[gentoo-commits] proj/linux-patches:4.4 commit in: /

[Mike Pagano]

commit:     16d3f8c13c8b9b34abd4f771917fcae6cc20ce89
Author:     Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Thu Oct  1 11:23:49 2020 +0000
Commit:     Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Thu Oct  1 11:23:49 2020 +0000
URL:        https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=16d3f8c1

Linux patch 4.4.238

Signed-off-by: Mike Pagano <mpagano <AT> gentoo.org>

 0000_README              |    4 +
 1237_linux-4.4.238.patch | 2701 ++++++++++++++++++++++++++++++++++++++++++++++
 2 files changed, 2705 insertions(+)

diff --git a/0000_README b/0000_README
index d93edf8..dfe06b2 100644
--- a/0000_README
+++ b/0000_README
@@ -991,6 +991,10 @@ Patch:  1236_linux-4.4.237.patch
 From:   http://www.kernel.org
 Desc:   Linux 4.4.237
 
+Patch:  1237_linux-4.4.238.patch
+From:   http://www.kernel.org
+Desc:   Linux 4.4.238
+
 Patch:  1500_XATTR_USER_PREFIX.patch
 From:   https://bugs.gentoo.org/show_bug.cgi?id=470644
 Desc:   Support for namespace user.pax.* on tmpfs.

diff --git a/1237_linux-4.4.238.patch b/1237_linux-4.4.238.patch
new file mode 100644
index 0000000..feef366
--- /dev/null
+++ b/1237_linux-4.4.238.patch
@@ -0,0 +1,2701 @@
+diff --git a/Documentation/DocBook/libata.tmpl b/Documentation/DocBook/libata.tmpl
+index d7fcdc5a43792..9b55778ab024f 100644
+--- a/Documentation/DocBook/libata.tmpl
++++ b/Documentation/DocBook/libata.tmpl
+@@ -324,7 +324,7 @@ Many legacy IDE drivers use ata_bmdma_status() as the bmdma_status() hook.
+ 
+ 	<sect2><title>High-level taskfile hooks</title>
+ 	<programlisting>
+-void (*qc_prep) (struct ata_queued_cmd *qc);
++enum ata_completion_errors (*qc_prep) (struct ata_queued_cmd *qc);
+ int (*qc_issue) (struct ata_queued_cmd *qc);
+ 	</programlisting>
+ 
+diff --git a/Documentation/devicetree/bindings/sound/wm8994.txt b/Documentation/devicetree/bindings/sound/wm8994.txt
+index e045e90a0924b..0f03b8228d080 100644
+--- a/Documentation/devicetree/bindings/sound/wm8994.txt
++++ b/Documentation/devicetree/bindings/sound/wm8994.txt
+@@ -14,9 +14,15 @@ Required properties:
+   - #gpio-cells : Must be 2. The first cell is the pin number and the
+     second cell is used to specify optional parameters (currently unused).
+ 
+-  - AVDD2-supply, DBVDD1-supply, DBVDD2-supply, DBVDD3-supply, CPVDD-supply,
+-    SPKVDD1-supply, SPKVDD2-supply : power supplies for the device, as covered
+-    in Documentation/devicetree/bindings/regulator/regulator.txt
++  - power supplies for the device, as covered in
++    Documentation/devicetree/bindings/regulator/regulator.txt, depending
++    on compatible:
++    - for wlf,wm1811 and wlf,wm8958:
++      AVDD1-supply, AVDD2-supply, DBVDD1-supply, DBVDD2-supply, DBVDD3-supply,
++      DCVDD-supply, CPVDD-supply, SPKVDD1-supply, SPKVDD2-supply
++    - for wlf,wm8994:
++      AVDD1-supply, AVDD2-supply, DBVDD-supply, DCVDD-supply, CPVDD-supply,
++      SPKVDD1-supply, SPKVDD2-supply
+ 
+ Optional properties:
+ 
+@@ -68,11 +74,11 @@ codec: wm8994@1a {
+ 
+ 	lineout1-se;
+ 
++	AVDD1-supply = <&regulator>;
+ 	AVDD2-supply = <&regulator>;
+ 	CPVDD-supply = <&regulator>;
+-	DBVDD1-supply = <&regulator>;
+-	DBVDD2-supply = <&regulator>;
+-	DBVDD3-supply = <&regulator>;
++	DBVDD-supply = <&regulator>;
++	DCVDD-supply = <&regulator>;
+ 	SPKVDD1-supply = <&regulator>;
+ 	SPKVDD2-supply = <&regulator>;
+ };
+diff --git a/Makefile b/Makefile
+index 003334dad3c3f..209fe98a591cd 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,6 +1,6 @@
+ VERSION = 4
+ PATCHLEVEL = 4
+-SUBLEVEL = 237
++SUBLEVEL = 238
+ EXTRAVERSION =
+ NAME = Blurry Fish Butt
+ 
+diff --git a/arch/m68k/q40/config.c b/arch/m68k/q40/config.c
+index e90fe903613ea..4e5f04d333188 100644
+--- a/arch/m68k/q40/config.c
++++ b/arch/m68k/q40/config.c
+@@ -303,6 +303,7 @@ static int q40_get_rtc_pll(struct rtc_pll_info *pll)
+ {
+ 	int tmp = Q40_RTC_CTRL;
+ 
++	pll->pll_ctrl = 0;
+ 	pll->pll_value = tmp & Q40_RTC_PLL_MASK;
+ 	if (tmp & Q40_RTC_PLL_SIGN)
+ 		pll->pll_value = -pll->pll_value;
+diff --git a/arch/mips/include/asm/cpu-type.h b/arch/mips/include/asm/cpu-type.h
+index abee2bfd10dc1..cea0bbb71590f 100644
+--- a/arch/mips/include/asm/cpu-type.h
++++ b/arch/mips/include/asm/cpu-type.h
+@@ -46,6 +46,7 @@ static inline int __pure __get_cpu_type(const int cpu_type)
+ 	case CPU_34K:
+ 	case CPU_1004K:
+ 	case CPU_74K:
++	case CPU_1074K:
+ 	case CPU_M14KC:
+ 	case CPU_M14KEC:
+ 	case CPU_INTERAPTIV:
+diff --git a/arch/s390/kernel/setup.c b/arch/s390/kernel/setup.c
+index 47692c78d09c5..fdc5e76e1f6b0 100644
+--- a/arch/s390/kernel/setup.c
++++ b/arch/s390/kernel/setup.c
+@@ -513,7 +513,7 @@ static struct notifier_block kdump_mem_nb = {
+ /*
+  * Make sure that the area behind memory_end is protected
+  */
+-static void reserve_memory_end(void)
++static void __init reserve_memory_end(void)
+ {
+ #ifdef CONFIG_CRASH_DUMP
+ 	if (ipl_info.type == IPL_TYPE_FCP_DUMP &&
+@@ -531,7 +531,7 @@ static void reserve_memory_end(void)
+ /*
+  * Make sure that oldmem, where the dump is stored, is protected
+  */
+-static void reserve_oldmem(void)
++static void __init reserve_oldmem(void)
+ {
+ #ifdef CONFIG_CRASH_DUMP
+ 	if (OLDMEM_BASE)
+@@ -543,7 +543,7 @@ static void reserve_oldmem(void)
+ /*
+  * Make sure that oldmem, where the dump is stored, is protected
+  */
+-static void remove_oldmem(void)
++static void __init remove_oldmem(void)
+ {
+ #ifdef CONFIG_CRASH_DUMP
+ 	if (OLDMEM_BASE)
+diff --git a/arch/x86/include/asm/nospec-branch.h b/arch/x86/include/asm/nospec-branch.h
+index 664e8505ccd63..2f84887e8934c 100644
+--- a/arch/x86/include/asm/nospec-branch.h
++++ b/arch/x86/include/asm/nospec-branch.h
+@@ -275,7 +275,7 @@ DECLARE_STATIC_KEY_FALSE(mds_idle_clear);
+  * combination with microcode which triggers a CPU buffer flush when the
+  * instruction is executed.
+  */
+-static inline void mds_clear_cpu_buffers(void)
++static __always_inline void mds_clear_cpu_buffers(void)
+ {
+ 	static const u16 ds = __KERNEL_DS;
+ 
+@@ -296,7 +296,7 @@ static inline void mds_clear_cpu_buffers(void)
+  *
+  * Clear CPU buffers if the corresponding static key is enabled
+  */
+-static inline void mds_user_clear_cpu_buffers(void)
++static __always_inline void mds_user_clear_cpu_buffers(void)
+ {
+ 	if (static_branch_likely(&mds_user_clear))
+ 		mds_clear_cpu_buffers();
+diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
+index 61fc92f92e0a0..ef920da075184 100644
+--- a/arch/x86/kvm/x86.c
++++ b/arch/x86/kvm/x86.c
+@@ -4013,10 +4013,13 @@ long kvm_arch_vm_ioctl(struct file *filp,
+ 		r = -EFAULT;
+ 		if (copy_from_user(&u.ps, argp, sizeof u.ps))
+ 			goto out;
++		mutex_lock(&kvm->lock);
+ 		r = -ENXIO;
+ 		if (!kvm->arch.vpit)
+-			goto out;
++			goto set_pit_out;
+ 		r = kvm_vm_ioctl_set_pit(kvm, &u.ps);
++set_pit_out:
++		mutex_unlock(&kvm->lock);
+ 		break;
+ 	}
+ 	case KVM_GET_PIT2: {
+@@ -4036,10 +4039,13 @@ long kvm_arch_vm_ioctl(struct file *filp,
+ 		r = -EFAULT;
+ 		if (copy_from_user(&u.ps2, argp, sizeof(u.ps2)))
+ 			goto out;
++		mutex_lock(&kvm->lock);
+ 		r = -ENXIO;
+ 		if (!kvm->arch.vpit)
+-			goto out;
++			goto set_pit2_out;
+ 		r = kvm_vm_ioctl_set_pit2(kvm, &u.ps2);
++set_pit2_out:
++		mutex_unlock(&kvm->lock);
+ 		break;
+ 	}
+ 	case KVM_REINJECT_CONTROL: {
+diff --git a/drivers/acpi/ec.c b/drivers/acpi/ec.c
+index 43f20328f830e..3096c087b7328 100644
+--- a/drivers/acpi/ec.c
++++ b/drivers/acpi/ec.c
+@@ -943,29 +943,21 @@ void acpi_ec_unblock_transactions_early(void)
+ /* --------------------------------------------------------------------------
+                                 Event Management
+    -------------------------------------------------------------------------- */
+-static struct acpi_ec_query_handler *
+-acpi_ec_get_query_handler(struct acpi_ec_query_handler *handler)
+-{
+-	if (handler)
+-		kref_get(&handler->kref);
+-	return handler;
+-}
+-
+ static struct acpi_ec_query_handler *
+ acpi_ec_get_query_handler_by_value(struct acpi_ec *ec, u8 value)
+ {
+ 	struct acpi_ec_query_handler *handler;
+-	bool found = false;
+ 
+ 	mutex_lock(&ec->mutex);
+ 	list_for_each_entry(handler, &ec->list, node) {
+ 		if (value == handler->query_bit) {
+-			found = true;
+-			break;
++			kref_get(&handler->kref);
++			mutex_unlock(&ec->mutex);
++			return handler;
+ 		}
+ 	}
+ 	mutex_unlock(&ec->mutex);
+-	return found ? acpi_ec_get_query_handler(handler) : NULL;
++	return NULL;
+ }
+ 
+ static void acpi_ec_query_handler_release(struct kref *kref)
+diff --git a/drivers/ata/acard-ahci.c b/drivers/ata/acard-ahci.c
+index ed6a30cd681a0..98581ae397c12 100644
+--- a/drivers/ata/acard-ahci.c
++++ b/drivers/ata/acard-ahci.c
+@@ -72,7 +72,7 @@ struct acard_sg {
+ 	__le32			size;	 /* bit 31 (EOT) max==0x10000 (64k) */
+ };
+ 
+-static void acard_ahci_qc_prep(struct ata_queued_cmd *qc);
++static enum ata_completion_errors acard_ahci_qc_prep(struct ata_queued_cmd *qc);
+ static bool acard_ahci_qc_fill_rtf(struct ata_queued_cmd *qc);
+ static int acard_ahci_port_start(struct ata_port *ap);
+ static int acard_ahci_init_one(struct pci_dev *pdev, const struct pci_device_id *ent);
+@@ -257,7 +257,7 @@ static unsigned int acard_ahci_fill_sg(struct ata_queued_cmd *qc, void *cmd_tbl)
+ 	return si;
+ }
+ 
+-static void acard_ahci_qc_prep(struct ata_queued_cmd *qc)
++static enum ata_completion_errors acard_ahci_qc_prep(struct ata_queued_cmd *qc)
+ {
+ 	struct ata_port *ap = qc->ap;
+ 	struct ahci_port_priv *pp = ap->private_data;
+@@ -295,6 +295,8 @@ static void acard_ahci_qc_prep(struct ata_queued_cmd *qc)
+ 		opts |= AHCI_CMD_ATAPI | AHCI_CMD_PREFETCH;
+ 
+ 	ahci_fill_cmd_slot(pp, qc->tag, opts);
++
++	return AC_ERR_OK;
+ }
+ 
+ static bool acard_ahci_qc_fill_rtf(struct ata_queued_cmd *qc)
+diff --git a/drivers/ata/libahci.c b/drivers/ata/libahci.c
+index 1241cecfcfcad..48338da2ecdfa 100644
+--- a/drivers/ata/libahci.c
++++ b/drivers/ata/libahci.c
+@@ -71,7 +71,7 @@ static int ahci_scr_write(struct ata_link *link, unsigned int sc_reg, u32 val);
+ static bool ahci_qc_fill_rtf(struct ata_queued_cmd *qc);
+ static int ahci_port_start(struct ata_port *ap);
+ static void ahci_port_stop(struct ata_port *ap);
+-static void ahci_qc_prep(struct ata_queued_cmd *qc);
++static enum ata_completion_errors ahci_qc_prep(struct ata_queued_cmd *qc);
+ static int ahci_pmp_qc_defer(struct ata_queued_cmd *qc);
+ static void ahci_freeze(struct ata_port *ap);
+ static void ahci_thaw(struct ata_port *ap);
+@@ -1535,7 +1535,7 @@ static int ahci_pmp_qc_defer(struct ata_queued_cmd *qc)
+ 		return sata_pmp_qc_defer_cmd_switch(qc);
+ }
+ 
+-static void ahci_qc_prep(struct ata_queued_cmd *qc)
++static enum ata_completion_errors ahci_qc_prep(struct ata_queued_cmd *qc)
+ {
+ 	struct ata_port *ap = qc->ap;
+ 	struct ahci_port_priv *pp = ap->private_data;
+@@ -1571,6 +1571,8 @@ static void ahci_qc_prep(struct ata_queued_cmd *qc)
+ 		opts |= AHCI_CMD_ATAPI | AHCI_CMD_PREFETCH;
+ 
+ 	ahci_fill_cmd_slot(pp, qc->tag, opts);
++
++	return AC_ERR_OK;
+ }
+ 
+ static void ahci_fbs_dec_intr(struct ata_port *ap)
+diff --git a/drivers/ata/libata-core.c b/drivers/ata/libata-core.c
+index 17cebfe5acc82..8ed3f6d75ff13 100644
+--- a/drivers/ata/libata-core.c
++++ b/drivers/ata/libata-core.c
+@@ -4713,7 +4713,10 @@ int ata_std_qc_defer(struct ata_queued_cmd *qc)
+ 	return ATA_DEFER_LINK;
+ }
+ 
+-void ata_noop_qc_prep(struct ata_queued_cmd *qc) { }
++enum ata_completion_errors ata_noop_qc_prep(struct ata_queued_cmd *qc)
++{
++	return AC_ERR_OK;
++}
+ 
+ /**
+  *	ata_sg_init - Associate command with scatter-gather table.
