a3, a4, a5, a6, res);		\
+-	register typeof(a7) r7 asm("r7") = a7
++	register unsigned long r7 asm("r7") = __a7
+ 
+ #define ___declare_args(count, ...) __declare_arg_ ## count(__VA_ARGS__)
+ #define __declare_args(count, ...)  ___declare_args(count, __VA_ARGS__)
+diff --git a/include/linux/platform_data/ina2xx.h b/include/linux/platform_data/ina2xx.h
+index 9abc0ca7259b..9f0aa1b48c78 100644
+--- a/include/linux/platform_data/ina2xx.h
++++ b/include/linux/platform_data/ina2xx.h
+@@ -1,7 +1,7 @@
+ /*
+  * Driver for Texas Instruments INA219, INA226 power monitor chips
+  *
+- * Copyright (C) 2012 Lothar Felten <l-felten@××.com>
++ * Copyright (C) 2012 Lothar Felten <lothar.felten@×××××.com>
+  *
+  * This program is free software; you can redistribute it and/or modify
+  * it under the terms of the GNU General Public License version 2 as
+diff --git a/include/linux/power_supply.h b/include/linux/power_supply.h
+index 3965503315ef..ad97baf7b8de 100644
+--- a/include/linux/power_supply.h
++++ b/include/linux/power_supply.h
+@@ -249,6 +249,7 @@ struct power_supply {
+ 	spinlock_t changed_lock;
+ 	bool changed;
+ 	bool initialized;
++	bool removing;
+ 	atomic_t use_cnt;
+ #ifdef CONFIG_THERMAL
+ 	struct thermal_zone_device *tzd;
+diff --git a/include/linux/slub_def.h b/include/linux/slub_def.h
+index 75f56c2ef2d4..b6a59e8cd855 100644
+--- a/include/linux/slub_def.h
++++ b/include/linux/slub_def.h
+@@ -67,7 +67,8 @@ struct kmem_cache {
+ 	int size;		/* The size of an object including meta data */
+ 	int object_size;	/* The size of an object without meta data */
+ 	int offset;		/* Free pointer offset. */
+-	int cpu_partial;	/* Number of per cpu partial objects to keep around */
++	/* Number of per cpu partial objects to keep around */
++	unsigned int cpu_partial;
+ 	struct kmem_cache_order_objects oo;
+ 
+ 	/* Allocation and freeing of slabs */
+diff --git a/include/media/v4l2-fh.h b/include/media/v4l2-fh.h
+index e19e6246e21c..d2671606cb5d 100644
+--- a/include/media/v4l2-fh.h
++++ b/include/media/v4l2-fh.h
+@@ -42,10 +42,13 @@ struct v4l2_ctrl_handler;
+  * @prio: priority of the file handler, as defined by &enum v4l2_priority
+  *
+  * @wait: event' s wait queue
++ * @subscribe_lock: serialise changes to the subscribed list; guarantee that
++ *		    the add and del event callbacks are orderly called
+  * @subscribed: list of subscribed events
+  * @available: list of events waiting to be dequeued
+  * @navailable: number of available events at @available list
+  * @sequence: event sequence number
++ *
+  * @m2m_ctx: pointer to &struct v4l2_m2m_ctx
+  */
+ struct v4l2_fh {
+@@ -56,6 +59,7 @@ struct v4l2_fh {
+ 
+ 	/* Events */
+ 	wait_queue_head_t	wait;
++	struct mutex		subscribe_lock;
+ 	struct list_head	subscribed;
+ 	struct list_head	available;
