[gentoo-commits] proj/linux-patches:4.4 commit in: /

["Mike Pagano" <mpagano@gentoo.org>]

commit:     6fb03f397f78fad471aade8559321d1ad9728055
Author:     Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Sun Oct  8 14:25:16 2017 +0000
Commit:     Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Sun Oct  8 14:25:16 2017 +0000
URL:        https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=6fb03f39

Linux patch 4.4.91

 0000_README             |    4 +
 1090_linux-4.4.91.patch | 2284 +++++++++++++++++++++++++++++++++++++++++++++++
 2 files changed, 2288 insertions(+)

diff --git a/0000_README b/0000_README
index fb5ca42..dc17474 100644
--- a/0000_README
+++ b/0000_README
@@ -403,6 +403,10 @@ Patch:  1089_linux-4.4.90.patch
 From:   http://www.kernel.org
 Desc:   Linux 4.4.90
 
+Patch:  1090_linux-4.4.91.patch
+From:   http://www.kernel.org
+Desc:   Linux 4.4.91
+
 Patch:  1500_XATTR_USER_PREFIX.patch
 From:   https://bugs.gentoo.org/show_bug.cgi?id=470644
 Desc:   Support for namespace user.pax.* on tmpfs.

diff --git a/1090_linux-4.4.91.patch b/1090_linux-4.4.91.patch
new file mode 100644
index 0000000..65a73f3
--- /dev/null
+++ b/1090_linux-4.4.91.patch
@@ -0,0 +1,2284 @@
+diff --git a/Documentation/devicetree/bindings/display/bridge/ti,ths8135.txt b/Documentation/devicetree/bindings/display/bridge/ti,ths8135.txt
+new file mode 100644
+index 000000000000..6ec1a880ac18
+--- /dev/null
++++ b/Documentation/devicetree/bindings/display/bridge/ti,ths8135.txt
+@@ -0,0 +1,46 @@
++THS8135 Video DAC
++-----------------
++
++This is the binding for Texas Instruments THS8135 Video DAC bridge.
++
++Required properties:
++
++- compatible: Must be "ti,ths8135"
++
++Required nodes:
++
++This device has two video ports. Their connections are modelled using the OF
++graph bindings specified in Documentation/devicetree/bindings/graph.txt.
++
++- Video port 0 for RGB input
++- Video port 1 for VGA output
++
++Example
++-------
++
++vga-bridge {
++	compatible = "ti,ths8135";
++	#address-cells = <1>;
++	#size-cells = <0>;
++
++	ports {
++		#address-cells = <1>;
++		#size-cells = <0>;
++
++		port@0 {
++			reg = <0>;
++
++			vga_bridge_in: endpoint {
++				remote-endpoint = <&lcdc_out_vga>;
++			};
++		};
++
++		port@1 {
++			reg = <1>;
++
++			vga_bridge_out: endpoint {
++				remote-endpoint = <&vga_con_in>;
++			};
++		};
++	};
++};
+diff --git a/Documentation/devicetree/bindings/iio/adc/avia-hx711.txt b/Documentation/devicetree/bindings/iio/adc/avia-hx711.txt
+new file mode 100644
+index 000000000000..b3629405f568
+--- /dev/null
++++ b/Documentation/devicetree/bindings/iio/adc/avia-hx711.txt
+@@ -0,0 +1,18 @@
++* AVIA HX711 ADC chip for weight cells
++  Bit-banging driver
++
++Required properties:
++ - compatible:	Should be "avia,hx711"
++ - sck-gpios:	Definition of the GPIO for the clock
++ - dout-gpios:	Definition of the GPIO for data-out
++		See Documentation/devicetree/bindings/gpio/gpio.txt
++ - avdd-supply:	Definition of the regulator used as analog supply
++
++Example:
++weight@0 {
++	compatible = "avia,hx711";
++	sck-gpios = <&gpio3 10 GPIO_ACTIVE_HIGH>;
++	dout-gpios = <&gpio0 7 GPIO_ACTIVE_HIGH>;
++	avdd-suppy = <&avdd>;
++};
++
+diff --git a/Documentation/devicetree/bindings/vendor-prefixes.txt b/Documentation/devicetree/bindings/vendor-prefixes.txt
+index 55df1d444e9f..98dc17507a84 100644
+--- a/Documentation/devicetree/bindings/vendor-prefixes.txt
++++ b/Documentation/devicetree/bindings/vendor-prefixes.txt
+@@ -31,6 +31,7 @@ asahi-kasei	Asahi Kasei Corp.
+ atmel	Atmel Corporation
+ auo	AU Optronics Corporation
+ avago	Avago Technologies
++avia	avia semiconductor
+ avic	Shanghai AVIC Optoelectronics Co., Ltd.
+ axis	Axis Communications AB
+ bosch	Bosch Sensortec GmbH
+diff --git a/Makefile b/Makefile
+index ca5aaaf4aef7..c1db50ef7fb5 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,6 +1,6 @@
+ VERSION = 4
+ PATCHLEVEL = 4
+-SUBLEVEL = 90
++SUBLEVEL = 91
+ EXTRAVERSION =
+ NAME = Blurry Fish Butt
+ 
+diff --git a/arch/arm/Kconfig-nommu b/arch/arm/Kconfig-nommu
+index aed66d5df7f1..b7576349528c 100644
+--- a/arch/arm/Kconfig-nommu
++++ b/arch/arm/Kconfig-nommu
+@@ -34,8 +34,7 @@ config PROCESSOR_ID
+ 	  used instead of the auto-probing which utilizes the register.
+ 
+ config REMAP_VECTORS_TO_RAM
+-	bool 'Install vectors to the beginning of RAM' if DRAM_BASE
+-	depends on DRAM_BASE
++	bool 'Install vectors to the beginning of RAM'
+ 	help
+ 	  The kernel needs to change the hardware exception vectors.