+@@ -5126,7 +5129,9 @@ void ata_qc_issue(struct ata_queued_cmd *qc)
+ 		return;
+ 	}
+ 
+-	ap->ops->qc_prep(qc);
++	qc->err_mask |= ap->ops->qc_prep(qc);
++	if (unlikely(qc->err_mask))
++		goto err;
+ 	trace_ata_qc_issue(qc);
+ 	qc->err_mask |= ap->ops->qc_issue(qc);
+ 	if (unlikely(qc->err_mask))
+diff --git a/drivers/ata/libata-sff.c b/drivers/ata/libata-sff.c
+index 1d8901fc0bfa9..0c69bc1d30c62 100644
+--- a/drivers/ata/libata-sff.c
++++ b/drivers/ata/libata-sff.c
+@@ -2741,12 +2741,14 @@ static void ata_bmdma_fill_sg_dumb(struct ata_queued_cmd *qc)
+  *	LOCKING:
+  *	spin_lock_irqsave(host lock)
+  */
+-void ata_bmdma_qc_prep(struct ata_queued_cmd *qc)
++enum ata_completion_errors ata_bmdma_qc_prep(struct ata_queued_cmd *qc)
+ {
+ 	if (!(qc->flags & ATA_QCFLAG_DMAMAP))
+-		return;
++		return AC_ERR_OK;
+ 
+ 	ata_bmdma_fill_sg(qc);
++
++	return AC_ERR_OK;
+ }
+ EXPORT_SYMBOL_GPL(ata_bmdma_qc_prep);
+ 
+@@ -2759,12 +2761,14 @@ EXPORT_SYMBOL_GPL(ata_bmdma_qc_prep);
+  *	LOCKING:
+  *	spin_lock_irqsave(host lock)
+  */
+-void ata_bmdma_dumb_qc_prep(struct ata_queued_cmd *qc)
++enum ata_completion_errors ata_bmdma_dumb_qc_prep(struct ata_queued_cmd *qc)
+ {
+ 	if (!(qc->flags & ATA_QCFLAG_DMAMAP))
+-		return;
++		return AC_ERR_OK;
+ 
+ 	ata_bmdma_fill_sg_dumb(qc);
++
++	return AC_ERR_OK;
+ }
+ EXPORT_SYMBOL_GPL(ata_bmdma_dumb_qc_prep);
+ 
+diff --git a/drivers/ata/pata_macio.c b/drivers/ata/pata_macio.c
+index e3d4b059fcd14..f1a20d1a65be0 100644
+--- a/drivers/ata/pata_macio.c
++++ b/drivers/ata/pata_macio.c
+@@ -507,7 +507,7 @@ static int pata_macio_cable_detect(struct ata_port *ap)
+ 	return ATA_CBL_PATA40;
+ }
+ 
+-static void pata_macio_qc_prep(struct ata_queued_cmd *qc)
++static enum ata_completion_errors pata_macio_qc_prep(struct ata_queued_cmd *qc)
+ {
+ 	unsigned int write = (qc->tf.flags & ATA_TFLAG_WRITE);
+ 	struct ata_port *ap = qc->ap;
+@@ -520,7 +520,7 @@ static void pata_macio_qc_prep(struct ata_queued_cmd *qc)
+ 		   __func__, qc, qc->flags, write, qc->dev->devno);
+ 
+ 	if (!(qc->flags & ATA_QCFLAG_DMAMAP))
+-		return;
++		return AC_ERR_OK;
+ 
+ 	table = (struct dbdma_cmd *) priv->dma_table_cpu;
+ 
+@@ -565,6 +565,8 @@ static void pata_macio_qc_prep(struct ata_queued_cmd *qc)
+ 	table->command = cpu_to_le16(DBDMA_STOP);
+ 
+ 	dev_dbgdma(priv->dev, "%s: %d DMA list entries\n", __func__, pi);
++
++	return AC_ERR_OK;
+ }
+ 
+ 
+diff --git a/drivers/ata/pata_pxa.c b/drivers/ata/pata_pxa.c
+index f6c46e9a4dc0f..d7186a503e358 100644
+--- a/drivers/ata/pata_pxa.c
++++ b/drivers/ata/pata_pxa.c
+@@ -59,25 +59,27 @@ static void pxa_ata_dma_irq(void *d)
+ /*
+  * Prepare taskfile for submission.
+  */
+-static void pxa_qc_prep(struct ata_queued_cmd *qc)
++static enum ata_completion_errors pxa_qc_prep(struct ata_queued_cmd *qc)
+ {
+ 	struct pata_pxa_data *pd = qc->ap->private_data;
+ 	struct dma_async_tx_descriptor *tx;
+ 	enum dma_transfer_direction dir;
+ 
+ 	if (!(qc->flags & ATA_QCFLAG_DMAMAP))
+-		return;
++		return AC_ERR_OK;
+ 
+ 	dir = (qc->dma_dir == DMA_TO_DEVICE ? DMA_MEM_TO_DEV : DMA_DEV_TO_MEM);
+ 	tx = dmaengine_prep_slave_sg(pd->dma_chan, qc->sg, qc->n_elem, dir,
+ 				     DMA_PREP_INTERRUPT);
+ 	if (!tx) {
+ 		ata_dev_err(qc->dev, "prep_slave_sg() failed\n");
+-		return;
++		return AC_ERR_OK;
+ 	}
+ 	tx->callback = pxa_ata_dma_irq;
+ 	tx->callback_param = pd;
+ 	pd->dma_cookie = dmaengine_submit(tx);
++
++	return AC_ERR_OK;
+ }
+ 
+ /*
+diff --git a/drivers/ata/pdc_adma.c b/drivers/ata/pdc_adma.c
+index 64d682c6ee57e..11da13bea2c93 100644
+--- a/drivers/ata/pdc_adma.c
++++ b/drivers/ata/pdc_adma.c
+@@ -132,7 +132,7 @@ static int adma_ata_init_one(struct pci_dev *pdev,
+ 				const struct pci_device_id *ent);
+ static int adma_port_start(struct ata_port *ap);
+ static void adma_port_stop(struct ata_port *ap);
+-static void adma_qc_prep(struct ata_queued_cmd *qc);
++static enum ata_completion_errors adma_qc_prep(struct ata_queued_cmd *qc);
+ static unsigned int adma_qc_issue(struct ata_queued_cmd *qc);
+ static int adma_check_atapi_dma(struct ata_queued_cmd *qc);
+ static void adma_freeze(struct ata_port *ap);
+@@ -311,7 +311,7 @@ static int adma_fill_sg(struct ata_queued_cmd *qc)
+ 	return i;
+ }
+ 
+-static void adma_qc_prep(struct ata_queued_cmd *qc)
++static enum ata_completion_errors adma_qc_prep(struct ata_queued_cmd *qc)
+ {
+ 	struct adma_port_priv *pp = qc->ap->private_data;
+ 	u8  *buf = pp->pkt;
+@@ -322,7 +322,7 @@ static void adma_qc_prep(struct ata_queued_cmd *qc)
+ 
+ 	adma_enter_reg_mode(qc->ap);
+ 	if (qc->tf.protocol != ATA_PROT_DMA)
+-		return;
++		return AC_ERR_OK;
+ 
+ 	buf[i++] = 0;	/* Response flags */
+ 	buf[i++] = 0;	/* reserved */
+@@ -387,6 +387,7 @@ static void adma_qc_prep(struct ata_queued_cmd *qc)
+ 			printk("%s\n", obuf);
+ 	}
+ #endif
++	return AC_ERR_OK;
+ }
+ 
+ static inline void adma_packet_start(struct ata_queued_cmd *qc)
+diff --git a/drivers/ata/sata_fsl.c b/drivers/ata/sata_fsl.c
+index a723ae9297831..100b5a3621ef3 100644
+--- a/drivers/ata/sata_fsl.c
++++ b/drivers/ata/sata_fsl.c
+@@ -513,7 +513,7 @@ static unsigned int sata_fsl_fill_sg(struct ata_queued_cmd *qc, void *cmd_desc,
+ 	return num_prde;
+ }
+ 
+-static void sata_fsl_qc_prep(struct ata_queued_cmd *qc)
++static enum ata_completion_errors sata_fsl_qc_prep(struct ata_queued_cmd *qc)
+ {
+ 	struct ata_port *ap = qc->ap;
+ 	struct sata_fsl_port_priv *pp = ap->private_data;
+@@ -559,6 +559,8 @@ static void sata_fsl_qc_prep(struct ata_queued_cmd *qc)
+ 
+ 	VPRINTK("SATA FSL : xx_qc_prep, di = 0x%x, ttl = %d, num_prde = %d\n",
+ 		desc_info, ttl_dwords, num_prde);
++
++	return AC_ERR_OK;
+ }
+ 
+ static unsigned int sata_fsl_qc_issue(struct ata_queued_cmd *qc)
+diff --git a/drivers/ata/sata_inic162x.c b/drivers/ata/sata_inic162x.c
+index e81a8217f1ff7..349a175f02675 100644
+--- a/drivers/ata/sata_inic162x.c
++++ b/drivers/ata/sata_inic162x.c
+@@ -472,7 +472,7 @@ static void inic_fill_sg(struct inic_prd *prd, struct ata_queued_cmd *qc)
+ 	prd[-1].flags |= PRD_END;
+ }
+ 
+-static void inic_qc_prep(struct ata_queued_cmd *qc)
++static enum ata_completion_errors inic_qc_prep(struct ata_queued_cmd *qc)
+ {
+ 	struct inic_port_priv *pp = qc->ap->private_data;
+ 	struct inic_pkt *pkt = pp->pkt;
+@@ -532,6 +532,8 @@ static void inic_qc_prep(struct ata_queued_cmd *qc)
+ 		inic_fill_sg(prd, qc);
+ 
+ 	pp->cpb_tbl[0] = pp->pkt_dma;
++
++	return AC_ERR_OK;
+ }
+ 
+ static unsigned int inic_qc_issue(struct ata_queued_cmd *qc)
+diff --git a/drivers/ata/sata_mv.c b/drivers/ata/sata_mv.c
+index 729f26322095e..5718dc94c90cb 100644
+--- a/drivers/ata/sata_mv.c
++++ b/drivers/ata/sata_mv.c
+@@ -605,8 +605,8 @@ static int mv5_scr_write(struct ata_link *link, unsigned int sc_reg_in, u32 val)
+ static int mv_port_start(struct ata_port *ap);
+ static void mv_port_stop(struct ata_port *ap);
+ static int mv_qc_defer(struct ata_queued_cmd *qc);
+-static void mv_qc_prep(struct ata_queued_cmd *qc);
+-static void mv_qc_prep_iie(struct ata_queued_cmd *qc);
++static enum ata_completion_errors mv_qc_prep(struct ata_queued_cmd *qc);
++static enum ata_completion_errors mv_qc_prep_iie(struct ata_queued_cmd *qc);
+ static unsigned int mv_qc_issue(struct ata_queued_cmd *qc);
+ static int mv_hardreset(struct ata_link *link, unsigned int *class,
+ 			unsigned long deadline);
+@@ -2046,7 +2046,7 @@ static void mv_rw_multi_errata_sata24(struct ata_queued_cmd *qc)
+  *      LOCKING:
+  *      Inherited from caller.
+  */
+-static void mv_qc_prep(struct ata_queued_cmd *qc)
++static enum ata_completion_errors mv_qc_prep(struct ata_queued_cmd *qc)
+ {
+ 	struct ata_port *ap = qc->ap;
+ 	struct mv_port_priv *pp = ap->private_data;
+@@ -2058,15 +2058,15 @@ static void mv_qc_prep(struct ata_queued_cmd *qc)
+ 	switch (tf->protocol) {
+ 	case ATA_PROT_DMA:
+ 		if (tf->command == ATA_CMD_DSM)
+-			return;
++			return AC_ERR_OK;
+ 		/* fall-thru */
+ 	case ATA_PROT_NCQ:
+ 		break;	/* continue below */
+ 	case ATA_PROT_PIO:
+ 		mv_rw_multi_errata_sata24(qc);
+-		return;
++		return AC_ERR_OK;
+ 	default:
+-		return;
++		return AC_ERR_OK;
+ 	}
+ 
+ 	/* Fill in command request block
+@@ -2113,12 +2113,10 @@ static void mv_qc_prep(struct ata_queued_cmd *qc)
+ 		 * non-NCQ mode are: [RW] STREAM DMA and W DMA FUA EXT, none
+ 		 * of which are defined/used by Linux.  If we get here, this
+ 		 * driver needs work.
+-		 *
+-		 * FIXME: modify libata to give qc_prep a return value and
+-		 * return error here.
+ 		 */
+-		BUG_ON(tf->command);
+-		break;
++		ata_port_err(ap, "%s: unsupported command: %.2x\n", __func__,
++				tf->command);
++		return AC_ERR_INVALID;
+ 	}
+ 	mv_crqb_pack_cmd(cw++, tf->nsect, ATA_REG_NSECT, 0);
+ 	mv_crqb_pack_cmd(cw++, tf->hob_lbal, ATA_REG_LBAL, 0);
+@@ -2131,8 +2129,10 @@ static void mv_qc_prep(struct ata_queued_cmd *qc)
+ 	mv_crqb_pack_cmd(cw++, tf->command, ATA_REG_CMD, 1);	/* last */
+ 
+ 	if (!(qc->flags & ATA_QCFLAG_DMAMAP))
+-		return;
++		return AC_ERR_OK;
+ 	mv_fill_sg(qc);
++
++	return AC_ERR_OK;
+ }
+ 
+ /**
+@@ -2147,7 +2147,7 @@ static void mv_qc_prep(struct ata_queued_cmd *qc)
+  *      LOCKING:
+  *      Inherited from caller.