+ 	unsigned int		navailable;
+diff --git a/kernel/module.c b/kernel/module.c
+index 0651f2d25fc9..2325c9821f2a 100644
+--- a/kernel/module.c
++++ b/kernel/module.c
+@@ -4011,7 +4011,7 @@ static unsigned long mod_find_symname(struct module *mod, const char *name)
+ 
+ 	for (i = 0; i < kallsyms->num_symtab; i++)
+ 		if (strcmp(name, symname(kallsyms, i)) == 0 &&
+-		    kallsyms->symtab[i].st_info != 'U')
++		    kallsyms->symtab[i].st_shndx != SHN_UNDEF)
+ 			return kallsyms->symtab[i].st_value;
+ 	return 0;
+ }
+@@ -4057,6 +4057,10 @@ int module_kallsyms_on_each_symbol(int (*fn)(void *, const char *,
+ 		if (mod->state == MODULE_STATE_UNFORMED)
+ 			continue;
+ 		for (i = 0; i < kallsyms->num_symtab; i++) {
++
++			if (kallsyms->symtab[i].st_shndx == SHN_UNDEF)
++				continue;
++
+ 			ret = fn(data, symname(kallsyms, i),
+ 				 mod, kallsyms->symtab[i].st_value);
+ 			if (ret != 0)
+diff --git a/kernel/time/alarmtimer.c b/kernel/time/alarmtimer.c
+index d67ef56ca9bc..a0ee81f49a87 100644
+--- a/kernel/time/alarmtimer.c
++++ b/kernel/time/alarmtimer.c
+@@ -786,7 +786,8 @@ static int alarm_timer_nsleep(const clockid_t which_clock, int flags,
+ 	/* Convert (if necessary) to absolute time */
+ 	if (flags != TIMER_ABSTIME) {
+ 		ktime_t now = alarm_bases[type].gettime();
+-		exp = ktime_add(now, exp);
++
++		exp = ktime_add_safe(now, exp);
+ 	}
+ 
+ 	if (alarmtimer_do_nsleep(&alarm, exp))
+diff --git a/lib/klist.c b/lib/klist.c
+index 0507fa5d84c5..f6b547812fe3 100644
+--- a/lib/klist.c
++++ b/lib/klist.c
+@@ -336,8 +336,9 @@ struct klist_node *klist_prev(struct klist_iter *i)
+ 	void (*put)(struct klist_node *) = i->i_klist->put;
+ 	struct klist_node *last = i->i_cur;
+ 	struct klist_node *prev;
++	unsigned long flags;
+ 
+-	spin_lock(&i->i_klist->k_lock);
++	spin_lock_irqsave(&i->i_klist->k_lock, flags);
+ 
+ 	if (last) {
+ 		prev = to_klist_node(last->n_node.prev);
+@@ -356,7 +357,7 @@ struct klist_node *klist_prev(struct klist_iter *i)
+ 		prev = to_klist_node(prev->n_node.prev);
+ 	}
+ 
+-	spin_unlock(&i->i_klist->k_lock);
++	spin_unlock_irqrestore(&i->i_klist->k_lock, flags);
+ 
+ 	if (put && last)
+ 		put(last);
+@@ -377,8 +378,9 @@ struct klist_node *klist_next(struct klist_iter *i)
+ 	void (*put)(struct klist_node *) = i->i_klist->put;
+ 	struct klist_node *last = i->i_cur;
+ 	struct klist_node *next;
++	unsigned long flags;
+ 
+-	spin_lock(&i->i_klist->k_lock);
++	spin_lock_irqsave(&i->i_klist->k_lock, flags);
+ 
+ 	if (last) {
+ 		next = to_klist_node(last->n_node.next);
+@@ -397,7 +399,7 @@ struct klist_node *klist_next(struct klist_iter *i)
+ 		next = to_klist_node(next->n_node.next);
+ 	}
+ 
+-	spin_unlock(&i->i_klist->k_lock);
++	spin_unlock_irqrestore(&i->i_klist->k_lock, flags);
+ 
+ 	if (put && last)
+ 		put(last);