+ 	  In nommu mode, the hardware exception vectors are normally
+diff --git a/arch/arm/boot/dts/r8a7790.dtsi b/arch/arm/boot/dts/r8a7790.dtsi
+index e07ae5d45e19..7b39d8fae61e 100644
+--- a/arch/arm/boot/dts/r8a7790.dtsi
++++ b/arch/arm/boot/dts/r8a7790.dtsi
+@@ -1409,7 +1409,8 @@
+ 	};
+ 
+ 	msiof0: spi@e6e20000 {
+-		compatible = "renesas,msiof-r8a7790";
++		compatible = "renesas,msiof-r8a7790",
++			     "renesas,rcar-gen2-msiof";
+ 		reg = <0 0xe6e20000 0 0x0064>;
+ 		interrupts = <0 156 IRQ_TYPE_LEVEL_HIGH>;
+ 		clocks = <&mstp0_clks R8A7790_CLK_MSIOF0>;
+@@ -1422,7 +1423,8 @@
+ 	};
+ 
+ 	msiof1: spi@e6e10000 {
+-		compatible = "renesas,msiof-r8a7790";
++		compatible = "renesas,msiof-r8a7790",
++			     "renesas,rcar-gen2-msiof";
+ 		reg = <0 0xe6e10000 0 0x0064>;
+ 		interrupts = <0 157 IRQ_TYPE_LEVEL_HIGH>;
+ 		clocks = <&mstp2_clks R8A7790_CLK_MSIOF1>;
+@@ -1435,7 +1437,8 @@
+ 	};
+ 
+ 	msiof2: spi@e6e00000 {
+-		compatible = "renesas,msiof-r8a7790";
++		compatible = "renesas,msiof-r8a7790",
++			     "renesas,rcar-gen2-msiof";
+ 		reg = <0 0xe6e00000 0 0x0064>;
+ 		interrupts = <0 158 IRQ_TYPE_LEVEL_HIGH>;
+ 		clocks = <&mstp2_clks R8A7790_CLK_MSIOF2>;
+@@ -1448,7 +1451,8 @@
+ 	};
+ 
+ 	msiof3: spi@e6c90000 {
+-		compatible = "renesas,msiof-r8a7790";
++		compatible = "renesas,msiof-r8a7790",
++			     "renesas,rcar-gen2-msiof";
+ 		reg = <0 0xe6c90000 0 0x0064>;
+ 		interrupts = <0 159 IRQ_TYPE_LEVEL_HIGH>;
+ 		clocks = <&mstp2_clks R8A7790_CLK_MSIOF3>;
+diff --git a/arch/arm/mach-at91/pm.c b/arch/arm/mach-at91/pm.c
+index d687f860a2da..84eefbc2b4f9 100644
+--- a/arch/arm/mach-at91/pm.c
++++ b/arch/arm/mach-at91/pm.c
+@@ -332,7 +332,7 @@ static void at91sam9_sdram_standby(void)
+ 		at91_ramc_write(1, AT91_SDRAMC_LPR, saved_lpr1);
+ }
+ 
+-static const struct of_device_id const ramc_ids[] __initconst = {
++static const struct of_device_id ramc_ids[] __initconst = {
+ 	{ .compatible = "atmel,at91rm9200-sdramc", .data = at91rm9200_standby },
+ 	{ .compatible = "atmel,at91sam9260-sdramc", .data = at91sam9_sdram_standby },
+ 	{ .compatible = "atmel,at91sam9g45-ddramc", .data = at91_ddr_standby },
+diff --git a/arch/arm/mach-bcm/bcm_kona_smc.c b/arch/arm/mach-bcm/bcm_kona_smc.c
+index cf3f8658f0e5..a55a7ecf146a 100644
+--- a/arch/arm/mach-bcm/bcm_kona_smc.c
++++ b/arch/arm/mach-bcm/bcm_kona_smc.c
+@@ -33,7 +33,7 @@ struct bcm_kona_smc_data {
+ 	unsigned result;
+ };
+ 
+-static const struct of_device_id const bcm_kona_smc_ids[] __initconst = {
++static const struct of_device_id bcm_kona_smc_ids[] __initconst = {
+ 	{.compatible = "brcm,kona-smc"},
+ 	{.compatible = "bcm,kona-smc"}, /* deprecated name */
+ 	{},
+diff --git a/arch/arm/mach-cns3xxx/core.c b/arch/arm/mach-cns3xxx/core.c
+index 9b1dc223d8d3..e17a0e025f62 100644
+--- a/arch/arm/mach-cns3xxx/core.c
++++ b/arch/arm/mach-cns3xxx/core.c
+@@ -346,7 +346,7 @@ static struct usb_ohci_pdata cns3xxx_usb_ohci_pdata = {
+ 	.power_off	= csn3xxx_usb_power_off,
+ };
+ 
+-static const struct of_dev_auxdata const cns3xxx_auxdata[] __initconst = {
++static const struct of_dev_auxdata cns3xxx_auxdata[] __initconst = {
+ 	{ "intel,usb-ehci", CNS3XXX_USB_BASE, "ehci-platform", &cns3xxx_usb_ehci_pdata },
+ 	{ "intel,usb-ohci", CNS3XXX_USB_OHCI_BASE, "ohci-platform", &cns3xxx_usb_ohci_pdata },
+ 	{ "cavium,cns3420-ahci", CNS3XXX_SATA2_BASE, "ahci", NULL },
+diff --git a/arch/arm/mach-omap2/prm_common.c b/arch/arm/mach-omap2/prm_common.c
+index 3fc2cbe52113..0ce4548ef7f0 100644
+--- a/arch/arm/mach-omap2/prm_common.c
++++ b/arch/arm/mach-omap2/prm_common.c
+@@ -706,7 +706,7 @@ static struct omap_prcm_init_data scrm_data __initdata = {
+ };
+ #endif
+ 
+-static const struct of_device_id const omap_prcm_dt_match_table[] __initconst = {
++static const struct of_device_id omap_prcm_dt_match_table[] __initconst = {
+ #ifdef CONFIG_SOC_AM33XX
+ 	{ .compatible = "ti,am3-prcm", .data = &am3_prm_data },
+ #endif
+diff --git a/arch/arm/mach-omap2/vc.c b/arch/arm/mach-omap2/vc.c
+index 2028167fff31..d76b1e5eb8ba 100644
+--- a/arch/arm/mach-omap2/vc.c
++++ b/arch/arm/mach-omap2/vc.c
+@@ -559,7 +559,7 @@ struct i2c_init_data {
+ 	u8 hsscll_12;
+ };
+ 
+-static const struct i2c_init_data const omap4_i2c_timing_data[] __initconst = {
++static const struct i2c_init_data omap4_i2c_timing_data[] __initconst = {
+ 	{
+ 		.load = 50,
+ 		.loadbits = 0x3,
+diff --git a/arch/arm/mach-spear/time.c b/arch/arm/mach-spear/time.c
+index 9ccffc1d0f28..aaaa6781b9fe 100644
+--- a/arch/arm/mach-spear/time.c
++++ b/arch/arm/mach-spear/time.c
+@@ -204,7 +204,7 @@ static void __init spear_clockevent_init(int irq)
+ 	setup_irq(irq, &spear_timer_irq);
+ }
+ 
+-static const struct of_device_id const timer_of_match[] __initconst = {
++static const struct of_device_id timer_of_match[] __initconst = {
+ 	{ .compatible = "st,spear-timer", },
+ 	{ },
+ };
+diff --git a/arch/mips/include/asm/irq.h b/arch/mips/include/asm/irq.h
+index ebb9efb02502..77edb22f855d 100644
+--- a/arch/mips/include/asm/irq.h
++++ b/arch/mips/include/asm/irq.h
+@@ -18,9 +18,24 @@
+ #include <irq.h>
+ 
+ #define IRQ_STACK_SIZE			THREAD_SIZE
++#define IRQ_STACK_START			(IRQ_STACK_SIZE - sizeof(unsigned long))
+ 
+ extern void *irq_stack[NR_CPUS];
+ 
++/*
++ * The highest address on the IRQ stack contains a dummy frame put down in
++ * genex.S (handle_int & except_vec_vi_handler) which is structured as follows:
++ *
++ *   top ------------
++ *       | task sp  | <- irq_stack[cpu] + IRQ_STACK_START
++ *       ------------
++ *       |          | <- First frame of IRQ context
++ *       ------------
++ *
++ * task sp holds a copy of the task stack pointer where the struct pt_regs
++ * from exception entry can be found.