+  */
+-static void mv_qc_prep_iie(struct ata_queued_cmd *qc)
++static enum ata_completion_errors mv_qc_prep_iie(struct ata_queued_cmd *qc)
+ {
+ 	struct ata_port *ap = qc->ap;
+ 	struct mv_port_priv *pp = ap->private_data;
+@@ -2158,9 +2158,9 @@ static void mv_qc_prep_iie(struct ata_queued_cmd *qc)
+ 
+ 	if ((tf->protocol != ATA_PROT_DMA) &&
+ 	    (tf->protocol != ATA_PROT_NCQ))
+-		return;
++		return AC_ERR_OK;
+ 	if (tf->command == ATA_CMD_DSM)
+-		return;  /* use bmdma for this */
++		return AC_ERR_OK;  /* use bmdma for this */
+ 
+ 	/* Fill in Gen IIE command request block */
+ 	if (!(tf->flags & ATA_TFLAG_WRITE))
+@@ -2201,8 +2201,10 @@ static void mv_qc_prep_iie(struct ata_queued_cmd *qc)
+ 		);
+ 
+ 	if (!(qc->flags & ATA_QCFLAG_DMAMAP))
+-		return;
++		return AC_ERR_OK;
+ 	mv_fill_sg(qc);
++
++	return AC_ERR_OK;
+ }
+ 
+ /**
+diff --git a/drivers/ata/sata_nv.c b/drivers/ata/sata_nv.c
+index 734f563b8d37b..bb098c4ae1775 100644
+--- a/drivers/ata/sata_nv.c
++++ b/drivers/ata/sata_nv.c
+@@ -313,7 +313,7 @@ static void nv_ck804_freeze(struct ata_port *ap);
+ static void nv_ck804_thaw(struct ata_port *ap);
+ static int nv_adma_slave_config(struct scsi_device *sdev);
+ static int nv_adma_check_atapi_dma(struct ata_queued_cmd *qc);
+-static void nv_adma_qc_prep(struct ata_queued_cmd *qc);
++static enum ata_completion_errors nv_adma_qc_prep(struct ata_queued_cmd *qc);
+ static unsigned int nv_adma_qc_issue(struct ata_queued_cmd *qc);
+ static irqreturn_t nv_adma_interrupt(int irq, void *dev_instance);
+ static void nv_adma_irq_clear(struct ata_port *ap);
+@@ -335,7 +335,7 @@ static void nv_mcp55_freeze(struct ata_port *ap);
+ static void nv_swncq_error_handler(struct ata_port *ap);
+ static int nv_swncq_slave_config(struct scsi_device *sdev);
+ static int nv_swncq_port_start(struct ata_port *ap);
+-static void nv_swncq_qc_prep(struct ata_queued_cmd *qc);
++static enum ata_completion_errors nv_swncq_qc_prep(struct ata_queued_cmd *qc);
+ static void nv_swncq_fill_sg(struct ata_queued_cmd *qc);
+ static unsigned int nv_swncq_qc_issue(struct ata_queued_cmd *qc);
+ static void nv_swncq_irq_clear(struct ata_port *ap, u16 fis);
+@@ -1382,7 +1382,7 @@ static int nv_adma_use_reg_mode(struct ata_queued_cmd *qc)
+ 	return 1;
+ }
+ 
+-static void nv_adma_qc_prep(struct ata_queued_cmd *qc)
++static enum ata_completion_errors nv_adma_qc_prep(struct ata_queued_cmd *qc)
+ {
+ 	struct nv_adma_port_priv *pp = qc->ap->private_data;
+ 	struct nv_adma_cpb *cpb = &pp->cpb[qc->tag];
+@@ -1394,7 +1394,7 @@ static void nv_adma_qc_prep(struct ata_queued_cmd *qc)
+ 			(qc->flags & ATA_QCFLAG_DMAMAP));
+ 		nv_adma_register_mode(qc->ap);
+ 		ata_bmdma_qc_prep(qc);
+-		return;
++		return AC_ERR_OK;
+ 	}
+ 
+ 	cpb->resp_flags = NV_CPB_RESP_DONE;
+@@ -1426,6 +1426,8 @@ static void nv_adma_qc_prep(struct ata_queued_cmd *qc)
+ 	cpb->ctl_flags = ctl_flags;
+ 	wmb();
+ 	cpb->resp_flags = 0;
++
++	return AC_ERR_OK;
+ }
+ 
+ static unsigned int nv_adma_qc_issue(struct ata_queued_cmd *qc)
+@@ -1989,17 +1991,19 @@ static int nv_swncq_port_start(struct ata_port *ap)
+ 	return 0;
+ }
+ 
+-static void nv_swncq_qc_prep(struct ata_queued_cmd *qc)
++static enum ata_completion_errors nv_swncq_qc_prep(struct ata_queued_cmd *qc)
+ {
+ 	if (qc->tf.protocol != ATA_PROT_NCQ) {
+ 		ata_bmdma_qc_prep(qc);
+-		return;
++		return AC_ERR_OK;
+ 	}
+ 
+ 	if (!(qc->flags & ATA_QCFLAG_DMAMAP))
+-		return;
++		return AC_ERR_OK;
+ 
+ 	nv_swncq_fill_sg(qc);
++
++	return AC_ERR_OK;
+ }
+ 
+ static void nv_swncq_fill_sg(struct ata_queued_cmd *qc)
+diff --git a/drivers/ata/sata_promise.c b/drivers/ata/sata_promise.c
+index 0fa211e2831cd..8ad8b376a642c 100644
+--- a/drivers/ata/sata_promise.c
++++ b/drivers/ata/sata_promise.c
+@@ -155,7 +155,7 @@ static int pdc_sata_scr_write(struct ata_link *link, unsigned int sc_reg, u32 va
+ static int pdc_ata_init_one(struct pci_dev *pdev, const struct pci_device_id *ent);
+ static int pdc_common_port_start(struct ata_port *ap);
+ static int pdc_sata_port_start(struct ata_port *ap);
+-static void pdc_qc_prep(struct ata_queued_cmd *qc);
++static enum ata_completion_errors pdc_qc_prep(struct ata_queued_cmd *qc);
+ static void pdc_tf_load_mmio(struct ata_port *ap, const struct ata_taskfile *tf);
+ static void pdc_exec_command_mmio(struct ata_port *ap, const struct ata_taskfile *tf);
+ static int pdc_check_atapi_dma(struct ata_queued_cmd *qc);
+@@ -649,7 +649,7 @@ static void pdc_fill_sg(struct ata_queued_cmd *qc)
+ 	prd[idx - 1].flags_len |= cpu_to_le32(ATA_PRD_EOT);
+ }
+ 
+-static void pdc_qc_prep(struct ata_queued_cmd *qc)
++static enum ata_completion_errors pdc_qc_prep(struct ata_queued_cmd *qc)
+ {
+ 	struct pdc_port_priv *pp = qc->ap->private_data;
+ 	unsigned int i;
+@@ -681,6 +681,8 @@ static void pdc_qc_prep(struct ata_queued_cmd *qc)
+ 	default:
+ 		break;
+ 	}
++
++	return AC_ERR_OK;
+ }
+ 
+ static int pdc_is_sataii_tx4(unsigned long flags)
+diff --git a/drivers/ata/sata_qstor.c b/drivers/ata/sata_qstor.c
+index af987a4f33d19..80ff3bbfc8269 100644
+--- a/drivers/ata/sata_qstor.c
++++ b/drivers/ata/sata_qstor.c
+@@ -116,7 +116,7 @@ static int qs_scr_write(struct ata_link *link, unsigned int sc_reg, u32 val);
+ static int qs_ata_init_one(struct pci_dev *pdev, const struct pci_device_id *ent);
+ static int qs_port_start(struct ata_port *ap);
+ static void qs_host_stop(struct ata_host *host);
+-static void qs_qc_prep(struct ata_queued_cmd *qc);
++static enum ata_completion_errors qs_qc_prep(struct ata_queued_cmd *qc);
+ static unsigned int qs_qc_issue(struct ata_queued_cmd *qc);
+ static int qs_check_atapi_dma(struct ata_queued_cmd *qc);
+ static void qs_freeze(struct ata_port *ap);
+@@ -276,7 +276,7 @@ static unsigned int qs_fill_sg(struct ata_queued_cmd *qc)
+ 	return si;
+ }
+ 
+-static void qs_qc_prep(struct ata_queued_cmd *qc)
++static enum ata_completion_errors qs_qc_prep(struct ata_queued_cmd *qc)
+ {
+ 	struct qs_port_priv *pp = qc->ap->private_data;
+ 	u8 dflags = QS_DF_PORD, *buf = pp->pkt;
+@@ -288,7 +288,7 @@ static void qs_qc_prep(struct ata_queued_cmd *qc)
+ 
+ 	qs_enter_reg_mode(qc->ap);
+ 	if (qc->tf.protocol != ATA_PROT_DMA)
+-		return;
++		return AC_ERR_OK;
+ 
+ 	nelem = qs_fill_sg(qc);
+ 
+@@ -311,6 +311,8 @@ static void qs_qc_prep(struct ata_queued_cmd *qc)
+ 
+ 	/* frame information structure (FIS) */
+ 	ata_tf_to_fis(&qc->tf, 0, 1, &buf[32]);
++
++	return AC_ERR_OK;
+ }
+ 
+ static inline void qs_packet_start(struct ata_queued_cmd *qc)
+diff --git a/drivers/ata/sata_rcar.c b/drivers/ata/sata_rcar.c
+index 21b80f5ee0920..4199f7a39be0b 100644
+--- a/drivers/ata/sata_rcar.c
++++ b/drivers/ata/sata_rcar.c
+@@ -551,12 +551,14 @@ static void sata_rcar_bmdma_fill_sg(struct ata_queued_cmd *qc)
+ 	prd[si - 1].addr |= cpu_to_le32(SATA_RCAR_DTEND);
+ }
+ 
+-static void sata_rcar_qc_prep(struct ata_queued_cmd *qc)
++static enum ata_completion_errors sata_rcar_qc_prep(struct ata_queued_cmd *qc)
+ {
+ 	if (!(qc->flags & ATA_QCFLAG_DMAMAP))
+-		return;
++		return AC_ERR_OK;
+ 
+ 	sata_rcar_bmdma_fill_sg(qc);
++
++	return AC_ERR_OK;
+ }
+ 
+ static void sata_rcar_bmdma_setup(struct ata_queued_cmd *qc)
+diff --git a/drivers/ata/sata_sil.c b/drivers/ata/sata_sil.c
+index 29bcff086bced..73156a301912f 100644
+--- a/drivers/ata/sata_sil.c
++++ b/drivers/ata/sata_sil.c
+@@ -119,7 +119,7 @@ static void sil_dev_config(struct ata_device *dev);
+ static int sil_scr_read(struct ata_link *link, unsigned int sc_reg, u32 *val);
+ static int sil_scr_write(struct ata_link *link, unsigned int sc_reg, u32 val);
+ static int sil_set_mode(struct ata_link *link, struct ata_device **r_failed);
+-static void sil_qc_prep(struct ata_queued_cmd *qc);
++static enum ata_completion_errors sil_qc_prep(struct ata_queued_cmd *qc);
+ static void sil_bmdma_setup(struct ata_queued_cmd *qc);
+ static void sil_bmdma_start(struct ata_queued_cmd *qc);
+ static void sil_bmdma_stop(struct ata_queued_cmd *qc);
+@@ -333,12 +333,14 @@ static void sil_fill_sg(struct ata_queued_cmd *qc)
+ 		last_prd->flags_len |= cpu_to_le32(ATA_PRD_EOT);
+ }
+ 
+-static void sil_qc_prep(struct ata_queued_cmd *qc)
++static enum ata_completion_errors sil_qc_prep(struct ata_queued_cmd *qc)
+ {
+ 	if (!(qc->flags & ATA_QCFLAG_DMAMAP))
+-		return;
++		return AC_ERR_OK;
+ 
+ 	sil_fill_sg(qc);
++
++	return AC_ERR_OK;
+ }
+ 
+ static unsigned char sil_get_device_cache_line(struct pci_dev *pdev)
+diff --git a/drivers/ata/sata_sil24.c b/drivers/ata/sata_sil24.c
+index 4b1995e2d044b..ffa3bf724054d 100644
+--- a/drivers/ata/sata_sil24.c
++++ b/drivers/ata/sata_sil24.c
+@@ -336,7 +336,7 @@ static void sil24_dev_config(struct ata_device *dev);
+ static int sil24_scr_read(struct ata_link *link, unsigned sc_reg, u32 *val);
+ static int sil24_scr_write(struct ata_link *link, unsigned sc_reg, u32 val);
+ static int sil24_qc_defer(struct ata_queued_cmd *qc);
+-static void sil24_qc_prep(struct ata_queued_cmd *qc);
++static enum ata_completion_errors sil24_qc_prep(struct ata_queued_cmd *qc);
+ static unsigned int sil24_qc_issue(struct ata_queued_cmd *qc);
+ static bool sil24_qc_fill_rtf(struct ata_queued_cmd *qc);
+ static void sil24_pmp_attach(struct ata_port *ap);
+@@ -840,7 +840,7 @@ static int sil24_qc_defer(struct ata_queued_cmd *qc)
+ 	return ata_std_qc_defer(qc);
+ }
+ 
+-static void sil24_qc_prep(struct ata_queued_cmd *qc)
++static enum ata_completion_errors sil24_qc_prep(struct ata_queued_cmd *qc)
+ {
+ 	struct ata_port *ap = qc->ap;
+ 	struct sil24_port_priv *pp = ap->private_data;
+@@ -884,6 +884,8 @@ static void sil24_qc_prep(struct ata_queued_cmd *qc)
+ 
+ 	if (qc->flags & ATA_QCFLAG_DMAMAP)
+ 		sil24_fill_sg(qc, sge);
++
++	return AC_ERR_OK;
+ }
+ 
+ static unsigned int sil24_qc_issue(struct ata_queued_cmd *qc)
+diff --git a/drivers/ata/sata_sx4.c b/drivers/ata/sata_sx4.c
+index fab504fd9cfd7..a7cd2c7ee1388 100644
+--- a/drivers/ata/sata_sx4.c
++++ b/drivers/ata/sata_sx4.c
+@@ -218,7 +218,7 @@ static void pdc_error_handler(struct ata_port *ap);
+ static void pdc_freeze(struct ata_port *ap);
+ static void pdc_thaw(struct ata_port *ap);
+ static int pdc_port_start(struct ata_port *ap);
+-static void pdc20621_qc_prep(struct ata_queued_cmd *qc);
++static enum ata_completion_errors pdc20621_qc_prep(struct ata_queued_cmd *qc);
+ static void pdc_tf_load_mmio(struct ata_port *ap, const struct ata_taskfile *tf);
+ static void pdc_exec_command_mmio(struct ata_port *ap, const struct ata_taskfile *tf);
+ static unsigned int pdc20621_dimm_init(struct ata_host *host);
+@@ -546,7 +546,7 @@ static void pdc20621_nodata_prep(struct ata_queued_cmd *qc)
+ 	VPRINTK("ata pkt buf ofs %u, mmio copied\n", i);
+ }
+ 
+-static void pdc20621_qc_prep(struct ata_queued_cmd *qc)
++static enum ata_completion_errors pdc20621_qc_prep(struct ata_queued_cmd *qc)
+ {
+ 	switch (qc->tf.protocol) {
+ 	case ATA_PROT_DMA:
+@@ -558,6 +558,8 @@ static void pdc20621_qc_prep(struct ata_queued_cmd *qc)
+ 	default:
+ 		break;
+ 	}
++
++	return AC_ERR_OK;
+ }
+ 
+ static void __pdc20621_push_hdma(struct ata_queued_cmd *qc,
+diff --git a/drivers/atm/eni.c b/drivers/atm/eni.c
+index ad591a2f7c822..340a1ee79d280 100644
+--- a/drivers/atm/eni.c
++++ b/drivers/atm/eni.c
+@@ -2242,7 +2242,7 @@ static int eni_init_one(struct pci_dev *pci_dev,
+ 
+ 	rc = dma_set_mask_and_coherent(&pci_dev->dev, DMA_BIT_MASK(32));
+ 	if (rc < 0)
+-		goto out;
++		goto err_disable;
+ 
+ 	rc = -ENOMEM;
+ 	eni_dev = kmalloc(sizeof(struct eni_dev), GFP_KERNEL);
+diff --git a/drivers/char/tlclk.c b/drivers/char/tlclk.c
+index 100cd1de9939d..59e1e94d12c01 100644
+--- a/drivers/char/tlclk.c
++++ b/drivers/char/tlclk.c
+@@ -777,17 +777,21 @@ static int __init tlclk_init(void)
+ {
+ 	int ret;
+ 
++	telclk_interrupt = (inb(TLCLK_REG7) & 0x0f);
++
++	alarm_events = kzalloc( sizeof(struct tlclk_alarms), GFP_KERNEL);
++	if (!alarm_events) {
++		ret = -ENOMEM;
++		goto out1;
++	}
++
+ 	ret = register_chrdev(tlclk_major, "telco_clock", &tlclk_fops);
