Gentoo Archives: gentoo-commits

From: Mike Pagano <mpagano@g.o>
To: gentoo-commits@l.g.o
Subject: [gentoo-commits] proj/linux-patches:4.14 commit in: /
Date: Thu, 29 Oct 2020 11:17:57
Message-Id: 1603970260.aa28df74d00b1f4e6e675eaee1c69e7692261f66.mpagano@gentoo
1 commit: aa28df74d00b1f4e6e675eaee1c69e7692261f66
2 Author: Mike Pagano <mpagano <AT> gentoo <DOT> org>
3 AuthorDate: Thu Oct 29 11:17:40 2020 +0000
4 Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org>
5 CommitDate: Thu Oct 29 11:17:40 2020 +0000
6 URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=aa28df74
7
8 Linux patch 4.14.203
9
10 Signed-off-by: Mike Pagano <mpagano <AT> gentoo.org>
11
12 0000_README | 4 +
13 1202_linux-4.14.203.patch | 5337 +++++++++++++++++++++++++++++++++++++++++++++
14 2 files changed, 5341 insertions(+)
15
16 diff --git a/0000_README b/0000_README
17 index a650372..1ffd0bc 100644
18 --- a/0000_README
19 +++ b/0000_README
20 @@ -851,6 +851,10 @@ Patch: 1201_linux-4.14.202.patch
21 From: https://www.kernel.org
22 Desc: Linux 4.14.202
23
24 +Patch: 1202_linux-4.14.203.patch
25 +From: https://www.kernel.org
26 +Desc: Linux 4.14.203
27 +
28 Patch: 1500_XATTR_USER_PREFIX.patch
29 From: https://bugs.gentoo.org/show_bug.cgi?id=470644
30 Desc: Support for namespace user.pax.* on tmpfs.
31
32 diff --git a/1202_linux-4.14.203.patch b/1202_linux-4.14.203.patch
33 new file mode 100644
34 index 0000000..5385857
35 --- /dev/null
36 +++ b/1202_linux-4.14.203.patch
37 @@ -0,0 +1,5337 @@
38 +diff --git a/Documentation/admin-guide/kernel-parameters.txt b/Documentation/admin-guide/kernel-parameters.txt
39 +index dc96e7f10ebcd..0a59fcf934f43 100644
40 +--- a/Documentation/admin-guide/kernel-parameters.txt
41 ++++ b/Documentation/admin-guide/kernel-parameters.txt
42 +@@ -552,7 +552,7 @@
43 + loops can be debugged more effectively on production
44 + systems.
45 +
46 +- clearcpuid=BITNUM [X86]
47 ++ clearcpuid=BITNUM[,BITNUM...] [X86]
48 + Disable CPUID feature X for the kernel. See
49 + arch/x86/include/asm/cpufeatures.h for the valid bit
50 + numbers. Note the Linux specific bits are not necessarily
51 +diff --git a/Documentation/networking/ip-sysctl.txt b/Documentation/networking/ip-sysctl.txt
52 +index 3bbe6fb2b086b..5f1e3dc567f1d 100644
53 +--- a/Documentation/networking/ip-sysctl.txt
54 ++++ b/Documentation/networking/ip-sysctl.txt
55 +@@ -905,12 +905,14 @@ icmp_ratelimit - INTEGER
56 + icmp_msgs_per_sec - INTEGER
57 + Limit maximal number of ICMP packets sent per second from this host.
58 + Only messages whose type matches icmp_ratemask (see below) are
59 +- controlled by this limit.
60 ++ controlled by this limit. For security reasons, the precise count
61 ++ of messages per second is randomized.
62 + Default: 1000
63 +
64 + icmp_msgs_burst - INTEGER
65 + icmp_msgs_per_sec controls number of ICMP packets sent per second,
66 + while icmp_msgs_burst controls the burst size of these packets.
67 ++ For security reasons, the precise burst size is randomized.
68 + Default: 50
69 +
70 + icmp_ratemask - INTEGER
71 +diff --git a/Makefile b/Makefile
72 +index 0284c231bdead..ee52592c30dad 100644
73 +--- a/Makefile
74 ++++ b/Makefile
75 +@@ -1,7 +1,7 @@
76 + # SPDX-License-Identifier: GPL-2.0
77 + VERSION = 4
78 + PATCHLEVEL = 14
79 +-SUBLEVEL = 202
80 ++SUBLEVEL = 203
81 + EXTRAVERSION =
82 + NAME = Petit Gorille
83 +
84 +diff --git a/arch/arc/plat-hsdk/Kconfig b/arch/arc/plat-hsdk/Kconfig
85 +index 8fb1600b29b76..e5f65a044c7b9 100644
86 +--- a/arch/arc/plat-hsdk/Kconfig
87 ++++ b/arch/arc/plat-hsdk/Kconfig
88 +@@ -11,4 +11,5 @@ menuconfig ARC_SOC_HSDK
89 + select ARC_HAS_ACCL_REGS
90 + select ARC_IRQ_NO_AUTOSAVE
91 + select CLK_HSDK
92 ++ select RESET_CONTROLLER
93 + select RESET_HSDK
94 +diff --git a/arch/arm/boot/dts/owl-s500.dtsi b/arch/arm/boot/dts/owl-s500.dtsi
95 +index 51a48741d4c01..2557ce026add2 100644
96 +--- a/arch/arm/boot/dts/owl-s500.dtsi
97 ++++ b/arch/arm/boot/dts/owl-s500.dtsi
98 +@@ -82,21 +82,21 @@
99 + global_timer: timer@b0020200 {
100 + compatible = "arm,cortex-a9-global-timer";
101 + reg = <0xb0020200 0x100>;
102 +- interrupts = <GIC_PPI 0 (GIC_CPU_MASK_SIMPLE(4) | IRQ_TYPE_EDGE_RISING)>;
103 ++ interrupts = <GIC_PPI 11 (GIC_CPU_MASK_SIMPLE(4) | IRQ_TYPE_EDGE_RISING)>;
104 + status = "disabled";
105 + };
106 +
107 + twd_timer: timer@b0020600 {
108 + compatible = "arm,cortex-a9-twd-timer";
109 + reg = <0xb0020600 0x20>;
110 +- interrupts = <GIC_PPI 2 (GIC_CPU_MASK_SIMPLE(4) | IRQ_TYPE_EDGE_RISING)>;
111 ++ interrupts = <GIC_PPI 13 (GIC_CPU_MASK_SIMPLE(4) | IRQ_TYPE_EDGE_RISING)>;
112 + status = "disabled";
113 + };
114 +
115 + twd_wdt: wdt@b0020620 {
116 + compatible = "arm,cortex-a9-twd-wdt";
117 + reg = <0xb0020620 0xe0>;
118 +- interrupts = <GIC_PPI 3 (GIC_CPU_MASK_SIMPLE(4) | IRQ_TYPE_EDGE_RISING)>;
119 ++ interrupts = <GIC_PPI 14 (GIC_CPU_MASK_SIMPLE(4) | IRQ_TYPE_EDGE_RISING)>;
120 + status = "disabled";
121 + };
122 +
123 +diff --git a/arch/arm/mm/cache-l2x0.c b/arch/arm/mm/cache-l2x0.c
124 +index 808efbb89b88c..02f613def40dc 100644
125 +--- a/arch/arm/mm/cache-l2x0.c
126 ++++ b/arch/arm/mm/cache-l2x0.c
127 +@@ -1261,20 +1261,28 @@ static void __init l2c310_of_parse(const struct device_node *np,
128 +
129 + ret = of_property_read_u32(np, "prefetch-data", &val);
130 + if (ret == 0) {
131 +- if (val)
132 ++ if (val) {
133 + prefetch |= L310_PREFETCH_CTRL_DATA_PREFETCH;
134 +- else
135 ++ *aux_val |= L310_PREFETCH_CTRL_DATA_PREFETCH;
136 ++ } else {
137 + prefetch &= ~L310_PREFETCH_CTRL_DATA_PREFETCH;
138 ++ *aux_val &= ~L310_PREFETCH_CTRL_DATA_PREFETCH;
139 ++ }
140 ++ *aux_mask &= ~L310_PREFETCH_CTRL_DATA_PREFETCH;
141 + } else if (ret != -EINVAL) {
142 + pr_err("L2C-310 OF prefetch-data property value is missing\n");
143 + }
144 +
145 + ret = of_property_read_u32(np, "prefetch-instr", &val);
146 + if (ret == 0) {
147 +- if (val)
148 ++ if (val) {
149 + prefetch |= L310_PREFETCH_CTRL_INSTR_PREFETCH;
150 +- else
151 ++ *aux_val |= L310_PREFETCH_CTRL_INSTR_PREFETCH;
152 ++ } else {
153 + prefetch &= ~L310_PREFETCH_CTRL_INSTR_PREFETCH;
154 ++ *aux_val &= ~L310_PREFETCH_CTRL_INSTR_PREFETCH;
155 ++ }
156 ++ *aux_mask &= ~L310_PREFETCH_CTRL_INSTR_PREFETCH;
157 + } else if (ret != -EINVAL) {
158 + pr_err("L2C-310 OF prefetch-instr property value is missing\n");
159 + }
160 +diff --git a/arch/arm64/boot/dts/qcom/msm8916.dtsi b/arch/arm64/boot/dts/qcom/msm8916.dtsi
161 +index 3cc449425a038..02b7a44f790b5 100644
162 +--- a/arch/arm64/boot/dts/qcom/msm8916.dtsi
163 ++++ b/arch/arm64/boot/dts/qcom/msm8916.dtsi
164 +@@ -818,7 +818,7 @@
165 + reg-names = "mdp_phys";
166 +
167 + interrupt-parent = <&mdss>;
168 +- interrupts = <0 0>;
169 ++ interrupts = <0>;
170 +
171 + clocks = <&gcc GCC_MDSS_AHB_CLK>,
172 + <&gcc GCC_MDSS_AXI_CLK>,
173 +@@ -850,7 +850,7 @@
174 + reg-names = "dsi_ctrl";
175 +
176 + interrupt-parent = <&mdss>;
177 +- interrupts = <4 0>;
178 ++ interrupts = <4>;
179 +
180 + assigned-clocks = <&gcc BYTE0_CLK_SRC>,
181 + <&gcc PCLK0_CLK_SRC>;
182 +diff --git a/arch/arm64/boot/dts/xilinx/zynqmp.dtsi b/arch/arm64/boot/dts/xilinx/zynqmp.dtsi
183 +index 7665fbddff280..0531843117f46 100644
184 +--- a/arch/arm64/boot/dts/xilinx/zynqmp.dtsi
185 ++++ b/arch/arm64/boot/dts/xilinx/zynqmp.dtsi
186 +@@ -410,7 +410,7 @@
187 + };
188 +
189 + i2c0: i2c@ff020000 {
190 +- compatible = "cdns,i2c-r1p14", "cdns,i2c-r1p10";
191 ++ compatible = "cdns,i2c-r1p14";
192 + status = "disabled";
193 + interrupt-parent = <&gic>;
194 + interrupts = <0 17 4>;
195 +@@ -420,7 +420,7 @@
196 + };
197 +
198 + i2c1: i2c@ff030000 {
199 +- compatible = "cdns,i2c-r1p14", "cdns,i2c-r1p10";
200 ++ compatible = "cdns,i2c-r1p14";
201 + status = "disabled";
202 + interrupt-parent = <&gic>;
203 + interrupts = <0 18 4>;
204 +diff --git a/arch/powerpc/include/asm/reg.h b/arch/powerpc/include/asm/reg.h
205 +index 05f3c2b3aa0ec..d6be5781a97ce 100644
206 +--- a/arch/powerpc/include/asm/reg.h
207 ++++ b/arch/powerpc/include/asm/reg.h
208 +@@ -753,7 +753,7 @@
209 + #define THRM1_TIN (1 << 31)
210 + #define THRM1_TIV (1 << 30)
211 + #define THRM1_THRES(x) ((x&0x7f)<<23)
212 +-#define THRM3_SITV(x) ((x&0x3fff)<<1)
213 ++#define THRM3_SITV(x) ((x & 0x1fff) << 1)
214 + #define THRM1_TID (1<<2)
215 + #define THRM1_TIE (1<<1)
216 + #define THRM1_V (1<<0)
217 +diff --git a/arch/powerpc/kernel/tau_6xx.c b/arch/powerpc/kernel/tau_6xx.c
218 +index a3374e8a258c6..2615cd66dad84 100644
219 +--- a/arch/powerpc/kernel/tau_6xx.c
220 ++++ b/arch/powerpc/kernel/tau_6xx.c
221 +@@ -38,8 +38,6 @@ static struct tau_temp
222 +
223 + struct timer_list tau_timer;
224 +
225 +-#undef DEBUG
226 +-
227 + /* TODO: put these in a /proc interface, with some sanity checks, and maybe
228 + * dynamic adjustment to minimize # of interrupts */
229 + /* configurable values for step size and how much to expand the window when
230 +@@ -72,47 +70,33 @@ void set_thresholds(unsigned long cpu)
231 +
232 + void TAUupdate(int cpu)
233 + {
234 +- unsigned thrm;
235 +-
236 +-#ifdef DEBUG
237 +- printk("TAUupdate ");
238 +-#endif
239 ++ u32 thrm;
240 ++ u32 bits = THRM1_TIV | THRM1_TIN | THRM1_V;
241 +
242 + /* if both thresholds are crossed, the step_sizes cancel out
243 + * and the window winds up getting expanded twice. */
244 +- if((thrm = mfspr(SPRN_THRM1)) & THRM1_TIV){ /* is valid? */
245 +- if(thrm & THRM1_TIN){ /* crossed low threshold */
246 +- if (tau[cpu].low >= step_size){
247 +- tau[cpu].low -= step_size;
248 +- tau[cpu].high -= (step_size - window_expand);
249 +- }
250 +- tau[cpu].grew = 1;
251 +-#ifdef DEBUG
252 +- printk("low threshold crossed ");
253 +-#endif
254 ++ thrm = mfspr(SPRN_THRM1);
255 ++ if ((thrm & bits) == bits) {
256 ++ mtspr(SPRN_THRM1, 0);
257 ++
258 ++ if (tau[cpu].low >= step_size) {
259 ++ tau[cpu].low -= step_size;
260 ++ tau[cpu].high -= (step_size - window_expand);
261 + }
262 ++ tau[cpu].grew = 1;
263 ++ pr_debug("%s: low threshold crossed\n", __func__);
264 + }
265 +- if((thrm = mfspr(SPRN_THRM2)) & THRM1_TIV){ /* is valid? */
266 +- if(thrm & THRM1_TIN){ /* crossed high threshold */
267 +- if (tau[cpu].high <= 127-step_size){
268 +- tau[cpu].low += (step_size - window_expand);
269 +- tau[cpu].high += step_size;
270 +- }
271 +- tau[cpu].grew = 1;
272 +-#ifdef DEBUG
273 +- printk("high threshold crossed ");
274 +-#endif
275 ++ thrm = mfspr(SPRN_THRM2);
276 ++ if ((thrm & bits) == bits) {
277 ++ mtspr(SPRN_THRM2, 0);
278 ++
279 ++ if (tau[cpu].high <= 127 - step_size) {
280 ++ tau[cpu].low += (step_size - window_expand);
281 ++ tau[cpu].high += step_size;
282 + }
283 ++ tau[cpu].grew = 1;
284 ++ pr_debug("%s: high threshold crossed\n", __func__);
285 + }
286 +-
287 +-#ifdef DEBUG
288 +- printk("grew = %d\n", tau[cpu].grew);
289 +-#endif
290 +-
291 +-#ifndef CONFIG_TAU_INT /* tau_timeout will do this if not using interrupts */
292 +- set_thresholds(cpu);
293 +-#endif
294 +-
295 + }
296 +
297 + #ifdef CONFIG_TAU_INT
298 +@@ -137,18 +121,18 @@ void TAUException(struct pt_regs * regs)
299 + static void tau_timeout(void * info)
300 + {
301 + int cpu;
302 +- unsigned long flags;
303 + int size;
304 + int shrink;
305 +
306 +- /* disabling interrupts *should* be okay */
307 +- local_irq_save(flags);
308 + cpu = smp_processor_id();
309 +
310 + #ifndef CONFIG_TAU_INT
311 + TAUupdate(cpu);
312 + #endif
313 +
314 ++ /* Stop thermal sensor comparisons and interrupts */
315 ++ mtspr(SPRN_THRM3, 0);
316 ++
317 + size = tau[cpu].high - tau[cpu].low;
318 + if (size > min_window && ! tau[cpu].grew) {
319 + /* do an exponential shrink of half the amount currently over size */
320 +@@ -170,22 +154,12 @@ static void tau_timeout(void * info)
321 +
322 + set_thresholds(cpu);
323 +
324 +- /*
325 +- * Do the enable every time, since otherwise a bunch of (relatively)
326 +- * complex sleep code needs to be added. One mtspr every time
327 +- * tau_timeout is called is probably not a big deal.
328 +- *
329 +- * Enable thermal sensor and set up sample interval timer
330 +- * need 20 us to do the compare.. until a nice 'cpu_speed' function
331 +- * call is implemented, just assume a 500 mhz clock. It doesn't really
332 +- * matter if we take too long for a compare since it's all interrupt
333 +- * driven anyway.
334 +- *
335 +- * use a extra long time.. (60 us @ 500 mhz)
336 ++ /* Restart thermal sensor comparisons and interrupts.
337 ++ * The "PowerPC 740 and PowerPC 750 Microprocessor Datasheet"
338 ++ * recommends that "the maximum value be set in THRM3 under all
339 ++ * conditions."
340 + */
341 +- mtspr(SPRN_THRM3, THRM3_SITV(500*60) | THRM3_E);
342 +-
343 +- local_irq_restore(flags);
344 ++ mtspr(SPRN_THRM3, THRM3_SITV(0x1fff) | THRM3_E);
345 + }
346 +
347 + static void tau_timeout_smp(unsigned long unused)
348 +diff --git a/arch/powerpc/perf/hv-gpci-requests.h b/arch/powerpc/perf/hv-gpci-requests.h
349 +index e608f9db12ddc..8965b4463d433 100644
350 +--- a/arch/powerpc/perf/hv-gpci-requests.h
351 ++++ b/arch/powerpc/perf/hv-gpci-requests.h
352 +@@ -95,7 +95,7 @@ REQUEST(__field(0, 8, partition_id)
353 +
354 + #define REQUEST_NAME system_performance_capabilities
355 + #define REQUEST_NUM 0x40
356 +-#define REQUEST_IDX_KIND "starting_index=0xffffffffffffffff"
357 ++#define REQUEST_IDX_KIND "starting_index=0xffffffff"
358 + #include I(REQUEST_BEGIN)
359 + REQUEST(__field(0, 1, perf_collect_privileged)
360 + __field(0x1, 1, capability_mask)
361 +@@ -223,7 +223,7 @@ REQUEST(__field(0, 2, partition_id)
362 +
363 + #define REQUEST_NAME system_hypervisor_times
364 + #define REQUEST_NUM 0xF0
365 +-#define REQUEST_IDX_KIND "starting_index=0xffffffffffffffff"
366 ++#define REQUEST_IDX_KIND "starting_index=0xffffffff"
367 + #include I(REQUEST_BEGIN)
368 + REQUEST(__count(0, 8, time_spent_to_dispatch_virtual_processors)
369 + __count(0x8, 8, time_spent_processing_virtual_processor_timers)
370 +@@ -234,7 +234,7 @@ REQUEST(__count(0, 8, time_spent_to_dispatch_virtual_processors)
371 +
372 + #define REQUEST_NAME system_tlbie_count_and_time
373 + #define REQUEST_NUM 0xF4
374 +-#define REQUEST_IDX_KIND "starting_index=0xffffffffffffffff"
375 ++#define REQUEST_IDX_KIND "starting_index=0xffffffff"
376 + #include I(REQUEST_BEGIN)
377 + REQUEST(__count(0, 8, tlbie_instructions_issued)
378 + /*
379 +diff --git a/arch/powerpc/perf/isa207-common.c b/arch/powerpc/perf/isa207-common.c
380 +index 7ecea7143e587..dd9f88fed63ce 100644
381 +--- a/arch/powerpc/perf/isa207-common.c
382 ++++ b/arch/powerpc/perf/isa207-common.c
383 +@@ -275,6 +275,15 @@ int isa207_get_constraint(u64 event, unsigned long *maskp, unsigned long *valp)
384 +
385 + mask |= CNST_PMC_MASK(pmc);
386 + value |= CNST_PMC_VAL(pmc);
387 ++
388 ++ /*
389 ++ * PMC5 and PMC6 are used to count cycles and instructions and
390 ++ * they do not support most of the constraint bits. Add a check
391 ++ * to exclude PMC5/6 from most of the constraints except for
392 ++ * EBB/BHRB.
393 ++ */
394 ++ if (pmc >= 5)
395 ++ goto ebb_bhrb;
396 + }
397 +
398 + if (pmc <= 4) {
399 +@@ -333,6 +342,7 @@ int isa207_get_constraint(u64 event, unsigned long *maskp, unsigned long *valp)
400 + }
401 + }
402 +
403 ++ebb_bhrb:
404 + if (!pmc && ebb)
405 + /* EBB events must specify the PMC */
406 + return -1;
407 +diff --git a/arch/powerpc/platforms/Kconfig b/arch/powerpc/platforms/Kconfig
408 +index d5e34ce5fd5d9..e06ccba351330 100644
409 +--- a/arch/powerpc/platforms/Kconfig
410 ++++ b/arch/powerpc/platforms/Kconfig
411 +@@ -243,7 +243,7 @@ config TAU
412 + temp is actually what /proc/cpuinfo says it is.
413 +
414 + config TAU_INT
415 +- bool "Interrupt driven TAU driver (DANGEROUS)"
416 ++ bool "Interrupt driven TAU driver (EXPERIMENTAL)"
417 + depends on TAU
418 + ---help---
419 + The TAU supports an interrupt driven mode which causes an interrupt
420 +@@ -251,12 +251,7 @@ config TAU_INT
421 + to get notified the temp has exceeded a range. With this option off,
422 + a timer is used to re-check the temperature periodically.
423 +
424 +- However, on some cpus it appears that the TAU interrupt hardware
425 +- is buggy and can cause a situation which would lead unexplained hard
426 +- lockups.
427 +-
428 +- Unless you are extending the TAU driver, or enjoy kernel/hardware
429 +- debugging, leave this option off.
430 ++ If in doubt, say N here.
431 +
432 + config TAU_AVERAGE
433 + bool "Average high and low temp"
434 +diff --git a/arch/powerpc/platforms/powernv/opal-dump.c b/arch/powerpc/platforms/powernv/opal-dump.c
435 +index 4c827826c05eb..1a8b6e276a112 100644
436 +--- a/arch/powerpc/platforms/powernv/opal-dump.c
437 ++++ b/arch/powerpc/platforms/powernv/opal-dump.c
438 +@@ -319,15 +319,14 @@ static ssize_t dump_attr_read(struct file *filep, struct kobject *kobj,
439 + return count;
440 + }
441 +
442 +-static struct dump_obj *create_dump_obj(uint32_t id, size_t size,
443 +- uint32_t type)
444 ++static void create_dump_obj(uint32_t id, size_t size, uint32_t type)
445 + {
446 + struct dump_obj *dump;
447 + int rc;
448 +
449 + dump = kzalloc(sizeof(*dump), GFP_KERNEL);
450 + if (!dump)
451 +- return NULL;
452 ++ return;
453 +
454 + dump->kobj.kset = dump_kset;
455 +
456 +@@ -347,34 +346,51 @@ static struct dump_obj *create_dump_obj(uint32_t id, size_t size,
457 + rc = kobject_add(&dump->kobj, NULL, "0x%x-0x%x", type, id);
458 + if (rc) {
459 + kobject_put(&dump->kobj);
460 +- return NULL;
461 ++ return;
462 + }
463 +
464 ++ /*
465 ++ * As soon as the sysfs file for this dump is created/activated there is
466 ++ * a chance the opal_errd daemon (or any userspace) might read and
467 ++ * acknowledge the dump before kobject_uevent() is called. If that
468 ++ * happens then there is a potential race between
469 ++ * dump_ack_store->kobject_put() and kobject_uevent() which leads to a
470 ++ * use-after-free of a kernfs object resulting in a kernel crash.
471 ++ *
472 ++ * To avoid that, we need to take a reference on behalf of the bin file,
473 ++ * so that our reference remains valid while we call kobject_uevent().
474 ++ * We then drop our reference before exiting the function, leaving the
475 ++ * bin file to drop the last reference (if it hasn't already).
476 ++ */
477 ++
478 ++ /* Take a reference for the bin file */
479 ++ kobject_get(&dump->kobj);
480 + rc = sysfs_create_bin_file(&dump->kobj, &dump->dump_attr);
481 +- if (rc) {
482 ++ if (rc == 0) {
483 ++ kobject_uevent(&dump->kobj, KOBJ_ADD);
484 ++
485 ++ pr_info("%s: New platform dump. ID = 0x%x Size %u\n",
486 ++ __func__, dump->id, dump->size);
487 ++ } else {
488 ++ /* Drop reference count taken for bin file */
489 + kobject_put(&dump->kobj);
490 +- return NULL;
491 + }
492 +
493 +- pr_info("%s: New platform dump. ID = 0x%x Size %u\n",
494 +- __func__, dump->id, dump->size);
495 +-
496 +- kobject_uevent(&dump->kobj, KOBJ_ADD);
497 +-
498 +- return dump;
499 ++ /* Drop our reference */
500 ++ kobject_put(&dump->kobj);
501 ++ return;
502 + }
503 +
504 + static irqreturn_t process_dump(int irq, void *data)
505 + {
506 + int rc;
507 + uint32_t dump_id, dump_size, dump_type;
508 +- struct dump_obj *dump;
509 + char name[22];
510 + struct kobject *kobj;
511 +
512 + rc = dump_read_info(&dump_id, &dump_size, &dump_type);
513 + if (rc != OPAL_SUCCESS)
514 +- return rc;
515 ++ return IRQ_HANDLED;
516 +
517 + sprintf(name, "0x%x-0x%x", dump_type, dump_id);
518 +
519 +@@ -386,12 +402,10 @@ static irqreturn_t process_dump(int irq, void *data)
520 + if (kobj) {
521 + /* Drop reference added by kset_find_obj() */
522 + kobject_put(kobj);
523 +- return 0;
524 ++ return IRQ_HANDLED;
525 + }
526 +
527 +- dump = create_dump_obj(dump_id, dump_size, dump_type);
528 +- if (!dump)
529 +- return -1;
530 ++ create_dump_obj(dump_id, dump_size, dump_type);
531 +
532 + return IRQ_HANDLED;
533 + }
534 +diff --git a/arch/powerpc/platforms/pseries/rng.c b/arch/powerpc/platforms/pseries/rng.c
535 +index 31ca557af60bc..262b8c5e1b9d0 100644
536 +--- a/arch/powerpc/platforms/pseries/rng.c
537 ++++ b/arch/powerpc/platforms/pseries/rng.c
538 +@@ -40,6 +40,7 @@ static __init int rng_init(void)
539 +
540 + ppc_md.get_random_seed = pseries_get_random_long;
541 +
542 ++ of_node_put(dn);
543 + return 0;
544 + }
545 + machine_subsys_initcall(pseries, rng_init);
546 +diff --git a/arch/powerpc/sysdev/xics/icp-hv.c b/arch/powerpc/sysdev/xics/icp-hv.c
547 +index bbc839a98c414..003deaabb5680 100644
548 +--- a/arch/powerpc/sysdev/xics/icp-hv.c
549 ++++ b/arch/powerpc/sysdev/xics/icp-hv.c
550 +@@ -179,6 +179,7 @@ int icp_hv_init(void)
551 +
552 + icp_ops = &icp_hv_ops;
553 +
554 ++ of_node_put(np);
555 + return 0;
556 + }
557 +
558 +diff --git a/arch/x86/kernel/fpu/init.c b/arch/x86/kernel/fpu/init.c
559 +index 6abd83572b016..9692ccc583bb3 100644
560 +--- a/arch/x86/kernel/fpu/init.c
561 ++++ b/arch/x86/kernel/fpu/init.c
562 +@@ -249,9 +249,9 @@ static void __init fpu__init_system_ctx_switch(void)
563 + */
564 + static void __init fpu__init_parse_early_param(void)
565 + {
566 +- char arg[32];
567 ++ char arg[128];
568 + char *argptr = arg;
569 +- int bit;
570 ++ int arglen, res, bit;
571 +
572 + if (cmdline_find_option_bool(boot_command_line, "no387"))
573 + setup_clear_cpu_cap(X86_FEATURE_FPU);
574 +@@ -271,12 +271,26 @@ static void __init fpu__init_parse_early_param(void)
575 + if (cmdline_find_option_bool(boot_command_line, "noxsaves"))
576 + setup_clear_cpu_cap(X86_FEATURE_XSAVES);
577 +
578 +- if (cmdline_find_option(boot_command_line, "clearcpuid", arg,
579 +- sizeof(arg)) &&
580 +- get_option(&argptr, &bit) &&
581 +- bit >= 0 &&
582 +- bit < NCAPINTS * 32)
583 +- setup_clear_cpu_cap(bit);
584 ++ arglen = cmdline_find_option(boot_command_line, "clearcpuid", arg, sizeof(arg));
585 ++ if (arglen <= 0)
586 ++ return;
587 ++
588 ++ pr_info("Clearing CPUID bits:");
589 ++ do {
590 ++ res = get_option(&argptr, &bit);
591 ++ if (res == 0 || res == 3)
592 ++ break;
593 ++
594 ++ /* If the argument was too long, the last bit may be cut off */
595 ++ if (res == 1 && arglen >= sizeof(arg))
596 ++ break;
597 ++
598 ++ if (bit >= 0 && bit < NCAPINTS * 32) {
599 ++ pr_cont(" " X86_CAP_FMT, x86_cap_flag(bit));
600 ++ setup_clear_cpu_cap(bit);
601 ++ }
602 ++ } while (res == 2);
603 ++ pr_cont("\n");
604 + }
605 +
606 + /*
607 +diff --git a/arch/x86/kvm/emulate.c b/arch/x86/kvm/emulate.c
608 +index 4cc8a4a6f1d00..46559812da24e 100644
609 +--- a/arch/x86/kvm/emulate.c
610 ++++ b/arch/x86/kvm/emulate.c
611 +@@ -3544,7 +3544,7 @@ static int em_rdpid(struct x86_emulate_ctxt *ctxt)
612 + u64 tsc_aux = 0;
613 +
614 + if (ctxt->ops->get_msr(ctxt, MSR_TSC_AUX, &tsc_aux))
615 +- return emulate_gp(ctxt, 0);
616 ++ return emulate_ud(ctxt);
617 + ctxt->dst.val = tsc_aux;
618 + return X86EMUL_CONTINUE;
619 + }
620 +diff --git a/arch/x86/kvm/mmu.c b/arch/x86/kvm/mmu.c
621 +index 1cceee0ed580d..e4b48ca24ff7a 100644
622 +--- a/arch/x86/kvm/mmu.c
623 ++++ b/arch/x86/kvm/mmu.c
624 +@@ -5846,6 +5846,7 @@ static void kvm_recover_nx_lpages(struct kvm *kvm)
625 + cond_resched_lock(&kvm->mmu_lock);
626 + }
627 + }
628 ++ kvm_mmu_commit_zap_page(kvm, &invalid_list);
629 +
630 + spin_unlock(&kvm->mmu_lock);
631 + srcu_read_unlock(&kvm->srcu, rcu_idx);
632 +diff --git a/arch/x86/kvm/svm.c b/arch/x86/kvm/svm.c
633 +index 78826d123fb86..cfd6e58e824b3 100644
634 +--- a/arch/x86/kvm/svm.c
635 ++++ b/arch/x86/kvm/svm.c
636 +@@ -4862,6 +4862,7 @@ static int svm_update_pi_irte(struct kvm *kvm, unsigned int host_irq,
637 + * - Tell IOMMU to use legacy mode for this interrupt.
638 + * - Retrieve ga_tag of prior interrupt remapping data.
639 + */
640 ++ pi.prev_ga_tag = 0;
641 + pi.is_guest_mode = false;
642 + ret = irq_set_vcpu_affinity(host_irq, &pi);
643 +
644 +diff --git a/crypto/algif_aead.c b/crypto/algif_aead.c
645 +index 379e83c8aa522..d2638a2289cda 100644
646 +--- a/crypto/algif_aead.c
647 ++++ b/crypto/algif_aead.c
648 +@@ -83,7 +83,7 @@ static int crypto_aead_copy_sgl(struct crypto_skcipher *null_tfm,
649 + SKCIPHER_REQUEST_ON_STACK(skreq, null_tfm);
650 +
651 + skcipher_request_set_tfm(skreq, null_tfm);
652 +- skcipher_request_set_callback(skreq, CRYPTO_TFM_REQ_MAY_BACKLOG,
653 ++ skcipher_request_set_callback(skreq, CRYPTO_TFM_REQ_MAY_SLEEP,
654 + NULL, NULL);
655 + skcipher_request_set_crypt(skreq, src, dst, len, NULL);
656 +
657 +@@ -296,19 +296,20 @@ static int _aead_recvmsg(struct socket *sock, struct msghdr *msg,
658 + areq->outlen = outlen;
659 +
660 + aead_request_set_callback(&areq->cra_u.aead_req,
661 +- CRYPTO_TFM_REQ_MAY_BACKLOG,
662 ++ CRYPTO_TFM_REQ_MAY_SLEEP,
663 + af_alg_async_cb, areq);
664 + err = ctx->enc ? crypto_aead_encrypt(&areq->cra_u.aead_req) :
665 + crypto_aead_decrypt(&areq->cra_u.aead_req);
666 +
667 + /* AIO operation in progress */
668 +- if (err == -EINPROGRESS || err == -EBUSY)
669 ++ if (err == -EINPROGRESS)
670 + return -EIOCBQUEUED;
671 +
672 + sock_put(sk);
673 + } else {
674 + /* Synchronous operation */
675 + aead_request_set_callback(&areq->cra_u.aead_req,
676 ++ CRYPTO_TFM_REQ_MAY_SLEEP |
677 + CRYPTO_TFM_REQ_MAY_BACKLOG,
678 + af_alg_complete, &ctx->completion);
679 + err = af_alg_wait_for_completion(ctx->enc ?