++ */
++
+ static inline bool on_irq_stack(int cpu, unsigned long sp)
+ {
+ 	unsigned long low = (unsigned long)irq_stack[cpu];
+diff --git a/arch/mips/kernel/asm-offsets.c b/arch/mips/kernel/asm-offsets.c
+index ec053ce7bb38..7ab8004c1659 100644
+--- a/arch/mips/kernel/asm-offsets.c
++++ b/arch/mips/kernel/asm-offsets.c
+@@ -102,6 +102,7 @@ void output_thread_info_defines(void)
+ 	DEFINE(_THREAD_SIZE, THREAD_SIZE);
+ 	DEFINE(_THREAD_MASK, THREAD_MASK);
+ 	DEFINE(_IRQ_STACK_SIZE, IRQ_STACK_SIZE);
++	DEFINE(_IRQ_STACK_START, IRQ_STACK_START);
+ 	BLANK();
+ }
+ 
+diff --git a/arch/mips/kernel/genex.S b/arch/mips/kernel/genex.S
+index 619e30e2c4f0..bb72f3ce7e29 100644
+--- a/arch/mips/kernel/genex.S
++++ b/arch/mips/kernel/genex.S
+@@ -216,9 +216,11 @@ NESTED(handle_int, PT_SIZE, sp)
+ 	beq	t0, t1, 2f
+ 
+ 	/* Switch to IRQ stack */
+-	li	t1, _IRQ_STACK_SIZE
++	li	t1, _IRQ_STACK_START
+ 	PTR_ADD sp, t0, t1
+ 
++	/* Save task's sp on IRQ stack so that unwinding can follow it */
++	LONG_S	s1, 0(sp)
+ 2:
+ 	jal	plat_irq_dispatch
+ 
+@@ -326,9 +328,11 @@ NESTED(except_vec_vi_handler, 0, sp)
+ 	beq	t0, t1, 2f
+ 
+ 	/* Switch to IRQ stack */
+-	li	t1, _IRQ_STACK_SIZE
++	li	t1, _IRQ_STACK_START
+ 	PTR_ADD sp, t0, t1
+ 
++	/* Save task's sp on IRQ stack so that unwinding can follow it */
++	LONG_S	s1, 0(sp)
+ 2:
+ 	jalr	v0
+ 
+diff --git a/arch/mips/kernel/process.c b/arch/mips/kernel/process.c
+index 8c26ecac930d..477ba026c3e5 100644
+--- a/arch/mips/kernel/process.c
++++ b/arch/mips/kernel/process.c
+@@ -483,31 +483,52 @@ unsigned long notrace unwind_stack_by_address(unsigned long stack_page,
+ 					      unsigned long pc,
+ 					      unsigned long *ra)
+ {
++	unsigned long low, high, irq_stack_high;
+ 	struct mips_frame_info info;
+ 	unsigned long size, ofs;
++	struct pt_regs *regs;
+ 	int leaf;
+-	extern void ret_from_irq(void);
+-	extern void ret_from_exception(void);
+ 
+ 	if (!stack_page)
+ 		return 0;
+ 
+ 	/*
+-	 * If we reached the bottom of interrupt context,
+-	 * return saved pc in pt_regs.
++	 * IRQ stacks start at IRQ_STACK_START
++	 * task stacks at THREAD_SIZE - 32
+ 	 */
+-	if (pc == (unsigned long)ret_from_irq ||
+-	    pc == (unsigned long)ret_from_exception) {
+-		struct pt_regs *regs;
+-		if (*sp >= stack_page &&
+-		    *sp + sizeof(*regs) <= stack_page + THREAD_SIZE - 32) {
+-			regs = (struct pt_regs *)*sp;
+-			pc = regs->cp0_epc;
+-			if (!user_mode(regs) && __kernel_text_address(pc)) {
+-				*sp = regs->regs[29];
+-				*ra = regs->regs[31];
+-				return pc;
+-			}
++	low = stack_page;
++	if (!preemptible() && on_irq_stack(raw_smp_processor_id(), *sp)) {
++		high = stack_page + IRQ_STACK_START;
++		irq_stack_high = high;
++	} else {
++		high = stack_page + THREAD_SIZE - 32;
++		irq_stack_high = 0;
++	}
++
++	/*
++	 * If we reached the top of the interrupt stack, start unwinding
++	 * the interrupted task stack.
++	 */
++	if (unlikely(*sp == irq_stack_high)) {
++		unsigned long task_sp = *(unsigned long *)*sp;
++
++		/*
++		 * Check that the pointer saved in the IRQ stack head points to
++		 * something within the stack of the current task
++		 */
++		if (!object_is_on_stack((void *)task_sp))
++			return 0;
++
++		/*
++		 * Follow pointer to tasks kernel stack frame where interrupted
++		 * state was saved.
++		 */
++		regs = (struct pt_regs *)task_sp;
++		pc = regs->cp0_epc;
++		if (!user_mode(regs) && __kernel_text_address(pc)) {
++			*sp = regs->regs[29];
++			*ra = regs->regs[31];
++			return pc;
+ 		}
+ 		return 0;
+ 	}
+@@ -528,8 +549,7 @@ unsigned long notrace unwind_stack_by_address(unsigned long stack_page,
+ 	if (leaf < 0)
+ 		return 0;
+ 
+-	if (*sp < stack_page ||
+-	    *sp + info.frame_size > stack_page + THREAD_SIZE - 32)
++	if (*sp < low || *sp + info.frame_size > high)
+ 		return 0;
+ 
+ 	if (leaf)
+diff --git a/arch/mips/kernel/vmlinux.lds.S b/arch/mips/kernel/vmlinux.lds.S
+index 0a93e83cd014..2026203c41e2 100644
+--- a/arch/mips/kernel/vmlinux.lds.S
++++ b/arch/mips/kernel/vmlinux.lds.S
+@@ -159,7 +159,7 @@ SECTIONS
+ 	 * Force .bss to 64K alignment so that .bss..swapper_pg_dir
+ 	 * gets that alignment.	 .sbss should be empty, so there will be
+ 	 * no holes after __init_end. */
+-	BSS_SECTION(0, 0x10000, 0)
++	BSS_SECTION(0, 0x10000, 8)
+ 
+ 	_end = . ;
+ 
+diff --git a/arch/mips/lantiq/xway/sysctrl.c b/arch/mips/lantiq/xway/sysctrl.c
+index daf580ce5ca2..2528181232fd 100644
+--- a/arch/mips/lantiq/xway/sysctrl.c
++++ b/arch/mips/lantiq/xway/sysctrl.c
+@@ -469,8 +469,8 @@ void __init ltq_soc_init(void)
+ 			panic("Failed to load xbar nodes from devicetree");
+ 		if (of_address_to_resource(np_xbar, 0, &res_xbar))
+ 			panic("Failed to get xbar resources");
+-		if (request_mem_region(res_xbar.start, resource_size(&res_xbar),
+-			res_xbar.name) < 0)
++		if (!request_mem_region(res_xbar.start, resource_size(&res_xbar),
++			res_xbar.name))
+ 			panic("Failed to get xbar resources");
+ 
+ 		ltq_xbar_membase = ioremap_nocache(res_xbar.start,
+diff --git a/arch/mips/ralink/rt3883.c b/arch/mips/ralink/rt3883.c
+index 3c575093f8f1..f2a6e1b8cce0 100644
+--- a/arch/mips/ralink/rt3883.c
++++ b/arch/mips/ralink/rt3883.c
+@@ -144,5 +144,5 @@ void prom_soc_init(struct ralink_soc_info *soc_info)
+ 
+ 	rt2880_pinmux_data = rt3883_pinmux_data;
+ 
+-	ralink_soc == RT3883_SOC;
++	ralink_soc = RT3883_SOC;
+ }
+diff --git a/arch/parisc/kernel/perf.c b/arch/parisc/kernel/perf.c
+index 518f4f5f1f43..d63d42533133 100644
+--- a/arch/parisc/kernel/perf.c
++++ b/arch/parisc/kernel/perf.c
+@@ -39,7 +39,7 @@
+  *  the PDC INTRIGUE calls.  This is done to eliminate bugs introduced
+  *  in various PDC revisions.  The code is much more maintainable
+  *  and reliable this way vs having to debug on every version of PDC
+- *  on every box. 