+ 	if (ret < 0) {
+ 		printk(KERN_ERR "tlclk: can't get major %d.\n", tlclk_major);
++		kfree(alarm_events);
+ 		return ret;
+ 	}
+ 	tlclk_major = ret;
+-	alarm_events = kzalloc( sizeof(struct tlclk_alarms), GFP_KERNEL);
+-	if (!alarm_events) {
+-		ret = -ENOMEM;
+-		goto out1;
+-	}
+ 
+ 	/* Read telecom clock IRQ number (Set by BIOS) */
+ 	if (!request_region(TLCLK_BASE, 8, "telco_clock")) {
+@@ -796,7 +800,6 @@ static int __init tlclk_init(void)
+ 		ret = -EBUSY;
+ 		goto out2;
+ 	}
+-	telclk_interrupt = (inb(TLCLK_REG7) & 0x0f);
+ 
+ 	if (0x0F == telclk_interrupt ) { /* not MCPBL0010 ? */
+ 		printk(KERN_ERR "telclk_interrupt = 0x%x non-mcpbl0010 hw.\n",
+@@ -837,8 +840,8 @@ out3:
+ 	release_region(TLCLK_BASE, 8);
+ out2:
+ 	kfree(alarm_events);
+-out1:
+ 	unregister_chrdev(tlclk_major, "telco_clock");
++out1:
+ 	return ret;
+ }
+ 
+diff --git a/drivers/char/tpm/tpm_ibmvtpm.c b/drivers/char/tpm/tpm_ibmvtpm.c
+index 3e6a22658b63b..d4cc1a1ac1f73 100644
+--- a/drivers/char/tpm/tpm_ibmvtpm.c
++++ b/drivers/char/tpm/tpm_ibmvtpm.c
+@@ -543,6 +543,7 @@ static irqreturn_t ibmvtpm_interrupt(int irq, void *vtpm_instance)
+ 	 */
+ 	while ((crq = ibmvtpm_crq_get_next(ibmvtpm)) != NULL) {
+ 		ibmvtpm_crq_process(crq, ibmvtpm);
++		wake_up_interruptible(&ibmvtpm->crq_queue.wq);
+ 		crq->valid = 0;
+ 		smp_wmb();
+ 	}
+@@ -589,6 +590,7 @@ static int tpm_ibmvtpm_probe(struct vio_dev *vio_dev,
+ 	}
+ 
+ 	crq_q->num_entry = CRQ_RES_BUF_SIZE / sizeof(*crq_q->crq_addr);
++	init_waitqueue_head(&crq_q->wq);
+ 	ibmvtpm->crq_dma_handle = dma_map_single(dev, crq_q->crq_addr,
+ 						 CRQ_RES_BUF_SIZE,
+ 						 DMA_BIDIRECTIONAL);
+@@ -641,6 +643,13 @@ static int tpm_ibmvtpm_probe(struct vio_dev *vio_dev,
+ 	if (rc)
+ 		goto init_irq_cleanup;
+ 
++	if (!wait_event_timeout(ibmvtpm->crq_queue.wq,
++				ibmvtpm->rtce_buf != NULL,
++				HZ)) {
++		dev_err(dev, "CRQ response timed out\n");
++		goto init_irq_cleanup;
++	}
++
+ 	return tpm_chip_register(chip);
+ init_irq_cleanup:
+ 	do {
+diff --git a/drivers/char/tpm/tpm_ibmvtpm.h b/drivers/char/tpm/tpm_ibmvtpm.h
+index 6af92890518f8..1a8c3b698f104 100644
+--- a/drivers/char/tpm/tpm_ibmvtpm.h
++++ b/drivers/char/tpm/tpm_ibmvtpm.h
+@@ -31,6 +31,7 @@ struct ibmvtpm_crq_queue {
+ 	struct ibmvtpm_crq *crq_addr;
+ 	u32 index;
+ 	u32 num_entry;
++	wait_queue_head_t wq;
+ };
+ 
+ struct ibmvtpm_dev {
+diff --git a/drivers/devfreq/tegra-devfreq.c b/drivers/devfreq/tegra-devfreq.c
+index 64a2e02b87d78..0b0de6a049afb 100644
+--- a/drivers/devfreq/tegra-devfreq.c
++++ b/drivers/devfreq/tegra-devfreq.c
+@@ -79,6 +79,8 @@
+ 
+ #define KHZ							1000
+ 
++#define KHZ_MAX						(ULONG_MAX / KHZ)
++
+ /* Assume that the bus is saturated if the utilization is 25% */
+ #define BUS_SATURATION_RATIO					25
+ 
+@@ -179,7 +181,7 @@ struct tegra_actmon_emc_ratio {
+ };
+ 
+ static struct tegra_actmon_emc_ratio actmon_emc_ratios[] = {
+-	{ 1400000, ULONG_MAX },
++	{ 1400000,    KHZ_MAX },
+ 	{ 1200000,    750000 },
+ 	{ 1100000,    600000 },
+ 	{ 1000000,    500000 },
+diff --git a/drivers/dma/tegra20-apb-dma.c b/drivers/dma/tegra20-apb-dma.c
+index b5cf5d36de2b4..68c460a2b16ea 100644
+--- a/drivers/dma/tegra20-apb-dma.c
++++ b/drivers/dma/tegra20-apb-dma.c
+@@ -1207,8 +1207,7 @@ static void tegra_dma_free_chan_resources(struct dma_chan *dc)
+ 
+ 	dev_dbg(tdc2dev(tdc), "Freeing channel %d\n", tdc->id);
+ 
+-	if (tdc->busy)
+-		tegra_dma_terminate_all(dc);
++	tegra_dma_terminate_all(dc);
+ 
+ 	spin_lock_irqsave(&tdc->lock, flags);
+ 	list_splice_init(&tdc->pending_sg_req, &sg_req_list);
+diff --git a/drivers/gpu/drm/amd/amdgpu/atom.c b/drivers/gpu/drm/amd/amdgpu/atom.c
+index 1b50e6c13fb3f..5fbf99d600587 100644
+--- a/drivers/gpu/drm/amd/amdgpu/atom.c
++++ b/drivers/gpu/drm/amd/amdgpu/atom.c
+@@ -748,8 +748,8 @@ static void atom_op_jump(atom_exec_context *ctx, int *ptr, int arg)
+ 			cjiffies = jiffies;
+ 			if (time_after(cjiffies, ctx->last_jump_jiffies)) {
+ 				cjiffies -= ctx->last_jump_jiffies;
+-				if ((jiffies_to_msecs(cjiffies) > 5000)) {
+-					DRM_ERROR("atombios stuck in loop for more than 5secs aborting\n");
++				if ((jiffies_to_msecs(cjiffies) > 10000)) {
++					DRM_ERROR("atombios stuck in loop for more than 10secs aborting\n");
+ 					ctx->abort = true;
+ 				}
+ 			} else {
+diff --git a/drivers/gpu/drm/gma500/cdv_intel_display.c b/drivers/gpu/drm/gma500/cdv_intel_display.c
+index 7d47b3d5cc0d0..54d554d720004 100644
+--- a/drivers/gpu/drm/gma500/cdv_intel_display.c
++++ b/drivers/gpu/drm/gma500/cdv_intel_display.c
+@@ -415,6 +415,8 @@ static bool cdv_intel_find_dp_pll(const struct gma_limit_t *limit,
+ 	struct gma_crtc *gma_crtc = to_gma_crtc(crtc);
+ 	struct gma_clock_t clock;
+ 
++	memset(&clock, 0, sizeof(clock));
++
+ 	switch (refclk) {
+ 	case 27000:
+ 		if (target < 200000) {
+diff --git a/drivers/infiniband/core/ucma.c b/drivers/infiniband/core/ucma.c
+index 3e4d3d5560bf1..6315f77b4a58c 100644
+--- a/drivers/infiniband/core/ucma.c
++++ b/drivers/infiniband/core/ucma.c
+@@ -1295,13 +1295,13 @@ static ssize_t ucma_set_option(struct ucma_file *file, const char __user *inbuf,
+ 	if (copy_from_user(&cmd, inbuf, sizeof(cmd)))
+ 		return -EFAULT;
+ 
++	if (unlikely(cmd.optlen > KMALLOC_MAX_SIZE))
++		return -EINVAL;
++
+ 	ctx = ucma_get_ctx(file, cmd.id);
+ 	if (IS_ERR(ctx))
+ 		return PTR_ERR(ctx);
+ 
+-	if (unlikely(cmd.optlen > KMALLOC_MAX_SIZE))
+-		return -EINVAL;
+-
+ 	optval = memdup_user((void __user *) (unsigned long) cmd.optval,
+ 			     cmd.optlen);
+ 	if (IS_ERR(optval)) {
+diff --git a/drivers/md/bcache/bcache.h b/drivers/md/bcache/bcache.h
+index 7fe7df56fa334..f0939fc1cfe55 100644
+--- a/drivers/md/bcache/bcache.h
++++ b/drivers/md/bcache/bcache.h
+@@ -547,6 +547,7 @@ struct cache_set {
+ 	 */
+ 	wait_queue_head_t	btree_cache_wait;
+ 	struct task_struct	*btree_cache_alloc_lock;
++	spinlock_t		btree_cannibalize_lock;
+ 
+ 	/*
+ 	 * When we free a btree node, we increment the gen of the bucket the
+diff --git a/drivers/md/bcache/btree.c b/drivers/md/bcache/btree.c
+index 122d975220945..bdf6071c1b184 100644
+--- a/drivers/md/bcache/btree.c
++++ b/drivers/md/bcache/btree.c
+@@ -841,15 +841,17 @@ out:
+ 
+ static int mca_cannibalize_lock(struct cache_set *c, struct btree_op *op)
+ {
+-	struct task_struct *old;
+-
+-	old = cmpxchg(&c->btree_cache_alloc_lock, NULL, current);
+-	if (old && old != current) {
++	spin_lock(&c->btree_cannibalize_lock);
++	if (likely(c->btree_cache_alloc_lock == NULL)) {
++		c->btree_cache_alloc_lock = current;
++	} else if (c->btree_cache_alloc_lock != current) {
+ 		if (op)
+ 			prepare_to_wait(&c->btree_cache_wait, &op->wait,
+ 					TASK_UNINTERRUPTIBLE);
++		spin_unlock(&c->btree_cannibalize_lock);
+ 		return -EINTR;
+ 	}
++	spin_unlock(&c->btree_cannibalize_lock);
+ 
+ 	return 0;
+ }
+@@ -884,10 +886,12 @@ static struct btree *mca_cannibalize(struct cache_set *c, struct btree_op *op,
+  */
+ static void bch_cannibalize_unlock(struct cache_set *c)
+ {
++	spin_lock(&c->btree_cannibalize_lock);
+ 	if (c->btree_cache_alloc_lock == current) {
+ 		c->btree_cache_alloc_lock = NULL;
+ 		wake_up(&c->btree_cache_wait);
+ 	}
++	spin_unlock(&c->btree_cannibalize_lock);
+ }
+ 
+ static struct btree *mca_alloc(struct cache_set *c, struct btree_op *op,
+diff --git a/drivers/md/bcache/super.c b/drivers/md/bcache/super.c
+index f7f8fb079d2a9..d73f9ea776861 100644
+--- a/drivers/md/bcache/super.c
++++ b/drivers/md/bcache/super.c
+@@ -1511,6 +1511,7 @@ struct cache_set *bch_cache_set_alloc(struct cache_sb *sb)
+ 	sema_init(&c->sb_write_mutex, 1);
+ 	mutex_init(&c->bucket_lock);
+ 	init_waitqueue_head(&c->btree_cache_wait);
++	spin_lock_init(&c->btree_cannibalize_lock);
+ 	init_waitqueue_head(&c->bucket_wait);
+ 	init_waitqueue_head(&c->gc_wait);
+ 	sema_init(&c->uuid_write_mutex, 1);
+diff --git a/drivers/media/dvb-frontends/tda10071.c b/drivers/media/dvb-frontends/tda10071.c
+index 119d47596ac81..b81887c4f72a9 100644
+--- a/drivers/media/dvb-frontends/tda10071.c
++++ b/drivers/media/dvb-frontends/tda10071.c
+@@ -483,10 +483,11 @@ static int tda10071_read_status(struct dvb_frontend *fe, enum fe_status *status)
+ 			goto error;
+ 
+ 		if (dev->delivery_system == SYS_DVBS) {
+-			dev->dvbv3_ber = buf[0] << 24 | buf[1] << 16 |
+-					 buf[2] << 8 | buf[3] << 0;
+-			dev->post_bit_error += buf[0] << 24 | buf[1] << 16 |
+-					       buf[2] << 8 | buf[3] << 0;
++			u32 bit_error = buf[0] << 24 | buf[1] << 16 |
++					buf[2] << 8 | buf[3] << 0;
++
++			dev->dvbv3_ber = bit_error;
++			dev->post_bit_error += bit_error;
+ 			c->post_bit_error.stat[0].scale = FE_SCALE_COUNTER;
+ 			c->post_bit_error.stat[0].uvalue = dev->post_bit_error;
+ 			dev->block_error += buf[4] << 8 | buf[5] << 0;
+diff --git a/drivers/media/usb/go7007/go7007-usb.c b/drivers/media/usb/go7007/go7007-usb.c
+index 4857c467e76cd..4490786936a02 100644
+--- a/drivers/media/usb/go7007/go7007-usb.c
++++ b/drivers/media/usb/go7007/go7007-usb.c
+@@ -1052,6 +1052,7 @@ static int go7007_usb_probe(struct usb_interface *intf,
+ 	struct go7007_usb *usb;
+ 	const struct go7007_usb_board *board;
+ 	struct usb_device *usbdev = interface_to_usbdev(intf);
++	struct usb_host_endpoint *ep;
+ 	unsigned num_i2c_devs;
+ 	char *name;
+ 	int video_pipe, i, v_urb_len;
+@@ -1147,7 +1148,8 @@ static int go7007_usb_probe(struct usb_interface *intf,
+ 	if (usb->intr_urb->transfer_buffer == NULL)
+ 		goto allocfail;
+ 
+-	if (go->board_id == GO7007_BOARDID_SENSORAY_2250)
++	ep = usb->usbdev->ep_in[4];
++	if (usb_endpoint_type(&ep->desc) == USB_ENDPOINT_XFER_BULK)
+ 		usb_fill_bulk_urb(usb->intr_urb, usb->usbdev,
+ 			usb_rcvbulkpipe(usb->usbdev, 4),
+ 			usb->intr_urb->transfer_buffer, 2*sizeof(u16),
+diff --git a/drivers/mfd/mfd-core.c b/drivers/mfd/mfd-core.c
+index 215bb5eeb5acf..c57e375fad6ed 100644
+--- a/drivers/mfd/mfd-core.c
++++ b/drivers/mfd/mfd-core.c
+@@ -31,6 +31,11 @@ int mfd_cell_enable(struct platform_device *pdev)
+ 	const struct mfd_cell *cell = mfd_get_cell(pdev);
+ 	int err = 0;
+ 
++	if (!cell->enable) {
++		dev_dbg(&pdev->dev, "No .enable() call-back registered\n");
++		return 0;
++	}
++
+ 	/* only call enable hook if the cell wasn't previously enabled */
+ 	if (atomic_inc_return(cell->usage_count) == 1)
+ 		err = cell->enable(pdev);
+@@ -48,6 +53,11 @@ int mfd_cell_disable(struct platform_device *pdev)
+ 	const struct mfd_cell *cell = mfd_get_cell(pdev);
+ 	int err = 0;
+ 
++	if (!cell->disable) {
++		dev_dbg(&pdev->dev, "No .disable() call-back registered\n");
++		return 0;
++	}
++
+ 	/* only disable if no other clients are using it */
+ 	if (atomic_dec_return(cell->usage_count) == 0)
+ 		err = cell->disable(pdev);
+diff --git a/drivers/mtd/chips/cfi_cmdset_0002.c b/drivers/mtd/chips/cfi_cmdset_0002.c
+index 972935f1b2f7e..3a3da0eeef1fb 100644
+--- a/drivers/mtd/chips/cfi_cmdset_0002.c
++++ b/drivers/mtd/chips/cfi_cmdset_0002.c
+@@ -724,7 +724,6 @@ static struct mtd_info *cfi_amdstd_setup(struct mtd_info *mtd)
+ 	kfree(mtd->eraseregions);
+ 	kfree(mtd);
+ 	kfree(cfi->cmdset_priv);
+-	kfree(cfi->cfiq);
+ 	return NULL;
+ }
+ 
+diff --git a/drivers/mtd/cmdlinepart.c b/drivers/mtd/cmdlinepart.c
+index 08f62987cc37c..ffbc9b304beb2 100644
+--- a/drivers/mtd/cmdlinepart.c
++++ b/drivers/mtd/cmdlinepart.c
+@@ -228,12 +228,29 @@ static int mtdpart_setup_real(char *s)
+ 		struct cmdline_mtd_partition *this_mtd;
+ 		struct mtd_partition *parts;
+ 		int mtd_id_len, num_parts;
+-		char *p, *mtd_id;
++		char *p, *mtd_id, *semicol;
++
++		/*
++		 * Replace the first ';' by a NULL char so strrchr can work
++		 * properly.
++		 */
++		semicol = strchr(s, ';');
++		if (semicol)
++			*semicol = '\0';
+ 
+ 		mtd_id = s;
+ 
+-		/* fetch <mtd-id> */
+-		p = strchr(s, ':');
++		/*
++		 * fetch <mtd-id>. We use strrchr to ignore all ':' that could
++		 * be present in the MTD name, only the last one is interpreted
++		 * as an <mtd-id>/<part-definition> separator.