680 +diff --git a/crypto/algif_skcipher.c b/crypto/algif_skcipher.c
681 +index d9ec5dca86729..a9dc4eeddcd53 100644
682 +--- a/crypto/algif_skcipher.c
683 ++++ b/crypto/algif_skcipher.c
684 +@@ -133,7 +133,7 @@ static int _skcipher_recvmsg(struct socket *sock, struct msghdr *msg,
685 + crypto_skcipher_decrypt(&areq->cra_u.skcipher_req);
686 +
687 + /* AIO operation in progress */
688 +- if (err == -EINPROGRESS || err == -EBUSY)
689 ++ if (err == -EINPROGRESS)
690 + return -EIOCBQUEUED;
691 +
692 + sock_put(sk);
693 +diff --git a/drivers/android/binder.c b/drivers/android/binder.c
694 +index bd74a29cf86c4..0db4b56460363 100644
695 +--- a/drivers/android/binder.c
696 ++++ b/drivers/android/binder.c
697 +@@ -286,7 +286,7 @@ struct binder_device {
698 + struct binder_work {
699 + struct list_head entry;
700 +
701 +- enum {
702 ++ enum binder_work_type {
703 + BINDER_WORK_TRANSACTION = 1,
704 + BINDER_WORK_TRANSACTION_COMPLETE,
705 + BINDER_WORK_RETURN_ERROR,
706 +@@ -850,27 +850,6 @@ static struct binder_work *binder_dequeue_work_head_ilocked(
707 + return w;
708 + }
709 +
710 +-/**
711 +- * binder_dequeue_work_head() - Dequeues the item at head of list
712 +- * @proc: binder_proc associated with list
713 +- * @list: list to dequeue head
714 +- *
715 +- * Removes the head of the list if there are items on the list
716 +- *
717 +- * Return: pointer dequeued binder_work, NULL if list was empty
718 +- */
719 +-static struct binder_work *binder_dequeue_work_head(
720 +- struct binder_proc *proc,
721 +- struct list_head *list)
722 +-{
723 +- struct binder_work *w;
724 +-
725 +- binder_inner_proc_lock(proc);
726 +- w = binder_dequeue_work_head_ilocked(list);
727 +- binder_inner_proc_unlock(proc);
728 +- return w;
729 +-}
730 +-
731 + static void
732 + binder_defer_work(struct binder_proc *proc, enum binder_deferred_state defer);
733 + static void binder_free_thread(struct binder_thread *thread);
734 +@@ -4162,13 +4141,17 @@ static void binder_release_work(struct binder_proc *proc,
735 + struct list_head *list)
736 + {
737 + struct binder_work *w;
738 ++ enum binder_work_type wtype;
739 +
740 + while (1) {
741 +- w = binder_dequeue_work_head(proc, list);
742 ++ binder_inner_proc_lock(proc);
743 ++ w = binder_dequeue_work_head_ilocked(list);
744 ++ wtype = w ? w->type : 0;
745 ++ binder_inner_proc_unlock(proc);
746 + if (!w)
747 + return;
748 +
749 +- switch (w->type) {
750 ++ switch (wtype) {
751 + case BINDER_WORK_TRANSACTION: {
752 + struct binder_transaction *t;
753 +
754 +@@ -4202,9 +4185,11 @@ static void binder_release_work(struct binder_proc *proc,
755 + kfree(death);
756 + binder_stats_deleted(BINDER_STAT_DEATH);
757 + } break;
758 ++ case BINDER_WORK_NODE:
759 ++ break;
760 + default:
761 + pr_err("unexpected work type, %d, not freed\n",
762 +- w->type);
763 ++ wtype);
764 + break;
765 + }
766 + }
767 +diff --git a/drivers/bluetooth/hci_ldisc.c b/drivers/bluetooth/hci_ldisc.c
768 +index 43221def1d29f..f19606019eb01 100644
769 +--- a/drivers/bluetooth/hci_ldisc.c
770 ++++ b/drivers/bluetooth/hci_ldisc.c
771 +@@ -541,6 +541,7 @@ static void hci_uart_tty_close(struct tty_struct *tty)
772 + clear_bit(HCI_UART_PROTO_READY, &hu->flags);
773 + percpu_up_write(&hu->proto_lock);
774 +
775 ++ cancel_work_sync(&hu->init_ready);
776 + cancel_work_sync(&hu->write_work);
777 +
778 + if (hdev) {
779 +diff --git a/drivers/bluetooth/hci_serdev.c b/drivers/bluetooth/hci_serdev.c
780 +index 72cf2d97b682c..196b046658ff4 100644
781 +--- a/drivers/bluetooth/hci_serdev.c
782 ++++ b/drivers/bluetooth/hci_serdev.c
783 +@@ -361,6 +361,8 @@ void hci_uart_unregister_device(struct hci_uart *hu)
784 + struct hci_dev *hdev = hu->hdev;
785 +
786 + clear_bit(HCI_UART_PROTO_READY, &hu->flags);
787 ++
788 ++ cancel_work_sync(&hu->init_ready);
789 + if (test_bit(HCI_UART_REGISTERED, &hu->flags))
790 + hci_unregister_dev(hdev);
791 + hci_free_dev(hdev);
792 +diff --git a/drivers/clk/at91/clk-main.c b/drivers/clk/at91/clk-main.c
793 +index 90988e7a5b47f..2e7da9b379d48 100644
794 +--- a/drivers/clk/at91/clk-main.c
795 ++++ b/drivers/clk/at91/clk-main.c
796 +@@ -517,12 +517,17 @@ static int clk_sam9x5_main_set_parent(struct clk_hw *hw, u8 index)
797 + return -EINVAL;
798 +
799 + regmap_read(regmap, AT91_CKGR_MOR, &tmp);
800 +- tmp &= ~MOR_KEY_MASK;
801 +
802 + if (index && !(tmp & AT91_PMC_MOSCSEL))
803 +- regmap_write(regmap, AT91_CKGR_MOR, tmp | AT91_PMC_MOSCSEL);
804 ++ tmp = AT91_PMC_MOSCSEL;
805 + else if (!index && (tmp & AT91_PMC_MOSCSEL))
806 +- regmap_write(regmap, AT91_CKGR_MOR, tmp & ~AT91_PMC_MOSCSEL);
807 ++ tmp = 0;
808 ++ else
809 ++ return 0;
810 ++
811 ++ regmap_update_bits(regmap, AT91_CKGR_MOR,
812 ++ AT91_PMC_MOSCSEL | MOR_KEY_MASK,
813 ++ tmp | AT91_PMC_KEY);
814 +
815 + while (!clk_sam9x5_main_ready(regmap))
816 + cpu_relax();
817 +diff --git a/drivers/clk/bcm/clk-bcm2835.c b/drivers/clk/bcm/clk-bcm2835.c
818 +index 6db4204e5d5d5..98295b9703178 100644
819 +--- a/drivers/clk/bcm/clk-bcm2835.c
820 ++++ b/drivers/clk/bcm/clk-bcm2835.c
821 +@@ -1354,8 +1354,10 @@ static struct clk_hw *bcm2835_register_pll(struct bcm2835_cprman *cprman,
822 + pll->hw.init = &init;
823 +
824 + ret = devm_clk_hw_register(cprman->dev, &pll->hw);
825 +- if (ret)
826 ++ if (ret) {
827 ++ kfree(pll);
828 + return NULL;
829 ++ }
830 + return &pll->hw;
831 + }
832 +
833 +diff --git a/drivers/cpufreq/powernv-cpufreq.c b/drivers/cpufreq/powernv-cpufreq.c
834 +index dc81fc2bf8015..56c3d86e5b9de 100644
835 +--- a/drivers/cpufreq/powernv-cpufreq.c
836 ++++ b/drivers/cpufreq/powernv-cpufreq.c
837 +@@ -846,12 +846,15 @@ static int powernv_cpufreq_reboot_notifier(struct notifier_block *nb,
838 + unsigned long action, void *unused)
839 + {
840 + int cpu;
841 +- struct cpufreq_policy cpu_policy;
842 ++ struct cpufreq_policy *cpu_policy;
843 +
844 + rebooting = true;
845 + for_each_online_cpu(cpu) {
846 +- cpufreq_get_policy(&cpu_policy, cpu);
847 +- powernv_cpufreq_target_index(&cpu_policy, get_nominal_index());
848 ++ cpu_policy = cpufreq_cpu_get(cpu);
849 ++ if (!cpu_policy)
850 ++ continue;
851 ++ powernv_cpufreq_target_index(cpu_policy, get_nominal_index());
852 ++ cpufreq_cpu_put(cpu_policy);
853 + }
854 +
855 + return NOTIFY_DONE;
856 +diff --git a/drivers/crypto/ccp/ccp-ops.c b/drivers/crypto/ccp/ccp-ops.c
857 +index 626b643d610eb..20ca9c9e109e0 100644
858 +--- a/drivers/crypto/ccp/ccp-ops.c
859 ++++ b/drivers/crypto/ccp/ccp-ops.c
860 +@@ -1752,7 +1752,7 @@ ccp_run_sha_cmd(struct ccp_cmd_queue *cmd_q, struct ccp_cmd *cmd)
861 + break;
862 + default:
863 + ret = -EINVAL;
864 +- goto e_ctx;
865 ++ goto e_data;
866 + }
867 + } else {
868 + /* Stash the context */
869 +diff --git a/drivers/crypto/ixp4xx_crypto.c b/drivers/crypto/ixp4xx_crypto.c
870 +index dadc4a808df5a..4b6773c345ab7 100644
871 +--- a/drivers/crypto/ixp4xx_crypto.c
872 ++++ b/drivers/crypto/ixp4xx_crypto.c
873 +@@ -531,7 +531,7 @@ static void release_ixp_crypto(struct device *dev)
874 +
875 + if (crypt_virt) {
876 + dma_free_coherent(dev,
877 +- NPE_QLEN_TOTAL * sizeof( struct crypt_ctl),
878 ++ NPE_QLEN * sizeof(struct crypt_ctl),
879 + crypt_virt, crypt_phys);
880 + }
881 + return;
882 +diff --git a/drivers/crypto/mediatek/mtk-platform.c b/drivers/crypto/mediatek/mtk-platform.c
883 +index b182e941b0cd8..b2b1e90a3079d 100644
884 +--- a/drivers/crypto/mediatek/mtk-platform.c
885 ++++ b/drivers/crypto/mediatek/mtk-platform.c
886 +@@ -445,7 +445,7 @@ static void mtk_desc_dma_free(struct mtk_cryp *cryp)
887 + static int mtk_desc_ring_alloc(struct mtk_cryp *cryp)
888 + {
889 + struct mtk_ring **ring = cryp->ring;
890 +- int i, err = ENOMEM;
891 ++ int i;
892 +
893 + for (i = 0; i < MTK_RING_MAX; i++) {
894 + ring[i] = kzalloc(sizeof(**ring), GFP_KERNEL);
895 +@@ -472,14 +472,14 @@ static int mtk_desc_ring_alloc(struct mtk_cryp *cryp)
896 + return 0;
897 +
898 + err_cleanup:
899 +- for (; i--; ) {
900 ++ do {
901 + dma_free_coherent(cryp->dev, MTK_DESC_RING_SZ,
902 + ring[i]->res_base, ring[i]->res_dma);
903 + dma_free_coherent(cryp->dev, MTK_DESC_RING_SZ,
904 + ring[i]->cmd_base, ring[i]->cmd_dma);
905 + kfree(ring[i]);
906 +- }
907 +- return err;
908 ++ } while (i--);
909 ++ return -ENOMEM;
910 + }
911 +
912 + static int mtk_crypto_probe(struct platform_device *pdev)
913 +diff --git a/drivers/crypto/omap-sham.c b/drivers/crypto/omap-sham.c
914 +index 4e38b87c32284..e34e9561e77d6 100644
915 +--- a/drivers/crypto/omap-sham.c
916 ++++ b/drivers/crypto/omap-sham.c
917 +@@ -455,6 +455,9 @@ static void omap_sham_write_ctrl_omap4(struct omap_sham_dev *dd, size_t length,
918 + struct omap_sham_reqctx *ctx = ahash_request_ctx(dd->req);
919 + u32 val, mask;
920 +
921 ++ if (likely(ctx->digcnt))
922 ++ omap_sham_write(dd, SHA_REG_DIGCNT(dd), ctx->digcnt);
923 ++
924 + /*
925 + * Setting ALGO_CONST only for the first iteration and
926 + * CLOSE_HASH only for the last one. Note that flags mode bits
927 +diff --git a/drivers/edac/i5100_edac.c b/drivers/edac/i5100_edac.c
928 +index b506eef6b146d..858ef4e15180b 100644
929 +--- a/drivers/edac/i5100_edac.c
930 ++++ b/drivers/edac/i5100_edac.c
931 +@@ -1072,16 +1072,15 @@ static int i5100_init_one(struct pci_dev *pdev, const struct pci_device_id *id)
932 + PCI_DEVICE_ID_INTEL_5100_19, 0);
933 + if (!einj) {
934 + ret = -ENODEV;
935 +- goto bail_einj;
936 ++ goto bail_mc_free;
937 + }
938 +
939 + rc = pci_enable_device(einj);
940 + if (rc < 0) {
941 + ret = rc;
942 +- goto bail_disable_einj;
943 ++ goto bail_einj;
944 + }
945 +
946 +-
947 + mci->pdev = &pdev->dev;
948 +
949 + priv = mci->pvt_info;
950 +@@ -1147,14 +1146,14 @@ static int i5100_init_one(struct pci_dev *pdev, const struct pci_device_id *id)
951 + bail_scrub:
952 + priv->scrub_enable = 0;
953 + cancel_delayed_work_sync(&(priv->i5100_scrubbing));
954 +- edac_mc_free(mci);
955 +-
956 +-bail_disable_einj:
957 + pci_disable_device(einj);
958 +
959 + bail_einj:
960 + pci_dev_put(einj);
961 +
962 ++bail_mc_free:
963 ++ edac_mc_free(mci);
964 ++
965 + bail_disable_ch1:
966 + pci_disable_device(ch1mm);
967 +
968 +diff --git a/drivers/gpu/drm/gma500/cdv_intel_dp.c b/drivers/gpu/drm/gma500/cdv_intel_dp.c
969 +index c52f9adf5e04c..7ec4e3fbafd8c 100644
970 +--- a/drivers/gpu/drm/gma500/cdv_intel_dp.c
971 ++++ b/drivers/gpu/drm/gma500/cdv_intel_dp.c
972 +@@ -2121,7 +2121,7 @@ cdv_intel_dp_init(struct drm_device *dev, struct psb_intel_mode_device *mode_dev
973 + intel_dp->dpcd,
974 + sizeof(intel_dp->dpcd));
975 + cdv_intel_edp_panel_vdd_off(gma_encoder);
976 +- if (ret == 0) {
977 ++ if (ret <= 0) {
978 + /* if this fails, presume the device is a ghost */
979 + DRM_INFO("failed to retrieve link info, disabling eDP\n");
980 + cdv_intel_dp_encoder_destroy(encoder);
981 +diff --git a/drivers/gpu/drm/virtio/virtgpu_kms.c b/drivers/gpu/drm/virtio/virtgpu_kms.c
982 +index 6400506a06b07..bed450fbb2168 100644
983 +--- a/drivers/gpu/drm/virtio/virtgpu_kms.c
984 ++++ b/drivers/gpu/drm/virtio/virtgpu_kms.c
985 +@@ -113,8 +113,10 @@ static void virtio_gpu_get_capsets(struct virtio_gpu_device *vgdev,
986 + vgdev->capsets[i].id > 0, 5 * HZ);
987 + if (ret == 0) {
988 + DRM_ERROR("timed out waiting for cap set %d\n", i);
989 ++ spin_lock(&vgdev->display_info_lock);
990 + kfree(vgdev->capsets);
991 + vgdev->capsets = NULL;
992 ++ spin_unlock(&vgdev->display_info_lock);
993 + return;
994 + }
995 + DRM_INFO("cap set %d: id %d, max-version %d, max-size %d\n",
996 +diff --git a/drivers/gpu/drm/virtio/virtgpu_vq.c b/drivers/gpu/drm/virtio/virtgpu_vq.c
997 +index a3be65e689fd2..a956c73ea85e5 100644
998 +--- a/drivers/gpu/drm/virtio/virtgpu_vq.c
999 ++++ b/drivers/gpu/drm/virtio/virtgpu_vq.c
1000 +@@ -563,9 +563,13 @@ static void virtio_gpu_cmd_get_capset_info_cb(struct virtio_gpu_device *vgdev,
1001 + int i = le32_to_cpu(cmd->capset_index);
1002 +
1003 + spin_lock(&vgdev->display_info_lock);
1004 +- vgdev->capsets[i].id = le32_to_cpu(resp->capset_id);
1005 +- vgdev->capsets[i].max_version = le32_to_cpu(resp->capset_max_version);
1006 +- vgdev->capsets[i].max_size = le32_to_cpu(resp->capset_max_size);
1007 ++ if (vgdev->capsets) {
1008 ++ vgdev->capsets[i].id = le32_to_cpu(resp->capset_id);
1009 ++ vgdev->capsets[i].max_version = le32_to_cpu(resp->capset_max_version);
1010 ++ vgdev->capsets[i].max_size = le32_to_cpu(resp->capset_max_size);
1011 ++ } else {
1012 ++ DRM_ERROR("invalid capset memory.");
1013 ++ }
1014 + spin_unlock(&vgdev->display_info_lock);
1015 + wake_up(&vgdev->resp_wq);
1016 + }
1017 +diff --git a/drivers/hid/hid-input.c b/drivers/hid/hid-input.c
1018 +index 3624d6e3384ff..07a043ae69f12 100644
1019 +--- a/drivers/hid/hid-input.c
1020 ++++ b/drivers/hid/hid-input.c
1021 +@@ -796,7 +796,7 @@ static void hidinput_configure_usage(struct hid_input *hidinput, struct hid_fiel
1022 + case 0x3b: /* Battery Strength */
1023 + hidinput_setup_battery(device, HID_INPUT_REPORT, field);
1024 + usage->type = EV_PWR;
1025 +- goto ignore;
1026 ++ return;
1027 +
1028 + case 0x3c: /* Invert */
1029 + map_key_clear(BTN_TOOL_RUBBER);
1030 +@@ -1043,7 +1043,7 @@ static void hidinput_configure_usage(struct hid_input *hidinput, struct hid_fiel
1031 + case HID_DC_BATTERYSTRENGTH:
1032 + hidinput_setup_battery(device, HID_INPUT_REPORT, field);
1033 + usage->type = EV_PWR;
1034 +- goto ignore;
1035 ++ return;
1036 + }
1037 + goto unknown;
1038 +
1039 +diff --git a/drivers/hid/hid-roccat-kone.c b/drivers/hid/hid-roccat-kone.c
1040 +index bf4675a273965..9be8c31f613fd 100644
1041 +--- a/drivers/hid/hid-roccat-kone.c
1042 ++++ b/drivers/hid/hid-roccat-kone.c
1043 +@@ -297,31 +297,40 @@ static ssize_t kone_sysfs_write_settings(struct file *fp, struct kobject *kobj,
1044 + struct kone_device *kone = hid_get_drvdata(dev_get_drvdata(dev));
1045 + struct usb_device *usb_dev = interface_to_usbdev(to_usb_interface(dev));
1046 + int retval = 0, difference, old_profile;
1047 ++ struct kone_settings *settings = (struct kone_settings *)buf;
1048 +
1049 + /* I need to get my data in one piece */
1050 + if (off != 0 || count != sizeof(struct kone_settings))
1051 + return -EINVAL;
1052 +
1053 + mutex_lock(&kone->kone_lock);
1054 +- difference = memcmp(buf, &kone->settings, sizeof(struct kone_settings));
1055 ++ difference = memcmp(settings, &kone->settings,
1056 ++ sizeof(struct kone_settings));
1057 + if (difference) {
1058 +- retval = kone_set_settings(usb_dev,
1059 +- (struct kone_settings const *)buf);
1060 +- if (retval) {
1061 +- mutex_unlock(&kone->kone_lock);
1062 +- return retval;
1063 ++ if (settings->startup_profile < 1 ||
1064 ++ settings->startup_profile > 5) {
1065 ++ retval = -EINVAL;
1066 ++ goto unlock;
1067 + }
1068 +
1069 ++ retval = kone_set_settings(usb_dev, settings);
1070 ++ if (retval)
1071 ++ goto unlock;
1072 ++
1073 + old_profile = kone->settings.startup_profile;
1074 +- memcpy(&kone->settings, buf, sizeof(struct kone_settings));
1075 ++ memcpy(&kone->settings, settings, sizeof(struct kone_settings));
1076 +
1077 + kone_profile_activated(kone, kone->settings.startup_profile);
1078 +
1079 + if (kone->settings.startup_profile != old_profile)
1080 + kone_profile_report(kone, kone->settings.startup_profile);
1081 + }
1082 ++unlock:
1083 + mutex_unlock(&kone->kone_lock);
1084 +
1085 ++ if (retval)
1086 ++ return retval;
1087 ++
1088 + return sizeof(struct kone_settings);
1089 + }
1090 + static BIN_ATTR(settings, 0660, kone_sysfs_read_settings,
1091 +diff --git a/drivers/i2c/busses/Kconfig b/drivers/i2c/busses/Kconfig
1092 +index b72a25585d52b..c457f65136f83 100644
1093 +--- a/drivers/i2c/busses/Kconfig
1094 ++++ b/drivers/i2c/busses/Kconfig
1095 +@@ -1095,6 +1095,7 @@ config I2C_RCAR
1096 + depends on HAS_DMA
1097 + depends on ARCH_RENESAS || COMPILE_TEST
1098 + select I2C_SLAVE
1099 ++ select RESET_CONTROLLER if ARCH_RCAR_GEN3
1100 + help
1101 + If you say yes to this option, support will be included for the
1102 + R-Car I2C controller.
1103 +diff --git a/drivers/i2c/i2c-core-acpi.c b/drivers/i2c/i2c-core-acpi.c
1104 +index 0d4d5dcf94f39..52ae674ebf5bf 100644
1105 +--- a/drivers/i2c/i2c-core-acpi.c
1106 ++++ b/drivers/i2c/i2c-core-acpi.c
1107 +@@ -219,6 +219,7 @@ static acpi_status i2c_acpi_add_device(acpi_handle handle, u32 level,
1108 + void i2c_acpi_register_devices(struct i2c_adapter *adap)
1109 + {
1110 + acpi_status status;
1111 ++ acpi_handle handle;
1112 +
1113 + if (!has_acpi_companion(&adap->dev))
1114 + return;
1115 +@@ -229,6 +230,15 @@ void i2c_acpi_register_devices(struct i2c_adapter *adap)
1116 + adap, NULL);
1117 + if (ACPI_FAILURE(status))
1118 + dev_warn(&adap->dev, "failed to enumerate I2C slaves\n");
1119 ++
1120 ++ if (!adap->dev.parent)
1121 ++ return;
1122 ++
1123 ++ handle = ACPI_HANDLE(adap->dev.parent);
1124 ++ if (!handle)
1125 ++ return;
1126 ++
1127 ++ acpi_walk_dep_device_list(handle);
1128 + }
1129 +
1130 + const struct acpi_device_id *
1131 +@@ -684,7 +694,6 @@ int i2c_acpi_install_space_handler(struct i2c_adapter *adapter)
1132 + return -ENOMEM;
1133 + }
1134 +
1135 +- acpi_walk_dep_device_list(handle);
1136 + return 0;
1137 + }
1138 +
1139 +diff --git a/drivers/infiniband/hw/hns/hns_roce_hw_v1.c b/drivers/infiniband/hw/hns/hns_roce_hw_v1.c
1140 +index 8208c30f03c5a..bdfef9abe8f33 100644
1141 +--- a/drivers/infiniband/hw/hns/hns_roce_hw_v1.c
1142 ++++ b/drivers/infiniband/hw/hns/hns_roce_hw_v1.c
1143 +@@ -243,7 +243,6 @@ int hns_roce_v1_post_send(struct ib_qp *ibqp, struct ib_send_wr *wr,
1144 + ps_opcode = HNS_ROCE_WQE_OPCODE_SEND;
1145 + break;
1146 + case IB_WR_LOCAL_INV:
1147 +- break;
1148 + case IB_WR_ATOMIC_CMP_AND_SWP:
1149 + case IB_WR_ATOMIC_FETCH_AND_ADD:
1150 + case IB_WR_LSO:
1151 +diff --git a/drivers/infiniband/hw/mlx4/cm.c b/drivers/infiniband/hw/mlx4/cm.c
1152 +index 8c79a480f2b76..d3e11503e67ca 100644
1153 +--- a/drivers/infiniband/hw/mlx4/cm.c
1154 ++++ b/drivers/infiniband/hw/mlx4/cm.c
1155 +@@ -307,6 +307,9 @@ static void schedule_delayed(struct ib_device *ibdev, struct id_map_entry *id)
1156 + if (!sriov->is_going_down) {
1157 + id->scheduled_delete = 1;
1158 + schedule_delayed_work(&id->timeout, CM_CLEANUP_CACHE_TIMEOUT);
1159 ++ } else if (id->scheduled_delete) {
1160 ++ /* Adjust timeout if already scheduled */
1161 ++ mod_delayed_work(system_wq, &id->timeout, CM_CLEANUP_CACHE_TIMEOUT);
1162 + }
1163 + spin_unlock_irqrestore(&sriov->going_down_lock, flags);
1164 + spin_unlock(&sriov->id_map_lock);
1165 +diff --git a/drivers/infiniband/hw/mlx4/mad.c b/drivers/infiniband/hw/mlx4/mad.c
1166 +index c69158ccab822..60d4f2c9c24d8 100644
1167 +--- a/drivers/infiniband/hw/mlx4/mad.c
1168 ++++ b/drivers/infiniband/hw/mlx4/mad.c
1169 +@@ -1305,6 +1305,18 @@ static void mlx4_ib_tunnel_comp_handler(struct ib_cq *cq, void *arg)
1170 + spin_unlock_irqrestore(&dev->sriov.going_down_lock, flags);
1171 + }
1172 +
1173 ++static void mlx4_ib_wire_comp_handler(struct ib_cq *cq, void *arg)
1174 ++{
1175 ++ unsigned long flags;
1176 ++ struct mlx4_ib_demux_pv_ctx *ctx = cq->cq_context;
1177 ++ struct mlx4_ib_dev *dev = to_mdev(ctx->ib_dev);
1178 ++
1179 ++ spin_lock_irqsave(&dev->sriov.going_down_lock, flags);
1180 ++ if (!dev->sriov.is_going_down && ctx->state == DEMUX_PV_STATE_ACTIVE)
1181 ++ queue_work(ctx->wi_wq, &ctx->work);
1182 ++ spin_unlock_irqrestore(&dev->sriov.going_down_lock, flags);
1183 ++}
1184 ++
1185 + static int mlx4_ib_post_pv_qp_buf(struct mlx4_ib_demux_pv_ctx *ctx,
1186 + struct mlx4_ib_demux_pv_qp *tun_qp,
1187 + int index)
1188 +@@ -2012,7 +2024,8 @@ static int create_pv_resources(struct ib_device *ibdev, int slave, int port,
1189 + cq_size *= 2;
1190 +
1191 + cq_attr.cqe = cq_size;
1192 +- ctx->cq = ib_create_cq(ctx->ib_dev, mlx4_ib_tunnel_comp_handler,
1193 ++ ctx->cq = ib_create_cq(ctx->ib_dev,
1194 ++ create_tun ? mlx4_ib_tunnel_comp_handler : mlx4_ib_wire_comp_handler,
1195 + NULL, ctx, &cq_attr);
1196 + if (IS_ERR(ctx->cq)) {
1197 + ret = PTR_ERR(ctx->cq);
1198 +@@ -2049,6 +2062,7 @@ static int create_pv_resources(struct ib_device *ibdev, int slave, int port,
1199 + INIT_WORK(&ctx->work, mlx4_ib_sqp_comp_worker);
1200 +
1201 + ctx->wq = to_mdev(ibdev)->sriov.demux[port - 1].wq;
1202 ++ ctx->wi_wq = to_mdev(ibdev)->sriov.demux[port - 1].wi_wq;
1203 +
1204 + ret = ib_req_notify_cq(ctx->cq, IB_CQ_NEXT_COMP);
1205 + if (ret) {
1206 +@@ -2192,7 +2206,7 @@ static int mlx4_ib_alloc_demux_ctx(struct mlx4_ib_dev *dev,
1207 + goto err_mcg;
1208 + }
1209 +
1210 +- snprintf(name, sizeof name, "mlx4_ibt%d", port);
1211 ++ snprintf(name, sizeof(name), "mlx4_ibt%d", port);
1212 + ctx->wq = alloc_ordered_workqueue(name, WQ_MEM_RECLAIM);
1213 + if (!ctx->wq) {
1214 + pr_err("Failed to create tunnelling WQ for port %d\n", port);
1215 +@@ -2200,7 +2214,15 @@ static int mlx4_ib_alloc_demux_ctx(struct mlx4_ib_dev *dev,
1216 + goto err_wq;
1217 + }
1218 +
1219 +- snprintf(name, sizeof name, "mlx4_ibud%d", port);
1220 ++ snprintf(name, sizeof(name), "mlx4_ibwi%d", port);
1221 ++ ctx->wi_wq = alloc_ordered_workqueue(name, WQ_MEM_RECLAIM);
1222 ++ if (!ctx->wi_wq) {
1223 ++ pr_err("Failed to create wire WQ for port %d\n", port);
1224 ++ ret = -ENOMEM;
1225 ++ goto err_wiwq;
1226 ++ }
1227 ++
1228 ++ snprintf(name, sizeof(name), "mlx4_ibud%d", port);
1229 + ctx->ud_wq = alloc_ordered_workqueue(name, WQ_MEM_RECLAIM);
1230 + if (!ctx->ud_wq) {
1231 + pr_err("Failed to create up/down WQ for port %d\n", port);
1232 +@@ -2211,6 +2233,10 @@ static int mlx4_ib_alloc_demux_ctx(struct mlx4_ib_dev *dev,
1233 + return 0;
1234 +
1235 + err_udwq:
1236 ++ destroy_workqueue(ctx->wi_wq);
1237 ++ ctx->wi_wq = NULL;
1238 ++
1239 ++err_wiwq:
1240 + destroy_workqueue(ctx->wq);
1241 + ctx->wq = NULL;
1242 +
1243 +@@ -2258,12 +2284,14 @@ static void mlx4_ib_free_demux_ctx(struct mlx4_ib_demux_ctx *ctx)
1244 + ctx->tun[i]->state = DEMUX_PV_STATE_DOWNING;
1245 + }
1246 + flush_workqueue(ctx->wq);
1247 ++ flush_workqueue(ctx->wi_wq);
1248 + for (i = 0; i < dev->dev->caps.sqp_demux; i++) {
1249 + destroy_pv_resources(dev, i, ctx->port, ctx->tun[i], 0);
1250 + free_pv_object(dev, i, ctx->port);
1251 + }
1252 + kfree(ctx->tun);
1253 + destroy_workqueue(ctx->ud_wq);
1254 ++ destroy_workqueue(ctx->wi_wq);
1255 + destroy_workqueue(ctx->wq);
1256 + }
1257 + }
1258 +diff --git a/drivers/infiniband/hw/mlx4/mlx4_ib.h b/drivers/infiniband/hw/mlx4/mlx4_ib.h
1259 +index 1fa19820355af..ed72c09080c1d 100644
1260 +--- a/drivers/infiniband/hw/mlx4/mlx4_ib.h
1261 ++++ b/drivers/infiniband/hw/mlx4/mlx4_ib.h
1262 +@@ -463,6 +463,7 @@ struct mlx4_ib_demux_pv_ctx {
1263 + struct ib_pd *pd;
1264 + struct work_struct work;
1265 + struct workqueue_struct *wq;
1266 ++ struct workqueue_struct *wi_wq;
1267 + struct mlx4_ib_demux_pv_qp qp[2];
1268 + };
1269 +
1270 +@@ -470,6 +471,7 @@ struct mlx4_ib_demux_ctx {
1271 + struct ib_device *ib_dev;
1272 + int port;
1273 + struct workqueue_struct *wq;
1274 ++ struct workqueue_struct *wi_wq;
1275 + struct workqueue_struct *ud_wq;
1276 + spinlock_t ud_lock;
1277 + atomic64_t subnet_prefix;
1278 +diff --git a/drivers/infiniband/hw/qedr/main.c b/drivers/infiniband/hw/qedr/main.c
1279 +index 3e48ed64760b7..8c9e23d1f434e 100644
1280 +--- a/drivers/infiniband/hw/qedr/main.c
1281 ++++ b/drivers/infiniband/hw/qedr/main.c
1282 +@@ -548,7 +548,7 @@ static int qedr_set_device_attr(struct qedr_dev *dev)
1283 + qed_attr = dev->ops->rdma_query_device(dev->rdma_ctx);
1284 +
1285 + /* Part 2 - check capabilities */
1286 +- page_size = ~dev->attr.page_size_caps + 1;
1287 ++ page_size = ~qed_attr->page_size_caps + 1;
1288 + if (page_size > PAGE_SIZE) {
1289 + DP_ERR(dev,
1290 + "Kernel PAGE_SIZE is %ld which is smaller than minimum page size (%d) required by qedr\n",
1291 +diff --git a/drivers/infiniband/sw/rdmavt/vt.c b/drivers/infiniband/sw/rdmavt/vt.c
1292 +index 64bdd442078a1..03a367db38e6d 100644
1293 +--- a/drivers/infiniband/sw/rdmavt/vt.c
1294 ++++ b/drivers/infiniband/sw/rdmavt/vt.c
1295 +@@ -97,9 +97,7 @@ struct rvt_dev_info *rvt_alloc_device(size_t size, int nports)
1296 + if (!rdi)
1297 + return rdi;
1298 +
1299 +- rdi->ports = kcalloc(nports,
1300 +- sizeof(struct rvt_ibport **),
1301 +- GFP_KERNEL);
1302 ++ rdi->ports = kcalloc(nports, sizeof(*rdi->ports), GFP_KERNEL);
1303 + if (!rdi->ports)
1304 + ib_dealloc_device(&rdi->ibdev);
1305 +
1306 +diff --git a/drivers/input/keyboard/ep93xx_keypad.c b/drivers/input/keyboard/ep93xx_keypad.c
1307 +index f77b295e0123e..01788a78041b3 100644
1308 +--- a/drivers/input/keyboard/ep93xx_keypad.c
1309 ++++ b/drivers/input/keyboard/ep93xx_keypad.c
1310 +@@ -257,8 +257,8 @@ static int ep93xx_keypad_probe(struct platform_device *pdev)
1311 + }
1312 +
1313 + keypad->irq = platform_get_irq(pdev, 0);
1314 +- if (!keypad->irq) {
1315 +- err = -ENXIO;
1316 ++ if (keypad->irq < 0) {
1317 ++ err = keypad->irq;
1318 + goto failed_free;
1319 + }
1320 +
1321 +diff --git a/drivers/input/keyboard/omap4-keypad.c b/drivers/input/keyboard/omap4-keypad.c
1322 +index 616fdd94b0694..5480f1a5658ee 100644
1323 +--- a/drivers/input/keyboard/omap4-keypad.c