+diff --git a/mm/slub.c b/mm/slub.c
+index e0ce5dec84ba..131dee87a67c 100644
+--- a/mm/slub.c
++++ b/mm/slub.c
+@@ -1793,7 +1793,7 @@ static void *get_partial_node(struct kmem_cache *s, struct kmem_cache_node *n,
+ {
+ 	struct page *page, *page2;
+ 	void *object = NULL;
+-	int available = 0;
++	unsigned int available = 0;
+ 	int objects;
+ 
+ 	/*
+@@ -4870,10 +4870,10 @@ static ssize_t cpu_partial_show(struct kmem_cache *s, char *buf)
+ static ssize_t cpu_partial_store(struct kmem_cache *s, const char *buf,
+ 				 size_t length)
+ {
+-	unsigned long objects;
++	unsigned int objects;
+ 	int err;
+ 
+-	err = kstrtoul(buf, 10, &objects);
++	err = kstrtouint(buf, 10, &objects);
+ 	if (err)
+ 		return err;
+ 	if (objects && !kmem_cache_has_cpu_partial(s))
+diff --git a/net/6lowpan/iphc.c b/net/6lowpan/iphc.c
+index 79f1fa22509a..23654f1902f3 100644
+--- a/net/6lowpan/iphc.c
++++ b/net/6lowpan/iphc.c
+@@ -745,6 +745,7 @@ int lowpan_header_decompress(struct sk_buff *skb, const struct net_device *dev,
+ 		hdr.hop_limit, &hdr.daddr);
+ 
+ 	skb_push(skb, sizeof(hdr));
++	skb_reset_mac_header(skb);
+ 	skb_reset_network_header(skb);
+ 	skb_copy_to_linear_data(skb, &hdr, sizeof(hdr));
+ 
+diff --git a/sound/aoa/core/gpio-feature.c b/sound/aoa/core/gpio-feature.c
+index 71960089e207..65557421fe0b 100644
+--- a/sound/aoa/core/gpio-feature.c
++++ b/sound/aoa/core/gpio-feature.c
+@@ -88,8 +88,10 @@ static struct device_node *get_gpio(char *name,
+ 	}
+ 
+ 	reg = of_get_property(np, "reg", NULL);
+-	if (!reg)
++	if (!reg) {
++		of_node_put(np);
+ 		return NULL;
++	}
+ 
+ 	*gpioptr = *reg;
+ 
+diff --git a/sound/pci/hda/hda_intel.c b/sound/pci/hda/hda_intel.c
+index 4e331dd5ff47..f913809a7de3 100644
+--- a/sound/pci/hda/hda_intel.c
++++ b/sound/pci/hda/hda_intel.c
+@@ -2349,7 +2349,8 @@ static const struct pci_device_id azx_ids[] = {
+ 	  .driver_data = AZX_DRIVER_GENERIC | AZX_DCAPS_PRESET_ATI_SB },
+ 	/* AMD Raven */
+ 	{ PCI_DEVICE(0x1022, 0x15e3),
+-	  .driver_data = AZX_DRIVER_GENERIC | AZX_DCAPS_PRESET_ATI_SB },
++	  .driver_data = AZX_DRIVER_GENERIC | AZX_DCAPS_PRESET_ATI_SB |
++			 AZX_DCAPS_PM_RUNTIME },
+ 	/* ATI HDMI */
+ 	{ PCI_DEVICE(0x1002, 0x0002),
+ 	  .driver_data = AZX_DRIVER_ATIHDMI_NS | AZX_DCAPS_PRESET_ATI_HDMI_NS },
+diff --git a/sound/soc/soc-dapm.c b/sound/soc/soc-dapm.c
+index 0b5d132bc3dd..8bfc534e3b34 100644
+--- a/sound/soc/soc-dapm.c
++++ b/sound/soc/soc-dapm.c
+@@ -3913,6 +3913,13 @@ int snd_soc_dapm_link_dai_widgets(struct snd_soc_card *card)
+ 			continue;
+ 		}
+ 
++		/* let users know there is no DAI to link */
++		if (!dai_w->priv) {
++			dev_dbg(card->dev, "dai widget %s has no DAI\n",
++				dai_w->name);
++			continue;
++		}
++
+ 		dai = dai_w->priv;
+ 
+ 		/* ...find all widgets with the same stream and link them */