++		 */
++		p = strrchr(s, ':');
++
++		/* Restore the ';' now. */
++		if (semicol)
++			*semicol = ';';
++
+ 		if (!p) {
+ 			pr_err("no mtd-id\n");
+ 			return -EINVAL;
+diff --git a/drivers/mtd/nand/omap_elm.c b/drivers/mtd/nand/omap_elm.c
+index 235ec7992b4cf..e46b11847082a 100644
+--- a/drivers/mtd/nand/omap_elm.c
++++ b/drivers/mtd/nand/omap_elm.c
+@@ -421,6 +421,7 @@ static int elm_probe(struct platform_device *pdev)
+ 	pm_runtime_enable(&pdev->dev);
+ 	if (pm_runtime_get_sync(&pdev->dev) < 0) {
+ 		ret = -EINVAL;
++		pm_runtime_put_sync(&pdev->dev);
+ 		pm_runtime_disable(&pdev->dev);
+ 		dev_err(&pdev->dev, "can't enable clock\n");
+ 		return ret;
+diff --git a/drivers/net/ethernet/intel/e1000/e1000_main.c b/drivers/net/ethernet/intel/e1000/e1000_main.c
+index f958188207fd6..e57aca6239f8e 100644
+--- a/drivers/net/ethernet/intel/e1000/e1000_main.c
++++ b/drivers/net/ethernet/intel/e1000/e1000_main.c
+@@ -568,8 +568,13 @@ void e1000_reinit_locked(struct e1000_adapter *adapter)
+ 	WARN_ON(in_interrupt());
+ 	while (test_and_set_bit(__E1000_RESETTING, &adapter->flags))
+ 		msleep(1);
+-	e1000_down(adapter);
+-	e1000_up(adapter);
++
++	/* only run the task if not already down */
++	if (!test_bit(__E1000_DOWN, &adapter->flags)) {
++		e1000_down(adapter);
++		e1000_up(adapter);
++	}
++
+ 	clear_bit(__E1000_RESETTING, &adapter->flags);
+ }
+ 
+@@ -1456,10 +1461,15 @@ static int e1000_close(struct net_device *netdev)
+ 	struct e1000_hw *hw = &adapter->hw;
+ 	int count = E1000_CHECK_RESET_COUNT;
+ 
+-	while (test_bit(__E1000_RESETTING, &adapter->flags) && count--)
++	while (test_and_set_bit(__E1000_RESETTING, &adapter->flags) && count--)
+ 		usleep_range(10000, 20000);
+ 
+-	WARN_ON(test_bit(__E1000_RESETTING, &adapter->flags));
++	WARN_ON(count < 0);
++
++	/* signal that we're down so that the reset task will no longer run */
++	set_bit(__E1000_DOWN, &adapter->flags);
++	clear_bit(__E1000_RESETTING, &adapter->flags);
++
+ 	e1000_down(adapter);
+ 	e1000_power_down_phy(adapter);
+ 	e1000_free_irq(adapter);
+diff --git a/drivers/net/wan/hdlc_ppp.c b/drivers/net/wan/hdlc_ppp.c
+index 4842344a96f1d..a2559f213daed 100644
+--- a/drivers/net/wan/hdlc_ppp.c
++++ b/drivers/net/wan/hdlc_ppp.c
+@@ -386,11 +386,8 @@ static void ppp_cp_parse_cr(struct net_device *dev, u16 pid, u8 id,
+ 	}
+ 
+ 	for (opt = data; len; len -= opt[1], opt += opt[1]) {
+-		if (len < 2 || len < opt[1]) {
+-			dev->stats.rx_errors++;
+-			kfree(out);
+-			return; /* bad packet, drop silently */
+-		}
++		if (len < 2 || opt[1] < 2 || len < opt[1])
++			goto err_out;
+ 
+ 		if (pid == PID_LCP)
+ 			switch (opt[0]) {
+@@ -398,6 +395,8 @@ static void ppp_cp_parse_cr(struct net_device *dev, u16 pid, u8 id,
+ 				continue; /* MRU always OK and > 1500 bytes? */
+ 
+ 			case LCP_OPTION_ACCM: /* async control character map */
++				if (opt[1] < sizeof(valid_accm))
++					goto err_out;
+ 				if (!memcmp(opt, valid_accm,
+ 					    sizeof(valid_accm)))
+ 					continue;
+@@ -409,6 +408,8 @@ static void ppp_cp_parse_cr(struct net_device *dev, u16 pid, u8 id,
+ 				}
+ 				break;
+ 			case LCP_OPTION_MAGIC:
++				if (len < 6)
++					goto err_out;
+ 				if (opt[1] != 6 || (!opt[2] && !opt[3] &&
+ 						    !opt[4] && !opt[5]))
+ 					break; /* reject invalid magic number */
+@@ -427,6 +428,11 @@ static void ppp_cp_parse_cr(struct net_device *dev, u16 pid, u8 id,
+ 		ppp_cp_event(dev, pid, RCR_GOOD, CP_CONF_ACK, id, req_len, data);
+ 
+ 	kfree(out);
++	return;
++
++err_out:
++	dev->stats.rx_errors++;
++	kfree(out);
+ }
+ 
+ static int ppp_rx(struct sk_buff *skb)
+diff --git a/drivers/net/wireless/ath/ar5523/ar5523.c b/drivers/net/wireless/ath/ar5523/ar5523.c
+index 5bf22057459e6..bc6330b437958 100644
+--- a/drivers/net/wireless/ath/ar5523/ar5523.c
++++ b/drivers/net/wireless/ath/ar5523/ar5523.c
+@@ -1774,6 +1774,8 @@ static struct usb_device_id ar5523_id_table[] = {
+ 	AR5523_DEVICE_UX(0x0846, 0x4300),	/* Netgear / WG111U */
+ 	AR5523_DEVICE_UG(0x0846, 0x4250),	/* Netgear / WG111T */
+ 	AR5523_DEVICE_UG(0x0846, 0x5f00),	/* Netgear / WPN111 */
++	AR5523_DEVICE_UG(0x083a, 0x4506),	/* SMC / EZ Connect
++						   SMCWUSBT-G2 */
+ 	AR5523_DEVICE_UG(0x157e, 0x3006),	/* Umedia / AR5523_1 */
+ 	AR5523_DEVICE_UX(0x157e, 0x3205),	/* Umedia / AR5523_2 */
+ 	AR5523_DEVICE_UG(0x157e, 0x3006),	/* Umedia / TEW444UBEU */
+diff --git a/drivers/net/wireless/mwifiex/fw.h b/drivers/net/wireless/mwifiex/fw.h
+index 9a5eb9ed89215..233af2292366d 100644
+--- a/drivers/net/wireless/mwifiex/fw.h
++++ b/drivers/net/wireless/mwifiex/fw.h
+@@ -848,7 +848,7 @@ struct mwifiex_tkip_param {
+ struct mwifiex_aes_param {
+ 	u8 pn[WPA_PN_SIZE];
+ 	__le16 key_len;
+-	u8 key[WLAN_KEY_LEN_CCMP];
++	u8 key[WLAN_KEY_LEN_CCMP_256];
+ } __packed;
+ 
+ struct mwifiex_wapi_param {
+diff --git a/drivers/net/wireless/mwifiex/sta_cmdresp.c b/drivers/net/wireless/mwifiex/sta_cmdresp.c
+index 9e3853c8a22da..32b0b06b74f1d 100644
+--- a/drivers/net/wireless/mwifiex/sta_cmdresp.c
++++ b/drivers/net/wireless/mwifiex/sta_cmdresp.c
+@@ -631,7 +631,7 @@ static int mwifiex_ret_802_11_key_material_v2(struct mwifiex_private *priv,
+ 	key_v2 = &resp->params.key_material_v2;
+ 
+ 	len = le16_to_cpu(key_v2->key_param_set.key_params.aes.key_len);
+-	if (len > WLAN_KEY_LEN_CCMP)
++	if (len > sizeof(key_v2->key_param_set.key_params.aes.key))
+ 		return -EINVAL;
+ 
+ 	if (le16_to_cpu(key_v2->action) == HostCmd_ACT_GEN_SET) {
+@@ -647,7 +647,7 @@ static int mwifiex_ret_802_11_key_material_v2(struct mwifiex_private *priv,
+ 		return 0;
+ 
+ 	memset(priv->aes_key_v2.key_param_set.key_params.aes.key, 0,
+-	       WLAN_KEY_LEN_CCMP);
++	       sizeof(key_v2->key_param_set.key_params.aes.key));
+ 	priv->aes_key_v2.key_param_set.key_params.aes.key_len =
+ 				cpu_to_le16(len);
+ 	memcpy(priv->aes_key_v2.key_param_set.key_params.aes.key,
+diff --git a/drivers/phy/phy-s5pv210-usb2.c b/drivers/phy/phy-s5pv210-usb2.c
+index 004d320767e4d..bb36cfd4e3e90 100644
+--- a/drivers/phy/phy-s5pv210-usb2.c
++++ b/drivers/phy/phy-s5pv210-usb2.c
+@@ -142,6 +142,10 @@ static void s5pv210_phy_pwr(struct samsung_usb2_phy_instance *inst, bool on)
+ 		udelay(10);
+ 		rst &= ~rstbits;
+ 		writel(rst, drv->reg_phy + S5PV210_UPHYRST);
++		/* The following delay is necessary for the reset sequence to be
++		 * completed
++		 */
++		udelay(80);
+ 	} else {
+ 		pwr = readl(drv->reg_phy + S5PV210_UPHYPWR);
+ 		pwr |= phypwr;
+diff --git a/drivers/scsi/aacraid/aachba.c b/drivers/scsi/aacraid/aachba.c
+index de33801ca31ea..0614d05a990a6 100644
+--- a/drivers/scsi/aacraid/aachba.c
++++ b/drivers/scsi/aacraid/aachba.c
+@@ -1938,13 +1938,13 @@ static int aac_read(struct scsi_cmnd * scsicmd)
+ 		scsicmd->result = DID_OK << 16 | COMMAND_COMPLETE << 8 |
+ 			SAM_STAT_CHECK_CONDITION;
+ 		set_sense(&dev->fsa_dev[cid].sense_data,
+-			  HARDWARE_ERROR, SENCODE_INTERNAL_TARGET_FAILURE,
++			  ILLEGAL_REQUEST, SENCODE_LBA_OUT_OF_RANGE,
+ 			  ASENCODE_INTERNAL_TARGET_FAILURE, 0, 0);
+ 		memcpy(scsicmd->sense_buffer, &dev->fsa_dev[cid].sense_data,
+ 		       min_t(size_t, sizeof(dev->fsa_dev[cid].sense_data),
+ 			     SCSI_SENSE_BUFFERSIZE));
+ 		scsicmd->scsi_done(scsicmd);
+-		return 1;
++		return 0;
+ 	}
+ 
+ 	dprintk((KERN_DEBUG "aac_read[cpu %d]: lba = %llu, t = %ld.\n",
+@@ -2035,13 +2035,13 @@ static int aac_write(struct scsi_cmnd * scsicmd)
+ 		scsicmd->result = DID_OK << 16 | COMMAND_COMPLETE << 8 |
+ 			SAM_STAT_CHECK_CONDITION;
+ 		set_sense(&dev->fsa_dev[cid].sense_data,
+-			  HARDWARE_ERROR, SENCODE_INTERNAL_TARGET_FAILURE,
++			  ILLEGAL_REQUEST, SENCODE_LBA_OUT_OF_RANGE,
+ 			  ASENCODE_INTERNAL_TARGET_FAILURE, 0, 0);
+ 		memcpy(scsicmd->sense_buffer, &dev->fsa_dev[cid].sense_data,
+ 		       min_t(size_t, sizeof(dev->fsa_dev[cid].sense_data),
+ 			     SCSI_SENSE_BUFFERSIZE));
+ 		scsicmd->scsi_done(scsicmd);
+-		return 1;
++		return 0;
+ 	}
+ 
+ 	dprintk((KERN_DEBUG "aac_write[cpu %d]: lba = %llu, t = %ld.\n",
+diff --git a/drivers/scsi/lpfc/lpfc_sli.c b/drivers/scsi/lpfc/lpfc_sli.c
+index 7a94c2d352390..97c0d79a2601f 100644
+--- a/drivers/scsi/lpfc/lpfc_sli.c
++++ b/drivers/scsi/lpfc/lpfc_sli.c
+@@ -15445,6 +15445,10 @@ lpfc_prep_seq(struct lpfc_vport *vport, struct hbq_dmabuf *seq_dmabuf)
+ 			list_add_tail(&iocbq->list, &first_iocbq->list);
+ 		}
+ 	}
++	/* Free the sequence's header buffer */
++	if (!first_iocbq)
++		lpfc_in_buf_free(vport->phba, &seq_dmabuf->dbuf);
++
+ 	return first_iocbq;
+ }
+ 
+diff --git a/drivers/tty/serial/8250/8250_core.c b/drivers/tty/serial/8250/8250_core.c
+index e9ea9005a984e..f24fa99da69f5 100644
+--- a/drivers/tty/serial/8250/8250_core.c
++++ b/drivers/tty/serial/8250/8250_core.c
+@@ -1037,8 +1037,10 @@ int serial8250_register_8250_port(struct uart_8250_port *up)
+ 
+ 			ret = uart_add_one_port(&serial8250_reg,
+ 						&uart->port);
+-			if (ret == 0)
+-				ret = uart->port.line;
++			if (ret)
++				goto err;
++
++			ret = uart->port.line;
+ 		} else {
+ 			dev_info(uart->port.dev,
+ 				"skipping CIR port at 0x%lx / 0x%llx, IRQ %d\n",
+@@ -1052,6 +1054,11 @@ int serial8250_register_8250_port(struct uart_8250_port *up)
+ 	mutex_unlock(&serial_mutex);
+ 
+ 	return ret;
++
++err:
++	uart->port.dev = NULL;
++	mutex_unlock(&serial_mutex);
++	return ret;
+ }
+ EXPORT_SYMBOL(serial8250_register_8250_port);
+ 
+diff --git a/drivers/tty/serial/8250/8250_omap.c b/drivers/tty/serial/8250/8250_omap.c
+index c4383573cf668..0377b35d62b80 100644
+--- a/drivers/tty/serial/8250/8250_omap.c
++++ b/drivers/tty/serial/8250/8250_omap.c
+@@ -1188,11 +1188,11 @@ static int omap8250_probe(struct platform_device *pdev)
+ 	spin_lock_init(&priv->rx_dma_lock);
+ 
+ 	device_init_wakeup(&pdev->dev, true);
++	pm_runtime_enable(&pdev->dev);
+ 	pm_runtime_use_autosuspend(&pdev->dev);
+ 	pm_runtime_set_autosuspend_delay(&pdev->dev, -1);
+ 
+ 	pm_runtime_irq_safe(&pdev->dev);
+-	pm_runtime_enable(&pdev->dev);
+ 
+ 	pm_runtime_get_sync(&pdev->dev);
+ 
+diff --git a/drivers/tty/serial/samsung.c b/drivers/tty/serial/samsung.c
+index 70a51d0bc6044..42aa37515e9bd 100644
+--- a/drivers/tty/serial/samsung.c
++++ b/drivers/tty/serial/samsung.c
+@@ -1151,14 +1151,14 @@ static unsigned int s3c24xx_serial_getclk(struct s3c24xx_uart_port *ourport,
+ 	struct s3c24xx_uart_info *info = ourport->info;
+ 	struct clk *clk;
+ 	unsigned long rate;
+-	unsigned int cnt, baud, quot, clk_sel, best_quot = 0;
++	unsigned int cnt, baud, quot, best_quot = 0;
+ 	char clkname[MAX_CLK_NAME_LENGTH];
+ 	int calc_deviation, deviation = (1 << 30) - 1;
+ 
+-	clk_sel = (ourport->cfg->clk_sel) ? ourport->cfg->clk_sel :
+-			ourport->info->def_clk_sel;
+ 	for (cnt = 0; cnt < info->num_clks; cnt++) {
+-		if (!(clk_sel & (1 << cnt)))
++		/* Keep selected clock if provided */
++		if (ourport->cfg->clk_sel &&
++			!(ourport->cfg->clk_sel & (1 << cnt)))
+ 			continue;
+ 
+ 		sprintf(clkname, "clk_uart_baud%d", cnt);
+diff --git a/drivers/tty/vt/vt.c b/drivers/tty/vt/vt.c
+index 0e4f54832fc79..01aeffcdf9849 100644
+--- a/drivers/tty/vt/vt.c
++++ b/drivers/tty/vt/vt.c
+@@ -2484,7 +2484,7 @@ static void console_callback(struct work_struct *ignored)
+ 	if (scrollback_delta) {
+ 		struct vc_data *vc = vc_cons[fg_console].d;
+ 		clear_selection();
+-		if (vc->vc_mode == KD_TEXT)
++		if (vc->vc_mode == KD_TEXT && vc->vc_sw->con_scrolldelta)
+ 			vc->vc_sw->con_scrolldelta(vc, scrollback_delta);
+ 		scrollback_delta = 0;
+ 	}
+diff --git a/drivers/usb/host/ehci-mv.c b/drivers/usb/host/ehci-mv.c
+index 849806a75f1ce..b29610899c9f6 100644
+--- a/drivers/usb/host/ehci-mv.c
++++ b/drivers/usb/host/ehci-mv.c
+@@ -196,12 +196,10 @@ static int mv_ehci_probe(struct platform_device *pdev)
+ 	hcd->rsrc_len = resource_size(r);
+ 	hcd->regs = ehci_mv->op_regs;
+ 
+-	hcd->irq = platform_get_irq(pdev, 0);
+-	if (!hcd->irq) {
+-		dev_err(&pdev->dev, "Cannot get irq.");
+-		retval = -ENODEV;
++	retval = platform_get_irq(pdev, 0);
++	if (retval < 0)
+ 		goto err_disable_clk;
+-	}
++	hcd->irq = retval;
+ 
+ 	ehci = hcd_to_ehci(hcd);
+ 	ehci->caps = (struct ehci_caps *) ehci_mv->cap_regs;
+diff --git a/drivers/vfio/pci/vfio_pci.c b/drivers/vfio/pci/vfio_pci.c
+index 7a82735d53087..8276ef7f3e834 100644
+--- a/drivers/vfio/pci/vfio_pci.c
++++ b/drivers/vfio/pci/vfio_pci.c
+@@ -255,6 +255,19 @@ static void vfio_pci_release(void *device_data)
+ 	if (!(--vdev->refcnt)) {
+ 		vfio_spapr_pci_eeh_release(vdev->pdev);
+ 		vfio_pci_disable(vdev);
++		mutex_lock(&vdev->igate);
++		if (vdev->err_trigger) {
++			eventfd_ctx_put(vdev->err_trigger);
++			vdev->err_trigger = NULL;
++		}
++		mutex_unlock(&vdev->igate);
++
++		mutex_lock(&vdev->igate);
++		if (vdev->req_trigger) {
++			eventfd_ctx_put(vdev->req_trigger);
++			vdev->req_trigger = NULL;
++		}
++		mutex_unlock(&vdev->igate);
+ 	}
+ 
+ 	mutex_unlock(&driver_lock);
+diff --git a/drivers/video/fbdev/omap2/dss/omapdss-boot-init.c b/drivers/video/fbdev/omap2/dss/omapdss-boot-init.c
+index 8b6f6d5fdd68b..43186fa8a13c9 100644
+--- a/drivers/video/fbdev/omap2/dss/omapdss-boot-init.c
++++ b/drivers/video/fbdev/omap2/dss/omapdss-boot-init.c
+@@ -194,7 +194,7 @@ static int __init omapdss_boot_init(void)
+ 	dss = of_find_matching_node(NULL, omapdss_of_match);
+ 
+ 	if (dss == NULL || !of_device_is_available(dss))
+-		return 0;
++		goto put_node;
+ 
+ 	omapdss_walk_device(dss, true);
+ 
+@@ -221,6 +221,8 @@ static int __init omapdss_boot_init(void)
+ 		kfree(n);
+ 	}
+ 
++put_node:
++	of_node_put(dss);
+ 	return 0;
+ }
+ 
+diff --git a/fs/block_dev.c b/fs/block_dev.c
+index b2ebfd96785b7..a71d442ef7d0e 100644
+--- a/fs/block_dev.c
++++ b/fs/block_dev.c
+@@ -1515,6 +1515,16 @@ static void __blkdev_put(struct block_device *bdev, fmode_t mode, int for_part)
+ 	struct gendisk *disk = bdev->bd_disk;
+ 	struct block_device *victim = NULL;
+ 
++	/*
++	 * Sync early if it looks like we're the last one.  If someone else
++	 * opens the block device between now and the decrement of bd_openers
++	 * then we did a sync that we didn't need to, but that's not the end
++	 * of the world and we want to avoid long (could be several minute)
++	 * syncs while holding the mutex.
++	 */
++	if (bdev->bd_openers == 1)
++		sync_blockdev(bdev);
++
+ 	mutex_lock_nested(&bdev->bd_mutex, for_part);
+ 	if (for_part)
+ 		bdev->bd_part_count--;
+diff --git a/fs/ceph/caps.c b/fs/ceph/caps.c
+index 3d0497421e62b..49e693232916f 100644
+--- a/fs/ceph/caps.c
++++ b/fs/ceph/caps.c
+@@ -1777,12 +1777,24 @@ ack:
+ 			if (mutex_trylock(&session->s_mutex) == 0) {
+ 				dout("inverting session/ino locks on %p\n",
+ 				     session);
++				session = ceph_get_mds_session(session);
+ 				spin_unlock(&ci->i_ceph_lock);
+ 				if (took_snap_rwsem) {
+ 					up_read(&mdsc->snap_rwsem);
+ 					took_snap_rwsem = 0;
+ 				}
+-				mutex_lock(&session->s_mutex);
++				if (session) {
++					mutex_lock(&session->s_mutex);
++					ceph_put_mds_session(session);
++				} else {
++					/*
++					 * Because we take the reference while
++					 * holding the i_ceph_lock, it should
++					 * never be NULL. Throw a warning if it
++					 * ever is.