1324 ++++ b/drivers/input/keyboard/omap4-keypad.c
1325 +@@ -253,10 +253,8 @@ static int omap4_keypad_probe(struct platform_device *pdev)
1326 + }
1327 +
1328 + irq = platform_get_irq(pdev, 0);
1329 +- if (!irq) {
1330 +- dev_err(&pdev->dev, "no keyboard irq assigned\n");
1331 +- return -EINVAL;
1332 +- }
1333 ++ if (irq < 0)
1334 ++ return irq;
1335 +
1336 + keypad_data = kzalloc(sizeof(struct omap4_keypad), GFP_KERNEL);
1337 + if (!keypad_data) {
1338 +diff --git a/drivers/input/keyboard/twl4030_keypad.c b/drivers/input/keyboard/twl4030_keypad.c
1339 +index f9f98ef1d98e3..8677dbe0fd209 100644
1340 +--- a/drivers/input/keyboard/twl4030_keypad.c
1341 ++++ b/drivers/input/keyboard/twl4030_keypad.c
1342 +@@ -63,7 +63,7 @@ struct twl4030_keypad {
1343 + bool autorepeat;
1344 + unsigned int n_rows;
1345 + unsigned int n_cols;
1346 +- unsigned int irq;
1347 ++ int irq;
1348 +
1349 + struct device *dbg_dev;
1350 + struct input_dev *input;
1351 +@@ -389,10 +389,8 @@ static int twl4030_kp_probe(struct platform_device *pdev)
1352 + }
1353 +
1354 + kp->irq = platform_get_irq(pdev, 0);
1355 +- if (!kp->irq) {
1356 +- dev_err(&pdev->dev, "no keyboard irq assigned\n");
1357 +- return -EINVAL;
1358 +- }
1359 ++ if (kp->irq < 0)
1360 ++ return kp->irq;
1361 +
1362 + error = matrix_keypad_build_keymap(keymap_data, NULL,
1363 + TWL4030_MAX_ROWS,
1364 +diff --git a/drivers/input/serio/sun4i-ps2.c b/drivers/input/serio/sun4i-ps2.c
1365 +index 04b96fe393397..46512b4d686a8 100644
1366 +--- a/drivers/input/serio/sun4i-ps2.c
1367 ++++ b/drivers/input/serio/sun4i-ps2.c
1368 +@@ -210,7 +210,6 @@ static int sun4i_ps2_probe(struct platform_device *pdev)
1369 + struct sun4i_ps2data *drvdata;
1370 + struct serio *serio;
1371 + struct device *dev = &pdev->dev;
1372 +- unsigned int irq;
1373 + int error;
1374 +
1375 + drvdata = kzalloc(sizeof(struct sun4i_ps2data), GFP_KERNEL);
1376 +@@ -263,14 +262,12 @@ static int sun4i_ps2_probe(struct platform_device *pdev)
1377 + writel(0, drvdata->reg_base + PS2_REG_GCTL);
1378 +
1379 + /* Get IRQ for the device */
1380 +- irq = platform_get_irq(pdev, 0);
1381 +- if (!irq) {
1382 +- dev_err(dev, "no IRQ found\n");
1383 +- error = -ENXIO;
1384 ++ drvdata->irq = platform_get_irq(pdev, 0);
1385 ++ if (drvdata->irq < 0) {
1386 ++ error = drvdata->irq;
1387 + goto err_disable_clk;
1388 + }
1389 +
1390 +- drvdata->irq = irq;
1391 + drvdata->serio = serio;
1392 + drvdata->dev = dev;
1393 +
1394 +diff --git a/drivers/input/touchscreen/imx6ul_tsc.c b/drivers/input/touchscreen/imx6ul_tsc.c
1395 +index ee82a975bfd29..5759c1592a456 100644
1396 +--- a/drivers/input/touchscreen/imx6ul_tsc.c
1397 ++++ b/drivers/input/touchscreen/imx6ul_tsc.c
1398 +@@ -542,20 +542,25 @@ static int __maybe_unused imx6ul_tsc_resume(struct device *dev)
1399 +
1400 + mutex_lock(&input_dev->mutex);
1401 +
1402 +- if (input_dev->users) {
1403 +- retval = clk_prepare_enable(tsc->adc_clk);
1404 +- if (retval)
1405 +- goto out;
1406 +-
1407 +- retval = clk_prepare_enable(tsc->tsc_clk);
1408 +- if (retval) {
1409 +- clk_disable_unprepare(tsc->adc_clk);
1410 +- goto out;
1411 +- }
1412 ++ if (!input_dev->users)
1413 ++ goto out;
1414 +
1415 +- retval = imx6ul_tsc_init(tsc);
1416 ++ retval = clk_prepare_enable(tsc->adc_clk);
1417 ++ if (retval)
1418 ++ goto out;
1419 ++
1420 ++ retval = clk_prepare_enable(tsc->tsc_clk);
1421 ++ if (retval) {
1422 ++ clk_disable_unprepare(tsc->adc_clk);
1423 ++ goto out;
1424 + }
1425 +
1426 ++ retval = imx6ul_tsc_init(tsc);
1427 ++ if (retval) {
1428 ++ clk_disable_unprepare(tsc->tsc_clk);
1429 ++ clk_disable_unprepare(tsc->adc_clk);
1430 ++ goto out;
1431 ++ }
1432 + out:
1433 + mutex_unlock(&input_dev->mutex);
1434 + return retval;
1435 +diff --git a/drivers/input/touchscreen/stmfts.c b/drivers/input/touchscreen/stmfts.c
1436 +index c72662c979e79..d9e93dabbca21 100644
1437 +--- a/drivers/input/touchscreen/stmfts.c
1438 ++++ b/drivers/input/touchscreen/stmfts.c
1439 +@@ -484,7 +484,7 @@ static ssize_t stmfts_sysfs_hover_enable_write(struct device *dev,
1440 +
1441 + mutex_lock(&sdata->mutex);
1442 +
1443 +- if (value & sdata->hover_enabled)
1444 ++ if (value && sdata->hover_enabled)
1445 + goto out;
1446 +
1447 + if (sdata->running)
1448 +diff --git a/drivers/mailbox/mailbox.c b/drivers/mailbox/mailbox.c
1449 +index 055c90b8253cb..10a559cfb7ea3 100644
1450 +--- a/drivers/mailbox/mailbox.c
1451 ++++ b/drivers/mailbox/mailbox.c
1452 +@@ -85,9 +85,12 @@ static void msg_submit(struct mbox_chan *chan)
1453 + exit:
1454 + spin_unlock_irqrestore(&chan->lock, flags);
1455 +
1456 +- if (!err && (chan->txdone_method & TXDONE_BY_POLL))
1457 +- /* kick start the timer immediately to avoid delays */
1458 +- hrtimer_start(&chan->mbox->poll_hrt, 0, HRTIMER_MODE_REL);
1459 ++ /* kick start the timer immediately to avoid delays */
1460 ++ if (!err && (chan->txdone_method & TXDONE_BY_POLL)) {
1461 ++ /* but only if not already active */
1462 ++ if (!hrtimer_active(&chan->mbox->poll_hrt))
1463 ++ hrtimer_start(&chan->mbox->poll_hrt, 0, HRTIMER_MODE_REL);
1464 ++ }
1465 + }
1466 +
1467 + static void tx_tick(struct mbox_chan *chan, int r)
1468 +@@ -125,11 +128,10 @@ static enum hrtimer_restart txdone_hrtimer(struct hrtimer *hrtimer)
1469 + struct mbox_chan *chan = &mbox->chans[i];
1470 +
1471 + if (chan->active_req && chan->cl) {
1472 ++ resched = true;
1473 + txdone = chan->mbox->ops->last_tx_done(chan);
1474 + if (txdone)
1475 + tx_tick(chan, 0);
1476 +- else
1477 +- resched = true;
1478 + }
1479 + }
1480 +
1481 +diff --git a/drivers/media/firewire/firedtv-fw.c b/drivers/media/firewire/firedtv-fw.c
1482 +index 5d634706a7eaa..382f290c3f4d5 100644
1483 +--- a/drivers/media/firewire/firedtv-fw.c
1484 ++++ b/drivers/media/firewire/firedtv-fw.c
1485 +@@ -271,8 +271,10 @@ static int node_probe(struct fw_unit *unit, const struct ieee1394_device_id *id)
1486 +
1487 + name_len = fw_csr_string(unit->directory, CSR_MODEL,
1488 + name, sizeof(name));
1489 +- if (name_len < 0)
1490 +- return name_len;
1491 ++ if (name_len < 0) {
1492 ++ err = name_len;
1493 ++ goto fail_free;
1494 ++ }
1495 + for (i = ARRAY_SIZE(model_names); --i; )
1496 + if (strlen(model_names[i]) <= name_len &&
1497 + strncmp(name, model_names[i], name_len) == 0)
1498 +diff --git a/drivers/media/i2c/m5mols/m5mols_core.c b/drivers/media/i2c/m5mols/m5mols_core.c
1499 +index 463534d44756e..9015ebc843b4e 100644
1500 +--- a/drivers/media/i2c/m5mols/m5mols_core.c
1501 ++++ b/drivers/media/i2c/m5mols/m5mols_core.c
1502 +@@ -755,7 +755,8 @@ static int m5mols_sensor_power(struct m5mols_info *info, bool enable)
1503 +
1504 + ret = regulator_bulk_enable(ARRAY_SIZE(supplies), supplies);
1505 + if (ret) {
1506 +- info->set_power(&client->dev, 0);
1507 ++ if (info->set_power)
1508 ++ info->set_power(&client->dev, 0);
1509 + return ret;
1510 + }
1511 +
1512 +diff --git a/drivers/media/i2c/tc358743.c b/drivers/media/i2c/tc358743.c
1513 +index c9647e24a4a3a..f74c4f6814ebb 100644
1514 +--- a/drivers/media/i2c/tc358743.c
1515 ++++ b/drivers/media/i2c/tc358743.c
1516 +@@ -1318,7 +1318,7 @@ static int tc358743_isr(struct v4l2_subdev *sd, u32 status, bool *handled)
1517 + static irqreturn_t tc358743_irq_handler(int irq, void *dev_id)
1518 + {
1519 + struct tc358743_state *state = dev_id;
1520 +- bool handled;
1521 ++ bool handled = false;
1522 +
1523 + tc358743_isr(&state->sd, 0, &handled);
1524 +
1525 +diff --git a/drivers/media/pci/bt8xx/bttv-driver.c b/drivers/media/pci/bt8xx/bttv-driver.c
1526 +index 227086a2e99c8..9e38c8b3ea762 100644
1527 +--- a/drivers/media/pci/bt8xx/bttv-driver.c
1528 ++++ b/drivers/media/pci/bt8xx/bttv-driver.c
1529 +@@ -4055,11 +4055,13 @@ static int bttv_probe(struct pci_dev *dev, const struct pci_device_id *pci_id)
1530 + btv->id = dev->device;
1531 + if (pci_enable_device(dev)) {
1532 + pr_warn("%d: Can't enable device\n", btv->c.nr);
1533 +- return -EIO;
1534 ++ result = -EIO;
1535 ++ goto free_mem;
1536 + }
1537 + if (pci_set_dma_mask(dev, DMA_BIT_MASK(32))) {
1538 + pr_warn("%d: No suitable DMA available\n", btv->c.nr);
1539 +- return -EIO;
1540 ++ result = -EIO;
1541 ++ goto free_mem;
1542 + }
1543 + if (!request_mem_region(pci_resource_start(dev,0),
1544 + pci_resource_len(dev,0),
1545 +@@ -4067,7 +4069,8 @@ static int bttv_probe(struct pci_dev *dev, const struct pci_device_id *pci_id)
1546 + pr_warn("%d: can't request iomem (0x%llx)\n",
1547 + btv->c.nr,
1548 + (unsigned long long)pci_resource_start(dev, 0));
1549 +- return -EBUSY;
1550 ++ result = -EBUSY;
1551 ++ goto free_mem;
1552 + }
1553 + pci_set_master(dev);
1554 + pci_set_command(dev);
1555 +@@ -4253,6 +4256,10 @@ fail0:
1556 + release_mem_region(pci_resource_start(btv->c.pci,0),
1557 + pci_resource_len(btv->c.pci,0));
1558 + pci_disable_device(btv->c.pci);
1559 ++
1560 ++free_mem:
1561 ++ bttvs[btv->c.nr] = NULL;
1562 ++ kfree(btv);
1563 + return result;
1564 + }
1565 +
1566 +diff --git a/drivers/media/pci/saa7134/saa7134-tvaudio.c b/drivers/media/pci/saa7134/saa7134-tvaudio.c
1567 +index 68d400e1e240e..8c3da6f7a60f1 100644
1568 +--- a/drivers/media/pci/saa7134/saa7134-tvaudio.c
1569 ++++ b/drivers/media/pci/saa7134/saa7134-tvaudio.c
1570 +@@ -693,7 +693,8 @@ int saa_dsp_writel(struct saa7134_dev *dev, int reg, u32 value)
1571 + {
1572 + int err;
1573 +
1574 +- audio_dbg(2, "dsp write reg 0x%x = 0x%06x\n", reg << 2, value);
1575 ++ audio_dbg(2, "dsp write reg 0x%x = 0x%06x\n",
1576 ++ (reg << 2) & 0xffffffff, value);
1577 + err = saa_dsp_wait_bit(dev,SAA7135_DSP_RWSTATE_WRR);
1578 + if (err < 0)
1579 + return err;
1580 +diff --git a/drivers/media/platform/exynos4-is/fimc-isp.c b/drivers/media/platform/exynos4-is/fimc-isp.c
1581 +index fd793d3ac0725..89989b2961599 100644
1582 +--- a/drivers/media/platform/exynos4-is/fimc-isp.c
1583 ++++ b/drivers/media/platform/exynos4-is/fimc-isp.c
1584 +@@ -311,8 +311,10 @@ static int fimc_isp_subdev_s_power(struct v4l2_subdev *sd, int on)
1585 +
1586 + if (on) {
1587 + ret = pm_runtime_get_sync(&is->pdev->dev);
1588 +- if (ret < 0)
1589 ++ if (ret < 0) {
1590 ++ pm_runtime_put(&is->pdev->dev);
1591 + return ret;
1592 ++ }
1593 + set_bit(IS_ST_PWR_ON, &is->state);
1594 +
1595 + ret = fimc_is_start_firmware(is);
1596 +diff --git a/drivers/media/platform/exynos4-is/fimc-lite.c b/drivers/media/platform/exynos4-is/fimc-lite.c
1597 +index 4a3c9948ca547..1cdca5ce48439 100644
1598 +--- a/drivers/media/platform/exynos4-is/fimc-lite.c
1599 ++++ b/drivers/media/platform/exynos4-is/fimc-lite.c
1600 +@@ -480,7 +480,7 @@ static int fimc_lite_open(struct file *file)
1601 + set_bit(ST_FLITE_IN_USE, &fimc->state);
1602 + ret = pm_runtime_get_sync(&fimc->pdev->dev);
1603 + if (ret < 0)
1604 +- goto unlock;
1605 ++ goto err_pm;
1606 +
1607 + ret = v4l2_fh_open(file);
1608 + if (ret < 0)
1609 +diff --git a/drivers/media/platform/exynos4-is/media-dev.c b/drivers/media/platform/exynos4-is/media-dev.c
1610 +index f772c9b92d9ba..24fb0f4b95e18 100644
1611 +--- a/drivers/media/platform/exynos4-is/media-dev.c
1612 ++++ b/drivers/media/platform/exynos4-is/media-dev.c
1613 +@@ -479,8 +479,10 @@ static int fimc_md_register_sensor_entities(struct fimc_md *fmd)
1614 + return -ENXIO;
1615 +
1616 + ret = pm_runtime_get_sync(fmd->pmf);
1617 +- if (ret < 0)
1618 ++ if (ret < 0) {
1619 ++ pm_runtime_put(fmd->pmf);
1620 + return ret;
1621 ++ }
1622 +
1623 + fmd->num_sensors = 0;
1624 +
1625 +@@ -1256,11 +1258,9 @@ static int fimc_md_get_pinctrl(struct fimc_md *fmd)
1626 + if (IS_ERR(pctl->state_default))
1627 + return PTR_ERR(pctl->state_default);
1628 +
1629 ++ /* PINCTRL_STATE_IDLE is optional */
1630 + pctl->state_idle = pinctrl_lookup_state(pctl->pinctrl,
1631 + PINCTRL_STATE_IDLE);
1632 +- if (IS_ERR(pctl->state_idle))
1633 +- return PTR_ERR(pctl->state_idle);
1634 +-
1635 + return 0;
1636 + }
1637 +
1638 +diff --git a/drivers/media/platform/exynos4-is/mipi-csis.c b/drivers/media/platform/exynos4-is/mipi-csis.c
1639 +index 560aadabcb111..040d10df17c97 100644
1640 +--- a/drivers/media/platform/exynos4-is/mipi-csis.c
1641 ++++ b/drivers/media/platform/exynos4-is/mipi-csis.c
1642 +@@ -513,8 +513,10 @@ static int s5pcsis_s_stream(struct v4l2_subdev *sd, int enable)
1643 + if (enable) {
1644 + s5pcsis_clear_counters(state);
1645 + ret = pm_runtime_get_sync(&state->pdev->dev);
1646 +- if (ret && ret != 1)
1647 ++ if (ret && ret != 1) {
1648 ++ pm_runtime_put_noidle(&state->pdev->dev);
1649 + return ret;
1650 ++ }
1651 + }
1652 +
1653 + mutex_lock(&state->lock);
1654 +diff --git a/drivers/media/platform/mx2_emmaprp.c b/drivers/media/platform/mx2_emmaprp.c
1655 +index 951f2fd415b0d..163e825bf1aac 100644
1656 +--- a/drivers/media/platform/mx2_emmaprp.c
1657 ++++ b/drivers/media/platform/mx2_emmaprp.c
1658 +@@ -942,8 +942,11 @@ static int emmaprp_probe(struct platform_device *pdev)
1659 + platform_set_drvdata(pdev, pcdev);
1660 +
1661 + irq = platform_get_irq(pdev, 0);
1662 +- if (irq < 0)
1663 +- return irq;
1664 ++ if (irq < 0) {
1665 ++ ret = irq;
1666 ++ goto rel_vdev;
1667 ++ }
1668 ++
1669 + ret = devm_request_irq(&pdev->dev, irq, emmaprp_irq, 0,
1670 + dev_name(&pdev->dev), pcdev);
1671 + if (ret)
1672 +diff --git a/drivers/media/platform/omap3isp/isp.c b/drivers/media/platform/omap3isp/isp.c
1673 +index b34b6a604f92f..c46402f3e88c1 100644
1674 +--- a/drivers/media/platform/omap3isp/isp.c
1675 ++++ b/drivers/media/platform/omap3isp/isp.c
1676 +@@ -2304,8 +2304,10 @@ static int isp_probe(struct platform_device *pdev)
1677 + mem = platform_get_resource(pdev, IORESOURCE_MEM, i);
1678 + isp->mmio_base[map_idx] =
1679 + devm_ioremap_resource(isp->dev, mem);
1680 +- if (IS_ERR(isp->mmio_base[map_idx]))
1681 +- return PTR_ERR(isp->mmio_base[map_idx]);
1682 ++ if (IS_ERR(isp->mmio_base[map_idx])) {
1683 ++ ret = PTR_ERR(isp->mmio_base[map_idx]);
1684 ++ goto error;
1685 ++ }
1686 + }
1687 +
1688 + ret = isp_get_clocks(isp);
1689 +diff --git a/drivers/media/platform/qcom/venus/core.c b/drivers/media/platform/qcom/venus/core.c
1690 +index 9360b36b82cd8..0a011b117a6db 100644
1691 +--- a/drivers/media/platform/qcom/venus/core.c
1692 ++++ b/drivers/media/platform/qcom/venus/core.c
1693 +@@ -236,8 +236,10 @@ static int venus_probe(struct platform_device *pdev)
1694 + goto err_dev_unregister;
1695 +
1696 + ret = pm_runtime_put_sync(dev);
1697 +- if (ret)
1698 ++ if (ret) {
1699 ++ pm_runtime_get_noresume(dev);
1700 + goto err_dev_unregister;
1701 ++ }
1702 +
1703 + return 0;
1704 +
1705 +@@ -248,6 +250,7 @@ err_core_deinit:
1706 + err_venus_shutdown:
1707 + venus_shutdown(dev);
1708 + err_runtime_disable:
1709 ++ pm_runtime_put_noidle(dev);
1710 + pm_runtime_set_suspended(dev);
1711 + pm_runtime_disable(dev);
1712 + hfi_destroy(core);
1713 +diff --git a/drivers/media/platform/rcar-fcp.c b/drivers/media/platform/rcar-fcp.c
1714 +index 0047d144c9326..19502a1860cf5 100644
1715 +--- a/drivers/media/platform/rcar-fcp.c
1716 ++++ b/drivers/media/platform/rcar-fcp.c
1717 +@@ -106,8 +106,10 @@ int rcar_fcp_enable(struct rcar_fcp_device *fcp)
1718 + return 0;
1719 +
1720 + ret = pm_runtime_get_sync(fcp->dev);
1721 +- if (ret < 0)
1722 ++ if (ret < 0) {
1723 ++ pm_runtime_put_noidle(fcp->dev);
1724 + return ret;
1725 ++ }
1726 +
1727 + return 0;
1728 + }
1729 +diff --git a/drivers/media/platform/s3c-camif/camif-core.c b/drivers/media/platform/s3c-camif/camif-core.c
1730 +index c4ab63986c8f0..95b11f69555c3 100644
1731 +--- a/drivers/media/platform/s3c-camif/camif-core.c
1732 ++++ b/drivers/media/platform/s3c-camif/camif-core.c
1733 +@@ -475,7 +475,7 @@ static int s3c_camif_probe(struct platform_device *pdev)
1734 +
1735 + ret = camif_media_dev_init(camif);
1736 + if (ret < 0)
1737 +- goto err_alloc;
1738 ++ goto err_pm;
1739 +
1740 + ret = camif_register_sensor(camif);
1741 + if (ret < 0)
1742 +@@ -509,10 +509,9 @@ err_sens:
1743 + media_device_unregister(&camif->media_dev);
1744 + media_device_cleanup(&camif->media_dev);
1745 + camif_unregister_media_entities(camif);
1746 +-err_alloc:
1747 ++err_pm:
1748 + pm_runtime_put(dev);
1749 + pm_runtime_disable(dev);
1750 +-err_pm:
1751 + camif_clk_put(camif);
1752 + err_clk:
1753 + s3c_camif_unregister_subdev(camif);
1754 +diff --git a/drivers/media/platform/s5p-mfc/s5p_mfc_pm.c b/drivers/media/platform/s5p-mfc/s5p_mfc_pm.c
1755 +index 5e080f32b0e82..95abf2bd7ebae 100644
1756 +--- a/drivers/media/platform/s5p-mfc/s5p_mfc_pm.c
1757 ++++ b/drivers/media/platform/s5p-mfc/s5p_mfc_pm.c
1758 +@@ -83,8 +83,10 @@ int s5p_mfc_power_on(void)
1759 + int i, ret = 0;
1760 +
1761 + ret = pm_runtime_get_sync(pm->device);
1762 +- if (ret < 0)
1763 ++ if (ret < 0) {
1764 ++ pm_runtime_put_noidle(pm->device);
1765 + return ret;
1766 ++ }
1767 +
1768 + /* clock control */
1769 + for (i = 0; i < pm->num_clocks; i++) {
1770 +diff --git a/drivers/media/platform/sti/bdisp/bdisp-v4l2.c b/drivers/media/platform/sti/bdisp/bdisp-v4l2.c
1771 +index 601ca2b2ecd34..79de7d413cf5e 100644
1772 +--- a/drivers/media/platform/sti/bdisp/bdisp-v4l2.c
1773 ++++ b/drivers/media/platform/sti/bdisp/bdisp-v4l2.c
1774 +@@ -1367,7 +1367,7 @@ static int bdisp_probe(struct platform_device *pdev)
1775 + ret = pm_runtime_get_sync(dev);
1776 + if (ret < 0) {
1777 + dev_err(dev, "failed to set PM\n");
1778 +- goto err_dbg;
1779 ++ goto err_pm;
1780 + }
1781 +
1782 + /* Filters */
1783 +@@ -1395,7 +1395,6 @@ err_filter:
1784 + bdisp_hw_free_filters(bdisp->dev);
1785 + err_pm:
1786 + pm_runtime_put(dev);
1787 +-err_dbg:
1788 + bdisp_debugfs_remove(bdisp);
1789 + err_v4l2:
1790 + v4l2_device_unregister(&bdisp->v4l2_dev);
1791 +diff --git a/drivers/media/platform/sti/delta/delta-v4l2.c b/drivers/media/platform/sti/delta/delta-v4l2.c
1792 +index b2dc3d223a9c9..7c925f309158d 100644
1793 +--- a/drivers/media/platform/sti/delta/delta-v4l2.c
1794 ++++ b/drivers/media/platform/sti/delta/delta-v4l2.c
1795 +@@ -970,8 +970,10 @@ static void delta_run_work(struct work_struct *work)
1796 + /* enable the hardware */
1797 + if (!dec->pm) {
1798 + ret = delta_get_sync(ctx);
1799 +- if (ret)
1800 ++ if (ret) {
1801 ++ delta_put_autosuspend(ctx);
1802 + goto err;
1803 ++ }
1804 + }
1805 +
1806 + /* decode this access unit */
1807 +diff --git a/drivers/media/platform/sti/hva/hva-hw.c b/drivers/media/platform/sti/hva/hva-hw.c
1808 +index ec25bdcfa3d1e..1185f6b6721e9 100644
1809 +--- a/drivers/media/platform/sti/hva/hva-hw.c
1810 ++++ b/drivers/media/platform/sti/hva/hva-hw.c
1811 +@@ -272,6 +272,7 @@ static unsigned long int hva_hw_get_ip_version(struct hva_dev *hva)
1812 +
1813 + if (pm_runtime_get_sync(dev) < 0) {
1814 + dev_err(dev, "%s failed to get pm_runtime\n", HVA_PREFIX);
1815 ++ pm_runtime_put_noidle(dev);
1816 + mutex_unlock(&hva->protect_mutex);
1817 + return -EFAULT;
1818 + }
1819 +@@ -392,7 +393,7 @@ int hva_hw_probe(struct platform_device *pdev, struct hva_dev *hva)
1820 + ret = pm_runtime_get_sync(dev);
1821 + if (ret < 0) {
1822 + dev_err(dev, "%s failed to set PM\n", HVA_PREFIX);
1823 +- goto err_clk;
1824 ++ goto err_pm;
1825 + }
1826 +
1827 + /* check IP hardware version */
1828 +@@ -557,6 +558,7 @@ void hva_hw_dump_regs(struct hva_dev *hva, struct seq_file *s)
1829 +
1830 + if (pm_runtime_get_sync(dev) < 0) {
1831 + seq_puts(s, "Cannot wake up IP\n");
1832 ++ pm_runtime_put_noidle(dev);
1833 + mutex_unlock(&hva->protect_mutex);
1834 + return;
1835 + }
1836 +diff --git a/drivers/media/platform/ti-vpe/vpe.c b/drivers/media/platform/ti-vpe/vpe.c
1837 +index 2e8970c7e22da..bbd8bb611915c 100644
1838 +--- a/drivers/media/platform/ti-vpe/vpe.c
1839 ++++ b/drivers/media/platform/ti-vpe/vpe.c
1840 +@@ -2470,6 +2470,8 @@ static int vpe_runtime_get(struct platform_device *pdev)
1841 +
1842 + r = pm_runtime_get_sync(&pdev->dev);
1843 + WARN_ON(r < 0);
1844 ++ if (r)
1845 ++ pm_runtime_put_noidle(&pdev->dev);
1846 + return r < 0 ? r : 0;
1847 + }
1848 +
1849 +diff --git a/drivers/media/platform/vsp1/vsp1_drv.c b/drivers/media/platform/vsp1/vsp1_drv.c
1850 +index eed9516e25e1d..5836fb298de27 100644
1851 +--- a/drivers/media/platform/vsp1/vsp1_drv.c
1852 ++++ b/drivers/media/platform/vsp1/vsp1_drv.c
1853 +@@ -549,7 +549,12 @@ int vsp1_device_get(struct vsp1_device *vsp1)
1854 + int ret;
1855 +
1856 + ret = pm_runtime_get_sync(vsp1->dev);
1857 +- return ret < 0 ? ret : 0;
1858 ++ if (ret < 0) {
1859 ++ pm_runtime_put_noidle(vsp1->dev);
1860 ++ return ret;
1861 ++ }
1862 ++
1863 ++ return 0;
1864 + }
1865 +
1866 + /*
1867 +@@ -829,12 +834,12 @@ static int vsp1_probe(struct platform_device *pdev)
1868 + /* Configure device parameters based on the version register. */
1869 + pm_runtime_enable(&pdev->dev);
1870 +
1871 +- ret = pm_runtime_get_sync(&pdev->dev);
1872 ++ ret = vsp1_device_get(vsp1);
1873 + if (ret < 0)
1874 + goto done;
1875 +
1876 + vsp1->version = vsp1_read(vsp1, VI6_IP_VERSION);
1877 +- pm_runtime_put_sync(&pdev->dev);
1878 ++ vsp1_device_put(vsp1);
1879 +
1880 + for (i = 0; i < ARRAY_SIZE(vsp1_device_infos); ++i) {
1881 + if ((vsp1->version & VI6_IP_VERSION_MODEL_MASK) ==
1882 +diff --git a/drivers/media/rc/ati_remote.c b/drivers/media/rc/ati_remote.c
1883 +index d0871d60a7231..8e3af398a6c4e 100644
1884 +--- a/drivers/media/rc/ati_remote.c
1885 ++++ b/drivers/media/rc/ati_remote.c
1886 +@@ -845,6 +845,10 @@ static int ati_remote_probe(struct usb_interface *interface,
1887 + err("%s: endpoint_in message size==0? \n", __func__);
1888 + return -ENODEV;
1889 + }
1890 ++ if (!usb_endpoint_is_int_out(endpoint_out)) {
1891 ++ err("%s: Unexpected endpoint_out\n", __func__);
1892 ++ return -ENODEV;
1893 ++ }
1894 +
1895 + ati_remote = kzalloc(sizeof (struct ati_remote), GFP_KERNEL);
1896 + rc_dev = rc_allocate_device(RC_DRIVER_SCANCODE);
1897 +diff --git a/drivers/media/tuners/tuner-simple.c b/drivers/media/tuners/tuner-simple.c
1898 +index cf44d3657f555..9b2501046bd14 100644
1899 +--- a/drivers/media/tuners/tuner-simple.c
1900 ++++ b/drivers/media/tuners/tuner-simple.c
1901 +@@ -499,7 +499,7 @@ static int simple_radio_bandswitch(struct dvb_frontend *fe, u8 *buffer)
1902 + case TUNER_TENA_9533_DI:
1903 + case TUNER_YMEC_TVF_5533MF:
1904 + tuner_dbg("This tuner doesn't have FM. Most cards have a TEA5767 for FM\n");
1905 +- return 0;
1906 ++ return -EINVAL;
1907 + case TUNER_PHILIPS_FM1216ME_MK3:
1908 + case TUNER_PHILIPS_FM1236_MK3:
1909 + case TUNER_PHILIPS_FMD1216ME_MK3:
1910 +@@ -700,7 +700,8 @@ static int simple_set_radio_freq(struct dvb_frontend *fe,
1911 + TUNER_RATIO_SELECT_50; /* 50 kHz step */
1912 +
1913 + /* Bandswitch byte */
1914 +- simple_radio_bandswitch(fe, &buffer[0]);
1915 ++ if (simple_radio_bandswitch(fe, &buffer[0]))
1916 ++ return 0;
1917 +
1918 + /* Convert from 1/16 kHz V4L steps to 1/20 MHz (=50 kHz) PLL steps
1919 + freq * (1 Mhz / 16000 V4L steps) * (20 PLL steps / 1 MHz) =
1920 +diff --git a/drivers/media/usb/uvc/uvc_entity.c b/drivers/media/usb/uvc/uvc_entity.c
1921 +index 554063c07d7a2..f2457953f27c6 100644
1922 +--- a/drivers/media/usb/uvc/uvc_entity.c
1923 ++++ b/drivers/media/usb/uvc/uvc_entity.c
1924 +@@ -78,10 +78,45 @@ static int uvc_mc_init_entity(struct uvc_video_chain *chain,
1925 + int ret;
1926 +
1927 + if (UVC_ENTITY_TYPE(entity) != UVC_TT_STREAMING) {
1928 ++ u32 function;
1929 ++
1930 + v4l2_subdev_init(&entity->subdev, &uvc_subdev_ops);
1931 + strlcpy(entity->subdev.name, entity->name,
1932 + sizeof(entity->subdev.name));
1933 +
1934 ++ switch (UVC_ENTITY_TYPE(entity)) {
1935 ++ case UVC_VC_SELECTOR_UNIT:
1936 ++ function = MEDIA_ENT_F_VID_MUX;
1937 ++ break;
1938 ++ case UVC_VC_PROCESSING_UNIT:
1939 ++ case UVC_VC_EXTENSION_UNIT:
1940 ++ /* For lack of a better option. */
1941 ++ function = MEDIA_ENT_F_PROC_VIDEO_PIXEL_FORMATTER;
1942 ++ break;
1943 ++ case UVC_COMPOSITE_CONNECTOR:
1944 ++ case UVC_COMPONENT_CONNECTOR:
1945 ++ function = MEDIA_ENT_F_CONN_COMPOSITE;
1946 ++ break;
1947 ++ case UVC_SVIDEO_CONNECTOR:
1948 ++ function = MEDIA_ENT_F_CONN_SVIDEO;
1949 ++ break;
1950 ++ case UVC_ITT_CAMERA:
1951 ++ function = MEDIA_ENT_F_CAM_SENSOR;
1952 ++ break;
1953 ++ case UVC_TT_VENDOR_SPECIFIC:
1954 ++ case UVC_ITT_VENDOR_SPECIFIC:
1955 ++ case UVC_ITT_MEDIA_TRANSPORT_INPUT:
1956 ++ case UVC_OTT_VENDOR_SPECIFIC:
1957 ++ case UVC_OTT_DISPLAY:
1958 ++ case UVC_OTT_MEDIA_TRANSPORT_OUTPUT:
1959 ++ case UVC_EXTERNAL_VENDOR_SPECIFIC:
1960 ++ default:
1961 ++ function = MEDIA_ENT_F_V4L2_SUBDEV_UNKNOWN;
1962 ++ break;
1963 ++ }
1964 ++
1965 ++ entity->subdev.entity.function = function;
1966 ++
1967 + ret = media_entity_pads_init(&entity->subdev.entity,
1968 + entity->num_pads, entity->pads);
1969 +
1970 +diff --git a/drivers/media/usb/uvc/uvc_v4l2.c b/drivers/media/usb/uvc/uvc_v4l2.c
1971 +index 3e7e283a44a8e..644afd55c0f0f 100644
1972 +--- a/drivers/media/usb/uvc/uvc_v4l2.c
1973 ++++ b/drivers/media/usb/uvc/uvc_v4l2.c
1974 +@@ -252,11 +252,41 @@ static int uvc_v4l2_try_format(struct uvc_streaming *stream,
1975 + if (ret < 0)
1976 + goto done;
1977 +
1978 ++ /* After the probe, update fmt with the values returned from
1979 ++ * negotiation with the device.