++ *  on every box.
+  */
+ 
+ #include <linux/capability.h>
+@@ -195,8 +195,8 @@ static int perf_config(uint32_t *image_ptr);
+ static int perf_release(struct inode *inode, struct file *file);
+ static int perf_open(struct inode *inode, struct file *file);
+ static ssize_t perf_read(struct file *file, char __user *buf, size_t cnt, loff_t *ppos);
+-static ssize_t perf_write(struct file *file, const char __user *buf, size_t count, 
+-	loff_t *ppos);
++static ssize_t perf_write(struct file *file, const char __user *buf,
++	size_t count, loff_t *ppos);
+ static long perf_ioctl(struct file *file, unsigned int cmd, unsigned long arg);
+ static void perf_start_counters(void);
+ static int perf_stop_counters(uint32_t *raddr);
+@@ -222,7 +222,7 @@ extern void perf_intrigue_disable_perf_counters (void);
+ /*
+  * configure:
+  *
+- * Configure the cpu with a given data image.  First turn off the counters, 
++ * Configure the cpu with a given data image.  First turn off the counters,
+  * then download the image, then turn the counters back on.
+  */
+ static int perf_config(uint32_t *image_ptr)
+@@ -234,7 +234,7 @@ static int perf_config(uint32_t *image_ptr)
+ 	error = perf_stop_counters(raddr);
+ 	if (error != 0) {
+ 		printk("perf_config: perf_stop_counters = %ld\n", error);
+-		return -EINVAL; 
++		return -EINVAL;
+ 	}
+ 
+ printk("Preparing to write image\n");
+@@ -242,7 +242,7 @@ printk("Preparing to write image\n");
+ 	error = perf_write_image((uint64_t *)image_ptr);
+ 	if (error != 0) {
+ 		printk("perf_config: DOWNLOAD = %ld\n", error);
+-		return -EINVAL; 
++		return -EINVAL;
+ 	}
+ 
+ printk("Preparing to start counters\n");
+@@ -254,7 +254,7 @@ printk("Preparing to start counters\n");
+ }
+ 
+ /*
+- * Open the device and initialize all of its memory.  The device is only 
++ * Open the device and initialize all of its memory.  The device is only
+  * opened once, but can be "queried" by multiple processes that know its
+  * file descriptor.
+  */
+@@ -298,8 +298,8 @@ static ssize_t perf_read(struct file *file, char __user *buf, size_t cnt, loff_t
+  * called on the processor that the download should happen
+  * on.
+  */
+-static ssize_t perf_write(struct file *file, const char __user *buf, size_t count, 
+-	loff_t *ppos)
++static ssize_t perf_write(struct file *file, const char __user *buf,
++	size_t count, loff_t *ppos)
+ {
+ 	int err;
+ 	size_t image_size;
+@@ -307,11 +307,11 @@ static ssize_t perf_write(struct file *file, const char __user *buf, size_t coun
+ 	uint32_t interface_type;
+ 	uint32_t test;
+ 
+-	if (perf_processor_interface == ONYX_INTF) 
++	if (perf_processor_interface == ONYX_INTF)
+ 		image_size = PCXU_IMAGE_SIZE;
+-	else if (perf_processor_interface == CUDA_INTF) 
++	else if (perf_processor_interface == CUDA_INTF)
+ 		image_size = PCXW_IMAGE_SIZE;
+-	else 
++	else
+ 		return -EFAULT;
+ 
+ 	if (!capable(CAP_SYS_ADMIN))
+@@ -331,22 +331,22 @@ static ssize_t perf_write(struct file *file, const char __user *buf, size_t coun
+ 
+ 	/* First check the machine type is correct for
+ 	   the requested image */
+-        if (((perf_processor_interface == CUDA_INTF) &&
+-		       (interface_type != CUDA_INTF)) ||
+-	    ((perf_processor_interface == ONYX_INTF) &&
+-	               (interface_type != ONYX_INTF))) 
++	if (((perf_processor_interface == CUDA_INTF) &&
++			(interface_type != CUDA_INTF)) ||
++		((perf_processor_interface == ONYX_INTF) &&
++			(interface_type != ONYX_INTF)))
+ 		return -EINVAL;
+ 
+ 	/* Next check to make sure the requested image
+ 	   is valid */
+-	if (((interface_type == CUDA_INTF) && 
++	if (((interface_type == CUDA_INTF) &&
+ 		       (test >= MAX_CUDA_IMAGES)) ||
+-	    ((interface_type == ONYX_INTF) && 
+-		       (test >= MAX_ONYX_IMAGES))) 
++	    ((interface_type == ONYX_INTF) &&
++		       (test >= MAX_ONYX_IMAGES)))
+ 		return -EINVAL;
+ 
+ 	/* Copy the image into the processor */
+-	if (interface_type == CUDA_INTF) 
++	if (interface_type == CUDA_INTF)
+ 		return perf_config(cuda_images[test]);
+ 	else
+ 		return perf_config(onyx_images[test]);
+@@ -360,7 +360,7 @@ static ssize_t perf_write(struct file *file, const char __user *buf, size_t coun
+ static void perf_patch_images(void)
+ {
+ #if 0 /* FIXME!! */
+-/* 
++/*
+  * NOTE:  this routine is VERY specific to the current TLB image.
+  * If the image is changed, this routine might also need to be changed.