++					 */
++					WARN_ON_ONCE(true);
++				}
+ 				goto retry;
+ 			}
+ 		}
+diff --git a/fs/fuse/dev.c b/fs/fuse/dev.c
+index 8142f6bf3d310..fc265f4b839ae 100644
+--- a/fs/fuse/dev.c
++++ b/fs/fuse/dev.c
+@@ -850,7 +850,6 @@ static int fuse_check_page(struct page *page)
+ {
+ 	if (page_mapcount(page) ||
+ 	    page->mapping != NULL ||
+-	    page_count(page) != 1 ||
+ 	    (page->flags & PAGE_FLAGS_CHECK_AT_PREP &
+ 	     ~(1 << PG_locked |
+ 	       1 << PG_referenced |
+diff --git a/fs/ubifs/io.c b/fs/ubifs/io.c
+index 97be412153328..9213a9e046ae0 100644
+--- a/fs/ubifs/io.c
++++ b/fs/ubifs/io.c
+@@ -237,7 +237,7 @@ int ubifs_is_mapped(const struct ubifs_info *c, int lnum)
+ int ubifs_check_node(const struct ubifs_info *c, const void *buf, int lnum,
+ 		     int offs, int quiet, int must_chk_crc)
+ {
+-	int err = -EINVAL, type, node_len;
++	int err = -EINVAL, type, node_len, dump_node = 1;
+ 	uint32_t crc, node_crc, magic;
+ 	const struct ubifs_ch *ch = buf;
+ 
+@@ -290,10 +290,22 @@ int ubifs_check_node(const struct ubifs_info *c, const void *buf, int lnum,
+ out_len:
+ 	if (!quiet)
+ 		ubifs_err(c, "bad node length %d", node_len);
++	if (type == UBIFS_DATA_NODE && node_len > UBIFS_DATA_NODE_SZ)
++		dump_node = 0;
+ out:
+ 	if (!quiet) {
+ 		ubifs_err(c, "bad node at LEB %d:%d", lnum, offs);
+-		ubifs_dump_node(c, buf);
++		if (dump_node) {
++			ubifs_dump_node(c, buf);
++		} else {
++			int safe_len = min3(node_len, c->leb_size - offs,
++				(int)UBIFS_MAX_DATA_NODE_SZ);
++			pr_err("\tprevent out-of-bounds memory access\n");
++			pr_err("\ttruncated data node length      %d\n", safe_len);
++			pr_err("\tcorrupted data node:\n");
++			print_hex_dump(KERN_ERR, "\t", DUMP_PREFIX_OFFSET, 32, 1,
++					buf, safe_len, 0);
++		}
+ 		dump_stack();
+ 	}
+ 	return err;
+diff --git a/fs/xfs/libxfs/xfs_attr_leaf.c b/fs/xfs/libxfs/xfs_attr_leaf.c
+index da8747b870df3..4539ff4d351f9 100644
+--- a/fs/xfs/libxfs/xfs_attr_leaf.c
++++ b/fs/xfs/libxfs/xfs_attr_leaf.c
+@@ -1326,7 +1326,9 @@ xfs_attr3_leaf_add_work(
+ 	for (i = 0; i < XFS_ATTR_LEAF_MAPSIZE; i++) {
+ 		if (ichdr->freemap[i].base == tmp) {
+ 			ichdr->freemap[i].base += sizeof(xfs_attr_leaf_entry_t);
+-			ichdr->freemap[i].size -= sizeof(xfs_attr_leaf_entry_t);
++			ichdr->freemap[i].size -=
++				min_t(uint16_t, ichdr->freemap[i].size,
++						sizeof(xfs_attr_leaf_entry_t));
+ 		}
+ 	}
+ 	ichdr->usedbytes += xfs_attr_leaf_entsize(leaf, args->index);
+diff --git a/include/linux/libata.h b/include/linux/libata.h
+index af561d33221d6..ec49344f7555d 100644
+--- a/include/linux/libata.h
++++ b/include/linux/libata.h
+@@ -500,6 +500,7 @@ enum hsm_task_states {
+ };
+ 
+ enum ata_completion_errors {
++	AC_ERR_OK		= 0,	    /* no error */
+ 	AC_ERR_DEV		= (1 << 0), /* device reported error */
+ 	AC_ERR_HSM		= (1 << 1), /* host state machine violation */
+ 	AC_ERR_TIMEOUT		= (1 << 2), /* timeout */
+@@ -896,9 +897,9 @@ struct ata_port_operations {
+ 	/*
+ 	 * Command execution
+ 	 */
+-	int  (*qc_defer)(struct ata_queued_cmd *qc);
+-	int  (*check_atapi_dma)(struct ata_queued_cmd *qc);
+-	void (*qc_prep)(struct ata_queued_cmd *qc);
++	int (*qc_defer)(struct ata_queued_cmd *qc);
++	int (*check_atapi_dma)(struct ata_queued_cmd *qc);
++	enum ata_completion_errors (*qc_prep)(struct ata_queued_cmd *qc);
+ 	unsigned int (*qc_issue)(struct ata_queued_cmd *qc);
+ 	bool (*qc_fill_rtf)(struct ata_queued_cmd *qc);
+ 
+@@ -1190,7 +1191,7 @@ extern int ata_xfer_mode2shift(unsigned long xfer_mode);
+ extern const char *ata_mode_string(unsigned long xfer_mask);
+ extern unsigned long ata_id_xfermask(const u16 *id);
+ extern int ata_std_qc_defer(struct ata_queued_cmd *qc);
+-extern void ata_noop_qc_prep(struct ata_queued_cmd *qc);
++extern enum ata_completion_errors ata_noop_qc_prep(struct ata_queued_cmd *qc);
+ extern void ata_sg_init(struct ata_queued_cmd *qc, struct scatterlist *sg,
+ 		 unsigned int n_elem);
+ extern unsigned int ata_dev_classify(const struct ata_taskfile *tf);
+@@ -1881,9 +1882,9 @@ extern const struct ata_port_operations ata_bmdma_port_ops;
+ 	.sg_tablesize		= LIBATA_MAX_PRD,		\
+ 	.dma_boundary		= ATA_DMA_BOUNDARY
+ 
+-extern void ata_bmdma_qc_prep(struct ata_queued_cmd *qc);
++extern enum ata_completion_errors ata_bmdma_qc_prep(struct ata_queued_cmd *qc);
+ extern unsigned int ata_bmdma_qc_issue(struct ata_queued_cmd *qc);
+-extern void ata_bmdma_dumb_qc_prep(struct ata_queued_cmd *qc);
++extern enum ata_completion_errors ata_bmdma_dumb_qc_prep(struct ata_queued_cmd *qc);
+ extern unsigned int ata_bmdma_port_intr(struct ata_port *ap,
+ 				      struct ata_queued_cmd *qc);
+ extern irqreturn_t ata_bmdma_interrupt(int irq, void *dev_instance);
+diff --git a/include/linux/mtd/map.h b/include/linux/mtd/map.h
+index 676d3d2a1a0a9..d8bae7cb86f39 100644
+--- a/include/linux/mtd/map.h
++++ b/include/linux/mtd/map.h
+@@ -307,7 +307,7 @@ void map_destroy(struct mtd_info *mtd);
+ ({									\
+ 	int i, ret = 1;							\
+ 	for (i = 0; i < map_words(map); i++) {				\
+-		if (((val1).x[i] & (val2).x[i]) != (val2).x[i]) {	\
++		if (((val1).x[i] & (val2).x[i]) != (val3).x[i]) {	\
+ 			ret = 0;					\
+ 			break;						\
+ 		}							\
+diff --git a/include/linux/seqlock.h b/include/linux/seqlock.h
+index e0582106ef4fa..a10f363784178 100644
+--- a/include/linux/seqlock.h
++++ b/include/linux/seqlock.h
+@@ -242,6 +242,13 @@ static inline void raw_write_seqcount_end(seqcount_t *s)
+  * usual consistency guarantee. It is one wmb cheaper, because we can
+  * collapse the two back-to-back wmb()s.
+  *
++ * Note that, writes surrounding the barrier should be declared atomic (e.g.
++ * via WRITE_ONCE): a) to ensure the writes become visible to other threads
++ * atomically, avoiding compiler optimizations; b) to document which writes are
++ * meant to propagate to the reader critical section. This is necessary because
++ * neither writes before and after the barrier are enclosed in a seq-writer
++ * critical section that would ensure readers are aware of ongoing writes.
++ *
+  *      seqcount_t seq;
+  *      bool X = true, Y = false;
+  *
+@@ -261,11 +268,11 @@ static inline void raw_write_seqcount_end(seqcount_t *s)
+  *
+  *      void write(void)
+  *      {
+- *              Y = true;
++ *              WRITE_ONCE(Y, true);
+  *
+  *              raw_write_seqcount_barrier(seq);
+  *
+- *              X = false;
++ *              WRITE_ONCE(X, false);
+  *      }
+  */
+ static inline void raw_write_seqcount_barrier(seqcount_t *s)
+diff --git a/include/linux/skbuff.h b/include/linux/skbuff.h
+index 735ff1525f485..95feb153fe9a8 100644
+--- a/include/linux/skbuff.h
++++ b/include/linux/skbuff.h
+@@ -1438,6 +1438,18 @@ static inline __u32 skb_queue_len(const struct sk_buff_head *list_)
+ 	return list_->qlen;
+ }
+ 
++/**
++ *	skb_queue_len_lockless	- get queue length
++ *	@list_: list to measure
++ *
++ *	Return the length of an &sk_buff queue.
++ *	This variant can be used in lockless contexts.
++ */
++static inline __u32 skb_queue_len_lockless(const struct sk_buff_head *list_)
++{
++	return READ_ONCE(list_->qlen);
++}
++
+ /**
+  *	__skb_queue_head_init - initialize non-spinlock portions of sk_buff_head
+  *	@list: queue to initialize
+@@ -1641,7 +1653,7 @@ static inline void __skb_unlink(struct sk_buff *skb, struct sk_buff_head *list)
+ {
+ 	struct sk_buff *next, *prev;
+ 
+-	list->qlen--;
++	WRITE_ONCE(list->qlen, list->qlen - 1);
+ 	next	   = skb->next;
+ 	prev	   = skb->prev;
+ 	skb->next  = skb->prev = NULL;
+@@ -2651,7 +2663,7 @@ static inline int skb_padto(struct sk_buff *skb, unsigned int len)
+  *	is untouched. Otherwise it is extended. Returns zero on
+  *	success. The skb is freed on error.
+  */
+-static inline int skb_put_padto(struct sk_buff *skb, unsigned int len)
++static inline int __must_check skb_put_padto(struct sk_buff *skb, unsigned int len)
+ {
+ 	unsigned int size = skb->len;
+ 
+diff --git a/kernel/audit_watch.c b/kernel/audit_watch.c
+index f45a9a5d3e47a..af453f3c2b3dd 100644
+--- a/kernel/audit_watch.c
++++ b/kernel/audit_watch.c
+@@ -316,8 +316,6 @@ static void audit_update_watch(struct audit_parent *parent,
+ 			if (oentry->rule.exe)
+ 				audit_remove_mark(oentry->rule.exe);
+ 
+-			audit_watch_log_rule_change(r, owatch, "updated_rules");
+-
+ 			call_rcu(&oentry->rcu, audit_free_rule_rcu);
+ 		}
+ 
+diff --git a/kernel/kprobes.c b/kernel/kprobes.c
+index 9241a29a1f9de..33c37dbc56a05 100644
+--- a/kernel/kprobes.c
++++ b/kernel/kprobes.c
+@@ -2012,6 +2012,9 @@ static void kill_kprobe(struct kprobe *p)
+ {
+ 	struct kprobe *kp;
+ 
++	if (WARN_ON_ONCE(kprobe_gone(p)))
++		return;
++
+ 	p->flags |= KPROBE_FLAG_GONE;
+ 	if (kprobe_aggrprobe(p)) {
+ 		/*
+@@ -2032,9 +2035,10 @@ static void kill_kprobe(struct kprobe *p)
+ 
+ 	/*
+ 	 * The module is going away. We should disarm the kprobe which
+-	 * is using ftrace.
++	 * is using ftrace, because ftrace framework is still available at
++	 * MODULE_STATE_GOING notification.
+ 	 */
+-	if (kprobe_ftrace(p))
++	if (kprobe_ftrace(p) && !kprobe_disabled(p) && !kprobes_all_disarmed)
+ 		disarm_kprobe_ftrace(p);
+ }
+ 
+@@ -2154,7 +2158,10 @@ static int kprobes_module_callback(struct notifier_block *nb,
+ 	mutex_lock(&kprobe_mutex);
+ 	for (i = 0; i < KPROBE_TABLE_SIZE; i++) {
+ 		head = &kprobe_table[i];
+-		hlist_for_each_entry_rcu(p, head, hlist)
++		hlist_for_each_entry_rcu(p, head, hlist) {
++			if (kprobe_gone(p))
++				continue;
++
+ 			if (within_module_init((unsigned long)p->addr, mod) ||
+ 			    (checkcore &&
+ 			     within_module_core((unsigned long)p->addr, mod))) {
+@@ -2165,6 +2172,7 @@ static int kprobes_module_callback(struct notifier_block *nb,
+ 				 */
+ 				kill_kprobe(p);
+ 			}
++		}
+ 	}
+ 	mutex_unlock(&kprobe_mutex);
+ 	return NOTIFY_DONE;
+diff --git a/kernel/printk/printk.c b/kernel/printk/printk.c
+index e53a976ca28ea..b55dfb3e801f9 100644
+--- a/kernel/printk/printk.c
++++ b/kernel/printk/printk.c
+@@ -2032,6 +2032,9 @@ static int __init console_setup(char *str)
+ 	char *s, *options, *brl_options = NULL;
+ 	int idx;
+ 
++	if (str[0] == 0)
++		return 1;
++
+ 	if (_braille_console_setup(&str, &brl_options))
+ 		return 1;
+ 
+diff --git a/kernel/sys.c b/kernel/sys.c
+index 1855f1bf113e4..e98664039cb23 100644
+--- a/kernel/sys.c
++++ b/kernel/sys.c
+@@ -1183,11 +1183,13 @@ SYSCALL_DEFINE1(uname, struct old_utsname __user *, name)
+ 
+ SYSCALL_DEFINE1(olduname, struct oldold_utsname __user *, name)
+ {
+-	struct oldold_utsname tmp = {};
++	struct oldold_utsname tmp;
+ 
+ 	if (!name)
+ 		return -EFAULT;
+ 
++	memset(&tmp, 0, sizeof(tmp));
++
+ 	down_read(&uts_sem);
+ 	memcpy(&tmp.sysname, &utsname()->sysname, __OLD_UTS_LEN);
+ 	memcpy(&tmp.nodename, &utsname()->nodename, __OLD_UTS_LEN);
+diff --git a/kernel/trace/ftrace.c b/kernel/trace/ftrace.c
+index e4c6f89b6b11f..89ed01911a9a2 100644
+--- a/kernel/trace/ftrace.c
++++ b/kernel/trace/ftrace.c
+@@ -2823,8 +2823,11 @@ static int referenced_filters(struct dyn_ftrace *rec)
+ 	int cnt = 0;
+ 
+ 	for (ops = ftrace_ops_list; ops != &ftrace_list_end; ops = ops->next) {
+-		if (ops_references_rec(ops, rec))
+-		    cnt++;
++		if (ops_references_rec(ops, rec)) {
++			cnt++;
++			if (ops->flags & FTRACE_OPS_FL_SAVE_REGS)
++				rec->flags |= FTRACE_FL_REGS;
++		}
+ 	}
+ 
+ 	return cnt;
+@@ -2874,7 +2877,7 @@ static int ftrace_update_code(struct module *mod, struct ftrace_page *new_pgs)
+ 			p = &pg->records[i];
+ 			if (test)
+ 				cnt += referenced_filters(p);
+-			p->flags = cnt;
++			p->flags += cnt;
+ 
+ 			/*
+ 			 * Do the initial record conversion from mcount jump
+diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c
+index 06efd18bf3e38..e4a0c0308b507 100644
+--- a/kernel/trace/trace.c
++++ b/kernel/trace/trace.c
+@@ -2271,6 +2271,9 @@ int trace_array_printk(struct trace_array *tr,
+ 	if (!(global_trace.trace_flags & TRACE_ITER_PRINTK))
+ 		return 0;
+ 
++	if (!tr)
++		return -ENOENT;
++
+ 	va_start(ap, fmt);
+ 	ret = trace_array_vprintk(tr, ip, fmt, ap);
+ 	va_end(ap);
+@@ -7260,7 +7263,7 @@ __init static int tracer_alloc_buffers(void)
+ 		goto out_free_buffer_mask;
+ 
+ 	/* Only allocate trace_printk buffers if a trace_printk exists */
+-	if (__stop___trace_bprintk_fmt != __start___trace_bprintk_fmt)
++	if (&__stop___trace_bprintk_fmt != &__start___trace_bprintk_fmt)
+ 		/* Must be called before global_trace.buffer is allocated */
+ 		trace_printk_init_buffers();
+ 
+diff --git a/kernel/trace/trace_entries.h b/kernel/trace/trace_entries.h
+index ee7b94a4810af..246db27dbdc99 100644
+--- a/kernel/trace/trace_entries.h
++++ b/kernel/trace/trace_entries.h
+@@ -178,7 +178,7 @@ FTRACE_ENTRY(kernel_stack, stack_entry,
+ 
+ 	F_STRUCT(
+ 		__field(	int,		size	)
+-		__dynamic_array(unsigned long,	caller	)
++		__array(	unsigned long,	caller,	FTRACE_STACK_ENTRIES	)
+ 	),
+ 
+ 	F_printk("\t=> (" IP_FMT ")\n\t=> (" IP_FMT ")\n\t=> (" IP_FMT ")\n"
+diff --git a/kernel/trace/trace_events.c b/kernel/trace/trace_events.c
+index bd4c0bb61ad72..9d6e755d17546 100644
+--- a/kernel/trace/trace_events.c
++++ b/kernel/trace/trace_events.c
+@@ -755,6 +755,8 @@ static int ftrace_set_clr_event(struct trace_array *tr, char *buf, int set)
+ 	char *event = NULL, *sub = NULL, *match;
+ 	int ret;
+ 
++	if (!tr)
++		return -ENOENT;
+ 	/*
+ 	 * The buf format can be <subsystem>:<event-name>
+ 	 *  *:<event-name> means any event by that name.