1980 ++ */
1981 ++ for (i = 0; i < stream->nformats; ++i) {
1982 ++ if (probe->bFormatIndex == stream->format[i].index) {
1983 ++ format = &stream->format[i];
1984 ++ break;
1985 ++ }
1986 ++ }
1987 ++
1988 ++ if (i == stream->nformats) {
1989 ++ uvc_trace(UVC_TRACE_FORMAT, "Unknown bFormatIndex %u\n",
1990 ++ probe->bFormatIndex);
1991 ++ return -EINVAL;
1992 ++ }
1993 ++
1994 ++ for (i = 0; i < format->nframes; ++i) {
1995 ++ if (probe->bFrameIndex == format->frame[i].bFrameIndex) {
1996 ++ frame = &format->frame[i];
1997 ++ break;
1998 ++ }
1999 ++ }
2000 ++
2001 ++ if (i == format->nframes) {
2002 ++ uvc_trace(UVC_TRACE_FORMAT, "Unknown bFrameIndex %u\n",
2003 ++ probe->bFrameIndex);
2004 ++ return -EINVAL;
2005 ++ }
2006 ++
2007 + fmt->fmt.pix.width = frame->wWidth;
2008 + fmt->fmt.pix.height = frame->wHeight;
2009 + fmt->fmt.pix.field = V4L2_FIELD_NONE;
2010 + fmt->fmt.pix.bytesperline = uvc_v4l2_get_bytesperline(format, frame);
2011 + fmt->fmt.pix.sizeimage = probe->dwMaxVideoFrameSize;
2012 ++ fmt->fmt.pix.pixelformat = format->fcc;
2013 + fmt->fmt.pix.colorspace = format->colorspace;
2014 + fmt->fmt.pix.priv = 0;
2015 +
2016 +diff --git a/drivers/memory/fsl-corenet-cf.c b/drivers/memory/fsl-corenet-cf.c
2017 +index 662d050243bec..2fbf8d09af36b 100644
2018 +--- a/drivers/memory/fsl-corenet-cf.c
2019 ++++ b/drivers/memory/fsl-corenet-cf.c
2020 +@@ -215,10 +215,8 @@ static int ccf_probe(struct platform_device *pdev)
2021 + dev_set_drvdata(&pdev->dev, ccf);
2022 +
2023 + irq = platform_get_irq(pdev, 0);
2024 +- if (!irq) {
2025 +- dev_err(&pdev->dev, "%s: no irq\n", __func__);
2026 +- return -ENXIO;
2027 +- }
2028 ++ if (irq < 0)
2029 ++ return irq;
2030 +
2031 + ret = devm_request_irq(&pdev->dev, irq, ccf_irq, 0, pdev->name, ccf);
2032 + if (ret) {
2033 +diff --git a/drivers/memory/omap-gpmc.c b/drivers/memory/omap-gpmc.c
2034 +index 7059bbda2faca..cc0da96d07cae 100644
2035 +--- a/drivers/memory/omap-gpmc.c
2036 ++++ b/drivers/memory/omap-gpmc.c
2037 +@@ -951,7 +951,7 @@ static int gpmc_cs_remap(int cs, u32 base)
2038 + int ret;
2039 + u32 old_base, size;
2040 +
2041 +- if (cs > gpmc_cs_num) {
2042 ++ if (cs >= gpmc_cs_num) {
2043 + pr_err("%s: requested chip-select is disabled\n", __func__);
2044 + return -ENODEV;
2045 + }
2046 +@@ -986,7 +986,7 @@ int gpmc_cs_request(int cs, unsigned long size, unsigned long *base)
2047 + struct resource *res = &gpmc->mem;
2048 + int r = -1;
2049 +
2050 +- if (cs > gpmc_cs_num) {
2051 ++ if (cs >= gpmc_cs_num) {
2052 + pr_err("%s: requested chip-select is disabled\n", __func__);
2053 + return -ENODEV;
2054 + }
2055 +diff --git a/drivers/mfd/rtsx_pcr.c b/drivers/mfd/rtsx_pcr.c
2056 +index 3cf69e5c57035..c9e45b6befacf 100644
2057 +--- a/drivers/mfd/rtsx_pcr.c
2058 ++++ b/drivers/mfd/rtsx_pcr.c
2059 +@@ -1268,12 +1268,14 @@ static int rtsx_pci_probe(struct pci_dev *pcidev,
2060 + ret = mfd_add_devices(&pcidev->dev, pcr->id, rtsx_pcr_cells,
2061 + ARRAY_SIZE(rtsx_pcr_cells), NULL, 0, NULL);
2062 + if (ret < 0)
2063 +- goto disable_irq;
2064 ++ goto free_slots;
2065 +
2066 + schedule_delayed_work(&pcr->idle_work, msecs_to_jiffies(200));
2067 +
2068 + return 0;
2069 +
2070 ++free_slots:
2071 ++ kfree(pcr->slots);
2072 + disable_irq:
2073 + free_irq(pcr->irq, (void *)pcr);
2074 + disable_msi:
2075 +diff --git a/drivers/mfd/sm501.c b/drivers/mfd/sm501.c
2076 +index 3270b8dbc9498..4ca245518a199 100644
2077 +--- a/drivers/mfd/sm501.c
2078 ++++ b/drivers/mfd/sm501.c
2079 +@@ -1425,8 +1425,14 @@ static int sm501_plat_probe(struct platform_device *dev)
2080 + goto err_claim;
2081 + }
2082 +
2083 +- return sm501_init_dev(sm);
2084 ++ ret = sm501_init_dev(sm);
2085 ++ if (ret)
2086 ++ goto err_unmap;
2087 ++
2088 ++ return 0;
2089 +
2090 ++ err_unmap:
2091 ++ iounmap(sm->regs);
2092 + err_claim:
2093 + release_resource(sm->regs_claim);
2094 + kfree(sm->regs_claim);
2095 +diff --git a/drivers/misc/eeprom/at25.c b/drivers/misc/eeprom/at25.c
2096 +index 5afe4cd165699..cd7e7e36907bc 100644
2097 +--- a/drivers/misc/eeprom/at25.c
2098 ++++ b/drivers/misc/eeprom/at25.c
2099 +@@ -355,7 +355,7 @@ static int at25_probe(struct spi_device *spi)
2100 + at25->nvmem_config.reg_read = at25_ee_read;
2101 + at25->nvmem_config.reg_write = at25_ee_write;
2102 + at25->nvmem_config.priv = at25;
2103 +- at25->nvmem_config.stride = 4;
2104 ++ at25->nvmem_config.stride = 1;
2105 + at25->nvmem_config.word_size = 1;
2106 + at25->nvmem_config.size = chip.byte_len;
2107 +
2108 +diff --git a/drivers/misc/mic/scif/scif_rma.c b/drivers/misc/mic/scif/scif_rma.c
2109 +index 95745dc4e0ecf..f282c2eaab29b 100644
2110 +--- a/drivers/misc/mic/scif/scif_rma.c
2111 ++++ b/drivers/misc/mic/scif/scif_rma.c
2112 +@@ -1404,6 +1404,8 @@ retry:
2113 + NULL);
2114 + up_write(&mm->mmap_sem);
2115 + if (nr_pages != pinned_pages->nr_pages) {
2116 ++ if (pinned_pages->nr_pages < 0)
2117 ++ pinned_pages->nr_pages = 0;
2118 + if (try_upgrade) {
2119 + if (ulimit)
2120 + __scif_dec_pinned_vm_lock(mm,
2121 +@@ -1424,7 +1426,6 @@ retry:
2122 +
2123 + if (pinned_pages->nr_pages < nr_pages) {
2124 + err = -EFAULT;
2125 +- pinned_pages->nr_pages = nr_pages;
2126 + goto dec_pinned;
2127 + }
2128 +
2129 +@@ -1437,7 +1438,6 @@ dec_pinned:
2130 + __scif_dec_pinned_vm_lock(mm, nr_pages, 0);
2131 + /* Something went wrong! Rollback */
2132 + error_unmap:
2133 +- pinned_pages->nr_pages = nr_pages;
2134 + scif_destroy_pinned_pages(pinned_pages);
2135 + *pages = NULL;
2136 + dev_dbg(scif_info.mdev.this_device,
2137 +diff --git a/drivers/misc/mic/vop/vop_main.c b/drivers/misc/mic/vop/vop_main.c
2138 +index a341938c7e2c6..e7cb57f8ddfe2 100644
2139 +--- a/drivers/misc/mic/vop/vop_main.c
2140 ++++ b/drivers/misc/mic/vop/vop_main.c
2141 +@@ -301,7 +301,7 @@ static struct virtqueue *vop_find_vq(struct virtio_device *dev,
2142 + /* First assign the vring's allocated in host memory */
2143 + vqconfig = _vop_vq_config(vdev->desc) + index;
2144 + memcpy_fromio(&config, vqconfig, sizeof(config));
2145 +- _vr_size = vring_size(le16_to_cpu(config.num), MIC_VIRTIO_RING_ALIGN);
2146 ++ _vr_size = round_up(vring_size(le16_to_cpu(config.num), MIC_VIRTIO_RING_ALIGN), 4);
2147 + vr_size = PAGE_ALIGN(_vr_size + sizeof(struct _mic_vring_info));
2148 + va = vpdev->hw_ops->ioremap(vpdev, le64_to_cpu(config.address),
2149 + vr_size);
2150 +diff --git a/drivers/misc/mic/vop/vop_vringh.c b/drivers/misc/mic/vop/vop_vringh.c
2151 +index fed992e2c2583..49e7a7240469c 100644
2152 +--- a/drivers/misc/mic/vop/vop_vringh.c
2153 ++++ b/drivers/misc/mic/vop/vop_vringh.c
2154 +@@ -308,7 +308,7 @@ static int vop_virtio_add_device(struct vop_vdev *vdev,
2155 +
2156 + num = le16_to_cpu(vqconfig[i].num);
2157 + mutex_init(&vvr->vr_mutex);
2158 +- vr_size = PAGE_ALIGN(vring_size(num, MIC_VIRTIO_RING_ALIGN) +
2159 ++ vr_size = PAGE_ALIGN(round_up(vring_size(num, MIC_VIRTIO_RING_ALIGN), 4) +
2160 + sizeof(struct _mic_vring_info));
2161 + vr->va = (void *)
2162 + __get_free_pages(GFP_KERNEL | __GFP_ZERO,
2163 +@@ -320,7 +320,7 @@ static int vop_virtio_add_device(struct vop_vdev *vdev,
2164 + goto err;
2165 + }
2166 + vr->len = vr_size;
2167 +- vr->info = vr->va + vring_size(num, MIC_VIRTIO_RING_ALIGN);
2168 ++ vr->info = vr->va + round_up(vring_size(num, MIC_VIRTIO_RING_ALIGN), 4);
2169 + vr->info->magic = cpu_to_le32(MIC_MAGIC + vdev->virtio_id + i);
2170 + vr_addr = dma_map_single(&vpdev->dev, vr->va, vr_size,
2171 + DMA_BIDIRECTIONAL);
2172 +@@ -611,6 +611,7 @@ static int vop_virtio_copy_from_user(struct vop_vdev *vdev, void __user *ubuf,
2173 + size_t partlen;
2174 + bool dma = VOP_USE_DMA;
2175 + int err = 0;
2176 ++ size_t offset = 0;
2177 +
2178 + if (daddr & (dma_alignment - 1)) {
2179 + vdev->tx_dst_unaligned += len;
2180 +@@ -659,13 +660,20 @@ memcpy:
2181 + * We are copying to IO below and should ideally use something
2182 + * like copy_from_user_toio(..) if it existed.
2183 + */
2184 +- if (copy_from_user((void __force *)dbuf, ubuf, len)) {
2185 +- err = -EFAULT;
2186 +- dev_err(vop_dev(vdev), "%s %d err %d\n",
2187 +- __func__, __LINE__, err);
2188 +- goto err;
2189 ++ while (len) {
2190 ++ partlen = min_t(size_t, len, VOP_INT_DMA_BUF_SIZE);
2191 ++
2192 ++ if (copy_from_user(vvr->buf, ubuf + offset, partlen)) {
2193 ++ err = -EFAULT;
2194 ++ dev_err(vop_dev(vdev), "%s %d err %d\n",
2195 ++ __func__, __LINE__, err);
2196 ++ goto err;
2197 ++ }
2198 ++ memcpy_toio(dbuf + offset, vvr->buf, partlen);
2199 ++ offset += partlen;
2200 ++ vdev->out_bytes += partlen;
2201 ++ len -= partlen;
2202 + }
2203 +- vdev->out_bytes += len;
2204 + err = 0;
2205 + err:
2206 + vpdev->hw_ops->iounmap(vpdev, dbuf);
2207 +diff --git a/drivers/misc/vmw_vmci/vmci_queue_pair.c b/drivers/misc/vmw_vmci/vmci_queue_pair.c
2208 +index b4570d5c1fe7d..d6210bf92c1f2 100644
2209 +--- a/drivers/misc/vmw_vmci/vmci_queue_pair.c
2210 ++++ b/drivers/misc/vmw_vmci/vmci_queue_pair.c
2211 +@@ -758,8 +758,9 @@ static int qp_host_get_user_memory(u64 produce_uva,
2212 + if (retval < (int)produce_q->kernel_if->num_pages) {
2213 + pr_debug("get_user_pages_fast(produce) failed (retval=%d)",
2214 + retval);
2215 +- qp_release_pages(produce_q->kernel_if->u.h.header_page,
2216 +- retval, false);
2217 ++ if (retval > 0)
2218 ++ qp_release_pages(produce_q->kernel_if->u.h.header_page,
2219 ++ retval, false);
2220 + err = VMCI_ERROR_NO_MEM;
2221 + goto out;
2222 + }
2223 +@@ -770,8 +771,9 @@ static int qp_host_get_user_memory(u64 produce_uva,
2224 + if (retval < (int)consume_q->kernel_if->num_pages) {
2225 + pr_debug("get_user_pages_fast(consume) failed (retval=%d)",
2226 + retval);
2227 +- qp_release_pages(consume_q->kernel_if->u.h.header_page,
2228 +- retval, false);
2229 ++ if (retval > 0)
2230 ++ qp_release_pages(consume_q->kernel_if->u.h.header_page,
2231 ++ retval, false);
2232 + qp_release_pages(produce_q->kernel_if->u.h.header_page,
2233 + produce_q->kernel_if->num_pages, false);
2234 + err = VMCI_ERROR_NO_MEM;
2235 +diff --git a/drivers/mmc/core/sdio_cis.c b/drivers/mmc/core/sdio_cis.c
2236 +index f8c372839d244..2ca5cd79018b4 100644
2237 +--- a/drivers/mmc/core/sdio_cis.c
2238 ++++ b/drivers/mmc/core/sdio_cis.c
2239 +@@ -30,6 +30,9 @@ static int cistpl_vers_1(struct mmc_card *card, struct sdio_func *func,
2240 + unsigned i, nr_strings;
2241 + char **buffer, *string;
2242 +
2243 ++ if (size < 2)
2244 ++ return 0;
2245 ++
2246 + /* Find all null-terminated (including zero length) strings in
2247 + the TPLLV1_INFO field. Trailing garbage is ignored. */
2248 + buf += 2;
2249 +diff --git a/drivers/mtd/lpddr/lpddr2_nvm.c b/drivers/mtd/lpddr/lpddr2_nvm.c
2250 +index 2342277c9bcb0..5e36366d9b36d 100644
2251 +--- a/drivers/mtd/lpddr/lpddr2_nvm.c
2252 ++++ b/drivers/mtd/lpddr/lpddr2_nvm.c
2253 +@@ -408,6 +408,17 @@ static int lpddr2_nvm_lock(struct mtd_info *mtd, loff_t start_add,
2254 + return lpddr2_nvm_do_block_op(mtd, start_add, len, LPDDR2_NVM_LOCK);
2255 + }
2256 +
2257 ++static const struct mtd_info lpddr2_nvm_mtd_info = {
2258 ++ .type = MTD_RAM,
2259 ++ .writesize = 1,
2260 ++ .flags = (MTD_CAP_NVRAM | MTD_POWERUP_LOCK),
2261 ++ ._read = lpddr2_nvm_read,
2262 ++ ._write = lpddr2_nvm_write,
2263 ++ ._erase = lpddr2_nvm_erase,
2264 ++ ._unlock = lpddr2_nvm_unlock,
2265 ++ ._lock = lpddr2_nvm_lock,
2266 ++};
2267 ++
2268 + /*
2269 + * lpddr2_nvm driver probe method
2270 + */
2271 +@@ -448,6 +459,7 @@ static int lpddr2_nvm_probe(struct platform_device *pdev)
2272 + .pfow_base = OW_BASE_ADDRESS,
2273 + .fldrv_priv = pcm_data,
2274 + };
2275 ++
2276 + if (IS_ERR(map->virt))
2277 + return PTR_ERR(map->virt);
2278 +
2279 +@@ -459,22 +471,13 @@ static int lpddr2_nvm_probe(struct platform_device *pdev)
2280 + return PTR_ERR(pcm_data->ctl_regs);
2281 +
2282 + /* Populate mtd_info data structure */
2283 +- *mtd = (struct mtd_info) {
2284 +- .dev = { .parent = &pdev->dev },
2285 +- .name = pdev->dev.init_name,
2286 +- .type = MTD_RAM,
2287 +- .priv = map,
2288 +- .size = resource_size(add_range),
2289 +- .erasesize = ERASE_BLOCKSIZE * pcm_data->bus_width,
2290 +- .writesize = 1,
2291 +- .writebufsize = WRITE_BUFFSIZE * pcm_data->bus_width,
2292 +- .flags = (MTD_CAP_NVRAM | MTD_POWERUP_LOCK),
2293 +- ._read = lpddr2_nvm_read,
2294 +- ._write = lpddr2_nvm_write,
2295 +- ._erase = lpddr2_nvm_erase,
2296 +- ._unlock = lpddr2_nvm_unlock,
2297 +- ._lock = lpddr2_nvm_lock,
2298 +- };
2299 ++ *mtd = lpddr2_nvm_mtd_info;
2300 ++ mtd->dev.parent = &pdev->dev;
2301 ++ mtd->name = pdev->dev.init_name;
2302 ++ mtd->priv = map;
2303 ++ mtd->size = resource_size(add_range);
2304 ++ mtd->erasesize = ERASE_BLOCKSIZE * pcm_data->bus_width;
2305 ++ mtd->writebufsize = WRITE_BUFFSIZE * pcm_data->bus_width;
2306 +
2307 + /* Verify the presence of the device looking for PFOW string */
2308 + if (!lpddr2_nvm_pfow_present(map)) {
2309 +diff --git a/drivers/mtd/mtdoops.c b/drivers/mtd/mtdoops.c
2310 +index 97bb8f6304d4f..09165eaac7a15 100644
2311 +--- a/drivers/mtd/mtdoops.c
2312 ++++ b/drivers/mtd/mtdoops.c
2313 +@@ -313,12 +313,13 @@ static void mtdoops_do_dump(struct kmsg_dumper *dumper,
2314 + kmsg_dump_get_buffer(dumper, true, cxt->oops_buf + MTDOOPS_HEADER_SIZE,
2315 + record_size - MTDOOPS_HEADER_SIZE, NULL);
2316 +
2317 +- /* Panics must be written immediately */
2318 +- if (reason != KMSG_DUMP_OOPS)
2319 ++ if (reason != KMSG_DUMP_OOPS) {
2320 ++ /* Panics must be written immediately */
2321 + mtdoops_write(cxt, 1);
2322 +-
2323 +- /* For other cases, schedule work to write it "nicely" */
2324 +- schedule_work(&cxt->work_write);
2325 ++ } else {
2326 ++ /* For other cases, schedule work to write it "nicely" */
2327 ++ schedule_work(&cxt->work_write);
2328 ++ }
2329 + }
2330 +
2331 + static void mtdoops_notify_add(struct mtd_info *mtd)
2332 +diff --git a/drivers/net/can/flexcan.c b/drivers/net/can/flexcan.c
2333 +index 84dd79041285a..94468a883f369 100644
2334 +--- a/drivers/net/can/flexcan.c
2335 ++++ b/drivers/net/can/flexcan.c
2336 +@@ -1055,18 +1055,23 @@ static int flexcan_chip_start(struct net_device *dev)
2337 + return err;
2338 + }
2339 +
2340 +-/* flexcan_chip_stop
2341 ++/* __flexcan_chip_stop
2342 + *
2343 +- * this functions is entered with clocks enabled
2344 ++ * this function is entered with clocks enabled
2345 + */
2346 +-static void flexcan_chip_stop(struct net_device *dev)
2347 ++static int __flexcan_chip_stop(struct net_device *dev, bool disable_on_error)
2348 + {
2349 + struct flexcan_priv *priv = netdev_priv(dev);
2350 + struct flexcan_regs __iomem *regs = priv->regs;
2351 ++ int err;
2352 +
2353 + /* freeze + disable module */
2354 +- flexcan_chip_freeze(priv);
2355 +- flexcan_chip_disable(priv);
2356 ++ err = flexcan_chip_freeze(priv);
2357 ++ if (err && !disable_on_error)
2358 ++ return err;
2359 ++ err = flexcan_chip_disable(priv);
2360 ++ if (err && !disable_on_error)
2361 ++ goto out_chip_unfreeze;
2362 +
2363 + /* Disable all interrupts */
2364 + flexcan_write(0, &regs->imask2);
2365 +@@ -1076,6 +1081,23 @@ static void flexcan_chip_stop(struct net_device *dev)
2366 +
2367 + flexcan_transceiver_disable(priv);
2368 + priv->can.state = CAN_STATE_STOPPED;
2369 ++
2370 ++ return 0;
2371 ++
2372 ++ out_chip_unfreeze:
2373 ++ flexcan_chip_unfreeze(priv);
2374 ++
2375 ++ return err;
2376 ++}
2377 ++
2378 ++static inline int flexcan_chip_stop_disable_on_error(struct net_device *dev)
2379 ++{
2380 ++ return __flexcan_chip_stop(dev, true);
2381 ++}
2382 ++
2383 ++static inline int flexcan_chip_stop(struct net_device *dev)
2384 ++{
2385 ++ return __flexcan_chip_stop(dev, false);
2386 + }
2387 +
2388 + static int flexcan_open(struct net_device *dev)
2389 +@@ -1129,7 +1151,7 @@ static int flexcan_close(struct net_device *dev)
2390 +
2391 + netif_stop_queue(dev);
2392 + can_rx_offload_disable(&priv->offload);
2393 +- flexcan_chip_stop(dev);
2394 ++ flexcan_chip_stop_disable_on_error(dev);
2395 +
2396 + free_irq(dev->irq, dev);
2397 + clk_disable_unprepare(priv->clk_per);
2398 +diff --git a/drivers/net/ethernet/cisco/enic/enic.h b/drivers/net/ethernet/cisco/enic/enic.h
2399 +index ba032ac9ae86c..893c51a94abbd 100644
2400 +--- a/drivers/net/ethernet/cisco/enic/enic.h
2401 ++++ b/drivers/net/ethernet/cisco/enic/enic.h
2402 +@@ -168,6 +168,7 @@ struct enic {
2403 + u16 num_vfs;
2404 + #endif
2405 + spinlock_t enic_api_lock;
2406 ++ bool enic_api_busy;
2407 + struct enic_port_profile *pp;
2408 +
2409 + /* work queue cache line section */
2410 +diff --git a/drivers/net/ethernet/cisco/enic/enic_api.c b/drivers/net/ethernet/cisco/enic/enic_api.c
2411 +index b161f24522b87..b028ea2dec2b9 100644
2412 +--- a/drivers/net/ethernet/cisco/enic/enic_api.c
2413 ++++ b/drivers/net/ethernet/cisco/enic/enic_api.c
2414 +@@ -34,6 +34,12 @@ int enic_api_devcmd_proxy_by_index(struct net_device *netdev, int vf,
2415 + struct vnic_dev *vdev = enic->vdev;
2416 +
2417 + spin_lock(&enic->enic_api_lock);
2418 ++ while (enic->enic_api_busy) {
2419 ++ spin_unlock(&enic->enic_api_lock);
2420 ++ cpu_relax();
2421 ++ spin_lock(&enic->enic_api_lock);
2422 ++ }
2423 ++
2424 + spin_lock_bh(&enic->devcmd_lock);
2425 +
2426 + vnic_dev_cmd_proxy_by_index_start(vdev, vf);
2427 +diff --git a/drivers/net/ethernet/cisco/enic/enic_main.c b/drivers/net/ethernet/cisco/enic/enic_main.c
2428 +index 52a3b32390a9c..f0bbc0fdeddcb 100644
2429 +--- a/drivers/net/ethernet/cisco/enic/enic_main.c
2430 ++++ b/drivers/net/ethernet/cisco/enic/enic_main.c
2431 +@@ -2101,8 +2101,6 @@ static int enic_dev_wait(struct vnic_dev *vdev,
2432 + int done;
2433 + int err;
2434 +
2435 +- BUG_ON(in_interrupt());
2436 +-
2437 + err = start(vdev, arg);
2438 + if (err)
2439 + return err;
2440 +@@ -2279,6 +2277,13 @@ static int enic_set_rss_nic_cfg(struct enic *enic)
2441 + rss_hash_bits, rss_base_cpu, rss_enable);
2442 + }
2443 +
2444 ++static void enic_set_api_busy(struct enic *enic, bool busy)
2445 ++{
2446 ++ spin_lock(&enic->enic_api_lock);
2447 ++ enic->enic_api_busy = busy;
2448 ++ spin_unlock(&enic->enic_api_lock);
2449 ++}
2450 ++
2451 + static void enic_reset(struct work_struct *work)
2452 + {
2453 + struct enic *enic = container_of(work, struct enic, reset);
2454 +@@ -2288,7 +2293,9 @@ static void enic_reset(struct work_struct *work)
2455 +
2456 + rtnl_lock();
2457 +
2458 +- spin_lock(&enic->enic_api_lock);
2459 ++ /* Stop any activity from infiniband */
2460 ++ enic_set_api_busy(enic, true);
2461 ++
2462 + enic_stop(enic->netdev);
2463 + enic_dev_soft_reset(enic);
2464 + enic_reset_addr_lists(enic);
2465 +@@ -2296,7 +2303,10 @@ static void enic_reset(struct work_struct *work)
2466 + enic_set_rss_nic_cfg(enic);
2467 + enic_dev_set_ig_vlan_rewrite_mode(enic);
2468 + enic_open(enic->netdev);
2469 +- spin_unlock(&enic->enic_api_lock);
2470 ++
2471 ++ /* Allow infiniband to fiddle with the device again */
2472 ++ enic_set_api_busy(enic, false);
2473 ++
2474 + call_netdevice_notifiers(NETDEV_REBOOT, enic->netdev);
2475 +
2476 + rtnl_unlock();
2477 +@@ -2308,7 +2318,9 @@ static void enic_tx_hang_reset(struct work_struct *work)
2478 +
2479 + rtnl_lock();
2480 +
2481 +- spin_lock(&enic->enic_api_lock);
2482 ++ /* Stop any activity from infiniband */
2483 ++ enic_set_api_busy(enic, true);
2484 ++
2485 + enic_dev_hang_notify(enic);
2486 + enic_stop(enic->netdev);
2487 + enic_dev_hang_reset(enic);
2488 +@@ -2317,7 +2329,10 @@ static void enic_tx_hang_reset(struct work_struct *work)
2489 + enic_set_rss_nic_cfg(enic);
2490 + enic_dev_set_ig_vlan_rewrite_mode(enic);
2491 + enic_open(enic->netdev);
2492 +- spin_unlock(&enic->enic_api_lock);
2493 ++
2494 ++ /* Allow infiniband to fiddle with the device again */
2495 ++ enic_set_api_busy(enic, false);
2496 ++
2497 + call_netdevice_notifiers(NETDEV_REBOOT, enic->netdev);
2498 +
2499 + rtnl_unlock();
2500 +diff --git a/drivers/net/ethernet/ibm/ibmveth.c b/drivers/net/ethernet/ibm/ibmveth.c
2501 +index b43aebfc7f5be..e0dfec57c3025 100644
2502 +--- a/drivers/net/ethernet/ibm/ibmveth.c
2503 ++++ b/drivers/net/ethernet/ibm/ibmveth.c
2504 +@@ -1330,6 +1330,7 @@ static int ibmveth_poll(struct napi_struct *napi, int budget)
2505 + int offset = ibmveth_rxq_frame_offset(adapter);
2506 + int csum_good = ibmveth_rxq_csum_good(adapter);
2507 + int lrg_pkt = ibmveth_rxq_large_packet(adapter);
2508 ++ __sum16 iph_check = 0;
2509 +
2510 + skb = ibmveth_rxq_get_buffer(adapter);
2511 +
2512 +@@ -1366,16 +1367,26 @@ static int ibmveth_poll(struct napi_struct *napi, int budget)
2513 + skb_put(skb, length);
2514 + skb->protocol = eth_type_trans(skb, netdev);
2515 +
2516 +- if (csum_good) {
2517 +- skb->ip_summed = CHECKSUM_UNNECESSARY;
2518 +- ibmveth_rx_csum_helper(skb, adapter);
2519 ++ /* PHYP without PLSO support places a -1 in the ip
2520 ++ * checksum for large send frames.
2521 ++ */
2522 ++ if (skb->protocol == cpu_to_be16(ETH_P_IP)) {
2523 ++ struct iphdr *iph = (struct iphdr *)skb->data;
2524 ++
2525 ++ iph_check = iph->check;
2526 + }
2527 +
2528 +- if (length > netdev->mtu + ETH_HLEN) {
2529 ++ if ((length > netdev->mtu + ETH_HLEN) ||
2530 ++ lrg_pkt || iph_check == 0xffff) {
2531 + ibmveth_rx_mss_helper(skb, mss, lrg_pkt);
2532 + adapter->rx_large_packets++;
2533 + }
2534 +
2535 ++ if (csum_good) {
2536 ++ skb->ip_summed = CHECKSUM_UNNECESSARY;
2537 ++ ibmveth_rx_csum_helper(skb, adapter);
2538 ++ }
2539 ++
2540 + napi_gro_receive(napi, skb); /* send it up */
2541 +
2542 + netdev->stats.rx_packets++;
2543 +diff --git a/drivers/net/ethernet/korina.c b/drivers/net/ethernet/korina.c
2544 +index 3c0a6451273df..1eccdbaa9a515 100644
2545 +--- a/drivers/net/ethernet/korina.c
2546 ++++ b/drivers/net/ethernet/korina.c
2547 +@@ -1188,7 +1188,7 @@ out:
2548 + return rc;
2549 +
2550 + probe_err_register:
2551 +- kfree(lp->td_ring);
2552 ++ kfree((struct dma_desc *)KSEG0ADDR(lp->td_ring));
2553 + probe_err_td_ring:
2554 + iounmap(lp->tx_dma_regs);
2555 + probe_err_dma_tx:
2556 +@@ -1208,6 +1208,7 @@ static int korina_remove(struct platform_device *pdev)
2557 + iounmap(lp->eth_regs);
2558 + iounmap(lp->rx_dma_regs);
2559 + iounmap(lp->tx_dma_regs);
2560 ++ kfree((struct dma_desc *)KSEG0ADDR(lp->td_ring));
2561 +
2562 + unregister_netdev(bif->dev);
2563 + free_netdev(bif->dev);
2564 +diff --git a/drivers/net/ethernet/mellanox/mlx4/en_rx.c b/drivers/net/ethernet/mellanox/mlx4/en_rx.c
2565 +index c6d101351537a..bb0063e851c34 100644
2566 +--- a/drivers/net/ethernet/mellanox/mlx4/en_rx.c
2567 ++++ b/drivers/net/ethernet/mellanox/mlx4/en_rx.c
2568 +@@ -948,6 +948,9 @@ int mlx4_en_poll_rx_cq(struct napi_struct *napi, int budget)
2569 + bool clean_complete = true;
2570 + int done;
2571 +
2572 ++ if (!budget)
2573 ++ return 0;
2574 ++
2575 + if (priv->tx_ring_num[TX_XDP]) {
2576 + xdp_tx_cq = priv->tx_cq[TX_XDP][cq->ring];
2577 + if (xdp_tx_cq->xdp_busy) {
2578 +diff --git a/drivers/net/ethernet/mellanox/mlx4/en_tx.c b/drivers/net/ethernet/mellanox/mlx4/en_tx.c
2579 +index 8a32a8f7f9c0c..777e22d42c0f0 100644
2580 +--- a/drivers/net/ethernet/mellanox/mlx4/en_tx.c
2581 ++++ b/drivers/net/ethernet/mellanox/mlx4/en_tx.c
2582 +@@ -343,7 +343,7 @@ u32 mlx4_en_recycle_tx_desc(struct mlx4_en_priv *priv,
2583 + .dma = tx_info->map0_dma,
2584 + };
2585 +
2586 +- if (!mlx4_en_rx_recycle(ring->recycle_ring, &frame)) {
2587 ++ if (!napi_mode || !mlx4_en_rx_recycle(ring->recycle_ring, &frame)) {
2588 + dma_unmap_page(priv->ddev, tx_info->map0_dma,
2589 + PAGE_SIZE, priv->dma_dir);
2590 + put_page(tx_info->page);
2591 +diff --git a/drivers/net/ethernet/realtek/r8169.c b/drivers/net/ethernet/realtek/r8169.c
2592 +index c7364d9496e39..72961082e3983 100644
2593 +--- a/drivers/net/ethernet/realtek/r8169.c
2594 ++++ b/drivers/net/ethernet/realtek/r8169.c
2595 +@@ -4501,6 +4501,58 @@ static void rtl_rar_set(struct rtl8169_private *tp, u8 *addr)
2596 + rtl_unlock_work(tp);
2597 + }
2598 +
2599 ++static void rtl_init_rxcfg(struct rtl8169_private *tp)
2600 ++{
2601 ++ void __iomem *ioaddr = tp->mmio_addr;
2602 ++
2603 ++ switch (tp->mac_version) {
2604 ++ case RTL_GIGA_MAC_VER_01:
2605 ++ case RTL_GIGA_MAC_VER_02:
2606 ++ case RTL_GIGA_MAC_VER_03:
2607 ++ case RTL_GIGA_MAC_VER_04:
2608 ++ case RTL_GIGA_MAC_VER_05:
2609 ++ case RTL_GIGA_MAC_VER_06:
2610 ++ case RTL_GIGA_MAC_VER_10:
2611 ++ case RTL_GIGA_MAC_VER_11:
2612 ++ case RTL_GIGA_MAC_VER_12:
2613 ++ case RTL_GIGA_MAC_VER_13:
2614 ++ case RTL_GIGA_MAC_VER_14:
2615 ++ case RTL_GIGA_MAC_VER_15:
2616 ++ case RTL_GIGA_MAC_VER_16:
2617 ++ case RTL_GIGA_MAC_VER_17:
2618 ++ RTL_W32(RxConfig, RX_FIFO_THRESH | RX_DMA_BURST);
2619 ++ break;
2620 ++ case RTL_GIGA_MAC_VER_18:
2621 ++ case RTL_GIGA_MAC_VER_19:
2622 ++ case RTL_GIGA_MAC_VER_20:
2623 ++ case RTL_GIGA_MAC_VER_21:
2624 ++ case RTL_GIGA_MAC_VER_22:
2625 ++ case RTL_GIGA_MAC_VER_23:
2626 ++ case RTL_GIGA_MAC_VER_24:
2627 ++ case RTL_GIGA_MAC_VER_34:
2628 ++ case RTL_GIGA_MAC_VER_35:
2629 ++ RTL_W32(RxConfig, RX128_INT_EN | RX_MULTI_EN | RX_DMA_BURST);
2630 ++ break;
2631 ++ case RTL_GIGA_MAC_VER_40:
2632 ++ case RTL_GIGA_MAC_VER_41:
2633 ++ case RTL_GIGA_MAC_VER_42:
2634 ++ case RTL_GIGA_MAC_VER_43:
2635 ++ case RTL_GIGA_MAC_VER_44:
2636 ++ case RTL_GIGA_MAC_VER_45:
2637 ++ case RTL_GIGA_MAC_VER_46:
2638 ++ case RTL_GIGA_MAC_VER_47:
2639 ++ case RTL_GIGA_MAC_VER_48:
2640 ++ case RTL_GIGA_MAC_VER_49:
2641 ++ case RTL_GIGA_MAC_VER_50:
2642 ++ case RTL_GIGA_MAC_VER_51:
2643 ++ RTL_W32(RxConfig, RX128_INT_EN | RX_MULTI_EN | RX_DMA_BURST | RX_EARLY_OFF);
2644 ++ break;
2645 ++ default:
2646 ++ RTL_W32(RxConfig, RX128_INT_EN | RX_DMA_BURST);
2647 ++ break;
2648 ++ }
2649 ++}
2650 ++
2651 + static int rtl_set_mac_address(struct net_device *dev, void *p)
2652 + {
2653 + struct rtl8169_private *tp = netdev_priv(dev);
2654 +@@ -4519,6 +4571,10 @@ static int rtl_set_mac_address(struct net_device *dev, void *p)
2655 +
2656 + pm_runtime_put_noidle(d);
2657 +
2658 ++ /* Reportedly at least Asus X453MA truncates packets otherwise */
2659 ++ if (tp->mac_version == RTL_GIGA_MAC_VER_37)
2660 ++ rtl_init_rxcfg(tp);
2661 ++
2662 + return 0;
2663 + }
2664 +
2665 +@@ -4956,58 +5012,6 @@ static void rtl_init_pll_power_ops(struct rtl8169_private *tp)
2666 + }
2667 + }
2668 +
2669 +-static void rtl_init_rxcfg(struct rtl8169_private *tp)
2670 +-{
2671 +- void __iomem *ioaddr = tp->mmio_addr;
2672 +-
2673 +- switch (tp->mac_version) {
2674 +- case RTL_GIGA_MAC_VER_01:
2675 +- case RTL_GIGA_MAC_VER_02:
2676 +- case RTL_GIGA_MAC_VER_03:
2677 +- case RTL_GIGA_MAC_VER_04:
2678 +- case RTL_GIGA_MAC_VER_05:
2679 +- case RTL_GIGA_MAC_VER_06:
2680 +- case RTL_GIGA_MAC_VER_10:
2681 +- case RTL_GIGA_MAC_VER_11:
2682 +- case RTL_GIGA_MAC_VER_12:
2683 +- case RTL_GIGA_MAC_VER_13:
2684 +- case RTL_GIGA_MAC_VER_14:
2685 +- case RTL_GIGA_MAC_VER_15:
2686 +- case RTL_GIGA_MAC_VER_16:
2687 +- case RTL_GIGA_MAC_VER_17:
2688 +- RTL_W32(RxConfig, RX_FIFO_THRESH | RX_DMA_BURST);
2689 +- break;
2690 +- case RTL_GIGA_MAC_VER_18:
2691 +- case RTL_GIGA_MAC_VER_19:
2692 +- case RTL_GIGA_MAC_VER_20:
2693 +- case RTL_GIGA_MAC_VER_21:
2694 +- case RTL_GIGA_MAC_VER_22:
2695 +- case RTL_GIGA_MAC_VER_23:
2696 +- case RTL_GIGA_MAC_VER_24:
2697 +- case RTL_GIGA_MAC_VER_34:
2698 +- case RTL_GIGA_MAC_VER_35:
2699 +- RTL_W32(RxConfig, RX128_INT_EN | RX_MULTI_EN | RX_DMA_BURST);
2700 +- break;