+  */
+@@ -368,9 +368,9 @@ static void perf_patch_images(void)
+ 	extern void $i_dtlb_miss_2_0();
+ 	extern void PA2_0_iva();
+ 
+-	/* 
++	/*
+ 	 * We can only use the lower 32-bits, the upper 32-bits should be 0
+-	 * anyway given this is in the kernel 
++	 * anyway given this is in the kernel
+ 	 */
+ 	uint32_t itlb_addr  = (uint32_t)&($i_itlb_miss_2_0);
+ 	uint32_t dtlb_addr  = (uint32_t)&($i_dtlb_miss_2_0);
+@@ -378,21 +378,21 @@ static void perf_patch_images(void)
+ 
+ 	if (perf_processor_interface == ONYX_INTF) {
+ 		/* clear last 2 bytes */
+-		onyx_images[TLBMISS][15] &= 0xffffff00;  
++		onyx_images[TLBMISS][15] &= 0xffffff00;
+ 		/* set 2 bytes */
+ 		onyx_images[TLBMISS][15] |= (0x000000ff&((dtlb_addr) >> 24));
+ 		onyx_images[TLBMISS][16] = (dtlb_addr << 8)&0xffffff00;
+ 		onyx_images[TLBMISS][17] = itlb_addr;
+ 
+ 		/* clear last 2 bytes */
+-		onyx_images[TLBHANDMISS][15] &= 0xffffff00;  
++		onyx_images[TLBHANDMISS][15] &= 0xffffff00;
+ 		/* set 2 bytes */
+ 		onyx_images[TLBHANDMISS][15] |= (0x000000ff&((dtlb_addr) >> 24));
+ 		onyx_images[TLBHANDMISS][16] = (dtlb_addr << 8)&0xffffff00;
+ 		onyx_images[TLBHANDMISS][17] = itlb_addr;
+ 
+ 		/* clear last 2 bytes */
+-		onyx_images[BIG_CPI][15] &= 0xffffff00;  
++		onyx_images[BIG_CPI][15] &= 0xffffff00;
+ 		/* set 2 bytes */
+ 		onyx_images[BIG_CPI][15] |= (0x000000ff&((dtlb_addr) >> 24));
+ 		onyx_images[BIG_CPI][16] = (dtlb_addr << 8)&0xffffff00;
+@@ -405,24 +405,24 @@ static void perf_patch_images(void)
+ 
+ 	} else if (perf_processor_interface == CUDA_INTF) {
+ 		/* Cuda interface */
+-		cuda_images[TLBMISS][16] =  
++		cuda_images[TLBMISS][16] =
+ 			(cuda_images[TLBMISS][16]&0xffff0000) |
+ 			((dtlb_addr >> 8)&0x0000ffff);
+-		cuda_images[TLBMISS][17] = 
++		cuda_images[TLBMISS][17] =
+ 			((dtlb_addr << 24)&0xff000000) | ((itlb_addr >> 16)&0x000000ff);
+ 		cuda_images[TLBMISS][18] = (itlb_addr << 16)&0xffff0000;
+ 
+-		cuda_images[TLBHANDMISS][16] = 
++		cuda_images[TLBHANDMISS][16] =
+ 			(cuda_images[TLBHANDMISS][16]&0xffff0000) |
+ 			((dtlb_addr >> 8)&0x0000ffff);
+-		cuda_images[TLBHANDMISS][17] = 
++		cuda_images[TLBHANDMISS][17] =
+ 			((dtlb_addr << 24)&0xff000000) | ((itlb_addr >> 16)&0x000000ff);
+ 		cuda_images[TLBHANDMISS][18] = (itlb_addr << 16)&0xffff0000;
+ 
+-		cuda_images[BIG_CPI][16] = 
++		cuda_images[BIG_CPI][16] =
+ 			(cuda_images[BIG_CPI][16]&0xffff0000) |
+ 			((dtlb_addr >> 8)&0x0000ffff);
+-		cuda_images[BIG_CPI][17] = 
++		cuda_images[BIG_CPI][17] =
+ 			((dtlb_addr << 24)&0xff000000) | ((itlb_addr >> 16)&0x000000ff);
+ 		cuda_images[BIG_CPI][18] = (itlb_addr << 16)&0xffff0000;
+ 	} else {
+@@ -434,7 +434,7 @@ static void perf_patch_images(void)
+ 
+ /*
+  * ioctl routine
+- * All routines effect the processor that they are executed on.  Thus you 
++ * All routines effect the processor that they are executed on.  Thus you
+  * must be running on the processor that you wish to change.
+  */
+ 
+@@ -460,7 +460,7 @@ static long perf_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
+ 			}
+ 
+ 			/* copy out the Counters */
+-			if (copy_to_user((void __user *)arg, raddr, 
++			if (copy_to_user((void __user *)arg, raddr,
+ 					sizeof (raddr)) != 0) {
+ 				error =  -EFAULT;
+ 				break;
+@@ -488,7 +488,7 @@ static const struct file_operations perf_fops = {
+ 	.open = perf_open,
+ 	.release = perf_release
+ };
+-	
++
+ static struct miscdevice perf_dev = {
+ 	MISC_DYNAMIC_MINOR,
+ 	PA_PERF_DEV,
+@@ -596,7 +596,7 @@ static int perf_stop_counters(uint32_t *raddr)
+ 		/* OR sticky2 (bit 1496) to counter2 bit 32 */
+ 		tmp64 |= (userbuf[23] >> 8) & 0x0000000080000000;
+ 		raddr[2] = (uint32_t)tmp64;
+-		
++
+ 		/* Counter3 is bits 1497 to 1528 */
+ 		tmp64 =  (userbuf[23] >> 7) & 0x00000000ffffffff;
+ 		/* OR sticky3 (bit 1529) to counter3 bit 32 */
+@@ -618,7 +618,7 @@ static int perf_stop_counters(uint32_t *raddr)
+ 		userbuf[22] = 0;
+ 		userbuf[23] = 0;
+ 
+-		/* 
++		/*
+ 		 * Write back the zeroed bytes + the image given
+ 		 * the read was destructive.
+ 		 */
+@@ -626,13 +626,13 @@ static int perf_stop_counters(uint32_t *raddr)
+ 	} else {
+ 
+ 		/*
+-		 * Read RDR-15 which contains the counters and sticky bits 
++		 * Read RDR-15 which contains the counters and sticky bits
+ 		 */
+ 		if (!perf_rdr_read_ubuf(15, userbuf)) {
+ 			return -13;
+ 		}
+ 
+-		/* 
++		/*
+ 		 * Clear out the counters
+ 		 */
+ 		perf_rdr_clear(15);
+@@ -645,7 +645,7 @@ static int perf_stop_counters(uint32_t *raddr)
+ 		raddr[2] = (uint32_t)((userbuf[1] >> 32) & 0x00000000ffffffffUL);
+ 		raddr[3] = (uint32_t)(userbuf[1] & 0x00000000ffffffffUL);
+ 	}
+- 
++
+ 	return 0;
+ }
+ 
+@@ -683,7 +683,7 @@ static int perf_rdr_read_ubuf(uint32_t	rdr_num, uint64_t *buffer)
+ 	i = tentry->num_words;
+ 	while (i--) {
+ 		buffer[i] = 0;
+-	}	
++	}
+ 
+ 	/* Check for bits an even number of 64 */
+ 	if ((xbits = width & 0x03f) != 0) {
+@@ -809,18 +809,22 @@ static int perf_write_image(uint64_t *memaddr)
+ 	}
+ 
+ 	runway = ioremap_nocache(cpu_device->hpa.start, 4096);
++	if (!runway) {
++		pr_err("perf_write_image: ioremap failed!\n");
++		return -ENOMEM;
++	}
+ 
+ 	/* Merge intrigue bits into Runway STATUS 0 */
+ 	tmp64 = __raw_readq(runway + RUNWAY_STATUS) & 0xffecfffffffffffful;