+diff --git a/lib/string.c b/lib/string.c
+index c7cf65ac42ad7..c9983dc01e727 100644
+--- a/lib/string.c
++++ b/lib/string.c
+@@ -235,6 +235,30 @@ ssize_t strscpy(char *dest, const char *src, size_t count)
+ EXPORT_SYMBOL(strscpy);
+ #endif
+ 
++/**
++ * stpcpy - copy a string from src to dest returning a pointer to the new end
++ *          of dest, including src's %NUL-terminator. May overrun dest.
++ * @dest: pointer to end of string being copied into. Must be large enough
++ *        to receive copy.
++ * @src: pointer to the beginning of string being copied from. Must not overlap
++ *       dest.
++ *
++ * stpcpy differs from strcpy in a key way: the return value is a pointer
++ * to the new %NUL-terminating character in @dest. (For strcpy, the return
++ * value is a pointer to the start of @dest). This interface is considered
++ * unsafe as it doesn't perform bounds checking of the inputs. As such it's
++ * not recommended for usage. Instead, its definition is provided in case
++ * the compiler lowers other libcalls to stpcpy.
++ */
++char *stpcpy(char *__restrict__ dest, const char *__restrict__ src);
++char *stpcpy(char *__restrict__ dest, const char *__restrict__ src)
++{
++	while ((*dest++ = *src++) != '\0')
++		/* nothing */;
++	return --dest;
++}
++EXPORT_SYMBOL(stpcpy);
++
+ #ifndef __HAVE_ARCH_STRCAT
+ /**
+  * strcat - Append one %NUL-terminated string to another
+diff --git a/mm/filemap.c b/mm/filemap.c
+index f217120973ebe..3d0a0e409cbf5 100644
+--- a/mm/filemap.c
++++ b/mm/filemap.c
+@@ -2313,6 +2313,14 @@ filler:
+ 		unlock_page(page);
+ 		goto out;
+ 	}
++
++	/*
++	 * A previous I/O error may have been due to temporary
++	 * failures.
++	 * Clear page error before actual read, PG_error will be
++	 * set again if read page fails.
++	 */
++	ClearPageError(page);
+ 	goto filler;
+ 
+ out:
+diff --git a/mm/mmap.c b/mm/mmap.c
+index 135cccce41f88..d48a654cbd237 100644
+--- a/mm/mmap.c
++++ b/mm/mmap.c
+@@ -1993,6 +1993,7 @@ arch_get_unmapped_area(struct file *filp, unsigned long addr,
+ 	info.low_limit = mm->mmap_base;
+ 	info.high_limit = TASK_SIZE;
+ 	info.align_mask = 0;
++	info.align_offset = 0;
+ 	return vm_unmapped_area(&info);
+ }
+ #endif
+@@ -2034,6 +2035,7 @@ arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0,
+ 	info.low_limit = max(PAGE_SIZE, mmap_min_addr);
+ 	info.high_limit = mm->mmap_base;
+ 	info.align_mask = 0;
++	info.align_offset = 0;
+ 	addr = vm_unmapped_area(&info);
+ 
+ 	/*
+diff --git a/mm/pagewalk.c b/mm/pagewalk.c
+index c2cbd26201696..a024667a9c041 100644
+--- a/mm/pagewalk.c
++++ b/mm/pagewalk.c
+@@ -14,9 +14,9 @@ static int walk_pte_range(pmd_t *pmd, unsigned long addr, unsigned long end,
+ 		err = walk->pte_entry(pte, addr, addr + PAGE_SIZE, walk);
+ 		if (err)
+ 		       break;
+-		addr += PAGE_SIZE;
+-		if (addr == end)
++		if (addr >= end - PAGE_SIZE)
+ 			break;
++		addr += PAGE_SIZE;
+ 		pte++;
+ 	}
+ 
+diff --git a/net/atm/lec.c b/net/atm/lec.c
+index e4afac94ff158..a38680e194436 100644
+--- a/net/atm/lec.c
++++ b/net/atm/lec.c
+@@ -1290,6 +1290,12 @@ static void lec_arp_clear_vccs(struct lec_arp_table *entry)
+ 		entry->vcc = NULL;
+ 	}
+ 	if (entry->recv_vcc) {
++		struct atm_vcc *vcc = entry->recv_vcc;
++		struct lec_vcc_priv *vpriv = LEC_VCC_PRIV(vcc);
++
++		kfree(vpriv);
++		vcc->user_back = NULL;
++
+ 		entry->recv_vcc->push = entry->old_recv_push;
+ 		vcc_release_async(entry->recv_vcc, -EPIPE);
+ 		entry->recv_vcc = NULL;
+diff --git a/net/batman-adv/bridge_loop_avoidance.c b/net/batman-adv/bridge_loop_avoidance.c
+index 9aa5daa551273..1267cbb1a329a 100644
+--- a/net/batman-adv/bridge_loop_avoidance.c
++++ b/net/batman-adv/bridge_loop_avoidance.c
+@@ -73,11 +73,12 @@ static inline u32 batadv_choose_claim(const void *data, u32 size)
+ /* return the index of the backbone gateway */
+ static inline u32 batadv_choose_backbone_gw(const void *data, u32 size)
+ {
+-	const struct batadv_bla_claim *claim = (struct batadv_bla_claim *)data;
++	const struct batadv_bla_backbone_gw *gw;
+ 	u32 hash = 0;
+ 
+-	hash = jhash(&claim->addr, sizeof(claim->addr), hash);
+-	hash = jhash(&claim->vid, sizeof(claim->vid), hash);
++	gw = (struct batadv_bla_backbone_gw *)data;
++	hash = jhash(&gw->orig, sizeof(gw->orig), hash);
++	hash = jhash(&gw->vid, sizeof(gw->vid), hash);
+ 
+ 	return hash % size;
+ }
+diff --git a/net/batman-adv/routing.c b/net/batman-adv/routing.c
+index b3e8b0e3073c2..e470410abb44d 100644
+--- a/net/batman-adv/routing.c
++++ b/net/batman-adv/routing.c
+@@ -782,6 +782,10 @@ static int batadv_check_unicast_ttvn(struct batadv_priv *bat_priv,
+ 	vid = batadv_get_vid(skb, hdr_len);
+ 	ethhdr = (struct ethhdr *)(skb->data + hdr_len);
+ 
++	/* do not reroute multicast frames in a unicast header */
++	if (is_multicast_ether_addr(ethhdr->h_dest))
++		return true;
++
+ 	/* check if the destination client was served by this node and it is now
+ 	 * roaming. In this case, it means that the node has got a ROAM_ADV
+ 	 * message and that it knows the new destination in the mesh to re-route
+diff --git a/net/bluetooth/hci_event.c b/net/bluetooth/hci_event.c
+index 16cf5633eae3e..03319ab8a7c6e 100644
+--- a/net/bluetooth/hci_event.c
++++ b/net/bluetooth/hci_event.c
+@@ -41,12 +41,27 @@
+ 
+ /* Handle HCI Event packets */
+ 
+-static void hci_cc_inquiry_cancel(struct hci_dev *hdev, struct sk_buff *skb)
++static void hci_cc_inquiry_cancel(struct hci_dev *hdev, struct sk_buff *skb,
++				  u8 *new_status)
+ {
+ 	__u8 status = *((__u8 *) skb->data);
+ 
+ 	BT_DBG("%s status 0x%2.2x", hdev->name, status);
+ 
++	/* It is possible that we receive Inquiry Complete event right
++	 * before we receive Inquiry Cancel Command Complete event, in
++	 * which case the latter event should have status of Command
++	 * Disallowed (0x0c). This should not be treated as error, since
++	 * we actually achieve what Inquiry Cancel wants to achieve,
++	 * which is to end the last Inquiry session.
++	 */
++	if (status == 0x0c && !test_bit(HCI_INQUIRY, &hdev->flags)) {
++		bt_dev_warn(hdev, "Ignoring error of Inquiry Cancel command");
++		status = 0x00;
++	}
++
++	*new_status = status;
++
+ 	if (status)
+ 		return;
+ 
+@@ -2758,7 +2773,7 @@ static void hci_cmd_complete_evt(struct hci_dev *hdev, struct sk_buff *skb,
+ 
+ 	switch (*opcode) {
+ 	case HCI_OP_INQUIRY_CANCEL:
+-		hci_cc_inquiry_cancel(hdev, skb);
++		hci_cc_inquiry_cancel(hdev, skb, status);
+ 		break;
+ 
+ 	case HCI_OP_PERIODIC_INQ:
+@@ -5230,6 +5245,11 @@ void hci_event_packet(struct hci_dev *hdev, struct sk_buff *skb)
+ 	u8 status = 0, event = hdr->evt, req_evt = 0;
+ 	u16 opcode = HCI_OP_NOP;
+ 
++	if (!event) {
++		bt_dev_warn(hdev, "Received unexpected HCI Event 00000000");
++		goto done;
++	}
++
+ 	if (hdev->sent_cmd && bt_cb(hdev->sent_cmd)->hci.req_event == event) {
+ 		struct hci_command_hdr *cmd_hdr = (void *) hdev->sent_cmd->data;
+ 		opcode = __le16_to_cpu(cmd_hdr->opcode);
+@@ -5441,6 +5461,7 @@ void hci_event_packet(struct hci_dev *hdev, struct sk_buff *skb)
+ 		req_complete_skb(hdev, status, opcode, orig_skb);
+ 	}
+ 
++done:
+ 	kfree_skb(orig_skb);
+ 	kfree_skb(skb);
+ 	hdev->stat.evt_rx++;
+diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c
+index 0e31bbe1256cd..f2db50da8ce2e 100644
+--- a/net/bluetooth/l2cap_core.c
++++ b/net/bluetooth/l2cap_core.c
+@@ -403,6 +403,9 @@ static void l2cap_chan_timeout(struct work_struct *work)
+ 	BT_DBG("chan %p state %s", chan, state_to_string(chan->state));
+ 
+ 	mutex_lock(&conn->chan_lock);
++	/* __set_chan_timer() calls l2cap_chan_hold(chan) while scheduling
++	 * this work. No need to call l2cap_chan_hold(chan) here again.
++	 */
+ 	l2cap_chan_lock(chan);
+ 
+ 	if (chan->state == BT_CONNECTED || chan->state == BT_CONFIG)
+@@ -415,12 +418,12 @@ static void l2cap_chan_timeout(struct work_struct *work)
+ 
+ 	l2cap_chan_close(chan, reason);
+ 
+-	l2cap_chan_unlock(chan);
+-
+ 	chan->ops->close(chan);
+-	mutex_unlock(&conn->chan_lock);
+ 
++	l2cap_chan_unlock(chan);
+ 	l2cap_chan_put(chan);
++
++	mutex_unlock(&conn->chan_lock);
+ }
+ 
+ struct l2cap_chan *l2cap_chan_create(void)
+@@ -1714,9 +1717,9 @@ static void l2cap_conn_del(struct hci_conn *hcon, int err)
+ 
+ 		l2cap_chan_del(chan, err);
+ 
+-		l2cap_chan_unlock(chan);
+-
+ 		chan->ops->close(chan);
++
++		l2cap_chan_unlock(chan);
+ 		l2cap_chan_put(chan);
+ 	}
+ 
+@@ -4093,7 +4096,8 @@ static inline int l2cap_config_req(struct l2cap_conn *conn,
+ 		return 0;
+ 	}
+ 
+-	if (chan->state != BT_CONFIG && chan->state != BT_CONNECT2) {
++	if (chan->state != BT_CONFIG && chan->state != BT_CONNECT2 &&
++	    chan->state != BT_CONNECTED) {
+ 		cmd_reject_invalid_cid(conn, cmd->ident, chan->scid,
+ 				       chan->dcid);
+ 		goto unlock;
+@@ -4316,6 +4320,7 @@ static inline int l2cap_disconnect_req(struct l2cap_conn *conn,
+ 		return 0;
+ 	}
+ 
++	l2cap_chan_hold(chan);
+ 	l2cap_chan_lock(chan);
+ 
+ 	rsp.dcid = cpu_to_le16(chan->scid);
+@@ -4324,12 +4329,11 @@ static inline int l2cap_disconnect_req(struct l2cap_conn *conn,
+ 
+ 	chan->ops->set_shutdown(chan);
+ 
+-	l2cap_chan_hold(chan);
+ 	l2cap_chan_del(chan, ECONNRESET);
+ 
+-	l2cap_chan_unlock(chan);
+-
+ 	chan->ops->close(chan);
++
++	l2cap_chan_unlock(chan);
+ 	l2cap_chan_put(chan);
+ 
+ 	mutex_unlock(&conn->chan_lock);
+@@ -4361,20 +4365,21 @@ static inline int l2cap_disconnect_rsp(struct l2cap_conn *conn,
+ 		return 0;
+ 	}
+ 
++	l2cap_chan_hold(chan);
+ 	l2cap_chan_lock(chan);
+ 
+ 	if (chan->state != BT_DISCONN) {
+ 		l2cap_chan_unlock(chan);
++		l2cap_chan_put(chan);
+ 		mutex_unlock(&conn->chan_lock);
+ 		return 0;
+ 	}
+ 
+-	l2cap_chan_hold(chan);
+ 	l2cap_chan_del(chan, 0);
+ 
+-	l2cap_chan_unlock(chan);
+-
+ 	chan->ops->close(chan);
++
++	l2cap_chan_unlock(chan);
+ 	l2cap_chan_put(chan);
+ 
+ 	mutex_unlock(&conn->chan_lock);
+diff --git a/net/bluetooth/l2cap_sock.c b/net/bluetooth/l2cap_sock.c
+index d9bbbded49ef8..e562385d9440e 100644
+--- a/net/bluetooth/l2cap_sock.c
++++ b/net/bluetooth/l2cap_sock.c
+@@ -1038,7 +1038,7 @@ done:
+ }
+ 
+ /* Kill socket (only if zapped and orphan)
+- * Must be called on unlocked socket.
++ * Must be called on unlocked socket, with l2cap channel lock.