2701 +- case RTL_GIGA_MAC_VER_40:
2702 +- case RTL_GIGA_MAC_VER_41:
2703 +- case RTL_GIGA_MAC_VER_42:
2704 +- case RTL_GIGA_MAC_VER_43:
2705 +- case RTL_GIGA_MAC_VER_44:
2706 +- case RTL_GIGA_MAC_VER_45:
2707 +- case RTL_GIGA_MAC_VER_46:
2708 +- case RTL_GIGA_MAC_VER_47:
2709 +- case RTL_GIGA_MAC_VER_48:
2710 +- case RTL_GIGA_MAC_VER_49:
2711 +- case RTL_GIGA_MAC_VER_50:
2712 +- case RTL_GIGA_MAC_VER_51:
2713 +- RTL_W32(RxConfig, RX128_INT_EN | RX_MULTI_EN | RX_DMA_BURST | RX_EARLY_OFF);
2714 +- break;
2715 +- default:
2716 +- RTL_W32(RxConfig, RX128_INT_EN | RX_DMA_BURST);
2717 +- break;
2718 +- }
2719 +-}
2720 +-
2721 + static void rtl8169_init_ring_indexes(struct rtl8169_private *tp)
2722 + {
2723 + tp->dirty_tx = tp->cur_tx = tp->cur_rx = 0;
2724 +diff --git a/drivers/net/usb/qmi_wwan.c b/drivers/net/usb/qmi_wwan.c
2725 +index 3e3dca59b7a69..2f79a5f1552d4 100644
2726 +--- a/drivers/net/usb/qmi_wwan.c
2727 ++++ b/drivers/net/usb/qmi_wwan.c
2728 +@@ -1301,6 +1301,7 @@ static const struct usb_device_id products[] = {
2729 + {QMI_QUIRK_SET_DTR(0x2cb7, 0x0104, 4)}, /* Fibocom NL678 series */
2730 + {QMI_FIXED_INTF(0x0489, 0xe0b4, 0)}, /* Foxconn T77W968 LTE */
2731 + {QMI_FIXED_INTF(0x0489, 0xe0b5, 0)}, /* Foxconn T77W968 LTE with eSIM support*/
2732 ++ {QMI_FIXED_INTF(0x2692, 0x9025, 4)}, /* Cellient MPL200 (rebranded Qualcomm 05c6:9025) */
2733 +
2734 + /* 4. Gobi 1000 devices */
2735 + {QMI_GOBI1K_DEVICE(0x05c6, 0x9212)}, /* Acer Gobi Modem Device */
2736 +diff --git a/drivers/net/wan/hdlc.c b/drivers/net/wan/hdlc.c
2737 +index 7221a53b8b144..500463044b1ab 100644
2738 +--- a/drivers/net/wan/hdlc.c
2739 ++++ b/drivers/net/wan/hdlc.c
2740 +@@ -49,7 +49,15 @@ static struct hdlc_proto *first_proto;
2741 + static int hdlc_rcv(struct sk_buff *skb, struct net_device *dev,
2742 + struct packet_type *p, struct net_device *orig_dev)
2743 + {
2744 +- struct hdlc_device *hdlc = dev_to_hdlc(dev);
2745 ++ struct hdlc_device *hdlc;
2746 ++
2747 ++ /* First make sure "dev" is an HDLC device */
2748 ++ if (!(dev->priv_flags & IFF_WAN_HDLC)) {
2749 ++ kfree_skb(skb);
2750 ++ return NET_RX_SUCCESS;
2751 ++ }
2752 ++
2753 ++ hdlc = dev_to_hdlc(dev);
2754 +
2755 + if (!net_eq(dev_net(dev), &init_net)) {
2756 + kfree_skb(skb);
2757 +diff --git a/drivers/net/wan/hdlc_raw_eth.c b/drivers/net/wan/hdlc_raw_eth.c
2758 +index 8bd3ed9058132..676dea2918bf3 100644
2759 +--- a/drivers/net/wan/hdlc_raw_eth.c
2760 ++++ b/drivers/net/wan/hdlc_raw_eth.c
2761 +@@ -102,6 +102,7 @@ static int raw_eth_ioctl(struct net_device *dev, struct ifreq *ifr)
2762 + old_qlen = dev->tx_queue_len;
2763 + ether_setup(dev);
2764 + dev->tx_queue_len = old_qlen;
2765 ++ dev->priv_flags &= ~IFF_TX_SKB_SHARING;
2766 + eth_hw_addr_random(dev);
2767 + call_netdevice_notifiers(NETDEV_POST_TYPE_CHANGE, dev);
2768 + netif_dormant_off(dev);
2769 +diff --git a/drivers/net/wireless/ath/ath10k/htt_rx.c b/drivers/net/wireless/ath/ath10k/htt_rx.c
2770 +index 21642bab485a1..fd276e54bb7c2 100644
2771 +--- a/drivers/net/wireless/ath/ath10k/htt_rx.c
2772 ++++ b/drivers/net/wireless/ath/ath10k/htt_rx.c
2773 +@@ -100,6 +100,14 @@ static int __ath10k_htt_rx_ring_fill_n(struct ath10k_htt *htt, int num)
2774 + BUILD_BUG_ON(HTT_RX_RING_FILL_LEVEL >= HTT_RX_RING_SIZE / 2);
2775 +
2776 + idx = __le32_to_cpu(*htt->rx_ring.alloc_idx.vaddr);
2777 ++
2778 ++ if (idx < 0 || idx >= htt->rx_ring.size) {
2779 ++ ath10k_err(htt->ar, "rx ring index is not valid, firmware malfunctioning?\n");
2780 ++ idx &= htt->rx_ring.size_mask;
2781 ++ ret = -ENOMEM;
2782 ++ goto fail;
2783 ++ }
2784 ++
2785 + while (num > 0) {
2786 + skb = dev_alloc_skb(HTT_RX_BUF_SIZE + HTT_RX_DESC_ALIGN);
2787 + if (!skb) {
2788 +diff --git a/drivers/net/wireless/ath/ath10k/mac.c b/drivers/net/wireless/ath/ath10k/mac.c
2789 +index ea47ad4b2343b..be4420ff52b8a 100644
2790 +--- a/drivers/net/wireless/ath/ath10k/mac.c
2791 ++++ b/drivers/net/wireless/ath/ath10k/mac.c
2792 +@@ -6718,7 +6718,7 @@ ath10k_mac_update_bss_chan_survey(struct ath10k *ar,
2793 + struct ieee80211_channel *channel)
2794 + {
2795 + int ret;
2796 +- enum wmi_bss_survey_req_type type = WMI_BSS_SURVEY_REQ_TYPE_READ_CLEAR;
2797 ++ enum wmi_bss_survey_req_type type = WMI_BSS_SURVEY_REQ_TYPE_READ;
2798 +
2799 + lockdep_assert_held(&ar->conf_mutex);
2800 +
2801 +diff --git a/drivers/net/wireless/ath/ath6kl/main.c b/drivers/net/wireless/ath/ath6kl/main.c
2802 +index b90c77ef792ef..1c542cf0fd058 100644
2803 +--- a/drivers/net/wireless/ath/ath6kl/main.c
2804 ++++ b/drivers/net/wireless/ath/ath6kl/main.c
2805 +@@ -430,6 +430,9 @@ void ath6kl_connect_ap_mode_sta(struct ath6kl_vif *vif, u16 aid, u8 *mac_addr,
2806 +
2807 + ath6kl_dbg(ATH6KL_DBG_TRC, "new station %pM aid=%d\n", mac_addr, aid);
2808 +
2809 ++ if (aid < 1 || aid > AP_MAX_NUM_STA)
2810 ++ return;
2811 ++
2812 + if (assoc_req_len > sizeof(struct ieee80211_hdr_3addr)) {
2813 + struct ieee80211_mgmt *mgmt =
2814 + (struct ieee80211_mgmt *) assoc_info;
2815 +diff --git a/drivers/net/wireless/ath/ath6kl/wmi.c b/drivers/net/wireless/ath/ath6kl/wmi.c
2816 +index d79c2bccf5822..f80f1757b58fc 100644
2817 +--- a/drivers/net/wireless/ath/ath6kl/wmi.c
2818 ++++ b/drivers/net/wireless/ath/ath6kl/wmi.c
2819 +@@ -2648,6 +2648,11 @@ int ath6kl_wmi_delete_pstream_cmd(struct wmi *wmi, u8 if_idx, u8 traffic_class,
2820 + return -EINVAL;
2821 + }
2822 +
2823 ++ if (tsid >= 16) {
2824 ++ ath6kl_err("invalid tsid: %d\n", tsid);
2825 ++ return -EINVAL;
2826 ++ }
2827 ++
2828 + skb = ath6kl_wmi_get_new_buf(sizeof(*cmd));
2829 + if (!skb)
2830 + return -ENOMEM;
2831 +diff --git a/drivers/net/wireless/ath/ath9k/hif_usb.c b/drivers/net/wireless/ath/ath9k/hif_usb.c
2832 +index e80d509bc5415..ce3a785212740 100644
2833 +--- a/drivers/net/wireless/ath/ath9k/hif_usb.c
2834 ++++ b/drivers/net/wireless/ath/ath9k/hif_usb.c
2835 +@@ -447,10 +447,19 @@ static void hif_usb_stop(void *hif_handle)
2836 + spin_unlock_irqrestore(&hif_dev->tx.tx_lock, flags);
2837 +
2838 + /* The pending URBs have to be canceled. */
2839 ++ spin_lock_irqsave(&hif_dev->tx.tx_lock, flags);
2840 + list_for_each_entry_safe(tx_buf, tx_buf_tmp,
2841 + &hif_dev->tx.tx_pending, list) {
2842 ++ usb_get_urb(tx_buf->urb);
2843 ++ spin_unlock_irqrestore(&hif_dev->tx.tx_lock, flags);
2844 + usb_kill_urb(tx_buf->urb);
2845 ++ list_del(&tx_buf->list);
2846 ++ usb_free_urb(tx_buf->urb);
2847 ++ kfree(tx_buf->buf);
2848 ++ kfree(tx_buf);
2849 ++ spin_lock_irqsave(&hif_dev->tx.tx_lock, flags);
2850 + }
2851 ++ spin_unlock_irqrestore(&hif_dev->tx.tx_lock, flags);
2852 +
2853 + usb_kill_anchored_urbs(&hif_dev->mgmt_submitted);
2854 + }
2855 +@@ -760,27 +769,37 @@ static void ath9k_hif_usb_dealloc_tx_urbs(struct hif_device_usb *hif_dev)
2856 + struct tx_buf *tx_buf = NULL, *tx_buf_tmp = NULL;
2857 + unsigned long flags;
2858 +
2859 ++ spin_lock_irqsave(&hif_dev->tx.tx_lock, flags);
2860 + list_for_each_entry_safe(tx_buf, tx_buf_tmp,
2861 + &hif_dev->tx.tx_buf, list) {
2862 ++ usb_get_urb(tx_buf->urb);
2863 ++ spin_unlock_irqrestore(&hif_dev->tx.tx_lock, flags);
2864 + usb_kill_urb(tx_buf->urb);
2865 + list_del(&tx_buf->list);
2866 + usb_free_urb(tx_buf->urb);
2867 + kfree(tx_buf->buf);
2868 + kfree(tx_buf);
2869 ++ spin_lock_irqsave(&hif_dev->tx.tx_lock, flags);
2870 + }
2871 ++ spin_unlock_irqrestore(&hif_dev->tx.tx_lock, flags);
2872 +
2873 + spin_lock_irqsave(&hif_dev->tx.tx_lock, flags);
2874 + hif_dev->tx.flags |= HIF_USB_TX_FLUSH;
2875 + spin_unlock_irqrestore(&hif_dev->tx.tx_lock, flags);
2876 +
2877 ++ spin_lock_irqsave(&hif_dev->tx.tx_lock, flags);
2878 + list_for_each_entry_safe(tx_buf, tx_buf_tmp,
2879 + &hif_dev->tx.tx_pending, list) {
2880 ++ usb_get_urb(tx_buf->urb);
2881 ++ spin_unlock_irqrestore(&hif_dev->tx.tx_lock, flags);
2882 + usb_kill_urb(tx_buf->urb);
2883 + list_del(&tx_buf->list);
2884 + usb_free_urb(tx_buf->urb);
2885 + kfree(tx_buf->buf);
2886 + kfree(tx_buf);
2887 ++ spin_lock_irqsave(&hif_dev->tx.tx_lock, flags);
2888 + }
2889 ++ spin_unlock_irqrestore(&hif_dev->tx.tx_lock, flags);
2890 +
2891 + usb_kill_anchored_urbs(&hif_dev->mgmt_submitted);
2892 + }
2893 +diff --git a/drivers/net/wireless/ath/ath9k/htc_hst.c b/drivers/net/wireless/ath/ath9k/htc_hst.c
2894 +index f705f0e1cb5be..05fca38b38ed4 100644
2895 +--- a/drivers/net/wireless/ath/ath9k/htc_hst.c
2896 ++++ b/drivers/net/wireless/ath/ath9k/htc_hst.c
2897 +@@ -342,6 +342,8 @@ void ath9k_htc_txcompletion_cb(struct htc_target *htc_handle,
2898 +
2899 + if (skb) {
2900 + htc_hdr = (struct htc_frame_hdr *) skb->data;
2901 ++ if (htc_hdr->endpoint_id >= ARRAY_SIZE(htc_handle->endpoint))
2902 ++ goto ret;
2903 + endpoint = &htc_handle->endpoint[htc_hdr->endpoint_id];
2904 + skb_pull(skb, sizeof(struct htc_frame_hdr));
2905 +
2906 +diff --git a/drivers/net/wireless/ath/wcn36xx/main.c b/drivers/net/wireless/ath/wcn36xx/main.c
2907 +index 688152bcfc15c..2450f5f7f79f3 100644
2908 +--- a/drivers/net/wireless/ath/wcn36xx/main.c
2909 ++++ b/drivers/net/wireless/ath/wcn36xx/main.c
2910 +@@ -162,7 +162,7 @@ static struct ieee80211_supported_band wcn_band_5ghz = {
2911 + .ampdu_density = IEEE80211_HT_MPDU_DENSITY_16,
2912 + .mcs = {
2913 + .rx_mask = { 0xff, 0, 0, 0, 0, 0, 0, 0, 0, 0, },
2914 +- .rx_highest = cpu_to_le16(72),
2915 ++ .rx_highest = cpu_to_le16(150),
2916 + .tx_params = IEEE80211_HT_MCS_TX_DEFINED,
2917 + }
2918 + }
2919 +diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
2920 +index bfc0e37b7f344..590bef2defb94 100644
2921 +--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
2922 ++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
2923 +@@ -318,7 +318,7 @@ static int brcmf_rx_hdrpull(struct brcmf_pub *drvr, struct sk_buff *skb,
2924 + ret = brcmf_proto_hdrpull(drvr, true, skb, ifp);
2925 +
2926 + if (ret || !(*ifp) || !(*ifp)->ndev) {
2927 +- if (ret != -ENODATA && *ifp)
2928 ++ if (ret != -ENODATA && *ifp && (*ifp)->ndev)
2929 + (*ifp)->ndev->stats.rx_errors++;
2930 + brcmu_pkt_buf_free_skb(skb);
2931 + return -ENODATA;
2932 +diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/msgbuf.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/msgbuf.c
2933 +index 65e16e3646ecf..5f0af5fac343d 100644
2934 +--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/msgbuf.c
2935 ++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/msgbuf.c
2936 +@@ -1538,6 +1538,8 @@ fail:
2937 + BRCMF_TX_IOCTL_MAX_MSG_SIZE,
2938 + msgbuf->ioctbuf,
2939 + msgbuf->ioctbuf_handle);
2940 ++ if (msgbuf->txflow_wq)
2941 ++ destroy_workqueue(msgbuf->txflow_wq);
2942 + kfree(msgbuf);
2943 + }
2944 + return -ENOMEM;
2945 +diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmsmac/phy/phy_lcn.c b/drivers/net/wireless/broadcom/brcm80211/brcmsmac/phy/phy_lcn.c
2946 +index 93d4cde0eb313..c9f48ec46f4a1 100644
2947 +--- a/drivers/net/wireless/broadcom/brcm80211/brcmsmac/phy/phy_lcn.c
2948 ++++ b/drivers/net/wireless/broadcom/brcm80211/brcmsmac/phy/phy_lcn.c
2949 +@@ -5090,8 +5090,10 @@ bool wlc_phy_attach_lcnphy(struct brcms_phy *pi)
2950 + pi->pi_fptr.radioloftget = wlc_lcnphy_get_radio_loft;
2951 + pi->pi_fptr.detach = wlc_phy_detach_lcnphy;
2952 +
2953 +- if (!wlc_phy_txpwr_srom_read_lcnphy(pi))
2954 ++ if (!wlc_phy_txpwr_srom_read_lcnphy(pi)) {
2955 ++ kfree(pi->u.pi_lcnphy);
2956 + return false;
2957 ++ }
2958 +
2959 + if (LCNREV_IS(pi->pubpi.phy_rev, 1)) {
2960 + if (pi_lcn->lcnphy_tempsense_option == 3) {
2961 +diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c b/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c
2962 +index b86c7a36d3f17..ec2ecdd1cc4ec 100644
2963 +--- a/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c
2964 ++++ b/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c
2965 +@@ -3198,9 +3198,12 @@ static int iwl_mvm_send_aux_roc_cmd(struct iwl_mvm *mvm,
2966 + aux_roc_req.apply_time_max_delay = cpu_to_le32(delay);
2967 +
2968 + IWL_DEBUG_TE(mvm,
2969 +- "ROC: Requesting to remain on channel %u for %ums (requested = %ums, max_delay = %ums, dtim_interval = %ums)\n",
2970 +- channel->hw_value, req_dur, duration, delay,
2971 +- dtim_interval);
2972 ++ "ROC: Requesting to remain on channel %u for %ums\n",
2973 ++ channel->hw_value, req_dur);
2974 ++ IWL_DEBUG_TE(mvm,
2975 ++ "\t(requested = %ums, max_delay = %ums, dtim_interval = %ums)\n",
2976 ++ duration, delay, dtim_interval);
2977 ++
2978 + /* Set the node address */
2979 + memcpy(aux_roc_req.node_addr, vif->addr, ETH_ALEN);
2980 +
2981 +diff --git a/drivers/net/wireless/marvell/mwifiex/scan.c b/drivers/net/wireless/marvell/mwifiex/scan.c
2982 +index 0071c40afe81b..a95b1368dad71 100644
2983 +--- a/drivers/net/wireless/marvell/mwifiex/scan.c
2984 ++++ b/drivers/net/wireless/marvell/mwifiex/scan.c
2985 +@@ -1890,7 +1890,7 @@ mwifiex_parse_single_response_buf(struct mwifiex_private *priv, u8 **bss_info,
2986 + chan, CFG80211_BSS_FTYPE_UNKNOWN,
2987 + bssid, timestamp,
2988 + cap_info_bitmap, beacon_period,
2989 +- ie_buf, ie_len, rssi, GFP_KERNEL);
2990 ++ ie_buf, ie_len, rssi, GFP_ATOMIC);
2991 + if (bss) {
2992 + bss_priv = (struct mwifiex_bss_priv *)bss->priv;
2993 + bss_priv->band = band;
2994 +diff --git a/drivers/net/wireless/marvell/mwifiex/sdio.c b/drivers/net/wireless/marvell/mwifiex/sdio.c
2995 +index fd5183c10c4ed..0e858621eef32 100644
2996 +--- a/drivers/net/wireless/marvell/mwifiex/sdio.c
2997 ++++ b/drivers/net/wireless/marvell/mwifiex/sdio.c
2998 +@@ -1973,6 +1973,8 @@ error:
2999 + kfree(card->mpa_rx.buf);
3000 + card->mpa_tx.buf_size = 0;
3001 + card->mpa_rx.buf_size = 0;
3002 ++ card->mpa_tx.buf = NULL;
3003 ++ card->mpa_rx.buf = NULL;
3004 + }
3005 +
3006 + return ret;
3007 +diff --git a/drivers/net/wireless/marvell/mwifiex/usb.c b/drivers/net/wireless/marvell/mwifiex/usb.c
3008 +index 50890cab8807b..44d5005188c93 100644
3009 +--- a/drivers/net/wireless/marvell/mwifiex/usb.c
3010 ++++ b/drivers/net/wireless/marvell/mwifiex/usb.c
3011 +@@ -1335,7 +1335,8 @@ static void mwifiex_usb_cleanup_tx_aggr(struct mwifiex_adapter *adapter)
3012 + skb_dequeue(&port->tx_aggr.aggr_list)))
3013 + mwifiex_write_data_complete(adapter, skb_tmp,
3014 + 0, -1);
3015 +- del_timer_sync(&port->tx_aggr.timer_cnxt.hold_timer);
3016 ++ if (port->tx_aggr.timer_cnxt.hold_timer.function)
3017 ++ del_timer_sync(&port->tx_aggr.timer_cnxt.hold_timer);
3018 + port->tx_aggr.timer_cnxt.is_hold_timer_set = false;
3019 + port->tx_aggr.timer_cnxt.hold_tmo_msecs = 0;
3020 + }
3021 +diff --git a/drivers/net/wireless/quantenna/qtnfmac/commands.c b/drivers/net/wireless/quantenna/qtnfmac/commands.c
3022 +index ed087bbc6f631..f37fda2238acc 100644
3023 +--- a/drivers/net/wireless/quantenna/qtnfmac/commands.c
3024 ++++ b/drivers/net/wireless/quantenna/qtnfmac/commands.c
3025 +@@ -796,6 +796,7 @@ int qtnf_cmd_send_del_intf(struct qtnf_vif *vif)
3026 + default:
3027 + pr_warn("VIF%u.%u: unsupported iftype %d\n", vif->mac->macid,
3028 + vif->vifid, vif->wdev.iftype);
3029 ++ dev_kfree_skb(cmd_skb);
3030 + ret = -EINVAL;
3031 + goto out;
3032 + }
3033 +@@ -1882,6 +1883,7 @@ int qtnf_cmd_send_change_sta(struct qtnf_vif *vif, const u8 *mac,
3034 + break;
3035 + default:
3036 + pr_err("unsupported iftype %d\n", vif->wdev.iftype);
3037 ++ dev_kfree_skb(cmd_skb);
3038 + ret = -EINVAL;
3039 + goto out;
3040 + }
3041 +diff --git a/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c b/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c
3042 +index 63f37fa72e4ba..5cf61710ae2f1 100644
3043 +--- a/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c
3044 ++++ b/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c
3045 +@@ -5453,7 +5453,6 @@ static int rtl8xxxu_submit_int_urb(struct ieee80211_hw *hw)
3046 + ret = usb_submit_urb(urb, GFP_KERNEL);
3047 + if (ret) {
3048 + usb_unanchor_urb(urb);
3049 +- usb_free_urb(urb);
3050 + goto error;
3051 + }
3052 +
3053 +@@ -5462,6 +5461,7 @@ static int rtl8xxxu_submit_int_urb(struct ieee80211_hw *hw)
3054 + rtl8xxxu_write32(priv, REG_USB_HIMR, val32);
3055 +
3056 + error:
3057 ++ usb_free_urb(urb);
3058 + return ret;
3059 + }
3060 +
3061 +@@ -5787,6 +5787,7 @@ static int rtl8xxxu_start(struct ieee80211_hw *hw)
3062 + struct rtl8xxxu_priv *priv = hw->priv;
3063 + struct rtl8xxxu_rx_urb *rx_urb;
3064 + struct rtl8xxxu_tx_urb *tx_urb;
3065 ++ struct sk_buff *skb;
3066 + unsigned long flags;
3067 + int ret, i;
3068 +
3069 +@@ -5837,6 +5838,13 @@ static int rtl8xxxu_start(struct ieee80211_hw *hw)
3070 + rx_urb->hw = hw;
3071 +
3072 + ret = rtl8xxxu_submit_rx_urb(priv, rx_urb);
3073 ++ if (ret) {
3074 ++ if (ret != -ENOMEM) {
3075 ++ skb = (struct sk_buff *)rx_urb->urb.context;
3076 ++ dev_kfree_skb(skb);
3077 ++ }
3078 ++ rtl8xxxu_queue_rx_urb(priv, rx_urb);
3079 ++ }
3080 + }
3081 + exit:
3082 + /*
3083 +diff --git a/drivers/ntb/hw/amd/ntb_hw_amd.c b/drivers/ntb/hw/amd/ntb_hw_amd.c
3084 +index f0788aae05c9c..72a7981ef73fb 100644
3085 +--- a/drivers/ntb/hw/amd/ntb_hw_amd.c
3086 ++++ b/drivers/ntb/hw/amd/ntb_hw_amd.c
3087 +@@ -1032,6 +1032,7 @@ static int amd_ntb_init_pci(struct amd_ntb_dev *ndev,
3088 +
3089 + err_dma_mask:
3090 + pci_clear_master(pdev);
3091 ++ pci_release_regions(pdev);
3092 + err_pci_regions:
3093 + pci_disable_device(pdev);
3094 + err_pci_enable:
3095 +diff --git a/drivers/nvme/target/core.c b/drivers/nvme/target/core.c
3096 +index d0be85d0c289a..7d6d30a2d7719 100644
3097 +--- a/drivers/nvme/target/core.c
3098 ++++ b/drivers/nvme/target/core.c
3099 +@@ -611,7 +611,8 @@ static void nvmet_start_ctrl(struct nvmet_ctrl *ctrl)
3100 + * in case a host died before it enabled the controller. Hence, simply
3101 + * reset the keep alive timer when the controller is enabled.
3102 + */
3103 +- mod_delayed_work(system_wq, &ctrl->ka_work, ctrl->kato * HZ);
3104 ++ if (ctrl->kato)
3105 ++ mod_delayed_work(system_wq, &ctrl->ka_work, ctrl->kato * HZ);
3106 + }
3107 +
3108 + static void nvmet_clear_ctrl(struct nvmet_ctrl *ctrl)
3109 +diff --git a/drivers/pci/host/pcie-iproc-msi.c b/drivers/pci/host/pcie-iproc-msi.c
3110 +index 2d0f535a2f69a..7e6f7b8504d2f 100644
3111 +--- a/drivers/pci/host/pcie-iproc-msi.c
3112 ++++ b/drivers/pci/host/pcie-iproc-msi.c
3113 +@@ -217,15 +217,20 @@ static int iproc_msi_irq_set_affinity(struct irq_data *data,
3114 + struct iproc_msi *msi = irq_data_get_irq_chip_data(data);
3115 + int target_cpu = cpumask_first(mask);
3116 + int curr_cpu;
3117 ++ int ret;
3118 +
3119 + curr_cpu = hwirq_to_cpu(msi, data->hwirq);
3120 + if (curr_cpu == target_cpu)
3121 +- return IRQ_SET_MASK_OK_DONE;
3122 ++ ret = IRQ_SET_MASK_OK_DONE;
3123 ++ else {
3124 ++ /* steer MSI to the target CPU */
3125 ++ data->hwirq = hwirq_to_canonical_hwirq(msi, data->hwirq) + target_cpu;
3126 ++ ret = IRQ_SET_MASK_OK;
3127 ++ }
3128 +
3129 +- /* steer MSI to the target CPU */
3130 +- data->hwirq = hwirq_to_canonical_hwirq(msi, data->hwirq) + target_cpu;
3131 ++ irq_data_update_effective_affinity(data, cpumask_of(target_cpu));
3132 +
3133 +- return IRQ_SET_MASK_OK;
3134 ++ return ret;
3135 + }
3136 +
3137 + static void iproc_msi_irq_compose_msi_msg(struct irq_data *data,
3138 +diff --git a/drivers/perf/xgene_pmu.c b/drivers/perf/xgene_pmu.c
3139 +index 8b79c2f7931f1..806fb1f415c29 100644
3140 +--- a/drivers/perf/xgene_pmu.c
3141 ++++ b/drivers/perf/xgene_pmu.c
3142 +@@ -1474,17 +1474,6 @@ static char *xgene_pmu_dev_name(struct device *dev, u32 type, int id)
3143 + }
3144 +
3145 + #if defined(CONFIG_ACPI)
3146 +-static int acpi_pmu_dev_add_resource(struct acpi_resource *ares, void *data)
3147 +-{
3148 +- struct resource *res = data;
3149 +-
3150 +- if (ares->type == ACPI_RESOURCE_TYPE_FIXED_MEMORY32)
3151 +- acpi_dev_resource_memory(ares, res);
3152 +-
3153 +- /* Always tell the ACPI core to skip this resource */
3154 +- return 1;
3155 +-}
3156 +-
3157 + static struct
3158 + xgene_pmu_dev_ctx *acpi_get_pmu_hw_inf(struct xgene_pmu *xgene_pmu,
3159 + struct acpi_device *adev, u32 type)
3160 +@@ -1496,6 +1485,7 @@ xgene_pmu_dev_ctx *acpi_get_pmu_hw_inf(struct xgene_pmu *xgene_pmu,
3161 + struct hw_pmu_info *inf;
3162 + void __iomem *dev_csr;
3163 + struct resource res;
3164 ++ struct resource_entry *rentry;
3165 + int enable_bit;
3166 + int rc;
3167 +
3168 +@@ -1504,11 +1494,23 @@ xgene_pmu_dev_ctx *acpi_get_pmu_hw_inf(struct xgene_pmu *xgene_pmu,
3169 + return NULL;
3170 +
3171 + INIT_LIST_HEAD(&resource_list);
3172 +- rc = acpi_dev_get_resources(adev, &resource_list,
3173 +- acpi_pmu_dev_add_resource, &res);
3174 ++ rc = acpi_dev_get_resources(adev, &resource_list, NULL, NULL);
3175 ++ if (rc <= 0) {
3176 ++ dev_err(dev, "PMU type %d: No resources found\n", type);
3177 ++ return NULL;
3178 ++ }
3179 ++
3180 ++ list_for_each_entry(rentry, &resource_list, node) {
3181 ++ if (resource_type(rentry->res) == IORESOURCE_MEM) {
3182 ++ res = *rentry->res;
3183 ++ rentry = NULL;
3184 ++ break;
3185 ++ }
3186 ++ }
3187 + acpi_dev_free_resource_list(&resource_list);
3188 +- if (rc < 0) {
3189 +- dev_err(dev, "PMU type %d: No resource address found\n", type);
3190 ++
3191 ++ if (rentry) {
3192 ++ dev_err(dev, "PMU type %d: No memory resource found\n", type);
3193 + return NULL;
3194 + }
3195 +
3196 +diff --git a/drivers/pinctrl/pinctrl-mcp23s08.c b/drivers/pinctrl/pinctrl-mcp23s08.c
3197 +index 22558bf294246..5971338c87572 100644
3198 +--- a/drivers/pinctrl/pinctrl-mcp23s08.c
3199 ++++ b/drivers/pinctrl/pinctrl-mcp23s08.c
3200 +@@ -119,7 +119,7 @@ static const struct regmap_config mcp23x08_regmap = {
3201 + .max_register = MCP_OLAT,
3202 + };
3203 +
3204 +-static const struct reg_default mcp23x16_defaults[] = {
3205 ++static const struct reg_default mcp23x17_defaults[] = {
3206 + {.reg = MCP_IODIR << 1, .def = 0xffff},
3207 + {.reg = MCP_IPOL << 1, .def = 0x0000},
3208 + {.reg = MCP_GPINTEN << 1, .def = 0x0000},
3209 +@@ -130,23 +130,23 @@ static const struct reg_default mcp23x16_defaults[] = {
3210 + {.reg = MCP_OLAT << 1, .def = 0x0000},
3211 + };
3212 +
3213 +-static const struct regmap_range mcp23x16_volatile_range = {
3214 ++static const struct regmap_range mcp23x17_volatile_range = {
3215 + .range_min = MCP_INTF << 1,
3216 + .range_max = MCP_GPIO << 1,
3217 + };
3218 +
3219 +-static const struct regmap_access_table mcp23x16_volatile_table = {
3220 +- .yes_ranges = &mcp23x16_volatile_range,
3221 ++static const struct regmap_access_table mcp23x17_volatile_table = {
3222 ++ .yes_ranges = &mcp23x17_volatile_range,
3223 + .n_yes_ranges = 1,
3224 + };
3225 +
3226 +-static const struct regmap_range mcp23x16_precious_range = {
3227 +- .range_min = MCP_GPIO << 1,
3228 ++static const struct regmap_range mcp23x17_precious_range = {
3229 ++ .range_min = MCP_INTCAP << 1,
3230 + .range_max = MCP_GPIO << 1,
3231 + };
3232 +
3233 +-static const struct regmap_access_table mcp23x16_precious_table = {
3234 +- .yes_ranges = &mcp23x16_precious_range,
3235 ++static const struct regmap_access_table mcp23x17_precious_table = {
3236 ++ .yes_ranges = &mcp23x17_precious_range,
3237 + .n_yes_ranges = 1,
3238 + };
3239 +
3240 +@@ -156,10 +156,10 @@ static const struct regmap_config mcp23x17_regmap = {
3241 +
3242 + .reg_stride = 2,
3243 + .max_register = MCP_OLAT << 1,
3244 +- .volatile_table = &mcp23x16_volatile_table,
3245 +- .precious_table = &mcp23x16_precious_table,
3246 +- .reg_defaults = mcp23x16_defaults,
3247 +- .num_reg_defaults = ARRAY_SIZE(mcp23x16_defaults),
3248 ++ .volatile_table = &mcp23x17_volatile_table,
3249 ++ .precious_table = &mcp23x17_precious_table,
3250 ++ .reg_defaults = mcp23x17_defaults,
3251 ++ .num_reg_defaults = ARRAY_SIZE(mcp23x17_defaults),
3252 + .cache_type = REGCACHE_FLAT,
3253 + .val_format_endian = REGMAP_ENDIAN_LITTLE,
3254 + };
3255 +diff --git a/drivers/pwm/pwm-lpss.c b/drivers/pwm/pwm-lpss.c
3256 +index 7a4a6406cf69a..69f8be065919e 100644
3257 +--- a/drivers/pwm/pwm-lpss.c
3258 ++++ b/drivers/pwm/pwm-lpss.c
3259 +@@ -105,10 +105,12 @@ static void pwm_lpss_prepare(struct pwm_lpss_chip *lpwm, struct pwm_device *pwm,
3260 + * The equation is:
3261 + * base_unit = round(base_unit_range * freq / c)
3262 + */
3263 +- base_unit_range = BIT(lpwm->info->base_unit_bits) - 1;
3264 ++ base_unit_range = BIT(lpwm->info->base_unit_bits);
3265 + freq *= base_unit_range;
3266 +
3267 + base_unit = DIV_ROUND_CLOSEST_ULL(freq, c);
3268 ++ /* base_unit must not be 0 and we also want to avoid overflowing it */
3269 ++ base_unit = clamp_val(base_unit, 1, base_unit_range - 1);
3270 +
3271 + on_time_div = 255ULL * duty_ns;
3272 + do_div(on_time_div, period_ns);
3273 +@@ -116,8 +118,7 @@ static void pwm_lpss_prepare(struct pwm_lpss_chip *lpwm, struct pwm_device *pwm,
3274 +
3275 + orig_ctrl = ctrl = pwm_lpss_read(pwm);
3276 + ctrl &= ~PWM_ON_TIME_DIV_MASK;
3277 +- ctrl &= ~(base_unit_range << PWM_BASE_UNIT_SHIFT);
3278 +- base_unit &= base_unit_range;
3279 ++ ctrl &= ~((base_unit_range - 1) << PWM_BASE_UNIT_SHIFT);
3280 + ctrl |= (u32) base_unit << PWM_BASE_UNIT_SHIFT;
3281 + ctrl |= on_time_div;
3282 +
3283 +diff --git a/drivers/rapidio/devices/rio_mport_cdev.c b/drivers/rapidio/devices/rio_mport_cdev.c
3284 +index f207f8725993c..a87c024d56700 100644
3285 +--- a/drivers/rapidio/devices/rio_mport_cdev.c
3286 ++++ b/drivers/rapidio/devices/rio_mport_cdev.c
3287 +@@ -900,15 +900,16 @@ rio_dma_transfer(struct file *filp, u32 transfer_mode,
3288 + rmcd_error("get_user_pages_unlocked err=%ld",
3289 + pinned);
3290 + nr_pages = 0;
3291 +- } else
3292 ++ } else {
3293 + rmcd_error("pinned %ld out of %ld pages",
3294 + pinned, nr_pages);
3295 ++ /*
3296 ++ * Set nr_pages up to mean "how many pages to unpin, in
3297 ++ * the error handler:
3298 ++ */
3299 ++ nr_pages = pinned;
3300 ++ }
3301 + ret = -EFAULT;
3302 +- /*
3303 +- * Set nr_pages up to mean "how many pages to unpin, in
3304 +- * the error handler:
3305 +- */
3306 +- nr_pages = pinned;
3307 + goto err_pg;
3308 + }
3309 +
3310 +@@ -1738,6 +1739,7 @@ static int rio_mport_add_riodev(struct mport_cdev_priv *priv,
3311 + struct rio_dev *rdev;
3312 + struct rio_switch *rswitch = NULL;
3313 + struct rio_mport *mport;
3314 ++ struct device *dev;
3315 + size_t size;
3316 + u32 rval;
3317 + u32 swpinfo = 0;
3318 +@@ -1752,8 +1754,10 @@ static int rio_mport_add_riodev(struct mport_cdev_priv *priv,
3319 + rmcd_debug(RDEV, "name:%s ct:0x%x did:0x%x hc:0x%x", dev_info.name,
3320 + dev_info.comptag, dev_info.destid, dev_info.hopcount);
3321 +
3322 +- if (bus_find_device_by_name(&rio_bus_type, NULL, dev_info.name)) {
3323 ++ dev = bus_find_device_by_name(&rio_bus_type, NULL, dev_info.name);
3324 ++ if (dev) {
3325 + rmcd_debug(RDEV, "device %s already exists", dev_info.name);
3326 ++ put_device(dev);
3327 + return -EEXIST;
3328 + }
3329 +
3330 +diff --git a/drivers/regulator/core.c b/drivers/regulator/core.c
3331 +index bd6991a99593d..a3c265177855d 100644
3332 +--- a/drivers/regulator/core.c
3333 ++++ b/drivers/regulator/core.c
3334 +@@ -4090,15 +4090,20 @@ regulator_register(const struct regulator_desc *regulator_desc,
3335 + else if (regulator_desc->supply_name)
3336 + rdev->supply_name = regulator_desc->supply_name;
3337 +
3338 +- /*
3339 +- * Attempt to resolve the regulator supply, if specified,
3340 +- * but don't return an error if we fail because we will try
3341 +- * to resolve it again later as more regulators are added.