+-	__raw_writeq(tmp64 | (*memaddr++ & 0x0013000000000000ul), 
++	__raw_writeq(tmp64 | (*memaddr++ & 0x0013000000000000ul),
+ 		     runway + RUNWAY_STATUS);
+-	
++
+ 	/* Write RUNWAY DEBUG registers */
+ 	for (i = 0; i < 8; i++) {
+ 		__raw_writeq(*memaddr++, runway + RUNWAY_DEBUG);
+ 	}
+ 
+-	return 0; 
++	return 0;
+ }
+ 
+ /*
+@@ -844,7 +848,7 @@ printk("perf_rdr_write\n");
+ 			perf_rdr_shift_out_U(rdr_num, buffer[i]);
+ 		} else {
+ 			perf_rdr_shift_out_W(rdr_num, buffer[i]);
+-		}	
++		}
+ 	}
+ printk("perf_rdr_write done\n");
+ }
+diff --git a/block/partitions/efi.c b/block/partitions/efi.c
+index 26cb624ace05..d26d0d27f5fd 100644
+--- a/block/partitions/efi.c
++++ b/block/partitions/efi.c
+@@ -293,7 +293,7 @@ static gpt_entry *alloc_read_gpt_entries(struct parsed_partitions *state,
+ 	if (!gpt)
+ 		return NULL;
+ 
+-	count = le32_to_cpu(gpt->num_partition_entries) *
++	count = (size_t)le32_to_cpu(gpt->num_partition_entries) *
+                 le32_to_cpu(gpt->sizeof_partition_entry);
+ 	if (!count)
+ 		return NULL;
+@@ -352,7 +352,7 @@ static int is_gpt_valid(struct parsed_partitions *state, u64 lba,
+ 			gpt_header **gpt, gpt_entry **ptes)
+ {
+ 	u32 crc, origcrc;
+-	u64 lastlba;
++	u64 lastlba, pt_size;
+ 
+ 	if (!ptes)
+ 		return 0;
+@@ -434,13 +434,20 @@ static int is_gpt_valid(struct parsed_partitions *state, u64 lba,
+ 		goto fail;
+ 	}
+ 
++	/* Sanity check partition table size */
++	pt_size = (u64)le32_to_cpu((*gpt)->num_partition_entries) *
++		le32_to_cpu((*gpt)->sizeof_partition_entry);
++	if (pt_size > KMALLOC_MAX_SIZE) {
++		pr_debug("GUID Partition Table is too large: %llu > %lu bytes\n",
++			 (unsigned long long)pt_size, KMALLOC_MAX_SIZE);
++		goto fail;
++	}
++
+ 	if (!(*ptes = alloc_read_gpt_entries(state, *gpt)))
+ 		goto fail;
+ 
+ 	/* Check the GUID Partition Entry Array CRC */
+-	crc = efi_crc32((const unsigned char *) (*ptes),
+-			le32_to_cpu((*gpt)->num_partition_entries) *
+-			le32_to_cpu((*gpt)->sizeof_partition_entry));
++	crc = efi_crc32((const unsigned char *) (*ptes), pt_size);
+ 
+ 	if (crc != le32_to_cpu((*gpt)->partition_entry_array_crc32)) {
+ 		pr_debug("GUID Partitition Entry Array CRC check failed.\n");
+diff --git a/drivers/ata/libata-transport.c b/drivers/ata/libata-transport.c
+index e2d94972962d..7aa10c200ecb 100644
+--- a/drivers/ata/libata-transport.c
++++ b/drivers/ata/libata-transport.c
+@@ -224,7 +224,6 @@ static DECLARE_TRANSPORT_CLASS(ata_port_class,
+ 
+ static void ata_tport_release(struct device *dev)
+ {
+-	put_device(dev->parent);
+ }
+ 
+ /**
+@@ -284,7 +283,7 @@ int ata_tport_add(struct device *parent,
+ 	device_initialize(dev);
+ 	dev->type = &ata_port_type;
+ 
+-	dev->parent = get_device(parent);
++	dev->parent = parent;
+ 	dev->release = ata_tport_release;
+ 	dev_set_name(dev, "ata%d", ap->print_id);
+ 	transport_setup_device(dev);
+@@ -348,7 +347,6 @@ static DECLARE_TRANSPORT_CLASS(ata_link_class,
+ 
+ static void ata_tlink_release(struct device *dev)
+ {
+-	put_device(dev->parent);
+ }
+ 
+ /**
+@@ -410,7 +408,7 @@ int ata_tlink_add(struct ata_link *link)
+ 	int error;
+ 
+ 	device_initialize(dev);
+-	dev->parent = get_device(&ap->tdev);
++	dev->parent = &ap->tdev;
+ 	dev->release = ata_tlink_release;
+ 	if (ata_is_host_link(link))
+ 		dev_set_name(dev, "link%d", ap->print_id);
+@@ -588,7 +586,6 @@ static DECLARE_TRANSPORT_CLASS(ata_dev_class,
+ 
+ static void ata_tdev_release(struct device *dev)
+ {
+-	put_device(dev->parent);
+ }
+ 
+ /**
+@@ -661,7 +658,7 @@ static int ata_tdev_add(struct ata_device *ata_dev)
+ 	int error;
+ 
+ 	device_initialize(dev);
+-	dev->parent = get_device(&link->tdev);
++	dev->parent = &link->tdev;
+ 	dev->release = ata_tdev_release;
+ 	if (ata_is_host_link(link))
+ 		dev_set_name(dev, "dev%d.%d", ap->print_id,ata_dev->devno);
+diff --git a/drivers/extcon/extcon-axp288.c b/drivers/extcon/extcon-axp288.c
+index fd55c2f2080a..6c9d7ccebb8c 100644
+--- a/drivers/extcon/extcon-axp288.c
++++ b/drivers/extcon/extcon-axp288.c
+@@ -168,7 +168,7 @@ static int axp288_handle_chrg_det_event(struct axp288_extcon_info *info)
+ 		return ret;
+ 	}
+ 
+-	vbus_attach = (pwr_stat & PS_STAT_VBUS_PRESENT);
++	vbus_attach = (pwr_stat & PS_STAT_VBUS_VALID);
+ 	if (!vbus_attach)
+ 		goto notify_otg;
+ 
+diff --git a/drivers/firmware/psci.c b/drivers/firmware/psci.c
+index d24f35d74b27..ae70d2485ca1 100644
+--- a/drivers/firmware/psci.c
++++ b/drivers/firmware/psci.c
+@@ -424,7 +424,7 @@ out_put_node:
+ 	return err;
+ }
+ 
+-static const struct of_device_id const psci_of_match[] __initconst = {
++static const struct of_device_id psci_of_match[] __initconst = {
+ 	{ .compatible = "arm,psci",	.data = psci_0_1_init},
+ 	{ .compatible = "arm,psci-0.2",	.data = psci_0_2_init},
+ 	{ .compatible = "arm,psci-1.0",	.data = psci_0_2_init},
+diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_events.c b/drivers/gpu/drm/amd/amdkfd/kfd_events.c
+index b6e28dcaea1d..1fb1daa0b366 100644
+--- a/drivers/gpu/drm/amd/amdkfd/kfd_events.c
++++ b/drivers/gpu/drm/amd/amdkfd/kfd_events.c
+@@ -739,8 +739,10 @@ int kfd_wait_on_events(struct kfd_process *p,
+ 		struct kfd_event_data event_data;
+ 
+ 		if (copy_from_user(&event_data, &events[i],
+-				sizeof(struct kfd_event_data)))