+  */
+ static void l2cap_sock_kill(struct sock *sk)
+ {
+@@ -1189,6 +1189,7 @@ static int l2cap_sock_release(struct socket *sock)
+ {
+ 	struct sock *sk = sock->sk;
+ 	int err;
++	struct l2cap_chan *chan;
+ 
+ 	BT_DBG("sock %p, sk %p", sock, sk);
+ 
+@@ -1198,9 +1199,17 @@ static int l2cap_sock_release(struct socket *sock)
+ 	bt_sock_unlink(&l2cap_sk_list, sk);
+ 
+ 	err = l2cap_sock_shutdown(sock, 2);
++	chan = l2cap_pi(sk)->chan;
++
++	l2cap_chan_hold(chan);
++	l2cap_chan_lock(chan);
+ 
+ 	sock_orphan(sk);
+ 	l2cap_sock_kill(sk);
++
++	l2cap_chan_unlock(chan);
++	l2cap_chan_put(chan);
++
+ 	return err;
+ }
+ 
+@@ -1218,12 +1227,15 @@ static void l2cap_sock_cleanup_listen(struct sock *parent)
+ 		BT_DBG("child chan %p state %s", chan,
+ 		       state_to_string(chan->state));
+ 
++		l2cap_chan_hold(chan);
+ 		l2cap_chan_lock(chan);
++
+ 		__clear_chan_timer(chan);
+ 		l2cap_chan_close(chan, ECONNRESET);
+-		l2cap_chan_unlock(chan);
+-
+ 		l2cap_sock_kill(sk);
++
++		l2cap_chan_unlock(chan);
++		l2cap_chan_put(chan);
+ 	}
+ }
+ 
+diff --git a/net/core/neighbour.c b/net/core/neighbour.c
+index 9849f1f4cf4f7..40d33431bc585 100644
+--- a/net/core/neighbour.c
++++ b/net/core/neighbour.c
+@@ -2798,6 +2798,7 @@ static void *neigh_stat_seq_next(struct seq_file *seq, void *v, loff_t *pos)
+ 		*pos = cpu+1;
+ 		return per_cpu_ptr(tbl->stats, cpu);
+ 	}
++	(*pos)++;
+ 	return NULL;
+ }
+ 
+diff --git a/net/ipv4/ip_output.c b/net/ipv4/ip_output.c
+index d940c9e0eb024..0355f125d8361 100644
+--- a/net/ipv4/ip_output.c
++++ b/net/ipv4/ip_output.c
+@@ -73,6 +73,7 @@
+ #include <net/icmp.h>
+ #include <net/checksum.h>
+ #include <net/inetpeer.h>
++#include <net/inet_ecn.h>
+ #include <linux/igmp.h>
+ #include <linux/netfilter_ipv4.h>
+ #include <linux/netfilter_bridge.h>
+@@ -1597,7 +1598,7 @@ void ip_send_unicast_reply(struct sock *sk, struct sk_buff *skb,
+ 	if (IS_ERR(rt))
+ 		return;
+ 
+-	inet_sk(sk)->tos = arg->tos;
++	inet_sk(sk)->tos = arg->tos & ~INET_ECN_MASK;
+ 
+ 	sk->sk_priority = skb->priority;
+ 	sk->sk_protocol = ip_hdr(skb)->protocol;
+diff --git a/net/ipv4/route.c b/net/ipv4/route.c
+index 542f6e0f438f1..ea1c319100a5d 100644
+--- a/net/ipv4/route.c
++++ b/net/ipv4/route.c
+@@ -271,6 +271,7 @@ static void *rt_cpu_seq_next(struct seq_file *seq, void *v, loff_t *pos)
+ 		*pos = cpu+1;
+ 		return &per_cpu(rt_cache_stat, cpu);
+ 	}
++	(*pos)++;
+ 	return NULL;
+ 
+ }
+diff --git a/net/key/af_key.c b/net/key/af_key.c
+index d2ec620319d76..76a008b1cbe5f 100644
+--- a/net/key/af_key.c
++++ b/net/key/af_key.c
+@@ -1873,6 +1873,13 @@ static int pfkey_dump(struct sock *sk, struct sk_buff *skb, const struct sadb_ms
+ 	if (ext_hdrs[SADB_X_EXT_FILTER - 1]) {
+ 		struct sadb_x_filter *xfilter = ext_hdrs[SADB_X_EXT_FILTER - 1];
+ 
++		if ((xfilter->sadb_x_filter_splen >=
++			(sizeof(xfrm_address_t) << 3)) ||
++		    (xfilter->sadb_x_filter_dplen >=
++			(sizeof(xfrm_address_t) << 3))) {
++			mutex_unlock(&pfk->dump_lock);
++			return -EINVAL;
++		}
+ 		filter = kmalloc(sizeof(*filter), GFP_KERNEL);
+ 		if (filter == NULL) {
+ 			mutex_unlock(&pfk->dump_lock);
+diff --git a/net/sunrpc/svc_xprt.c b/net/sunrpc/svc_xprt.c
+index 2b8e80c721db1..a7cd031656801 100644
+--- a/net/sunrpc/svc_xprt.c
++++ b/net/sunrpc/svc_xprt.c
+@@ -97,8 +97,17 @@ void svc_unreg_xprt_class(struct svc_xprt_class *xcl)
+ }
+ EXPORT_SYMBOL_GPL(svc_unreg_xprt_class);
+ 
+-/*
+- * Format the transport list for printing
++/**
++ * svc_print_xprts - Format the transport list for printing
++ * @buf: target buffer for formatted address
++ * @maxlen: length of target buffer
++ *
++ * Fills in @buf with a string containing a list of transport names, each name
++ * terminated with '\n'. If the buffer is too small, some entries may be
++ * missing, but it is guaranteed that all lines in the output buffer are
++ * complete.
++ *
++ * Returns positive length of the filled-in string.
+  */
+ int svc_print_xprts(char *buf, int maxlen)
+ {
+@@ -111,9 +120,9 @@ int svc_print_xprts(char *buf, int maxlen)
+ 	list_for_each_entry(xcl, &svc_xprt_class_list, xcl_list) {
+ 		int slen;
+ 
+-		sprintf(tmpstr, "%s %d\n", xcl->xcl_name, xcl->xcl_max_payload);
+-		slen = strlen(tmpstr);
+-		if (len + slen > maxlen)
++		slen = snprintf(tmpstr, sizeof(tmpstr), "%s %d\n",
++				xcl->xcl_name, xcl->xcl_max_payload);
++		if (slen >= sizeof(tmpstr) || len + slen >= maxlen)
+ 			break;
+ 		len += slen;
+ 		strcat(buf, tmpstr);
+diff --git a/net/tipc/msg.c b/net/tipc/msg.c
+index 67bddcb2ff466..fc1aa8bcb185d 100644
+--- a/net/tipc/msg.c
++++ b/net/tipc/msg.c
+@@ -138,7 +138,8 @@ int tipc_buf_append(struct sk_buff **headbuf, struct sk_buff **buf)
+ 	if (fragid == FIRST_FRAGMENT) {
+ 		if (unlikely(head))
+ 			goto err;
+-		if (unlikely(skb_unclone(frag, GFP_ATOMIC)))
++		frag = skb_unshare(frag, GFP_ATOMIC);
++		if (unlikely(!frag))
+ 			goto err;
+ 		head = *headbuf = frag;
+ 		*buf = NULL;
+diff --git a/net/unix/af_unix.c b/net/unix/af_unix.c
+index b5e2ef242efe7..ac78c5ac82846 100644
+--- a/net/unix/af_unix.c
++++ b/net/unix/af_unix.c
+@@ -191,11 +191,17 @@ static inline int unix_may_send(struct sock *sk, struct sock *osk)
+ 	return unix_peer(osk) == NULL || unix_our_peer(sk, osk);
+ }
+ 
+-static inline int unix_recvq_full(struct sock const *sk)
++static inline int unix_recvq_full(const struct sock *sk)
+ {
+ 	return skb_queue_len(&sk->sk_receive_queue) > sk->sk_max_ack_backlog;
+ }
+ 
++static inline int unix_recvq_full_lockless(const struct sock *sk)
++{
++	return skb_queue_len_lockless(&sk->sk_receive_queue) >
++		READ_ONCE(sk->sk_max_ack_backlog);
++}
++
+ struct sock *unix_peer_get(struct sock *s)
+ {
+ 	struct sock *peer;
+@@ -1792,7 +1798,8 @@ restart_locked:
+ 	 * - unix_peer(sk) == sk by time of get but disconnected before lock
+ 	 */
+ 	if (other != sk &&
+-	    unlikely(unix_peer(other) != sk && unix_recvq_full(other))) {
++	    unlikely(unix_peer(other) != sk &&
++	    unix_recvq_full_lockless(other))) {
+ 		if (timeo) {
+ 			timeo = unix_wait_for_peer(other, timeo);
+ 
+diff --git a/security/selinux/selinuxfs.c b/security/selinux/selinuxfs.c
+index c02da25d7b631..7778e28cce9d7 100644
+--- a/security/selinux/selinuxfs.c
++++ b/security/selinux/selinuxfs.c
+@@ -1370,6 +1370,7 @@ static struct avc_cache_stats *sel_avc_get_stat_idx(loff_t *idx)
+ 		*idx = cpu + 1;
+ 		return &per_cpu(avc_cache_stats, cpu);
+ 	}
++	(*idx)++;
+ 	return NULL;
+ }
+ 
+diff --git a/sound/hda/hdac_bus.c b/sound/hda/hdac_bus.c
+index 0e81ea89a5965..e3f68a76d90eb 100644
+--- a/sound/hda/hdac_bus.c
++++ b/sound/hda/hdac_bus.c
+@@ -155,6 +155,7 @@ static void process_unsol_events(struct work_struct *work)
+ 	struct hdac_driver *drv;
+ 	unsigned int rp, caddr, res;
+ 
++	spin_lock_irq(&bus->reg_lock);
+ 	while (bus->unsol_rp != bus->unsol_wp) {
+ 		rp = (bus->unsol_rp + 1) % HDA_UNSOL_QUEUE_SIZE;
+ 		bus->unsol_rp = rp;
+@@ -166,10 +167,13 @@ static void process_unsol_events(struct work_struct *work)
+ 		codec = bus->caddr_tbl[caddr & 0x0f];
+ 		if (!codec || !codec->dev.driver)
+ 			continue;
++		spin_unlock_irq(&bus->reg_lock);
+ 		drv = drv_to_hdac_driver(codec->dev.driver);
+ 		if (drv->unsol_event)
+ 			drv->unsol_event(codec, res);
++		spin_lock_irq(&bus->reg_lock);
+ 	}
++	spin_unlock_irq(&bus->reg_lock);
+ }
+ 
+ /**
+diff --git a/sound/pci/asihpi/hpioctl.c b/sound/pci/asihpi/hpioctl.c
+index 7a32abbe0cef8..4bdcb7443b1f5 100644
+--- a/sound/pci/asihpi/hpioctl.c
++++ b/sound/pci/asihpi/hpioctl.c
+@@ -346,7 +346,7 @@ int asihpi_adapter_probe(struct pci_dev *pci_dev,
+ 	struct hpi_message hm;
+ 	struct hpi_response hr;
+ 	struct hpi_adapter adapter;
+-	struct hpi_pci pci;
++	struct hpi_pci pci = { 0 };
+ 
+ 	memset(&adapter, 0, sizeof(adapter));
+ 
+@@ -502,7 +502,7 @@ int asihpi_adapter_probe(struct pci_dev *pci_dev,
+ 	return 0;
+ 
+ err:
+-	for (idx = 0; idx < HPI_MAX_ADAPTER_MEM_SPACES; idx++) {
++	while (--idx >= 0) {
+ 		if (pci.ap_mem_base[idx]) {
+ 			iounmap(pci.ap_mem_base[idx]);
+ 			pci.ap_mem_base[idx] = NULL;
+diff --git a/sound/soc/kirkwood/kirkwood-dma.c b/sound/soc/kirkwood/kirkwood-dma.c
+index dbfdfe99c69df..231c7d97333c7 100644
+--- a/sound/soc/kirkwood/kirkwood-dma.c
++++ b/sound/soc/kirkwood/kirkwood-dma.c
+@@ -136,7 +136,7 @@ static int kirkwood_dma_open(struct snd_pcm_substream *substream)
+ 		err = request_irq(priv->irq, kirkwood_dma_irq, IRQF_SHARED,
+ 				  "kirkwood-i2s", priv);
+ 		if (err)
+-			return -EBUSY;
++			return err;
+ 
+ 		/*
+ 		 * Enable Error interrupts. We're only ack'ing them but
+diff --git a/sound/usb/midi.c b/sound/usb/midi.c
+index 5c4a3d6c42341..934540042bc2e 100644
+--- a/sound/usb/midi.c
++++ b/sound/usb/midi.c
+@@ -1803,6 +1803,28 @@ static int snd_usbmidi_create_endpoints(struct snd_usb_midi *umidi,
+ 	return 0;
+ }
+ 
++static struct usb_ms_endpoint_descriptor *find_usb_ms_endpoint_descriptor(
++					struct usb_host_endpoint *hostep)
++{
++	unsigned char *extra = hostep->extra;
++	int extralen = hostep->extralen;
++
++	while (extralen > 3) {
++		struct usb_ms_endpoint_descriptor *ms_ep =
++				(struct usb_ms_endpoint_descriptor *)extra;
++
++		if (ms_ep->bLength > 3 &&
++		    ms_ep->bDescriptorType == USB_DT_CS_ENDPOINT &&
++		    ms_ep->bDescriptorSubtype == UAC_MS_GENERAL)
++			return ms_ep;
++		if (!extra[0])
++			break;
++		extralen -= extra[0];
++		extra += extra[0];
++	}
++	return NULL;
++}
++
+ /*
+  * Returns MIDIStreaming device capabilities.
+  */
+@@ -1840,11 +1862,8 @@ static int snd_usbmidi_get_ms_info(struct snd_usb_midi *umidi,
+ 		ep = get_ep_desc(hostep);
+ 		if (!usb_endpoint_xfer_bulk(ep) && !usb_endpoint_xfer_int(ep))
+ 			continue;
+-		ms_ep = (struct usb_ms_endpoint_descriptor *)hostep->extra;
+-		if (hostep->extralen < 4 ||
+-		    ms_ep->bLength < 4 ||
+-		    ms_ep->bDescriptorType != USB_DT_CS_ENDPOINT ||
+-		    ms_ep->bDescriptorSubtype != UAC_MS_GENERAL)
++		ms_ep = find_usb_ms_endpoint_descriptor(hostep);
++		if (!ms_ep)
+ 			continue;
+ 		if (usb_endpoint_dir_out(ep)) {
+ 			if (endpoints[epidx].out_ep) {
+diff --git a/tools/perf/util/symbol-elf.c b/tools/perf/util/symbol-elf.c
+index 2070c02de3af5..ea55cb6b614f4 100644
+--- a/tools/perf/util/symbol-elf.c
++++ b/tools/perf/util/symbol-elf.c
+@@ -1390,6 +1390,7 @@ struct kcore_copy_info {
+ 	u64 first_symbol;
+ 	u64 last_symbol;
+ 	u64 first_module;
++	u64 first_module_symbol;
+ 	u64 last_module_symbol;
+ 	struct phdr_data kernel_map;
+ 	struct phdr_data modules_map;
+@@ -1404,6 +1405,8 @@ static int kcore_copy__process_kallsyms(void *arg, const char *name, char type,
+ 		return 0;
+ 
+ 	if (strchr(name, '[')) {
++		if (!kci->first_module_symbol || start < kci->first_module_symbol)
++			kci->first_module_symbol = start;
+ 		if (start > kci->last_module_symbol)
+ 			kci->last_module_symbol = start;
+ 		return 0;
+@@ -1528,6 +1531,10 @@ static int kcore_copy__calc_maps(struct kcore_copy_info *kci, const char *dir,
+ 		kci->etext += page_size;
+ 	}
+ 
++	if (kci->first_module_symbol &&
++	    (!kci->first_module || kci->first_module_symbol < kci->first_module))
++		kci->first_module = kci->first_module_symbol;
++
+ 	kci->first_module = round_down(kci->first_module, page_size);
+ 
+ 	if (kci->last_module_symbol) {
+diff --git a/virt/kvm/kvm_main.c b/virt/kvm/kvm_main.c
+index 82f3a9d78cab4..ba8e8840b94b2 100644
+--- a/virt/kvm/kvm_main.c
++++ b/virt/kvm/kvm_main.c
+@@ -3392,7 +3392,7 @@ int kvm_io_bus_register_dev(struct kvm *kvm, enum kvm_bus bus_idx, gpa_t addr,
+ void kvm_io_bus_unregister_dev(struct kvm *kvm, enum kvm_bus bus_idx,
+ 			       struct kvm_io_device *dev)
+ {
+-	int i;
++	int i, j;
+ 	struct kvm_io_bus *new_bus, *bus;
+ 
+ 	bus = kvm->buses[bus_idx];
+@@ -3409,17 +3409,20 @@ void kvm_io_bus_unregister_dev(struct kvm *kvm, enum kvm_bus bus_idx,
+ 
+ 	new_bus = kmalloc(sizeof(*bus) + ((bus->dev_count - 1) *
+ 			  sizeof(struct kvm_io_range)), GFP_KERNEL);
+-	if (!new_bus)  {
++	if (new_bus) {
++		memcpy(new_bus, bus, sizeof(*bus) + i * sizeof(struct kvm_io_range));
++		new_bus->dev_count--;
++		memcpy(new_bus->range + i, bus->range + i + 1,
++		       (new_bus->dev_count - i) * sizeof(struct kvm_io_range));
++	} else {
+ 		pr_err("kvm: failed to shrink bus, removing it completely\n");
+-		goto broken;
++		for (j = 0; j < bus->dev_count; j++) {
++			if (j == i)
++				continue;
++			kvm_iodevice_destructor(bus->range[j].dev);
++		}
+ 	}
+ 
+-	memcpy(new_bus, bus, sizeof(*bus) + i * sizeof(struct kvm_io_range));
+-	new_bus->dev_count--;
+-	memcpy(new_bus->range + i, bus->range + i + 1,
+-	       (new_bus->dev_count - i) * sizeof(struct kvm_io_range));
+-
+-broken:
+ 	rcu_assign_pointer(kvm->buses[bus_idx], new_bus);
+ 	synchronize_srcu_expedited(&kvm->srcu);
+ 	kfree(bus);