3342 +- */
3343 +- if (regulator_resolve_supply(rdev))
3344 +- rdev_dbg(rdev, "unable to resolve supply\n");
3345 +-
3346 + ret = set_machine_constraints(rdev, constraints);
3347 ++ if (ret == -EPROBE_DEFER) {
3348 ++ /* Regulator might be in bypass mode and so needs its supply
3349 ++ * to set the constraints */
3350 ++ /* FIXME: this currently triggers a chicken-and-egg problem
3351 ++ * when creating -SUPPLY symlink in sysfs to a regulator
3352 ++ * that is just being created */
3353 ++ ret = regulator_resolve_supply(rdev);
3354 ++ if (!ret)
3355 ++ ret = set_machine_constraints(rdev, constraints);
3356 ++ else
3357 ++ rdev_dbg(rdev, "unable to resolve supply early: %pe\n",
3358 ++ ERR_PTR(ret));
3359 ++ }
3360 + if (ret < 0)
3361 + goto wash;
3362 +
3363 +diff --git a/drivers/scsi/be2iscsi/be_main.c b/drivers/scsi/be2iscsi/be_main.c
3364 +index b4542e7e2ad5b..86e1eac3a4703 100644
3365 +--- a/drivers/scsi/be2iscsi/be_main.c
3366 ++++ b/drivers/scsi/be2iscsi/be_main.c
3367 +@@ -3013,6 +3013,7 @@ static int beiscsi_create_eqs(struct beiscsi_hba *phba,
3368 + goto create_eq_error;
3369 + }
3370 +
3371 ++ mem->dma = paddr;
3372 + mem->va = eq_vaddress;
3373 + ret = be_fill_queue(eq, phba->params.num_eq_entries,
3374 + sizeof(struct be_eq_entry), eq_vaddress);
3375 +@@ -3022,7 +3023,6 @@ static int beiscsi_create_eqs(struct beiscsi_hba *phba,
3376 + goto create_eq_error;
3377 + }
3378 +
3379 +- mem->dma = paddr;
3380 + ret = beiscsi_cmd_eq_create(&phba->ctrl, eq,
3381 + phwi_context->cur_eqd);
3382 + if (ret) {
3383 +@@ -3079,6 +3079,7 @@ static int beiscsi_create_cqs(struct beiscsi_hba *phba,
3384 + goto create_cq_error;
3385 + }
3386 +
3387 ++ mem->dma = paddr;
3388 + ret = be_fill_queue(cq, phba->params.num_cq_entries,
3389 + sizeof(struct sol_cqe), cq_vaddress);
3390 + if (ret) {
3391 +@@ -3088,7 +3089,6 @@ static int beiscsi_create_cqs(struct beiscsi_hba *phba,
3392 + goto create_cq_error;
3393 + }
3394 +
3395 +- mem->dma = paddr;
3396 + ret = beiscsi_cmd_cq_create(&phba->ctrl, cq, eq, false,
3397 + false, 0);
3398 + if (ret) {
3399 +diff --git a/drivers/scsi/csiostor/csio_hw.c b/drivers/scsi/csiostor/csio_hw.c
3400 +index ab30db8c36c6f..bbcba3d08d495 100644
3401 +--- a/drivers/scsi/csiostor/csio_hw.c
3402 ++++ b/drivers/scsi/csiostor/csio_hw.c
3403 +@@ -1997,7 +1997,7 @@ static int csio_hw_prep_fw(struct csio_hw *hw, struct fw_info *fw_info,
3404 + FW_HDR_FW_VER_MICRO_G(c), FW_HDR_FW_VER_BUILD_G(c),
3405 + FW_HDR_FW_VER_MAJOR_G(k), FW_HDR_FW_VER_MINOR_G(k),
3406 + FW_HDR_FW_VER_MICRO_G(k), FW_HDR_FW_VER_BUILD_G(k));
3407 +- ret = EINVAL;
3408 ++ ret = -EINVAL;
3409 + goto bye;
3410 + }
3411 +
3412 +diff --git a/drivers/scsi/ibmvscsi/ibmvfc.c b/drivers/scsi/ibmvscsi/ibmvfc.c
3413 +index 34612add3829f..dbacd9830d3df 100644
3414 +--- a/drivers/scsi/ibmvscsi/ibmvfc.c
3415 ++++ b/drivers/scsi/ibmvscsi/ibmvfc.c
3416 +@@ -4797,6 +4797,7 @@ static int ibmvfc_probe(struct vio_dev *vdev, const struct vio_device_id *id)
3417 + if (IS_ERR(vhost->work_thread)) {
3418 + dev_err(dev, "Couldn't create kernel thread: %ld\n",
3419 + PTR_ERR(vhost->work_thread));
3420 ++ rc = PTR_ERR(vhost->work_thread);
3421 + goto free_host_mem;
3422 + }
3423 +
3424 +diff --git a/drivers/scsi/mvumi.c b/drivers/scsi/mvumi.c
3425 +index fe97401ad1927..1fffa301c1b9f 100644
3426 +--- a/drivers/scsi/mvumi.c
3427 ++++ b/drivers/scsi/mvumi.c
3428 +@@ -2439,6 +2439,7 @@ static int mvumi_io_attach(struct mvumi_hba *mhba)
3429 + if (IS_ERR(mhba->dm_thread)) {
3430 + dev_err(&mhba->pdev->dev,
3431 + "failed to create device scan thread\n");
3432 ++ ret = PTR_ERR(mhba->dm_thread);
3433 + mutex_unlock(&mhba->sas_discovery_mutex);
3434 + goto fail_create_thread;
3435 + }
3436 +diff --git a/drivers/scsi/qedi/qedi_fw.c b/drivers/scsi/qedi/qedi_fw.c
3437 +index 2e5e04a7623fa..e8f2c662471e0 100644
3438 +--- a/drivers/scsi/qedi/qedi_fw.c
3439 ++++ b/drivers/scsi/qedi/qedi_fw.c
3440 +@@ -62,6 +62,7 @@ static void qedi_process_logout_resp(struct qedi_ctx *qedi,
3441 + "Freeing tid=0x%x for cid=0x%x\n",
3442 + cmd->task_id, qedi_conn->iscsi_conn_id);
3443 +
3444 ++ spin_lock(&qedi_conn->list_lock);
3445 + if (likely(cmd->io_cmd_in_list)) {
3446 + cmd->io_cmd_in_list = false;
3447 + list_del_init(&cmd->io_cmd);
3448 +@@ -72,6 +73,7 @@ static void qedi_process_logout_resp(struct qedi_ctx *qedi,
3449 + cmd->task_id, qedi_conn->iscsi_conn_id,
3450 + &cmd->io_cmd);
3451 + }
3452 ++ spin_unlock(&qedi_conn->list_lock);
3453 +
3454 + cmd->state = RESPONSE_RECEIVED;
3455 + qedi_clear_task_idx(qedi, cmd->task_id);
3456 +@@ -127,6 +129,7 @@ static void qedi_process_text_resp(struct qedi_ctx *qedi,
3457 + "Freeing tid=0x%x for cid=0x%x\n",
3458 + cmd->task_id, qedi_conn->iscsi_conn_id);
3459 +
3460 ++ spin_lock(&qedi_conn->list_lock);
3461 + if (likely(cmd->io_cmd_in_list)) {
3462 + cmd->io_cmd_in_list = false;
3463 + list_del_init(&cmd->io_cmd);
3464 +@@ -137,6 +140,7 @@ static void qedi_process_text_resp(struct qedi_ctx *qedi,
3465 + cmd->task_id, qedi_conn->iscsi_conn_id,
3466 + &cmd->io_cmd);
3467 + }
3468 ++ spin_unlock(&qedi_conn->list_lock);
3469 +
3470 + cmd->state = RESPONSE_RECEIVED;
3471 + qedi_clear_task_idx(qedi, cmd->task_id);
3472 +@@ -231,11 +235,13 @@ static void qedi_process_tmf_resp(struct qedi_ctx *qedi,
3473 +
3474 + tmf_hdr = (struct iscsi_tm *)qedi_cmd->task->hdr;
3475 +
3476 ++ spin_lock(&qedi_conn->list_lock);
3477 + if (likely(qedi_cmd->io_cmd_in_list)) {
3478 + qedi_cmd->io_cmd_in_list = false;
3479 + list_del_init(&qedi_cmd->io_cmd);
3480 + qedi_conn->active_cmd_count--;
3481 + }
3482 ++ spin_unlock(&qedi_conn->list_lock);
3483 +
3484 + if (((tmf_hdr->flags & ISCSI_FLAG_TM_FUNC_MASK) ==
3485 + ISCSI_TM_FUNC_LOGICAL_UNIT_RESET) ||
3486 +@@ -299,11 +305,13 @@ static void qedi_process_login_resp(struct qedi_ctx *qedi,
3487 + ISCSI_LOGIN_RESPONSE_HDR_DATA_SEG_LEN_MASK;
3488 + qedi_conn->gen_pdu.resp_wr_ptr = qedi_conn->gen_pdu.resp_buf + pld_len;
3489 +
3490 ++ spin_lock(&qedi_conn->list_lock);
3491 + if (likely(cmd->io_cmd_in_list)) {
3492 + cmd->io_cmd_in_list = false;
3493 + list_del_init(&cmd->io_cmd);
3494 + qedi_conn->active_cmd_count--;
3495 + }
3496 ++ spin_unlock(&qedi_conn->list_lock);
3497 +
3498 + memset(task_ctx, '\0', sizeof(*task_ctx));
3499 +
3500 +@@ -836,8 +844,11 @@ static void qedi_process_cmd_cleanup_resp(struct qedi_ctx *qedi,
3501 + qedi_clear_task_idx(qedi_conn->qedi, rtid);
3502 +
3503 + spin_lock(&qedi_conn->list_lock);
3504 +- list_del_init(&dbg_cmd->io_cmd);
3505 +- qedi_conn->active_cmd_count--;
3506 ++ if (likely(dbg_cmd->io_cmd_in_list)) {
3507 ++ dbg_cmd->io_cmd_in_list = false;
3508 ++ list_del_init(&dbg_cmd->io_cmd);
3509 ++ qedi_conn->active_cmd_count--;
3510 ++ }
3511 + spin_unlock(&qedi_conn->list_lock);
3512 + qedi_cmd->state = CLEANUP_RECV;
3513 + wake_up_interruptible(&qedi_conn->wait_queue);
3514 +@@ -1257,6 +1268,7 @@ int qedi_cleanup_all_io(struct qedi_ctx *qedi, struct qedi_conn *qedi_conn,
3515 + qedi_conn->cmd_cleanup_req++;
3516 + qedi_iscsi_cleanup_task(ctask, true);
3517 +
3518 ++ cmd->io_cmd_in_list = false;
3519 + list_del_init(&cmd->io_cmd);
3520 + qedi_conn->active_cmd_count--;
3521 + QEDI_WARN(&qedi->dbg_ctx,
3522 +@@ -1470,8 +1482,11 @@ ldel_exit:
3523 + spin_unlock_bh(&qedi_conn->tmf_work_lock);
3524 +
3525 + spin_lock(&qedi_conn->list_lock);
3526 +- list_del_init(&cmd->io_cmd);
3527 +- qedi_conn->active_cmd_count--;
3528 ++ if (likely(cmd->io_cmd_in_list)) {
3529 ++ cmd->io_cmd_in_list = false;
3530 ++ list_del_init(&cmd->io_cmd);
3531 ++ qedi_conn->active_cmd_count--;
3532 ++ }
3533 + spin_unlock(&qedi_conn->list_lock);
3534 +
3535 + clear_bit(QEDI_CONN_FW_CLEANUP, &qedi_conn->flags);
3536 +diff --git a/drivers/scsi/qedi/qedi_iscsi.c b/drivers/scsi/qedi/qedi_iscsi.c
3537 +index 4d7971c3f339b..c55fb411c8a55 100644
3538 +--- a/drivers/scsi/qedi/qedi_iscsi.c
3539 ++++ b/drivers/scsi/qedi/qedi_iscsi.c
3540 +@@ -983,11 +983,13 @@ static void qedi_cleanup_active_cmd_list(struct qedi_conn *qedi_conn)
3541 + {
3542 + struct qedi_cmd *cmd, *cmd_tmp;
3543 +
3544 ++ spin_lock(&qedi_conn->list_lock);
3545 + list_for_each_entry_safe(cmd, cmd_tmp, &qedi_conn->active_cmd_list,
3546 + io_cmd) {
3547 + list_del_init(&cmd->io_cmd);
3548 + qedi_conn->active_cmd_count--;
3549 + }
3550 ++ spin_unlock(&qedi_conn->list_lock);
3551 + }
3552 +
3553 + static void qedi_ep_disconnect(struct iscsi_endpoint *ep)
3554 +diff --git a/drivers/scsi/qla4xxx/ql4_os.c b/drivers/scsi/qla4xxx/ql4_os.c
3555 +index fb3abaf817a35..62022a66e9ee2 100644
3556 +--- a/drivers/scsi/qla4xxx/ql4_os.c
3557 ++++ b/drivers/scsi/qla4xxx/ql4_os.c
3558 +@@ -1223,7 +1223,7 @@ static int qla4xxx_get_host_stats(struct Scsi_Host *shost, char *buf, int len)
3559 + le64_to_cpu(ql_iscsi_stats->iscsi_sequence_error);
3560 + exit_host_stats:
3561 + if (ql_iscsi_stats)
3562 +- dma_free_coherent(&ha->pdev->dev, host_stats_size,
3563 ++ dma_free_coherent(&ha->pdev->dev, stats_size,
3564 + ql_iscsi_stats, iscsi_stats_dma);
3565 +
3566 + ql4_printk(KERN_INFO, ha, "%s: Get host stats done\n",
3567 +diff --git a/drivers/scsi/ufs/ufs-qcom.c b/drivers/scsi/ufs/ufs-qcom.c
3568 +index ee3589ac64abf..6b6b8bf2ec929 100644
3569 +--- a/drivers/scsi/ufs/ufs-qcom.c
3570 ++++ b/drivers/scsi/ufs/ufs-qcom.c
3571 +@@ -1595,9 +1595,6 @@ int ufs_qcom_testbus_config(struct ufs_qcom_host *host)
3572 + */
3573 + }
3574 + mask <<= offset;
3575 +-
3576 +- pm_runtime_get_sync(host->hba->dev);
3577 +- ufshcd_hold(host->hba, false);
3578 + ufshcd_rmwl(host->hba, TEST_BUS_SEL,
3579 + (u32)host->testbus.select_major << 19,
3580 + REG_UFS_CFG1);
3581 +@@ -1610,8 +1607,6 @@ int ufs_qcom_testbus_config(struct ufs_qcom_host *host)
3582 + * committed before returning.
3583 + */
3584 + mb();
3585 +- ufshcd_release(host->hba);
3586 +- pm_runtime_put_sync(host->hba->dev);
3587 +
3588 + return 0;
3589 + }
3590 +diff --git a/drivers/tty/hvc/hvcs.c b/drivers/tty/hvc/hvcs.c
3591 +index 63c29fe9d21f1..f77d7f39c113c 100644
3592 +--- a/drivers/tty/hvc/hvcs.c
3593 ++++ b/drivers/tty/hvc/hvcs.c
3594 +@@ -1231,13 +1231,6 @@ static void hvcs_close(struct tty_struct *tty, struct file *filp)
3595 +
3596 + tty_wait_until_sent(tty, HVCS_CLOSE_WAIT);
3597 +
3598 +- /*
3599 +- * This line is important because it tells hvcs_open that this
3600 +- * device needs to be re-configured the next time hvcs_open is
3601 +- * called.
3602 +- */
3603 +- tty->driver_data = NULL;
3604 +-
3605 + free_irq(irq, hvcsd);
3606 + return;
3607 + } else if (hvcsd->port.count < 0) {
3608 +@@ -1252,6 +1245,13 @@ static void hvcs_cleanup(struct tty_struct * tty)
3609 + {
3610 + struct hvcs_struct *hvcsd = tty->driver_data;
3611 +
3612 ++ /*
3613 ++ * This line is important because it tells hvcs_open that this
3614 ++ * device needs to be re-configured the next time hvcs_open is
3615 ++ * called.
3616 ++ */
3617 ++ tty->driver_data = NULL;
3618 ++
3619 + tty_port_put(&hvcsd->port);
3620 + }
3621 +
3622 +diff --git a/drivers/tty/ipwireless/network.c b/drivers/tty/ipwireless/network.c
3623 +index 695439c031474..abc737ae81d1c 100644
3624 +--- a/drivers/tty/ipwireless/network.c
3625 ++++ b/drivers/tty/ipwireless/network.c
3626 +@@ -117,7 +117,7 @@ static int ipwireless_ppp_start_xmit(struct ppp_channel *ppp_channel,
3627 + skb->len,
3628 + notify_packet_sent,
3629 + network);
3630 +- if (ret == -1) {
3631 ++ if (ret < 0) {
3632 + skb_pull(skb, 2);
3633 + return 0;
3634 + }
3635 +@@ -134,7 +134,7 @@ static int ipwireless_ppp_start_xmit(struct ppp_channel *ppp_channel,
3636 + notify_packet_sent,
3637 + network);
3638 + kfree(buf);
3639 +- if (ret == -1)
3640 ++ if (ret < 0)
3641 + return 0;
3642 + }
3643 + kfree_skb(skb);
3644 +diff --git a/drivers/tty/ipwireless/tty.c b/drivers/tty/ipwireless/tty.c
3645 +index 1ef751c27ac6d..cb04971843306 100644
3646 +--- a/drivers/tty/ipwireless/tty.c
3647 ++++ b/drivers/tty/ipwireless/tty.c
3648 +@@ -218,7 +218,7 @@ static int ipw_write(struct tty_struct *linux_tty,
3649 + ret = ipwireless_send_packet(tty->hardware, IPW_CHANNEL_RAS,
3650 + buf, count,
3651 + ipw_write_packet_sent_callback, tty);
3652 +- if (ret == -1) {
3653 ++ if (ret < 0) {
3654 + mutex_unlock(&tty->ipw_tty_mutex);
3655 + return 0;
3656 + }
3657 +diff --git a/drivers/tty/pty.c b/drivers/tty/pty.c
3658 +index b3208b1b1028d..bca47176db4c2 100644
3659 +--- a/drivers/tty/pty.c
3660 ++++ b/drivers/tty/pty.c
3661 +@@ -120,10 +120,10 @@ static int pty_write(struct tty_struct *tty, const unsigned char *buf, int c)
3662 + spin_lock_irqsave(&to->port->lock, flags);
3663 + /* Stuff the data into the input queue of the other end */
3664 + c = tty_insert_flip_string(to->port, buf, c);
3665 ++ spin_unlock_irqrestore(&to->port->lock, flags);
3666 + /* And shovel */
3667 + if (c)
3668 + tty_flip_buffer_push(to->port);
3669 +- spin_unlock_irqrestore(&to->port->lock, flags);
3670 + }
3671 + return c;
3672 + }
3673 +diff --git a/drivers/tty/serial/Kconfig b/drivers/tty/serial/Kconfig
3674 +index b788fee54249d..3628d37773034 100644
3675 +--- a/drivers/tty/serial/Kconfig
3676 ++++ b/drivers/tty/serial/Kconfig
3677 +@@ -9,6 +9,7 @@ menu "Serial drivers"
3678 +
3679 + config SERIAL_EARLYCON
3680 + bool
3681 ++ depends on SERIAL_CORE
3682 + help
3683 + Support for early consoles with the earlycon parameter. This enables
3684 + the console before standard serial driver is probed. The console is
3685 +diff --git a/drivers/tty/serial/fsl_lpuart.c b/drivers/tty/serial/fsl_lpuart.c
3686 +index 16422987ab0f3..cebebdcd091ce 100644
3687 +--- a/drivers/tty/serial/fsl_lpuart.c
3688 ++++ b/drivers/tty/serial/fsl_lpuart.c
3689 +@@ -567,7 +567,7 @@ static void lpuart32_poll_put_char(struct uart_port *port, unsigned char c)
3690 +
3691 + static int lpuart32_poll_get_char(struct uart_port *port)
3692 + {
3693 +- if (!(lpuart32_read(port, UARTSTAT) & UARTSTAT_RDRF))
3694 ++ if (!(lpuart32_read(port, UARTWATER) >> UARTWATER_RXCNT_OFF))
3695 + return NO_POLL_CHAR;
3696 +
3697 + return lpuart32_read(port, UARTDATA);
3698 +diff --git a/drivers/usb/class/cdc-acm.c b/drivers/usb/class/cdc-acm.c
3699 +index b3e4b014a1cc0..8129040a3d0f2 100644
3700 +--- a/drivers/usb/class/cdc-acm.c
3701 ++++ b/drivers/usb/class/cdc-acm.c
3702 +@@ -1287,9 +1287,21 @@ static int acm_probe(struct usb_interface *intf,
3703 + }
3704 + }
3705 + } else {
3706 ++ int class = -1;
3707 ++
3708 + data_intf_num = union_header->bSlaveInterface0;
3709 + control_interface = usb_ifnum_to_if(usb_dev, union_header->bMasterInterface0);
3710 + data_interface = usb_ifnum_to_if(usb_dev, data_intf_num);
3711 ++
3712 ++ if (control_interface)
3713 ++ class = control_interface->cur_altsetting->desc.bInterfaceClass;
3714 ++
3715 ++ if (class != USB_CLASS_COMM && class != USB_CLASS_CDC_DATA) {
3716 ++ dev_dbg(&intf->dev, "Broken union descriptor, assuming single interface\n");
3717 ++ combined_interfaces = 1;
3718 ++ control_interface = data_interface = intf;
3719 ++ goto look_for_collapsed_interface;
3720 ++ }
3721 + }
3722 +
3723 + if (!control_interface || !data_interface) {
3724 +@@ -1945,6 +1957,17 @@ static const struct usb_device_id acm_ids[] = {
3725 + .driver_info = IGNORE_DEVICE,
3726 + },
3727 +
3728 ++ /* Exclude ETAS ES58x */
3729 ++ { USB_DEVICE(0x108c, 0x0159), /* ES581.4 */
3730 ++ .driver_info = IGNORE_DEVICE,
3731 ++ },
3732 ++ { USB_DEVICE(0x108c, 0x0168), /* ES582.1 */
3733 ++ .driver_info = IGNORE_DEVICE,
3734 ++ },
3735 ++ { USB_DEVICE(0x108c, 0x0169), /* ES584.1 */
3736 ++ .driver_info = IGNORE_DEVICE,
3737 ++ },
3738 ++
3739 + { USB_DEVICE(0x1bc7, 0x0021), /* Telit 3G ACM only composition */
3740 + .driver_info = SEND_ZERO_PACKET,
3741 + },
3742 +diff --git a/drivers/usb/class/cdc-wdm.c b/drivers/usb/class/cdc-wdm.c
3743 +index d5d42dccda10a..ec2de4e448c41 100644
3744 +--- a/drivers/usb/class/cdc-wdm.c
3745 ++++ b/drivers/usb/class/cdc-wdm.c
3746 +@@ -57,6 +57,9 @@ MODULE_DEVICE_TABLE (usb, wdm_ids);
3747 +
3748 + #define WDM_MAX 16
3749 +
3750 ++/* we cannot wait forever at flush() */
3751 ++#define WDM_FLUSH_TIMEOUT (30 * HZ)
3752 ++
3753 + /* CDC-WMC r1.1 requires wMaxCommand to be "at least 256 decimal (0x100)" */
3754 + #define WDM_DEFAULT_BUFSIZE 256
3755 +
3756 +@@ -147,7 +150,7 @@ static void wdm_out_callback(struct urb *urb)
3757 + kfree(desc->outbuf);
3758 + desc->outbuf = NULL;
3759 + clear_bit(WDM_IN_USE, &desc->flags);
3760 +- wake_up(&desc->wait);
3761 ++ wake_up_all(&desc->wait);
3762 + }
3763 +
3764 + /* forward declaration */
3765 +@@ -390,6 +393,9 @@ static ssize_t wdm_write
3766 + if (test_bit(WDM_RESETTING, &desc->flags))
3767 + r = -EIO;
3768 +
3769 ++ if (test_bit(WDM_DISCONNECTING, &desc->flags))
3770 ++ r = -ENODEV;
3771 ++
3772 + if (r < 0) {
3773 + rv = r;
3774 + goto out_free_mem_pm;
3775 +@@ -421,6 +427,7 @@ static ssize_t wdm_write
3776 + if (rv < 0) {
3777 + desc->outbuf = NULL;
3778 + clear_bit(WDM_IN_USE, &desc->flags);
3779 ++ wake_up_all(&desc->wait); /* for wdm_wait_for_response() */
3780 + dev_err(&desc->intf->dev, "Tx URB error: %d\n", rv);
3781 + rv = usb_translate_errors(rv);
3782 + goto out_free_mem_pm;
3783 +@@ -580,28 +587,58 @@ err:
3784 + return rv;
3785 + }
3786 +
3787 +-static int wdm_flush(struct file *file, fl_owner_t id)
3788 ++static int wdm_wait_for_response(struct file *file, long timeout)
3789 + {
3790 + struct wdm_device *desc = file->private_data;
3791 ++ long rv; /* Use long here because (int) MAX_SCHEDULE_TIMEOUT < 0. */
3792 +
3793 +- wait_event(desc->wait,
3794 +- /*
3795 +- * needs both flags. We cannot do with one
3796 +- * because resetting it would cause a race
3797 +- * with write() yet we need to signal
3798 +- * a disconnect
3799 +- */
3800 +- !test_bit(WDM_IN_USE, &desc->flags) ||
3801 +- test_bit(WDM_DISCONNECTING, &desc->flags));
3802 +-
3803 +- /* cannot dereference desc->intf if WDM_DISCONNECTING */
3804 ++ /*
3805 ++ * Needs both flags. We cannot do with one because resetting it would
3806 ++ * cause a race with write() yet we need to signal a disconnect.
3807 ++ */
3808 ++ rv = wait_event_interruptible_timeout(desc->wait,
3809 ++ !test_bit(WDM_IN_USE, &desc->flags) ||
3810 ++ test_bit(WDM_DISCONNECTING, &desc->flags),
3811 ++ timeout);
3812 ++
3813 ++ /*
3814 ++ * To report the correct error. This is best effort.
3815 ++ * We are inevitably racing with the hardware.
3816 ++ */
3817 + if (test_bit(WDM_DISCONNECTING, &desc->flags))
3818 + return -ENODEV;
3819 +- if (desc->werr < 0)
3820 +- dev_err(&desc->intf->dev, "Error in flush path: %d\n",
3821 +- desc->werr);
3822 ++ if (!rv)
3823 ++ return -EIO;
3824 ++ if (rv < 0)
3825 ++ return -EINTR;
3826 +
3827 +- return usb_translate_errors(desc->werr);
3828 ++ spin_lock_irq(&desc->iuspin);
3829 ++ rv = desc->werr;
3830 ++ desc->werr = 0;
3831 ++ spin_unlock_irq(&desc->iuspin);
3832 ++
3833 ++ return usb_translate_errors(rv);
3834 ++
3835 ++}
3836 ++
3837 ++/*
3838 ++ * You need to send a signal when you react to malicious or defective hardware.
3839 ++ * Also, don't abort when fsync() returned -EINVAL, for older kernels which do
3840 ++ * not implement wdm_flush() will return -EINVAL.
3841 ++ */
3842 ++static int wdm_fsync(struct file *file, loff_t start, loff_t end, int datasync)
3843 ++{
3844 ++ return wdm_wait_for_response(file, MAX_SCHEDULE_TIMEOUT);
3845 ++}
3846 ++
3847 ++/*
3848 ++ * Same with wdm_fsync(), except it uses finite timeout in order to react to
3849 ++ * malicious or defective hardware which ceased communication after close() was
3850 ++ * implicitly called due to process termination.
3851 ++ */
3852 ++static int wdm_flush(struct file *file, fl_owner_t id)
3853 ++{
3854 ++ return wdm_wait_for_response(file, WDM_FLUSH_TIMEOUT);
3855 + }
3856 +
3857 + static unsigned int wdm_poll(struct file *file, struct poll_table_struct *wait)
3858 +@@ -726,6 +763,7 @@ static const struct file_operations wdm_fops = {
3859 + .owner = THIS_MODULE,
3860 + .read = wdm_read,
3861 + .write = wdm_write,
3862 ++ .fsync = wdm_fsync,
3863 + .open = wdm_open,
3864 + .flush = wdm_flush,
3865 + .release = wdm_release,
3866 +diff --git a/drivers/usb/core/urb.c b/drivers/usb/core/urb.c
3867 +index 83bd48734af58..bd6ebc9d17c8c 100644
3868 +--- a/drivers/usb/core/urb.c
3869 ++++ b/drivers/usb/core/urb.c
3870 +@@ -767,11 +767,12 @@ void usb_block_urb(struct urb *urb)
3871 + EXPORT_SYMBOL_GPL(usb_block_urb);
3872 +
3873 + /**
3874 +- * usb_kill_anchored_urbs - cancel transfer requests en masse
3875 ++ * usb_kill_anchored_urbs - kill all URBs associated with an anchor
3876 + * @anchor: anchor the requests are bound to
3877 + *
3878 +- * this allows all outstanding URBs to be killed starting
3879 +- * from the back of the queue
3880 ++ * This kills all outstanding URBs starting from the back of the queue,
3881 ++ * with guarantee that no completer callbacks will take place from the
3882 ++ * anchor after this function returns.
3883 + *
3884 + * This routine should not be called by a driver after its disconnect
3885 + * method has returned.
3886 +@@ -779,20 +780,26 @@ EXPORT_SYMBOL_GPL(usb_block_urb);
3887 + void usb_kill_anchored_urbs(struct usb_anchor *anchor)
3888 + {
3889 + struct urb *victim;
3890 ++ int surely_empty;
3891 +
3892 +- spin_lock_irq(&anchor->lock);
3893 +- while (!list_empty(&anchor->urb_list)) {
3894 +- victim = list_entry(anchor->urb_list.prev, struct urb,
3895 +- anchor_list);
3896 +- /* we must make sure the URB isn't freed before we kill it*/
3897 +- usb_get_urb(victim);
3898 +- spin_unlock_irq(&anchor->lock);
3899 +- /* this will unanchor the URB */
3900 +- usb_kill_urb(victim);
3901 +- usb_put_urb(victim);
3902 ++ do {
3903 + spin_lock_irq(&anchor->lock);
3904 +- }
3905 +- spin_unlock_irq(&anchor->lock);
3906 ++ while (!list_empty(&anchor->urb_list)) {
3907 ++ victim = list_entry(anchor->urb_list.prev,
3908 ++ struct urb, anchor_list);
3909 ++ /* make sure the URB isn't freed before we kill it */
3910 ++ usb_get_urb(victim);
3911 ++ spin_unlock_irq(&anchor->lock);
3912 ++ /* this will unanchor the URB */
3913 ++ usb_kill_urb(victim);
3914 ++ usb_put_urb(victim);
3915 ++ spin_lock_irq(&anchor->lock);
3916 ++ }
3917 ++ surely_empty = usb_anchor_check_wakeup(anchor);
3918 ++
3919 ++ spin_unlock_irq(&anchor->lock);
3920 ++ cpu_relax();
3921 ++ } while (!surely_empty);
3922 + }
3923 + EXPORT_SYMBOL_GPL(usb_kill_anchored_urbs);
3924 +
3925 +@@ -811,21 +818,27 @@ EXPORT_SYMBOL_GPL(usb_kill_anchored_urbs);
3926 + void usb_poison_anchored_urbs(struct usb_anchor *anchor)
3927 + {
3928 + struct urb *victim;
3929 ++ int surely_empty;
3930 +
3931 +- spin_lock_irq(&anchor->lock);
3932 +- anchor->poisoned = 1;
3933 +- while (!list_empty(&anchor->urb_list)) {
3934 +- victim = list_entry(anchor->urb_list.prev, struct urb,
3935 +- anchor_list);
3936 +- /* we must make sure the URB isn't freed before we kill it*/
3937 +- usb_get_urb(victim);
3938 +- spin_unlock_irq(&anchor->lock);
3939 +- /* this will unanchor the URB */
3940 +- usb_poison_urb(victim);
3941 +- usb_put_urb(victim);
3942 ++ do {
3943 + spin_lock_irq(&anchor->lock);
3944 +- }
3945 +- spin_unlock_irq(&anchor->lock);
3946 ++ anchor->poisoned = 1;
3947 ++ while (!list_empty(&anchor->urb_list)) {
3948 ++ victim = list_entry(anchor->urb_list.prev,
3949 ++ struct urb, anchor_list);
3950 ++ /* make sure the URB isn't freed before we kill it */
3951 ++ usb_get_urb(victim);
3952 ++ spin_unlock_irq(&anchor->lock);
3953 ++ /* this will unanchor the URB */
3954 ++ usb_poison_urb(victim);
3955 ++ usb_put_urb(victim);
3956 ++ spin_lock_irq(&anchor->lock);
3957 ++ }
3958 ++ surely_empty = usb_anchor_check_wakeup(anchor);
3959 ++
3960 ++ spin_unlock_irq(&anchor->lock);
3961 ++ cpu_relax();
3962 ++ } while (!surely_empty);
3963 + }
3964 + EXPORT_SYMBOL_GPL(usb_poison_anchored_urbs);
3965 +
3966 +@@ -965,14 +978,20 @@ void usb_scuttle_anchored_urbs(struct usb_anchor *anchor)
3967 + {
3968 + struct urb *victim;
3969 + unsigned long flags;
3970 ++ int surely_empty;
3971 ++
3972 ++ do {
3973 ++ spin_lock_irqsave(&anchor->lock, flags);
3974 ++ while (!list_empty(&anchor->urb_list)) {
3975 ++ victim = list_entry(anchor->urb_list.prev,
3976 ++ struct urb, anchor_list);
3977 ++ __usb_unanchor_urb(victim, anchor);
3978 ++ }
3979 ++ surely_empty = usb_anchor_check_wakeup(anchor);
3980 +
3981 +- spin_lock_irqsave(&anchor->lock, flags);
3982 +- while (!list_empty(&anchor->urb_list)) {
3983 +- victim = list_entry(anchor->urb_list.prev, struct urb,
3984 +- anchor_list);
3985 +- __usb_unanchor_urb(victim, anchor);
3986 +- }
3987 +- spin_unlock_irqrestore(&anchor->lock, flags);
3988 ++ spin_unlock_irqrestore(&anchor->lock, flags);
3989 ++ cpu_relax();
3990 ++ } while (!surely_empty);
3991 + }
3992 +
3993 + EXPORT_SYMBOL_GPL(usb_scuttle_anchored_urbs);
3994 +diff --git a/drivers/usb/dwc2/gadget.c b/drivers/usb/dwc2/gadget.c
3995 +index 03bc479d04e0d..d2d4067a1a5f4 100644
3996 +--- a/drivers/usb/dwc2/gadget.c
3997 ++++ b/drivers/usb/dwc2/gadget.c
3998 +@@ -704,8 +704,11 @@ static u32 dwc2_hsotg_read_frameno(struct dwc2_hsotg *hsotg)
3999 + */
4000 + static unsigned int dwc2_gadget_get_chain_limit(struct dwc2_hsotg_ep *hs_ep)
4001 + {
4002 ++ const struct usb_endpoint_descriptor *ep_desc = hs_ep->ep.desc;
4003 + int is_isoc = hs_ep->isochronous;
4004 + unsigned int maxsize;
4005 ++ u32 mps = hs_ep->ep.maxpacket;
4006 ++ int dir_in = hs_ep->dir_in;
4007 +
4008 + if (is_isoc)
4009 + maxsize = hs_ep->dir_in ? DEV_DMA_ISOC_TX_NBYTES_LIMIT :
4010 +@@ -716,6 +719,11 @@ static unsigned int dwc2_gadget_get_chain_limit(struct dwc2_hsotg_ep *hs_ep)
4011 + /* Above size of one descriptor was chosen, multiple it */
4012 + maxsize *= MAX_DMA_DESC_NUM_GENERIC;
4013 +
4014 ++ /* Interrupt OUT EP with mps not multiple of 4 */
4015 ++ if (hs_ep->index)
4016 ++ if (usb_endpoint_xfer_int(ep_desc) && !dir_in && (mps % 4))
4017 ++ maxsize = mps * MAX_DMA_DESC_NUM_GENERIC;
4018 ++
4019 + return maxsize;
4020 + }
4021 +
4022 +@@ -731,11 +739,14 @@ static unsigned int dwc2_gadget_get_chain_limit(struct dwc2_hsotg_ep *hs_ep)
4023 + * Isochronous - descriptor rx/tx bytes bitfield limit,
4024 + * Control In/Bulk/Interrupt - multiple of mps. This will allow to not
4025 + * have concatenations from various descriptors within one packet.