++				sizeof(struct kfd_event_data))) {
++			ret = -EFAULT;
+ 			goto fail;
++		}
+ 
+ 		ret = init_event_waiter(p, &event_waiters[i],
+ 				event_data.event_id, i);
+diff --git a/drivers/hwmon/gl520sm.c b/drivers/hwmon/gl520sm.c
+index dee93ec87d02..84e0994aafdd 100644
+--- a/drivers/hwmon/gl520sm.c
++++ b/drivers/hwmon/gl520sm.c
+@@ -208,11 +208,13 @@ static ssize_t get_cpu_vid(struct device *dev, struct device_attribute *attr,
+ }
+ static DEVICE_ATTR(cpu0_vid, S_IRUGO, get_cpu_vid, NULL);
+ 
+-#define VDD_FROM_REG(val) (((val) * 95 + 2) / 4)
+-#define VDD_TO_REG(val) clamp_val((((val) * 4 + 47) / 95), 0, 255)
++#define VDD_FROM_REG(val)	DIV_ROUND_CLOSEST((val) * 95, 4)
++#define VDD_CLAMP(val)		clamp_val(val, 0, 255 * 95 / 4)
++#define VDD_TO_REG(val)		DIV_ROUND_CLOSEST(VDD_CLAMP(val) * 4, 95)
+ 
+-#define IN_FROM_REG(val) ((val) * 19)
+-#define IN_TO_REG(val) clamp_val((((val) + 9) / 19), 0, 255)
++#define IN_FROM_REG(val)	((val) * 19)
++#define IN_CLAMP(val)		clamp_val(val, 0, 255 * 19)
++#define IN_TO_REG(val)		DIV_ROUND_CLOSEST(IN_CLAMP(val), 19)
+ 
+ static ssize_t get_in_input(struct device *dev, struct device_attribute *attr,
+ 			    char *buf)
+@@ -349,8 +351,13 @@ static SENSOR_DEVICE_ATTR(in4_max, S_IRUGO | S_IWUSR,
+ 
+ #define DIV_FROM_REG(val) (1 << (val))
+ #define FAN_FROM_REG(val, div) ((val) == 0 ? 0 : (480000 / ((val) << (div))))
+-#define FAN_TO_REG(val, div) ((val) <= 0 ? 0 : \
+-	clamp_val((480000 + ((val) << ((div)-1))) / ((val) << (div)), 1, 255))
++
++#define FAN_BASE(div)		(480000 >> (div))
++#define FAN_CLAMP(val, div)	clamp_val(val, FAN_BASE(div) / 255, \
++					  FAN_BASE(div))
++#define FAN_TO_REG(val, div)	((val) == 0 ? 0 : \
++				 DIV_ROUND_CLOSEST(480000, \
++						FAN_CLAMP(val, div) << (div)))
+ 
+ static ssize_t get_fan_input(struct device *dev, struct device_attribute *attr,
+ 			     char *buf)
+@@ -513,9 +520,9 @@ static SENSOR_DEVICE_ATTR(fan2_div, S_IRUGO | S_IWUSR,
+ static DEVICE_ATTR(fan1_off, S_IRUGO | S_IWUSR,
+ 		get_fan_off, set_fan_off);
+ 
+-#define TEMP_FROM_REG(val) (((val) - 130) * 1000)
+-#define TEMP_TO_REG(val) clamp_val(((((val) < 0 ? \
+-			(val) - 500 : (val) + 500) / 1000) + 130), 0, 255)
++#define TEMP_FROM_REG(val)	(((val) - 130) * 1000)
++#define TEMP_CLAMP(val)		clamp_val(val, -130000, 125000)
++#define TEMP_TO_REG(val)	(DIV_ROUND_CLOSEST(TEMP_CLAMP(val), 1000) + 130)
+ 
+ static ssize_t get_temp_input(struct device *dev, struct device_attribute *attr,
+ 			      char *buf)
+diff --git a/drivers/i2c/busses/i2c-meson.c b/drivers/i2c/busses/i2c-meson.c
+index 71d3929adf54..8d65f33af5da 100644
+--- a/drivers/i2c/busses/i2c-meson.c
++++ b/drivers/i2c/busses/i2c-meson.c
+@@ -175,7 +175,7 @@ static void meson_i2c_put_data(struct meson_i2c *i2c, char *buf, int len)
+ 		wdata1 |= *buf++ << ((i - 4) * 8);
+ 
+ 	writel(wdata0, i2c->regs + REG_TOK_WDATA0);
+-	writel(wdata0, i2c->regs + REG_TOK_WDATA1);
++	writel(wdata1, i2c->regs + REG_TOK_WDATA1);
+ 
+ 	dev_dbg(i2c->dev, "%s: data %08x %08x len %d\n", __func__,
+ 		wdata0, wdata1, len);
+diff --git a/drivers/iio/adc/axp288_adc.c b/drivers/iio/adc/axp288_adc.c
+index 0c904edd6c00..f684fe31f832 100644
+--- a/drivers/iio/adc/axp288_adc.c
++++ b/drivers/iio/adc/axp288_adc.c
+@@ -28,8 +28,6 @@
+ #include <linux/iio/driver.h>
+ 
+ #define AXP288_ADC_EN_MASK		0xF1
+-#define AXP288_ADC_TS_PIN_GPADC		0xF2
+-#define AXP288_ADC_TS_PIN_ON		0xF3
+ 
+ enum axp288_adc_id {
+ 	AXP288_ADC_TS,
+@@ -123,16 +121,6 @@ static int axp288_adc_read_channel(int *val, unsigned long address,
+ 	return IIO_VAL_INT;
+ }
+ 
+-static int axp288_adc_set_ts(struct regmap *regmap, unsigned int mode,
+-				unsigned long address)
+-{
+-	/* channels other than GPADC do not need to switch TS pin */
+-	if (address != AXP288_GP_ADC_H)
+-		return 0;
+-
+-	return regmap_write(regmap, AXP288_ADC_TS_PIN_CTRL, mode);
+-}
+-
+ static int axp288_adc_read_raw(struct iio_dev *indio_dev,
+ 			struct iio_chan_spec const *chan,
+ 			int *val, int *val2, long mask)
+@@ -143,16 +131,7 @@ static int axp288_adc_read_raw(struct iio_dev *indio_dev,
+ 	mutex_lock(&indio_dev->mlock);
+ 	switch (mask) {
+ 	case IIO_CHAN_INFO_RAW:
+-		if (axp288_adc_set_ts(info->regmap, AXP288_ADC_TS_PIN_GPADC,
+-					chan->address)) {
+-			dev_err(&indio_dev->dev, "GPADC mode\n");
+-			ret = -EINVAL;
+-			break;
+-		}
+ 		ret = axp288_adc_read_channel(val, chan->address, info->regmap);
+-		if (axp288_adc_set_ts(info->regmap, AXP288_ADC_TS_PIN_ON,
+-						chan->address))
+-			dev_err(&indio_dev->dev, "TS pin restore\n");
+ 		break;
+ 	default:
+ 		ret = -EINVAL;
+@@ -162,15 +141,6 @@ static int axp288_adc_read_raw(struct iio_dev *indio_dev,
+ 	return ret;
+ }
+ 
+-static int axp288_adc_set_state(struct regmap *regmap)
+-{
+-	/* ADC should be always enabled for internal FG to function */
+-	if (regmap_write(regmap, AXP288_ADC_TS_PIN_CTRL, AXP288_ADC_TS_PIN_ON))
+-		return -EIO;
+-
+-	return regmap_write(regmap, AXP20X_ADC_EN1, AXP288_ADC_EN_MASK);
+-}
+-
+ static const struct iio_info axp288_adc_iio_info = {
+ 	.read_raw = &axp288_adc_read_raw,
+ 	.driver_module = THIS_MODULE,
+@@ -199,7 +169,7 @@ static int axp288_adc_probe(struct platform_device *pdev)
+ 	 * Set ADC to enabled state at all time, including system suspend.