4026 ++ * Interrupt OUT - if mps not multiple of 4 then a single packet corresponds
4027 ++ * to a single descriptor.
4028 + *
4029 + * Selects corresponding mask for RX/TX bytes as well.
4030 + */
4031 + static u32 dwc2_gadget_get_desc_params(struct dwc2_hsotg_ep *hs_ep, u32 *mask)
4032 + {
4033 ++ const struct usb_endpoint_descriptor *ep_desc = hs_ep->ep.desc;
4034 + u32 mps = hs_ep->ep.maxpacket;
4035 + int dir_in = hs_ep->dir_in;
4036 + u32 desc_size = 0;
4037 +@@ -759,6 +770,13 @@ static u32 dwc2_gadget_get_desc_params(struct dwc2_hsotg_ep *hs_ep, u32 *mask)
4038 + desc_size -= desc_size % mps;
4039 + }
4040 +
4041 ++ /* Interrupt OUT EP with mps not multiple of 4 */
4042 ++ if (hs_ep->index)
4043 ++ if (usb_endpoint_xfer_int(ep_desc) && !dir_in && (mps % 4)) {
4044 ++ desc_size = mps;
4045 ++ *mask = DEV_DMA_NBYTES_MASK;
4046 ++ }
4047 ++
4048 + return desc_size;
4049 + }
4050 +
4051 +@@ -1094,13 +1112,7 @@ static void dwc2_hsotg_start_req(struct dwc2_hsotg *hsotg,
4052 + length += (mps - (length % mps));
4053 + }
4054 +
4055 +- /*
4056 +- * If more data to send, adjust DMA for EP0 out data stage.
4057 +- * ureq->dma stays unchanged, hence increment it by already
4058 +- * passed passed data count before starting new transaction.
4059 +- */
4060 +- if (!index && hsotg->ep0_state == DWC2_EP0_DATA_OUT &&
4061 +- continuing)
4062 ++ if (continuing)
4063 + offset = ureq->actual;
4064 +
4065 + /* Fill DDMA chain entries */
4066 +@@ -2260,22 +2272,36 @@ static void dwc2_hsotg_change_ep_iso_parity(struct dwc2_hsotg *hsotg,
4067 + */
4068 + static unsigned int dwc2_gadget_get_xfersize_ddma(struct dwc2_hsotg_ep *hs_ep)
4069 + {
4070 ++ const struct usb_endpoint_descriptor *ep_desc = hs_ep->ep.desc;
4071 + struct dwc2_hsotg *hsotg = hs_ep->parent;
4072 + unsigned int bytes_rem = 0;
4073 ++ unsigned int bytes_rem_correction = 0;
4074 + struct dwc2_dma_desc *desc = hs_ep->desc_list;
4075 + int i;
4076 + u32 status;
4077 ++ u32 mps = hs_ep->ep.maxpacket;
4078 ++ int dir_in = hs_ep->dir_in;
4079 +
4080 + if (!desc)
4081 + return -EINVAL;
4082 +
4083 ++ /* Interrupt OUT EP with mps not multiple of 4 */
4084 ++ if (hs_ep->index)
4085 ++ if (usb_endpoint_xfer_int(ep_desc) && !dir_in && (mps % 4))
4086 ++ bytes_rem_correction = 4 - (mps % 4);
4087 ++
4088 + for (i = 0; i < hs_ep->desc_count; ++i) {
4089 + status = desc->status;
4090 + bytes_rem += status & DEV_DMA_NBYTES_MASK;
4091 ++ bytes_rem -= bytes_rem_correction;
4092 +
4093 + if (status & DEV_DMA_STS_MASK)
4094 + dev_err(hsotg->dev, "descriptor %d closed with %x\n",
4095 + i, status & DEV_DMA_STS_MASK);
4096 ++
4097 ++ if (status & DEV_DMA_L)
4098 ++ break;
4099 ++
4100 + desc++;
4101 + }
4102 +
4103 +diff --git a/drivers/usb/dwc2/params.c b/drivers/usb/dwc2/params.c
4104 +index a3ffe97170ffd..cf6ff8bfd7f61 100644
4105 +--- a/drivers/usb/dwc2/params.c
4106 ++++ b/drivers/usb/dwc2/params.c
4107 +@@ -711,7 +711,7 @@ int dwc2_get_hwparams(struct dwc2_hsotg *hsotg)
4108 + int dwc2_init_params(struct dwc2_hsotg *hsotg)
4109 + {
4110 + const struct of_device_id *match;
4111 +- void (*set_params)(void *data);
4112 ++ void (*set_params)(struct dwc2_hsotg *data);
4113 +
4114 + dwc2_set_default_params(hsotg);
4115 + dwc2_get_device_properties(hsotg);
4116 +diff --git a/drivers/usb/gadget/function/f_ncm.c b/drivers/usb/gadget/function/f_ncm.c
4117 +index f62cdf1238d77..61c0bc7c985f4 100644
4118 +--- a/drivers/usb/gadget/function/f_ncm.c
4119 ++++ b/drivers/usb/gadget/function/f_ncm.c
4120 +@@ -92,8 +92,10 @@ static inline struct f_ncm *func_to_ncm(struct usb_function *f)
4121 + /* peak (theoretical) bulk transfer rate in bits-per-second */
4122 + static inline unsigned ncm_bitrate(struct usb_gadget *g)
4123 + {
4124 +- if (gadget_is_superspeed(g) && g->speed == USB_SPEED_SUPER)
4125 +- return 13 * 1024 * 8 * 1000 * 8;
4126 ++ if (gadget_is_superspeed(g) && g->speed >= USB_SPEED_SUPER_PLUS)
4127 ++ return 4250000000U;
4128 ++ else if (gadget_is_superspeed(g) && g->speed == USB_SPEED_SUPER)
4129 ++ return 3750000000U;
4130 + else if (gadget_is_dualspeed(g) && g->speed == USB_SPEED_HIGH)
4131 + return 13 * 512 * 8 * 1000 * 8;
4132 + else
4133 +@@ -1539,7 +1541,7 @@ static int ncm_bind(struct usb_configuration *c, struct usb_function *f)
4134 + fs_ncm_notify_desc.bEndpointAddress;
4135 +
4136 + status = usb_assign_descriptors(f, ncm_fs_function, ncm_hs_function,
4137 +- ncm_ss_function, NULL);
4138 ++ ncm_ss_function, ncm_ss_function);
4139 + if (status)
4140 + goto fail;
4141 +
4142 +diff --git a/drivers/usb/gadget/function/f_printer.c b/drivers/usb/gadget/function/f_printer.c
4143 +index e6d4fa5eeff10..b2b43a5518786 100644
4144 +--- a/drivers/usb/gadget/function/f_printer.c
4145 ++++ b/drivers/usb/gadget/function/f_printer.c
4146 +@@ -35,6 +35,7 @@
4147 + #include <linux/types.h>
4148 + #include <linux/ctype.h>
4149 + #include <linux/cdev.h>
4150 ++#include <linux/kref.h>
4151 +
4152 + #include <asm/byteorder.h>
4153 + #include <linux/io.h>
4154 +@@ -68,7 +69,7 @@ struct printer_dev {
4155 + struct usb_gadget *gadget;
4156 + s8 interface;
4157 + struct usb_ep *in_ep, *out_ep;
4158 +-
4159 ++ struct kref kref;
4160 + struct list_head rx_reqs; /* List of free RX structs */
4161 + struct list_head rx_reqs_active; /* List of Active RX xfers */
4162 + struct list_head rx_buffers; /* List of completed xfers */
4163 +@@ -222,6 +223,13 @@ static inline struct usb_endpoint_descriptor *ep_desc(struct usb_gadget *gadget,
4164 +
4165 + /*-------------------------------------------------------------------------*/
4166 +
4167 ++static void printer_dev_free(struct kref *kref)
4168 ++{
4169 ++ struct printer_dev *dev = container_of(kref, struct printer_dev, kref);
4170 ++
4171 ++ kfree(dev);
4172 ++}
4173 ++
4174 + static struct usb_request *
4175 + printer_req_alloc(struct usb_ep *ep, unsigned len, gfp_t gfp_flags)
4176 + {
4177 +@@ -352,6 +360,7 @@ printer_open(struct inode *inode, struct file *fd)
4178 +
4179 + spin_unlock_irqrestore(&dev->lock, flags);
4180 +
4181 ++ kref_get(&dev->kref);
4182 + DBG(dev, "printer_open returned %x\n", ret);
4183 + return ret;
4184 + }
4185 +@@ -369,6 +378,7 @@ printer_close(struct inode *inode, struct file *fd)
4186 + dev->printer_status &= ~PRINTER_SELECTED;
4187 + spin_unlock_irqrestore(&dev->lock, flags);
4188 +
4189 ++ kref_put(&dev->kref, printer_dev_free);
4190 + DBG(dev, "printer_close\n");
4191 +
4192 + return 0;
4193 +@@ -1354,7 +1364,8 @@ static void gprinter_free(struct usb_function *f)
4194 + struct f_printer_opts *opts;
4195 +
4196 + opts = container_of(f->fi, struct f_printer_opts, func_inst);
4197 +- kfree(dev);
4198 ++
4199 ++ kref_put(&dev->kref, printer_dev_free);
4200 + mutex_lock(&opts->lock);
4201 + --opts->refcnt;
4202 + mutex_unlock(&opts->lock);
4203 +@@ -1423,6 +1434,7 @@ static struct usb_function *gprinter_alloc(struct usb_function_instance *fi)
4204 + return ERR_PTR(-ENOMEM);
4205 + }
4206 +
4207 ++ kref_init(&dev->kref);
4208 + ++opts->refcnt;
4209 + dev->minor = opts->minor;
4210 + dev->pnp_string = opts->pnp_string;
4211 +diff --git a/drivers/usb/gadget/function/u_ether.c b/drivers/usb/gadget/function/u_ether.c
4212 +index 81d84e0c3c6cd..716edd593a994 100644
4213 +--- a/drivers/usb/gadget/function/u_ether.c
4214 ++++ b/drivers/usb/gadget/function/u_ether.c
4215 +@@ -97,7 +97,7 @@ struct eth_dev {
4216 + static inline int qlen(struct usb_gadget *gadget, unsigned qmult)
4217 + {
4218 + if (gadget_is_dualspeed(gadget) && (gadget->speed == USB_SPEED_HIGH ||
4219 +- gadget->speed == USB_SPEED_SUPER))
4220 ++ gadget->speed >= USB_SPEED_SUPER))
4221 + return qmult * DEFAULT_QLEN;
4222 + else
4223 + return DEFAULT_QLEN;
4224 +diff --git a/drivers/usb/host/ohci-hcd.c b/drivers/usb/host/ohci-hcd.c
4225 +index 4ea1530257e27..dfc24be376002 100644
4226 +--- a/drivers/usb/host/ohci-hcd.c
4227 ++++ b/drivers/usb/host/ohci-hcd.c
4228 +@@ -665,20 +665,24 @@ retry:
4229 +
4230 + /* handle root hub init quirks ... */
4231 + val = roothub_a (ohci);
4232 +- val &= ~(RH_A_PSM | RH_A_OCPM);
4233 ++ /* Configure for per-port over-current protection by default */
4234 ++ val &= ~RH_A_NOCP;
4235 ++ val |= RH_A_OCPM;
4236 + if (ohci->flags & OHCI_QUIRK_SUPERIO) {
4237 +- /* NSC 87560 and maybe others */
4238 ++ /* NSC 87560 and maybe others.
4239 ++ * Ganged power switching, no over-current protection.
4240 ++ */
4241 + val |= RH_A_NOCP;
4242 +- val &= ~(RH_A_POTPGT | RH_A_NPS);
4243 +- ohci_writel (ohci, val, &ohci->regs->roothub.a);
4244 ++ val &= ~(RH_A_POTPGT | RH_A_NPS | RH_A_PSM | RH_A_OCPM);
4245 + } else if ((ohci->flags & OHCI_QUIRK_AMD756) ||
4246 + (ohci->flags & OHCI_QUIRK_HUB_POWER)) {
4247 + /* hub power always on; required for AMD-756 and some
4248 +- * Mac platforms. ganged overcurrent reporting, if any.
4249 ++ * Mac platforms.
4250 + */
4251 + val |= RH_A_NPS;
4252 +- ohci_writel (ohci, val, &ohci->regs->roothub.a);
4253 + }
4254 ++ ohci_writel(ohci, val, &ohci->regs->roothub.a);
4255 ++
4256 + ohci_writel (ohci, RH_HS_LPSC, &ohci->regs->roothub.status);
4257 + ohci_writel (ohci, (val & RH_A_NPS) ? 0 : RH_B_PPCM,
4258 + &ohci->regs->roothub.b);
4259 +diff --git a/drivers/vfio/pci/vfio_pci_intrs.c b/drivers/vfio/pci/vfio_pci_intrs.c
4260 +index bdfdd506bc588..c989f777bf771 100644
4261 +--- a/drivers/vfio/pci/vfio_pci_intrs.c
4262 ++++ b/drivers/vfio/pci/vfio_pci_intrs.c
4263 +@@ -355,11 +355,13 @@ static int vfio_msi_set_vector_signal(struct vfio_pci_device *vdev,
4264 + vdev->ctx[vector].producer.token = trigger;
4265 + vdev->ctx[vector].producer.irq = irq;
4266 + ret = irq_bypass_register_producer(&vdev->ctx[vector].producer);
4267 +- if (unlikely(ret))
4268 ++ if (unlikely(ret)) {
4269 + dev_info(&pdev->dev,
4270 + "irq bypass producer (token %p) registration fails: %d\n",
4271 + vdev->ctx[vector].producer.token, ret);
4272 +
4273 ++ vdev->ctx[vector].producer.token = NULL;
4274 ++ }
4275 + vdev->ctx[vector].trigger = trigger;
4276 +
4277 + return 0;
4278 +diff --git a/drivers/vfio/vfio_iommu_type1.c b/drivers/vfio/vfio_iommu_type1.c
4279 +index 9c8ed9d7f9aa5..bfbe5236239bd 100644
4280 +--- a/drivers/vfio/vfio_iommu_type1.c
4281 ++++ b/drivers/vfio/vfio_iommu_type1.c
4282 +@@ -629,7 +629,8 @@ static int vfio_iommu_type1_pin_pages(void *iommu_data,
4283 +
4284 + ret = vfio_add_to_pfn_list(dma, iova, phys_pfn[i]);
4285 + if (ret) {
4286 +- vfio_unpin_page_external(dma, iova, do_accounting);
4287 ++ if (put_pfn(phys_pfn[i], dma->prot) && do_accounting)
4288 ++ vfio_lock_acct(dma, -1, true);
4289 + goto pin_unwind;
4290 + }
4291 + }
4292 +diff --git a/drivers/video/backlight/sky81452-backlight.c b/drivers/video/backlight/sky81452-backlight.c
4293 +index d414c7a3acf5a..a2f77625b7170 100644
4294 +--- a/drivers/video/backlight/sky81452-backlight.c
4295 ++++ b/drivers/video/backlight/sky81452-backlight.c
4296 +@@ -207,6 +207,7 @@ static struct sky81452_bl_platform_data *sky81452_bl_parse_dt(
4297 + num_entry);
4298 + if (ret < 0) {
4299 + dev_err(dev, "led-sources node is invalid.\n");
4300 ++ of_node_put(np);
4301 + return ERR_PTR(-EINVAL);
4302 + }
4303 +
4304 +diff --git a/drivers/video/fbdev/sis/init.c b/drivers/video/fbdev/sis/init.c
4305 +index dfe3eb769638b..fde27feae5d0c 100644
4306 +--- a/drivers/video/fbdev/sis/init.c
4307 ++++ b/drivers/video/fbdev/sis/init.c
4308 +@@ -2428,6 +2428,11 @@ SiS_SetCRT1FIFO_630(struct SiS_Private *SiS_Pr, unsigned short ModeNo,
4309 +
4310 + i = 0;
4311 +
4312 ++ if (SiS_Pr->ChipType == SIS_730)
4313 ++ queuedata = &FQBQData730[0];
4314 ++ else
4315 ++ queuedata = &FQBQData[0];
4316 ++
4317 + if(ModeNo > 0x13) {
4318 +
4319 + /* Get VCLK */
4320 +@@ -2445,12 +2450,6 @@ SiS_SetCRT1FIFO_630(struct SiS_Private *SiS_Pr, unsigned short ModeNo,
4321 + /* Get half colordepth */
4322 + colorth = colortharray[(SiS_Pr->SiS_ModeType - ModeEGA)];
4323 +
4324 +- if(SiS_Pr->ChipType == SIS_730) {
4325 +- queuedata = &FQBQData730[0];
4326 +- } else {
4327 +- queuedata = &FQBQData[0];
4328 +- }
4329 +-
4330 + do {
4331 + templ = SiS_CalcDelay2(SiS_Pr, queuedata[i]) * VCLK * colorth;
4332 +
4333 +diff --git a/drivers/video/fbdev/vga16fb.c b/drivers/video/fbdev/vga16fb.c
4334 +index ee6957a799bb6..aea8fd85cbf70 100644
4335 +--- a/drivers/video/fbdev/vga16fb.c
4336 ++++ b/drivers/video/fbdev/vga16fb.c
4337 +@@ -243,7 +243,7 @@ static void vga16fb_update_fix(struct fb_info *info)
4338 + }
4339 +
4340 + static void vga16fb_clock_chip(struct vga16fb_par *par,
4341 +- unsigned int pixclock,
4342 ++ unsigned int *pixclock,
4343 + const struct fb_info *info,
4344 + int mul, int div)
4345 + {
4346 +@@ -259,14 +259,14 @@ static void vga16fb_clock_chip(struct vga16fb_par *par,
4347 + { 0 /* bad */, 0x00, 0x00}};
4348 + int err;
4349 +
4350 +- pixclock = (pixclock * mul) / div;
4351 ++ *pixclock = (*pixclock * mul) / div;
4352 + best = vgaclocks;
4353 +- err = pixclock - best->pixclock;
4354 ++ err = *pixclock - best->pixclock;
4355 + if (err < 0) err = -err;
4356 + for (ptr = vgaclocks + 1; ptr->pixclock; ptr++) {
4357 + int tmp;
4358 +
4359 +- tmp = pixclock - ptr->pixclock;
4360 ++ tmp = *pixclock - ptr->pixclock;
4361 + if (tmp < 0) tmp = -tmp;
4362 + if (tmp < err) {
4363 + err = tmp;
4364 +@@ -275,7 +275,7 @@ static void vga16fb_clock_chip(struct vga16fb_par *par,
4365 + }
4366 + par->misc |= best->misc;
4367 + par->clkdiv = best->seq_clock_mode;
4368 +- pixclock = (best->pixclock * div) / mul;
4369 ++ *pixclock = (best->pixclock * div) / mul;
4370 + }
4371 +
4372 + #define FAIL(X) return -EINVAL
4373 +@@ -497,10 +497,10 @@ static int vga16fb_check_var(struct fb_var_screeninfo *var,
4374 +
4375 + if (mode & MODE_8BPP)
4376 + /* pixel clock == vga clock / 2 */
4377 +- vga16fb_clock_chip(par, var->pixclock, info, 1, 2);
4378 ++ vga16fb_clock_chip(par, &var->pixclock, info, 1, 2);
4379 + else
4380 + /* pixel clock == vga clock */
4381 +- vga16fb_clock_chip(par, var->pixclock, info, 1, 1);
4382 ++ vga16fb_clock_chip(par, &var->pixclock, info, 1, 1);
4383 +
4384 + var->red.offset = var->green.offset = var->blue.offset =
4385 + var->transp.offset = 0;
4386 +diff --git a/drivers/virt/fsl_hypervisor.c b/drivers/virt/fsl_hypervisor.c
4387 +index 2e1678d22f6ff..1799bfb382e50 100644
4388 +--- a/drivers/virt/fsl_hypervisor.c
4389 ++++ b/drivers/virt/fsl_hypervisor.c
4390 +@@ -157,7 +157,7 @@ static long ioctl_memcpy(struct fsl_hv_ioctl_memcpy __user *p)
4391 +
4392 + unsigned int i;
4393 + long ret = 0;
4394 +- int num_pinned; /* return value from get_user_pages() */
4395 ++ int num_pinned = 0; /* return value from get_user_pages_fast() */
4396 + phys_addr_t remote_paddr; /* The next address in the remote buffer */
4397 + uint32_t count; /* The number of bytes left to copy */
4398 +
4399 +@@ -174,7 +174,7 @@ static long ioctl_memcpy(struct fsl_hv_ioctl_memcpy __user *p)
4400 + return -EINVAL;
4401 +
4402 + /*
4403 +- * The array of pages returned by get_user_pages() covers only
4404 ++ * The array of pages returned by get_user_pages_fast() covers only
4405 + * page-aligned memory. Since the user buffer is probably not
4406 + * page-aligned, we need to handle the discrepancy.
4407 + *
4408 +@@ -224,7 +224,7 @@ static long ioctl_memcpy(struct fsl_hv_ioctl_memcpy __user *p)
4409 +
4410 + /*
4411 + * 'pages' is an array of struct page pointers that's initialized by
4412 +- * get_user_pages().
4413 ++ * get_user_pages_fast().
4414 + */
4415 + pages = kzalloc(num_pages * sizeof(struct page *), GFP_KERNEL);
4416 + if (!pages) {
4417 +@@ -241,7 +241,7 @@ static long ioctl_memcpy(struct fsl_hv_ioctl_memcpy __user *p)
4418 + if (!sg_list_unaligned) {
4419 + pr_debug("fsl-hv: could not allocate S/G list\n");
4420 + ret = -ENOMEM;
4421 +- goto exit;
4422 ++ goto free_pages;
4423 + }
4424 + sg_list = PTR_ALIGN(sg_list_unaligned, sizeof(struct fh_sg_list));
4425 +
4426 +@@ -250,7 +250,6 @@ static long ioctl_memcpy(struct fsl_hv_ioctl_memcpy __user *p)
4427 + num_pages, pages, (param.source == -1) ? 0 : FOLL_WRITE);
4428 +
4429 + if (num_pinned != num_pages) {
4430 +- /* get_user_pages() failed */
4431 + pr_debug("fsl-hv: could not lock source buffer\n");
4432 + ret = (num_pinned < 0) ? num_pinned : -EFAULT;
4433 + goto exit;
4434 +@@ -292,13 +291,13 @@ static long ioctl_memcpy(struct fsl_hv_ioctl_memcpy __user *p)
4435 + virt_to_phys(sg_list), num_pages);
4436 +
4437 + exit:
4438 +- if (pages) {
4439 +- for (i = 0; i < num_pages; i++)
4440 +- if (pages[i])
4441 +- put_page(pages[i]);
4442 ++ if (pages && (num_pinned > 0)) {
4443 ++ for (i = 0; i < num_pinned; i++)
4444 ++ put_page(pages[i]);
4445 + }
4446 +
4447 + kfree(sg_list_unaligned);
4448 ++free_pages:
4449 + kfree(pages);
4450 +
4451 + if (!ret)
4452 +diff --git a/fs/cifs/asn1.c b/fs/cifs/asn1.c
4453 +index a3b56544c21b9..ae1f2817bd6a6 100644
4454 +--- a/fs/cifs/asn1.c
4455 ++++ b/fs/cifs/asn1.c
4456 +@@ -541,8 +541,8 @@ decode_negTokenInit(unsigned char *security_blob, int length,
4457 + return 0;
4458 + } else if ((cls != ASN1_CTX) || (con != ASN1_CON)
4459 + || (tag != ASN1_EOC)) {
4460 +- cifs_dbg(FYI, "cls = %d con = %d tag = %d end = %p (%d) exit 0\n",
4461 +- cls, con, tag, end, *end);
4462 ++ cifs_dbg(FYI, "cls = %d con = %d tag = %d end = %p exit 0\n",
4463 ++ cls, con, tag, end);
4464 + return 0;
4465 + }
4466 +
4467 +@@ -552,8 +552,8 @@ decode_negTokenInit(unsigned char *security_blob, int length,
4468 + return 0;
4469 + } else if ((cls != ASN1_UNI) || (con != ASN1_CON)
4470 + || (tag != ASN1_SEQ)) {
4471 +- cifs_dbg(FYI, "cls = %d con = %d tag = %d end = %p (%d) exit 1\n",
4472 +- cls, con, tag, end, *end);
4473 ++ cifs_dbg(FYI, "cls = %d con = %d tag = %d end = %p exit 1\n",
4474 ++ cls, con, tag, end);
4475 + return 0;
4476 + }
4477 +
4478 +@@ -563,8 +563,8 @@ decode_negTokenInit(unsigned char *security_blob, int length,
4479 + return 0;
4480 + } else if ((cls != ASN1_CTX) || (con != ASN1_CON)
4481 + || (tag != ASN1_EOC)) {
4482 +- cifs_dbg(FYI, "cls = %d con = %d tag = %d end = %p (%d) exit 0\n",
4483 +- cls, con, tag, end, *end);
4484 ++ cifs_dbg(FYI, "cls = %d con = %d tag = %d end = %p exit 0\n",
4485 ++ cls, con, tag, end);
4486 + return 0;
4487 + }
4488 +
4489 +@@ -575,8 +575,8 @@ decode_negTokenInit(unsigned char *security_blob, int length,
4490 + return 0;
4491 + } else if ((cls != ASN1_UNI) || (con != ASN1_CON)
4492 + || (tag != ASN1_SEQ)) {
4493 +- cifs_dbg(FYI, "cls = %d con = %d tag = %d end = %p (%d) exit 1\n",
4494 +- cls, con, tag, end, *end);
4495 ++ cifs_dbg(FYI, "cls = %d con = %d tag = %d sequence_end = %p exit 1\n",
4496 ++ cls, con, tag, sequence_end);
4497 + return 0;
4498 + }
4499 +
4500 +diff --git a/fs/cifs/smb2ops.c b/fs/cifs/smb2ops.c
4501 +index d2cfba90d9f8d..62ac5afaa7f2f 100644
4502 +--- a/fs/cifs/smb2ops.c
4503 ++++ b/fs/cifs/smb2ops.c
4504 +@@ -2305,7 +2305,7 @@ crypt_message(struct TCP_Server_Info *server, struct smb_rqst *rqst, int enc)
4505 + if (rc) {
4506 + cifs_dbg(VFS, "%s: Could not get %scryption key\n", __func__,
4507 + enc ? "en" : "de");
4508 +- return 0;
4509 ++ return rc;
4510 + }
4511 +
4512 + rc = smb3_crypto_aead_allocate(server);
4513 +diff --git a/fs/dlm/config.c b/fs/dlm/config.c
4514 +index 7211e826d90df..472f4f835d3e1 100644
4515 +--- a/fs/dlm/config.c
4516 ++++ b/fs/dlm/config.c
4517 +@@ -218,6 +218,7 @@ struct dlm_space {
4518 + struct list_head members;
4519 + struct mutex members_lock;
4520 + int members_count;
4521 ++ struct dlm_nodes *nds;
4522 + };
4523 +
4524 + struct dlm_comms {
4525 +@@ -426,6 +427,7 @@ static struct config_group *make_space(struct config_group *g, const char *name)
4526 + INIT_LIST_HEAD(&sp->members);
4527 + mutex_init(&sp->members_lock);
4528 + sp->members_count = 0;
4529 ++ sp->nds = nds;
4530 + return &sp->group;
4531 +
4532 + fail:
4533 +@@ -447,6 +449,7 @@ static void drop_space(struct config_group *g, struct config_item *i)
4534 + static void release_space(struct config_item *i)
4535 + {
4536 + struct dlm_space *sp = config_item_to_space(i);
4537 ++ kfree(sp->nds);
4538 + kfree(sp);
4539 + }
4540 +
4541 +diff --git a/fs/ext4/fsmap.c b/fs/ext4/fsmap.c
4542 +index 7ec3408985980..1a4d42a1b161d 100644
4543 +--- a/fs/ext4/fsmap.c
4544 ++++ b/fs/ext4/fsmap.c
4545 +@@ -121,6 +121,9 @@ static int ext4_getfsmap_helper(struct super_block *sb,
4546 +
4547 + /* Are we just counting mappings? */
4548 + if (info->gfi_head->fmh_count == 0) {
4549 ++ if (info->gfi_head->fmh_entries == UINT_MAX)
4550 ++ return EXT4_QUERY_RANGE_ABORT;
4551 ++
4552 + if (rec_fsblk > info->gfi_next_fsblk)
4553 + info->gfi_head->fmh_entries++;
4554 +
4555 +diff --git a/fs/f2fs/sysfs.c b/fs/f2fs/sysfs.c
4556 +index a55919eec0351..6a13099b3c823 100644
4557 +--- a/fs/f2fs/sysfs.c
4558 ++++ b/fs/f2fs/sysfs.c
4559 +@@ -563,4 +563,5 @@ void f2fs_unregister_sysfs(struct f2fs_sb_info *sbi)
4560 + }
4561 + kobject_del(&sbi->s_kobj);
4562 + kobject_put(&sbi->s_kobj);
4563 ++ wait_for_completion(&sbi->s_kobj_unregister);
4564 + }
4565 +diff --git a/fs/ntfs/inode.c b/fs/ntfs/inode.c
4566 +index 7c410f8794124..2aa073b82d30f 100644
4567 +--- a/fs/ntfs/inode.c
4568 ++++ b/fs/ntfs/inode.c
4569 +@@ -1844,6 +1844,12 @@ int ntfs_read_inode_mount(struct inode *vi)
4570 + brelse(bh);
4571 + }
4572 +
4573 ++ if (le32_to_cpu(m->bytes_allocated) != vol->mft_record_size) {
4574 ++ ntfs_error(sb, "Incorrect mft record size %u in superblock, should be %u.",
4575 ++ le32_to_cpu(m->bytes_allocated), vol->mft_record_size);
4576 ++ goto err_out;
4577 ++ }
4578 ++
4579 + /* Apply the mst fixups. */
4580 + if (post_read_mst_fixup((NTFS_RECORD*)m, vol->mft_record_size)) {
4581 + /* FIXME: Try to use the $MFTMirr now. */
4582 +diff --git a/fs/proc/base.c b/fs/proc/base.c
4583 +index 64695dcf89f3b..eeb81d9648c67 100644
4584 +--- a/fs/proc/base.c
4585 ++++ b/fs/proc/base.c
4586 +@@ -1041,7 +1041,6 @@ static ssize_t oom_adj_read(struct file *file, char __user *buf, size_t count,
4587 +
4588 + static int __set_oom_adj(struct file *file, int oom_adj, bool legacy)
4589 + {
4590 +- static DEFINE_MUTEX(oom_adj_mutex);
4591 + struct mm_struct *mm = NULL;
4592 + struct task_struct *task;
4593 + int err = 0;
4594 +@@ -1081,7 +1080,7 @@ static int __set_oom_adj(struct file *file, int oom_adj, bool legacy)
4595 + struct task_struct *p = find_lock_task_mm(task);
4596 +
4597 + if (p) {
4598 +- if (atomic_read(&p->mm->mm_users) > 1) {
4599 ++ if (test_bit(MMF_MULTIPROCESS, &p->mm->flags)) {
4600 + mm = p->mm;
4601 + mmgrab(mm);
4602 + }
4603 +diff --git a/fs/quota/quota_v2.c b/fs/quota/quota_v2.c
4604 +index a73e5b34db418..5d4dc0f84f202 100644
4605 +--- a/fs/quota/quota_v2.c
4606 ++++ b/fs/quota/quota_v2.c
4607 +@@ -283,6 +283,7 @@ static void v2r1_mem2diskdqb(void *dp, struct dquot *dquot)
4608 + d->dqb_curspace = cpu_to_le64(m->dqb_curspace);
4609 + d->dqb_btime = cpu_to_le64(m->dqb_btime);
4610 + d->dqb_id = cpu_to_le32(from_kqid(&init_user_ns, dquot->dq_id));
4611 ++ d->dqb_pad = 0;
4612 + if (qtree_entry_unused(info, dp))
4613 + d->dqb_itime = cpu_to_le64(1);
4614 + }
4615 +diff --git a/fs/ramfs/file-nommu.c b/fs/ramfs/file-nommu.c
4616 +index 3ac1f23870837..5e1ebbe639ebf 100644
4617 +--- a/fs/ramfs/file-nommu.c
4618 ++++ b/fs/ramfs/file-nommu.c
4619 +@@ -228,7 +228,7 @@ static unsigned long ramfs_nommu_get_unmapped_area(struct file *file,
4620 + if (!pages)
4621 + goto out_free;
4622 +
4623 +- nr = find_get_pages(inode->i_mapping, &pgoff, lpages, pages);
4624 ++ nr = find_get_pages_contig(inode->i_mapping, pgoff, lpages, pages);
4625 + if (nr != lpages)
4626 + goto out_free_pages; /* leave if some pages were missing */
4627 +
4628 +diff --git a/fs/reiserfs/inode.c b/fs/reiserfs/inode.c
4629 +index 4b0fed69e0330..06c4d376b0e39 100644
4630 +--- a/fs/reiserfs/inode.c
4631 ++++ b/fs/reiserfs/inode.c
4632 +@@ -2160,7 +2160,8 @@ out_end_trans:
4633 + out_inserted_sd:
4634 + clear_nlink(inode);
4635 + th->t_trans_id = 0; /* so the caller can't use this handle later */
4636 +- unlock_new_inode(inode); /* OK to do even if we hadn't locked it */
4637 ++ if (inode->i_state & I_NEW)
4638 ++ unlock_new_inode(inode);
4639 + iput(inode);
4640 + return err;
4641 + }
4642 +diff --git a/fs/reiserfs/super.c b/fs/reiserfs/super.c
4643 +index 9caf3948417c0..fbae5f4eea09c 100644
4644 +--- a/fs/reiserfs/super.c
4645 ++++ b/fs/reiserfs/super.c
4646 +@@ -1264,6 +1264,10 @@ static int reiserfs_parse_options(struct super_block *s,
4647 + "turned on.");
4648 + return 0;
4649 + }
4650 ++ if (qf_names[qtype] !=
4651 ++ REISERFS_SB(s)->s_qf_names[qtype])
4652 ++ kfree(qf_names[qtype]);
4653 ++ qf_names[qtype] = NULL;
4654 + if (*arg) { /* Some filename specified? */
4655 + if (REISERFS_SB(s)->s_qf_names[qtype]
4656 + && strcmp(REISERFS_SB(s)->s_qf_names[qtype],
4657 +@@ -1293,10 +1297,6 @@ static int reiserfs_parse_options(struct super_block *s,
4658 + else
4659 + *mount_options |= 1 << REISERFS_GRPQUOTA;
4660 + } else {
4661 +- if (qf_names[qtype] !=
4662 +- REISERFS_SB(s)->s_qf_names[qtype])
4663 +- kfree(qf_names[qtype]);
4664 +- qf_names[qtype] = NULL;
4665 + if (qtype == USRQUOTA)
4666 + *mount_options &= ~(1 << REISERFS_USRQUOTA);
4667 + else
4668 +diff --git a/fs/udf/inode.c b/fs/udf/inode.c
4669 +index 3c1b54091d6cc..dd57bd446340c 100644
4670 +--- a/fs/udf/inode.c
4671 ++++ b/fs/udf/inode.c
4672 +@@ -132,21 +132,24 @@ void udf_evict_inode(struct inode *inode)
4673 + struct udf_inode_info *iinfo = UDF_I(inode);
4674 + int want_delete = 0;
4675 +
4676 +- if (!inode->i_nlink && !is_bad_inode(inode)) {
4677 +- want_delete = 1;
4678 +- udf_setsize(inode, 0);
4679 +- udf_update_inode(inode, IS_SYNC(inode));
4680 ++ if (!is_bad_inode(inode)) {
4681 ++ if (!inode->i_nlink) {
4682 ++ want_delete = 1;
4683 ++ udf_setsize(inode, 0);
4684 ++ udf_update_inode(inode, IS_SYNC(inode));
4685 ++ }
4686 ++ if (iinfo->i_alloc_type != ICBTAG_FLAG_AD_IN_ICB &&
4687 ++ inode->i_size != iinfo->i_lenExtents) {
4688 ++ udf_warn(inode->i_sb,
4689 ++ "Inode %lu (mode %o) has inode size %llu different from extent length %llu. Filesystem need not be standards compliant.\n",
4690 ++ inode->i_ino, inode->i_mode,
4691 ++ (unsigned long long)inode->i_size,
4692 ++ (unsigned long long)iinfo->i_lenExtents);
4693 ++ }
4694 + }
4695 + truncate_inode_pages_final(&inode->i_data);
4696 + invalidate_inode_buffers(inode);
4697 + clear_inode(inode);
4698 +- if (iinfo->i_alloc_type != ICBTAG_FLAG_AD_IN_ICB &&
4699 +- inode->i_size != iinfo->i_lenExtents) {
4700 +- udf_warn(inode->i_sb, "Inode %lu (mode %o) has inode size %llu different from extent length %llu. Filesystem need not be standards compliant.\n",
4701 +- inode->i_ino, inode->i_mode,
4702 +- (unsigned long long)inode->i_size,
4703 +- (unsigned long long)iinfo->i_lenExtents);
4704 +- }
4705 + kfree(iinfo->i_ext.i_data);
4706 + iinfo->i_ext.i_data = NULL;
4707 + udf_clear_extent_cache(inode);
4708 +diff --git a/fs/udf/super.c b/fs/udf/super.c
4709 +index 51de27685e185..2b8147ecd97fb 100644
4710 +--- a/fs/udf/super.c
4711 ++++ b/fs/udf/super.c
4712 +@@ -1385,6 +1385,12 @@ static int udf_load_sparable_map(struct super_block *sb,
4713 + (int)spm->numSparingTables);
4714 + return -EIO;
4715 + }
4716 ++ if (le32_to_cpu(spm->sizeSparingTable) > sb->s_blocksize) {
4717 ++ udf_err(sb, "error loading logical volume descriptor: "
4718 ++ "Too big sparing table size (%u)\n",
4719 ++ le32_to_cpu(spm->sizeSparingTable));
4720 ++ return -EIO;
4721 ++ }
4722 +
4723 + for (i = 0; i < spm->numSparingTables; i++) {
4724 + loc = le32_to_cpu(spm->locSparingTable[i]);
4725 +diff --git a/fs/xfs/xfs_fsmap.c b/fs/xfs/xfs_fsmap.c
4726 +index 43cfc07996a43..e7622e0841868 100644
4727 +--- a/fs/xfs/xfs_fsmap.c
4728 ++++ b/fs/xfs/xfs_fsmap.c
4729 +@@ -273,6 +273,9 @@ xfs_getfsmap_helper(
4730 +
4731 + /* Are we just counting mappings? */
4732 + if (info->head->fmh_count == 0) {
4733 ++ if (info->head->fmh_entries == UINT_MAX)
4734 ++ return -ECANCELED;
4735 ++
4736 + if (rec_daddr > info->next_daddr)
4737 + info->head->fmh_entries++;
4738 +
4739 +diff --git a/fs/xfs/xfs_rtalloc.c b/fs/xfs/xfs_rtalloc.c
4740 +index cdcb7235e41ae..7d3b56872e563 100644
4741 +--- a/fs/xfs/xfs_rtalloc.c
4742 ++++ b/fs/xfs/xfs_rtalloc.c
4743 +@@ -257,6 +257,9 @@ xfs_rtallocate_extent_block(
4744 + end = XFS_BLOCKTOBIT(mp, bbno + 1) - 1;
4745 + i <= end;
4746 + i++) {
4747 ++ /* Make sure we don't scan off the end of the rt volume. */
4748 ++ maxlen = min(mp->m_sb.sb_rextents, i + maxlen) - i;
4749 ++
4750 + /*
4751 + * See if there's a free extent of maxlen starting at i.
4752 + * If it's not so then next will contain the first non-free.
4753 +@@ -448,6 +451,14 @@ xfs_rtallocate_extent_near(
4754 + */
4755 + if (bno >= mp->m_sb.sb_rextents)
4756 + bno = mp->m_sb.sb_rextents - 1;
4757 ++
4758 ++ /* Make sure we don't run off the end of the rt volume. */
4759 ++ maxlen = min(mp->m_sb.sb_rextents, bno + maxlen) - bno;
4760 ++ if (maxlen < minlen) {
4761 ++ *rtblock = NULLRTBLOCK;
4762 ++ return 0;
4763 ++ }
4764 ++
4765 + /*
4766 + * Try the exact allocation first.
4767 + */
4768 +diff --git a/include/linux/oom.h b/include/linux/oom.h
4769 +index 6adac113e96d2..c84597595cb41 100644
4770 +--- a/include/linux/oom.h
4771 ++++ b/include/linux/oom.h
4772 +@@ -45,6 +45,7 @@ struct oom_control {
4773 + };
4774 +
4775 + extern struct mutex oom_lock;
4776 ++extern struct mutex oom_adj_mutex;
4777 +
4778 + static inline void set_current_oom_origin(void)
4779 + {
4780 +diff --git a/include/linux/overflow.h b/include/linux/overflow.h
4781 +index 40b48e2133cb8..38a47cc62cf3a 100644
4782 +--- a/include/linux/overflow.h
4783 ++++ b/include/linux/overflow.h
4784 +@@ -3,6 +3,7 @@
4785 + #define __LINUX_OVERFLOW_H
4786 +
4787 + #include <linux/compiler.h>
4788 ++#include <linux/limits.h>
4789 +
4790 + /*
4791 + * In the fallback code below, we need to compute the minimum and
4792 +diff --git a/include/linux/sched/coredump.h b/include/linux/sched/coredump.h
4793 +index ecdc6542070f1..dfd82eab29025 100644
4794 +--- a/include/linux/sched/coredump.h
4795 ++++ b/include/linux/sched/coredump.h
4796 +@@ -72,6 +72,7 @@ static inline int get_dumpable(struct mm_struct *mm)
4797 + #define MMF_DISABLE_THP 24 /* disable THP for all VMAs */
4798 + #define MMF_OOM_VICTIM 25 /* mm is the oom victim */
4799 + #define MMF_OOM_REAP_QUEUED 26 /* mm was queued for oom_reaper */
4800 ++#define MMF_MULTIPROCESS 27 /* mm is shared between processes */
4801 + #define MMF_DISABLE_THP_MASK (1 << MMF_DISABLE_THP)
4802 +
4803 + #define MMF_INIT_MASK (MMF_DUMPABLE_MASK | MMF_DUMP_FILTER_MASK |\
4804 +diff --git a/include/net/ip.h b/include/net/ip.h
4805 +index 666d89ca4e2e2..20a92cdb1e35c 100644
4806 +--- a/include/net/ip.h
4807 ++++ b/include/net/ip.h
4808 +@@ -364,12 +364,18 @@ static inline unsigned int ip_dst_mtu_maybe_forward(const struct dst_entry *dst,
4809 + bool forwarding)
4810 + {
4811 + struct net *net = dev_net(dst->dev);
4812 ++ unsigned int mtu;
4813 +
4814 + if (net->ipv4.sysctl_ip_fwd_use_pmtu ||
4815 + ip_mtu_locked(dst) ||
4816 + !forwarding)
4817 + return dst_mtu(dst);
4818 +
4819 ++ /* 'forwarding = true' case should always honour route mtu */
4820 ++ mtu = dst_metric_raw(dst, RTAX_MTU);
4821 ++ if (mtu)
4822 ++ return mtu;
4823 ++
4824 + return min(READ_ONCE(dst->dev->mtu), IP_MAX_MTU);
4825 + }
4826 +
4827 +diff --git a/include/scsi/scsi_common.h b/include/scsi/scsi_common.h
4828 +index 731ac09ed2313..5b567b43e1b16 100644
4829 +--- a/include/scsi/scsi_common.h
4830 ++++ b/include/scsi/scsi_common.h
4831 +@@ -25,6 +25,13 @@ scsi_command_size(const unsigned char *cmnd)
4832 + scsi_varlen_cdb_length(cmnd) : COMMAND_SIZE(cmnd[0]);
4833 + }
4834 +
4835 ++static inline unsigned char
4836 ++scsi_command_control(const unsigned char *cmnd)
4837 ++{
4838 ++ return (cmnd[0] == VARIABLE_LENGTH_CMD) ?
4839 ++ cmnd[1] : cmnd[COMMAND_SIZE(cmnd[0]) - 1];
4840 ++}
4841 ++
4842 + /* Returns a human-readable name for the device */
4843 + extern const char *scsi_device_type(unsigned type);
4844 +
4845 +diff --git a/include/trace/events/target.h b/include/trace/events/target.h
4846 +index 914a872dd3435..e87a3716b0ac9 100644
4847 +--- a/include/trace/events/target.h
4848 ++++ b/include/trace/events/target.h
4849 +@@ -140,6 +140,7 @@ TRACE_EVENT(target_sequencer_start,
4850 + __field( unsigned int, opcode )
4851 + __field( unsigned int, data_length )
4852 + __field( unsigned int, task_attribute )
4853 ++ __field( unsigned char, control )
4854 + __array( unsigned char, cdb, TCM_MAX_COMMAND_SIZE )
4855 + __string( initiator, cmd->se_sess->se_node_acl->initiatorname )
4856 + ),
4857 +@@ -149,6 +150,7 @@ TRACE_EVENT(target_sequencer_start,
4858 + __entry->opcode = cmd->t_task_cdb[0];
4859 + __entry->data_length = cmd->data_length;
4860 + __entry->task_attribute = cmd->sam_task_attr;
4861 ++ __entry->control = scsi_command_control(cmd->t_task_cdb);
4862 + memcpy(__entry->cdb, cmd->t_task_cdb, TCM_MAX_COMMAND_SIZE);
4863 + __assign_str(initiator, cmd->se_sess->se_node_acl->initiatorname);
4864 + ),
4865 +@@ -158,9 +160,7 @@ TRACE_EVENT(target_sequencer_start,
4866 + show_opcode_name(__entry->opcode),
4867 + __entry->data_length, __print_hex(__entry->cdb, 16),
4868 + show_task_attribute_name(__entry->task_attribute),
4869 +- scsi_command_size(__entry->cdb) <= 16 ?
4870 +- __entry->cdb[scsi_command_size(__entry->cdb) - 1] :
4871 +- __entry->cdb[1]
4872 ++ __entry->control
4873 + )
4874 + );
4875 +
4876 +@@ -175,6 +175,7 @@ TRACE_EVENT(target_cmd_complete,
4877 + __field( unsigned int, opcode )
4878 + __field( unsigned int, data_length )
4879 + __field( unsigned int, task_attribute )
4880 ++ __field( unsigned char, control )
4881 + __field( unsigned char, scsi_status )
4882 + __field( unsigned char, sense_length )
4883 + __array( unsigned char, cdb, TCM_MAX_COMMAND_SIZE )
4884 +@@ -187,6 +188,7 @@ TRACE_EVENT(target_cmd_complete,
4885 + __entry->opcode = cmd->t_task_cdb[0];
4886 + __entry->data_length = cmd->data_length;
4887 + __entry->task_attribute = cmd->sam_task_attr;
4888 ++ __entry->control = scsi_command_control(cmd->t_task_cdb);
4889 + __entry->scsi_status = cmd->scsi_status;
4890 + __entry->sense_length = cmd->scsi_status == SAM_STAT_CHECK_CONDITION ?
4891 + min(18, ((u8 *) cmd->sense_buffer)[SPC_ADD_SENSE_LEN_OFFSET] + 8) : 0;
4892 +@@ -203,9 +205,7 @@ TRACE_EVENT(target_cmd_complete,
4893 + show_opcode_name(__entry->opcode),
4894 + __entry->data_length, __print_hex(__entry->cdb, 16),
4895 + show_task_attribute_name(__entry->task_attribute),
4896 +- scsi_command_size(__entry->cdb) <= 16 ?
4897 +- __entry->cdb[scsi_command_size(__entry->cdb) - 1] :
4898 +- __entry->cdb[1]
4899 ++ __entry->control
4900 + )
4901 + );
4902 +
4903 +diff --git a/include/uapi/linux/perf_event.h b/include/uapi/linux/perf_event.h
4904 +index 362493a2f950b..fc72a3839c9dc 100644
4905 +--- a/include/uapi/linux/perf_event.h
4906 ++++ b/include/uapi/linux/perf_event.h
4907 +@@ -1033,7 +1033,7 @@ union perf_mem_data_src {
4908 +
4909 + #define PERF_MEM_SNOOPX_FWD 0x01 /* forward */
4910 + /* 1 free */
4911 +-#define PERF_MEM_SNOOPX_SHIFT 37
4912 ++#define PERF_MEM_SNOOPX_SHIFT 38
4913 +
4914 + /* locked instruction */
4915 + #define PERF_MEM_LOCK_NA 0x01 /* not available */
4916 +diff --git a/kernel/debug/kdb/kdb_io.c b/kernel/debug/kdb/kdb_io.c
4917 +index 6a4b41484afe6..b45576ca3b0da 100644
4918 +--- a/kernel/debug/kdb/kdb_io.c
4919 ++++ b/kernel/debug/kdb/kdb_io.c
4920 +@@ -679,12 +679,16 @@ int vkdb_printf(enum kdb_msgsrc src, const char *fmt, va_list ap)
4921 + size_avail = sizeof(kdb_buffer) - len;
4922 + goto kdb_print_out;
4923 + }
4924 +- if (kdb_grepping_flag >= KDB_GREPPING_FLAG_SEARCH)
4925 ++ if (kdb_grepping_flag >= KDB_GREPPING_FLAG_SEARCH) {
4926 + /*
4927 + * This was a interactive search (using '/' at more
4928 +- * prompt) and it has completed. Clear the flag.
4929 ++ * prompt) and it has completed. Replace the \0 with
4930 ++ * its original value to ensure multi-line strings
4931 ++ * are handled properly, and return to normal mode.
4932 + */
4933 ++ *cphold = replaced_byte;
4934 + kdb_grepping_flag = 0;
4935 ++ }
4936 + /*
4937 + * at this point the string is a full line and
4938 + * should be printed, up to the null.
4939 +diff --git a/kernel/fork.c b/kernel/fork.c
4940 +index 0a328cf0cb136..535aeb7ca145c 100644
4941 +--- a/kernel/fork.c
4942 ++++ b/kernel/fork.c
4943 +@@ -1544,6 +1544,25 @@ static __always_inline void delayed_free_task(struct task_struct *tsk)
4944 + free_task(tsk);
4945 + }
4946 +
4947 ++static void copy_oom_score_adj(u64 clone_flags, struct task_struct *tsk)
4948 ++{
4949 ++ /* Skip if kernel thread */
4950 ++ if (!tsk->mm)
4951 ++ return;
4952 ++
4953 ++ /* Skip if spawning a thread or using vfork */
4954 ++ if ((clone_flags & (CLONE_VM | CLONE_THREAD | CLONE_VFORK)) != CLONE_VM)
4955 ++ return;
4956 ++
4957 ++ /* We need to synchronize with __set_oom_adj */
4958 ++ mutex_lock(&oom_adj_mutex);
4959 ++ set_bit(MMF_MULTIPROCESS, &tsk->mm->flags);
4960 ++ /* Update the values in case they were changed after copy_signal */
4961 ++ tsk->signal->oom_score_adj = current->signal->oom_score_adj;
4962 ++ tsk->signal->oom_score_adj_min = current->signal->oom_score_adj_min;
4963 ++ mutex_unlock(&oom_adj_mutex);
4964 ++}
4965 ++
4966 + /*
4967 + * This creates a new process as a copy of the old one,
4968 + * but does not actually start it yet.
4969 +@@ -1952,6 +1971,8 @@ static __latent_entropy struct task_struct *copy_process(
4970 + trace_task_newtask(p, clone_flags);
4971 + uprobe_copy_process(p, clone_flags);
4972 +
4973 ++ copy_oom_score_adj(clone_flags, p);
4974 ++
4975 + return p;
4976 +
4977 + bad_fork_cancel_cgroup:
4978 +diff --git a/kernel/power/hibernate.c b/kernel/power/hibernate.c
4979 +index 2e65aacfa1162..02df69a8ee3c0 100644
4980 +--- a/kernel/power/hibernate.c
4981 ++++ b/kernel/power/hibernate.c
4982 +@@ -833,17 +833,6 @@ static int software_resume(void)
4983 +
4984 + /* Check if the device is there */
4985 + swsusp_resume_device = name_to_dev_t(resume_file);
4986 +-
4987 +- /*
4988 +- * name_to_dev_t is ineffective to verify parition if resume_file is in
4989 +- * integer format. (e.g. major:minor)
4990 +- */
4991 +- if (isdigit(resume_file[0]) && resume_wait) {
4992 +- int partno;
4993 +- while (!get_gendisk(swsusp_resume_device, &partno))
4994 +- msleep(10);
4995 +- }
4996 +-
4997 + if (!swsusp_resume_device) {
4998 + /*
4999 + * Some device discovery might still be in progress; we need
5000 +diff --git a/lib/crc32.c b/lib/crc32.c
5001 +index 6ddc92bc14609..a1ccb4a8a9950 100644
5002 +--- a/lib/crc32.c
5003 ++++ b/lib/crc32.c
5004 +@@ -327,7 +327,7 @@ static inline u32 __pure crc32_be_generic(u32 crc, unsigned char const *p,
5005 + return crc;
5006 + }
5007 +
5008 +-#if CRC_LE_BITS == 1
5009 ++#if CRC_BE_BITS == 1
5010 + u32 __pure crc32_be(u32 crc, unsigned char const *p, size_t len)
5011 + {
5012 + return crc32_be_generic(crc, p, len, NULL, CRCPOLY_BE);
5013 +diff --git a/mm/memcontrol.c b/mm/memcontrol.c
5014 +index 5cbcd4b81bf8f..70707d44a6903 100644
5015 +--- a/mm/memcontrol.c
5016 ++++ b/mm/memcontrol.c
5017 +@@ -4514,7 +4514,7 @@ static struct page *mc_handle_swap_pte(struct vm_area_struct *vma,
5018 + struct page *page = NULL;
5019 + swp_entry_t ent = pte_to_swp_entry(ptent);
5020 +
5021 +- if (!(mc.flags & MOVE_ANON) || non_swap_entry(ent))
5022 ++ if (!(mc.flags & MOVE_ANON))
5023 + return NULL;
5024 +
5025 + /*
5026 +@@ -4533,6 +4533,9 @@ static struct page *mc_handle_swap_pte(struct vm_area_struct *vma,
5027 + return page;
5028 + }
5029 +
5030 ++ if (non_swap_entry(ent))
5031 ++ return NULL;
5032 ++
5033 + /*
5034 + * Because lookup_swap_cache() updates some statistics counter,
5035 + * we call find_get_page() with swapper_space directly.
5036 +diff --git a/mm/oom_kill.c b/mm/oom_kill.c
5037 +index 7a5c0b229c6ae..6482d743c5c88 100644
5038 +--- a/mm/oom_kill.c
5039 ++++ b/mm/oom_kill.c
5040 +@@ -53,6 +53,8 @@ int sysctl_oom_kill_allocating_task;
5041 + int sysctl_oom_dump_tasks = 1;
5042 +
5043 + DEFINE_MUTEX(oom_lock);
5044 ++/* Serializes oom_score_adj and oom_score_adj_min updates */
5045 ++DEFINE_MUTEX(oom_adj_mutex);
5046 +
5047 + #ifdef CONFIG_NUMA
5048 + /**
5049 +diff --git a/net/bluetooth/l2cap_sock.c b/net/bluetooth/l2cap_sock.c
5050 +index 7ff82f97e42cc..f94b14beba2bc 100644
5051 +--- a/net/bluetooth/l2cap_sock.c
5052 ++++ b/net/bluetooth/l2cap_sock.c
5053 +@@ -1342,8 +1342,6 @@ static void l2cap_sock_teardown_cb(struct l2cap_chan *chan, int err)
5054 +
5055 + parent = bt_sk(sk)->parent;
5056 +
5057 +- sock_set_flag(sk, SOCK_ZAPPED);
5058 +-
5059 + switch (chan->state) {
5060 + case BT_OPEN:
5061 + case BT_BOUND:
5062 +@@ -1370,8 +1368,11 @@ static void l2cap_sock_teardown_cb(struct l2cap_chan *chan, int err)
5063 +
5064 + break;
5065 + }
5066 +-
5067 + release_sock(sk);
5068 ++
5069 ++ /* Only zap after cleanup to avoid use after free race */
5070 ++ sock_set_flag(sk, SOCK_ZAPPED);
5071 ++
5072 + }
5073 +
5074 + static void l2cap_sock_state_change_cb(struct l2cap_chan *chan, int state,
5075 +diff --git a/net/ipv4/icmp.c b/net/ipv4/icmp.c
5076 +index 995ef3d233689..41c78a716b9aa 100644
5077 +--- a/net/ipv4/icmp.c
5078 ++++ b/net/ipv4/icmp.c
5079 +@@ -244,7 +244,7 @@ static struct {
5080 + /**
5081 + * icmp_global_allow - Are we allowed to send one more ICMP message ?
5082 + *
5083 +- * Uses a token bucket to limit our ICMP messages to sysctl_icmp_msgs_per_sec.
5084 ++ * Uses a token bucket to limit our ICMP messages to ~sysctl_icmp_msgs_per_sec.
5085 + * Returns false if we reached the limit and can not send another packet.
5086 + * Note: called with BH disabled
5087 + */
5088 +@@ -272,7 +272,10 @@ bool icmp_global_allow(void)
5089 + }
5090 + credit = min_t(u32, icmp_global.credit + incr, sysctl_icmp_msgs_burst);
5091 + if (credit) {
5092 +- credit--;
5093 ++ /* We want to use a credit of one in average, but need to randomize
5094 ++ * it for security reasons.
5095 ++ */
5096 ++ credit = max_t(int, credit - prandom_u32_max(3), 0);
5097 + rc = true;
5098 + }
5099 + WRITE_ONCE(icmp_global.credit, credit);
5100 +diff --git a/net/ipv4/route.c b/net/ipv4/route.c
5101 +index 6fcb12e083d99..87854642e0b6e 100644
5102 +--- a/net/ipv4/route.c
5103 ++++ b/net/ipv4/route.c
5104 +@@ -2603,10 +2603,12 @@ struct rtable *ip_route_output_flow(struct net *net, struct flowi4 *flp4,
5105 + if (IS_ERR(rt))
5106 + return rt;
5107 +
5108 +- if (flp4->flowi4_proto)
5109 ++ if (flp4->flowi4_proto) {
5110 ++ flp4->flowi4_oif = rt->dst.dev->ifindex;
5111 + rt = (struct rtable *)xfrm_lookup_route(net, &rt->dst,
5112 + flowi4_to_flowi(flp4),
5113 + sk, 0);
5114 ++ }
5115 +
5116 + return rt;
5117 + }
5118 +diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
5119 +index 83d03340417a1..ec12a52edce2c 100644
5120 +--- a/net/ipv4/tcp_input.c
5121 ++++ b/net/ipv4/tcp_input.c
5122 +@@ -5539,6 +5539,8 @@ void tcp_rcv_established(struct sock *sk, struct sk_buff *skb,
5123 + tcp_data_snd_check(sk);
5124 + if (!inet_csk_ack_scheduled(sk))
5125 + goto no_ack;
5126 ++ } else {
5127 ++ tcp_update_wl(tp, TCP_SKB_CB(skb)->seq);
5128 + }
5129 +
5130 + __tcp_ack_snd_check(sk, 0);
5131 +diff --git a/net/mac80211/cfg.c b/net/mac80211/cfg.c
5132 +index c883cb67b7311..0b82d8da4ab0a 100644
5133 +--- a/net/mac80211/cfg.c
5134 ++++ b/net/mac80211/cfg.c
5135 +@@ -661,7 +661,8 @@ void sta_set_rate_info_tx(struct sta_info *sta,
5136 + u16 brate;
5137 +
5138 + sband = ieee80211_get_sband(sta->sdata);
5139 +- if (sband) {
5140 ++ WARN_ON_ONCE(sband && !sband->bitrates);
5141 ++ if (sband && sband->bitrates) {
5142 + brate = sband->bitrates[rate->idx].bitrate;
5143 + rinfo->legacy = DIV_ROUND_UP(brate, 1 << shift);
5144 + }
5145 +diff --git a/net/mac80211/sta_info.c b/net/mac80211/sta_info.c
5146 +index 6af5fda6461ce..2a18687019003 100644
5147 +--- a/net/mac80211/sta_info.c
5148 ++++ b/net/mac80211/sta_info.c
5149 +@@ -2004,6 +2004,10 @@ static void sta_stats_decode_rate(struct ieee80211_local *local, u16 rate,
5150 +
5151 + rinfo->flags = 0;
5152 + sband = local->hw.wiphy->bands[band];
5153 ++
5154 ++ if (WARN_ON_ONCE(!sband->bitrates))
5155 ++ break;
5156 ++
5157 + brate = sband->bitrates[rate_idx].bitrate;
5158 + if (rinfo->bw == RATE_INFO_BW_5)
5159 + shift = 2;
5160 +diff --git a/net/netfilter/ipvs/ip_vs_ctl.c b/net/netfilter/ipvs/ip_vs_ctl.c
5161 +index 5ec80818ace2c..c1672ff009637 100644
5162 +--- a/net/netfilter/ipvs/ip_vs_ctl.c
5163 ++++ b/net/netfilter/ipvs/ip_vs_ctl.c
5164 +@@ -2425,6 +2425,10 @@ do_ip_vs_set_ctl(struct sock *sk, int cmd, void __user *user, unsigned int len)
5165 + /* Set timeout values for (tcp tcpfin udp) */
5166 + ret = ip_vs_set_timeout(ipvs, (struct ip_vs_timeout_user *)arg);
5167 + goto out_unlock;
5168 ++ } else if (!len) {
5169 ++ /* No more commands with len == 0 below */
5170 ++ ret = -EINVAL;
5171 ++ goto out_unlock;
5172 + }
5173 +
5174 + usvc_compat = (struct ip_vs_service_user *)arg;
5175 +@@ -2501,9 +2505,6 @@ do_ip_vs_set_ctl(struct sock *sk, int cmd, void __user *user, unsigned int len)
5176 + break;
5177 + case IP_VS_SO_SET_DELDEST:
5178 + ret = ip_vs_del_dest(svc, &udest);
5179 +- break;
5180 +- default:
5181 +- ret = -EINVAL;
5182 + }
5183 +
5184 + out_unlock:
5185 +diff --git a/net/nfc/netlink.c b/net/nfc/netlink.c
5186 +index 6199f4334fbd2..2d642baeafbb2 100644
5187 +--- a/net/nfc/netlink.c
5188 ++++ b/net/nfc/netlink.c
5189 +@@ -1224,7 +1224,7 @@ static int nfc_genl_fw_download(struct sk_buff *skb, struct genl_info *info)
5190 + u32 idx;
5191 + char firmware_name[NFC_FIRMWARE_NAME_MAXSIZE + 1];
5192 +
5193 +- if (!info->attrs[NFC_ATTR_DEVICE_INDEX])
5194 ++ if (!info->attrs[NFC_ATTR_DEVICE_INDEX] || !info->attrs[NFC_ATTR_FIRMWARE_NAME])
5195 + return -EINVAL;
5196 +
5197 + idx = nla_get_u32(info->attrs[NFC_ATTR_DEVICE_INDEX]);
5198 +diff --git a/net/tipc/msg.c b/net/tipc/msg.c
5199 +index d048ec6dab12a..e61657a0438a9 100644
5200 +--- a/net/tipc/msg.c
5201 ++++ b/net/tipc/msg.c
5202 +@@ -140,7 +140,8 @@ int tipc_buf_append(struct sk_buff **headbuf, struct sk_buff **buf)
5203 + if (fragid == FIRST_FRAGMENT) {
5204 + if (unlikely(head))
5205 + goto err;
5206 +- frag = skb_unshare(frag, GFP_ATOMIC);
5207 ++ if (skb_cloned(frag))
5208 ++ frag = skb_copy(frag, GFP_ATOMIC);
5209 + if (unlikely(!frag))
5210 + goto err;
5211 + head = *headbuf = frag;
5212 +diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
5213 +index bf3caa376f9fe..6bd4f6c8fc2ef 100644
5214 +--- a/net/wireless/nl80211.c
5215 ++++ b/net/wireless/nl80211.c
5216 +@@ -1784,7 +1784,10 @@ static int nl80211_send_wiphy(struct cfg80211_registered_device *rdev,
5217 + * case we'll continue with more data in the next round,
5218 + * but break unconditionally so unsplit data stops here.
5219 + */
5220 +- state->split_start++;
5221 ++ if (state->split)
5222 ++ state->split_start++;
5223 ++ else
5224 ++ state->split_start = 0;
5225 + break;
5226 + case 9:
5227 + if (rdev->wiphy.extended_capabilities &&
5228 +diff --git a/samples/mic/mpssd/mpssd.c b/samples/mic/mpssd/mpssd.c
5229 +index 49db1def1721c..84e583ab8fd0c 100644
5230 +--- a/samples/mic/mpssd/mpssd.c
5231 ++++ b/samples/mic/mpssd/mpssd.c
5232 +@@ -414,9 +414,9 @@ mic_virtio_copy(struct mic_info *mic, int fd,
5233 +
5234 + static inline unsigned _vring_size(unsigned int num, unsigned long align)
5235 + {
5236 +- return ((sizeof(struct vring_desc) * num + sizeof(__u16) * (3 + num)
5237 ++ return _ALIGN_UP(((sizeof(struct vring_desc) * num + sizeof(__u16) * (3 + num)
5238 + + align - 1) & ~(align - 1))
5239 +- + sizeof(__u16) * 3 + sizeof(struct vring_used_elem) * num;
5240 ++ + sizeof(__u16) * 3 + sizeof(struct vring_used_elem) * num, 4);
5241 + }
5242 +
5243 + /*
5244 +diff --git a/security/integrity/ima/ima_crypto.c b/security/integrity/ima/ima_crypto.c
5245 +index 7b16e54f01c60..2c8fd4e907009 100644
5246 +--- a/security/integrity/ima/ima_crypto.c
5247 ++++ b/security/integrity/ima/ima_crypto.c
5248 +@@ -699,6 +699,8 @@ static int __init ima_calc_boot_aggregate_tfm(char *digest,
5249 + ima_pcrread(i, pcr_i);
5250 + /* now accumulate with current aggregate */
5251 + rc = crypto_shash_update(shash, pcr_i, TPM_DIGEST_SIZE);
5252 ++ if (rc != 0)
5253 ++ return rc;
5254 + }
5255 + if (!rc)
5256 + crypto_shash_final(shash, digest);
5257 +diff --git a/sound/core/seq/oss/seq_oss.c b/sound/core/seq/oss/seq_oss.c
5258 +index 4b78979599131..ade880fe24a41 100644
5259 +--- a/sound/core/seq/oss/seq_oss.c
5260 ++++ b/sound/core/seq/oss/seq_oss.c
5261 +@@ -187,9 +187,12 @@ odev_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
5262 + if (snd_BUG_ON(!dp))
5263 + return -ENXIO;
5264 +
5265 +- mutex_lock(&register_mutex);
5266 ++ if (cmd != SNDCTL_SEQ_SYNC &&
5267 ++ mutex_lock_interruptible(&register_mutex))
5268 ++ return -ERESTARTSYS;
5269 + rc = snd_seq_oss_ioctl(dp, cmd, arg);
5270 +- mutex_unlock(&register_mutex);
5271 ++ if (cmd != SNDCTL_SEQ_SYNC)
5272 ++ mutex_unlock(&register_mutex);
5273 + return rc;
5274 + }
5275 +
5276 +diff --git a/sound/firewire/bebob/bebob_hwdep.c b/sound/firewire/bebob/bebob_hwdep.c
5277 +index 2b367c21b80c3..9bea8d6d5e062 100644
5278 +--- a/sound/firewire/bebob/bebob_hwdep.c
5279 ++++ b/sound/firewire/bebob/bebob_hwdep.c
5280 +@@ -37,12 +37,11 @@ hwdep_read(struct snd_hwdep *hwdep, char __user *buf, long count,
5281 + }
5282 +
5283 + memset(&event, 0, sizeof(event));
5284 ++ count = min_t(long, count, sizeof(event.lock_status));
5285 + if (bebob->dev_lock_changed) {
5286 + event.lock_status.type = SNDRV_FIREWIRE_EVENT_LOCK_STATUS;
5287 + event.lock_status.status = (bebob->dev_lock_count > 0);
5288 + bebob->dev_lock_changed = false;
5289 +-
5290 +- count = min_t(long, count, sizeof(event.lock_status));
5291 + }
5292 +
5293 + spin_unlock_irq(&bebob->lock);
5294 +diff --git a/sound/soc/qcom/lpass-cpu.c b/sound/soc/qcom/lpass-cpu.c
5295 +index 292b103abada9..475579a9830a3 100644
5296 +--- a/sound/soc/qcom/lpass-cpu.c
5297 ++++ b/sound/soc/qcom/lpass-cpu.c
5298 +@@ -182,21 +182,6 @@ static int lpass_cpu_daiops_hw_params(struct snd_pcm_substream *substream,
5299 + return 0;
5300 + }
5301 +
5302 +-static int lpass_cpu_daiops_hw_free(struct snd_pcm_substream *substream,
5303 +- struct snd_soc_dai *dai)
5304 +-{
5305 +- struct lpass_data *drvdata = snd_soc_dai_get_drvdata(dai);
5306 +- int ret;
5307 +-
5308 +- ret = regmap_write(drvdata->lpaif_map,
5309 +- LPAIF_I2SCTL_REG(drvdata->variant, dai->driver->id),
5310 +- 0);
5311 +- if (ret)
5312 +- dev_err(dai->dev, "error writing to i2sctl reg: %d\n", ret);
5313 +-
5314 +- return ret;
5315 +-}
5316 +-
5317 + static int lpass_cpu_daiops_prepare(struct snd_pcm_substream *substream,
5318 + struct snd_soc_dai *dai)
5319 + {
5320 +@@ -277,7 +262,6 @@ const struct snd_soc_dai_ops asoc_qcom_lpass_cpu_dai_ops = {
5321 + .startup = lpass_cpu_daiops_startup,
5322 + .shutdown = lpass_cpu_daiops_shutdown,
5323 + .hw_params = lpass_cpu_daiops_hw_params,
5324 +- .hw_free = lpass_cpu_daiops_hw_free,
5325 + .prepare = lpass_cpu_daiops_prepare,
5326 + .trigger = lpass_cpu_daiops_trigger,
5327 + };
5328 +diff --git a/sound/soc/qcom/lpass-platform.c b/sound/soc/qcom/lpass-platform.c
5329 +index e1945e1772cda..b8f8cb906d805 100644
5330 +--- a/sound/soc/qcom/lpass-platform.c
5331 ++++ b/sound/soc/qcom/lpass-platform.c
5332 +@@ -67,7 +67,7 @@ static int lpass_platform_pcmops_open(struct snd_pcm_substream *substream)
5333 + int ret, dma_ch, dir = substream->stream;
5334 + struct lpass_pcm_data *data;
5335 +
5336 +- data = devm_kzalloc(soc_runtime->dev, sizeof(*data), GFP_KERNEL);
5337 ++ data = kzalloc(sizeof(*data), GFP_KERNEL);
5338 + if (!data)
5339 + return -ENOMEM;
5340 +
5341 +@@ -127,6 +127,7 @@ static int lpass_platform_pcmops_close(struct snd_pcm_substream *substream)
5342 + if (v->free_dma_channel)
5343 + v->free_dma_channel(drvdata, data->dma_ch);
5344 +
5345 ++ kfree(data);
5346 + return 0;
5347 + }
5348 +
5349 +diff --git a/tools/perf/util/intel-pt.c b/tools/perf/util/intel-pt.c
5350 +index e8e05e7838b26..66591e8e26470 100644
5351 +--- a/tools/perf/util/intel-pt.c
5352 ++++ b/tools/perf/util/intel-pt.c
5353 +@@ -906,6 +906,8 @@ static void intel_pt_set_pid_tid_cpu(struct intel_pt *pt,
5354 +
5355 + if (queue->tid == -1 || pt->have_sched_switch) {
5356 + ptq->tid = machine__get_current_tid(pt->machine, ptq->cpu);
5357 ++ if (ptq->tid == -1)
5358 ++ ptq->pid = -1;
5359 + thread__zput(ptq->thread);
5360 + }
5361 +
5362 +@@ -1948,10 +1950,8 @@ static int intel_pt_context_switch(struct intel_pt *pt, union perf_event *event,
5363 + tid = sample->tid;
5364 + }
5365 +
5366 +- if (tid == -1) {
5367 +- pr_err("context_switch event has no tid\n");
5368 +- return -EINVAL;
5369 +- }
5370 ++ if (tid == -1)
5371 ++ intel_pt_log("context_switch event has no tid\n");
5372 +
5373 + intel_pt_log("context_switch: cpu %d pid %d tid %d time %"PRIu64" tsc %#"PRIx64"\n",
5374 + cpu, pid, tid, sample->time, perf_time_to_tsc(sample->time,