+ 	 * otherwise internal fuel gauge functionality may be affected.
+ 	 */
+-	ret = axp288_adc_set_state(axp20x->regmap);
++	ret = regmap_write(info->regmap, AXP20X_ADC_EN1, AXP288_ADC_EN_MASK);
+ 	if (ret) {
+ 		dev_err(&pdev->dev, "unable to enable ADC device\n");
+ 		return ret;
+diff --git a/drivers/infiniband/hw/qib/qib_iba7322.c b/drivers/infiniband/hw/qib/qib_iba7322.c
+index 6c8ff10101c0..77cc77ba998f 100644
+--- a/drivers/infiniband/hw/qib/qib_iba7322.c
++++ b/drivers/infiniband/hw/qib/qib_iba7322.c
+@@ -7097,7 +7097,7 @@ static void qib_7322_txchk_change(struct qib_devdata *dd, u32 start,
+ 	unsigned long flags;
+ 
+ 	while (wait) {
+-		unsigned long shadow;
++		unsigned long shadow = 0;
+ 		int cstart, previ = -1;
+ 
+ 		/*
+diff --git a/drivers/infiniband/ulp/ipoib/ipoib_main.c b/drivers/infiniband/ulp/ipoib/ipoib_main.c
+index 6699ecd855f0..bad76eed06b3 100644
+--- a/drivers/infiniband/ulp/ipoib/ipoib_main.c
++++ b/drivers/infiniband/ulp/ipoib/ipoib_main.c
+@@ -1239,7 +1239,7 @@ static void __ipoib_reap_neigh(struct ipoib_dev_priv *priv)
+ 						   rcu_dereference_protected(neigh->hnext,
+ 									     lockdep_is_held(&priv->lock)));
+ 				/* remove from path/mc list */
+-				list_del(&neigh->list);
++				list_del_init(&neigh->list);
+ 				call_rcu(&neigh->rcu, ipoib_neigh_reclaim);
+ 			} else {
+ 				np = &neigh->hnext;
+@@ -1406,7 +1406,7 @@ void ipoib_neigh_free(struct ipoib_neigh *neigh)
+ 					   rcu_dereference_protected(neigh->hnext,
+ 								     lockdep_is_held(&priv->lock)));
+ 			/* remove from parent list */
+-			list_del(&neigh->list);
++			list_del_init(&neigh->list);
+ 			call_rcu(&neigh->rcu, ipoib_neigh_reclaim);
+ 			return;
+ 		} else {
+@@ -1491,7 +1491,7 @@ void ipoib_del_neighs_by_gid(struct net_device *dev, u8 *gid)
+ 						   rcu_dereference_protected(neigh->hnext,
+ 									     lockdep_is_held(&priv->lock)));
+ 				/* remove from parent list */
+-				list_del(&neigh->list);
++				list_del_init(&neigh->list);
+ 				call_rcu(&neigh->rcu, ipoib_neigh_reclaim);
+ 			} else {
+ 				np = &neigh->hnext;
+@@ -1533,7 +1533,7 @@ static void ipoib_flush_neighs(struct ipoib_dev_priv *priv)
+ 					   rcu_dereference_protected(neigh->hnext,
+ 								     lockdep_is_held(&priv->lock)));
+ 			/* remove from path/mc list */
+-			list_del(&neigh->list);
++			list_del_init(&neigh->list);
+ 			call_rcu(&neigh->rcu, ipoib_neigh_reclaim);
+ 		}
+ 	}
+diff --git a/drivers/infiniband/ulp/ipoib/ipoib_vlan.c b/drivers/infiniband/ulp/ipoib/ipoib_vlan.c
+index 57a34f87dedf..9b47a437d6c9 100644
+--- a/drivers/infiniband/ulp/ipoib/ipoib_vlan.c
++++ b/drivers/infiniband/ulp/ipoib/ipoib_vlan.c
+@@ -160,11 +160,11 @@ int ipoib_vlan_add(struct net_device *pdev, unsigned short pkey)
+ out:
+ 	up_write(&ppriv->vlan_rwsem);
+ 
++	rtnl_unlock();
++
+ 	if (result)
+ 		free_netdev(priv->dev);
+ 
+-	rtnl_unlock();
+-
+ 	return result;
+ }
+ 
+@@ -185,7 +185,6 @@ int ipoib_vlan_delete(struct net_device *pdev, unsigned short pkey)
+ 	list_for_each_entry_safe(priv, tpriv, &ppriv->child_intfs, list) {
+ 		if (priv->pkey == pkey &&
+ 		    priv->child_type == IPOIB_LEGACY_CHILD) {
+-			unregister_netdevice(priv->dev);
+ 			list_del(&priv->list);
+ 			dev = priv->dev;
+ 			break;
+@@ -193,6 +192,11 @@ int ipoib_vlan_delete(struct net_device *pdev, unsigned short pkey)
+ 	}
+ 	up_write(&ppriv->vlan_rwsem);
+ 
++	if (dev) {
++		ipoib_dbg(ppriv, "delete child vlan %s\n", dev->name);
++		unregister_netdevice(dev);
++	}
++
+ 	rtnl_unlock();
+ 
+ 	if (dev) {
+diff --git a/drivers/iommu/io-pgtable-arm.c b/drivers/iommu/io-pgtable-arm.c
+index dad768caa9c5..18751b1dfd3d 100644
+--- a/drivers/iommu/io-pgtable-arm.c
++++ b/drivers/iommu/io-pgtable-arm.c
+@@ -335,8 +335,12 @@ static int __arm_lpae_map(struct arm_lpae_io_pgtable *data, unsigned long iova,
+ 		if (cfg->quirks & IO_PGTABLE_QUIRK_ARM_NS)
+ 			pte |= ARM_LPAE_PTE_NSTABLE;
+ 		__arm_lpae_set_pte(ptep, pte, cfg);
+-	} else {
++	} else if (!iopte_leaf(pte, lvl)) {
+ 		cptep = iopte_deref(pte, data);
++	} else {
++		/* We require an unmap first */
++		WARN_ON(!selftest_running);
++		return -EEXIST;
+ 	}
+ 
+ 	/* Rinse, repeat */
+diff --git a/drivers/md/raid10.c b/drivers/md/raid10.c
+index e5ee4e9e0ea5..a8a86d450d76 100644
+--- a/drivers/md/raid10.c
++++ b/drivers/md/raid10.c
+@@ -1414,11 +1414,24 @@ retry_write:
+ 			mbio->bi_private = r10_bio;
+ 
+ 			atomic_inc(&r10_bio->remaining);
++
++			cb = blk_check_plugged(raid10_unplug, mddev,
++					       sizeof(*plug));
++			if (cb)
++				plug = container_of(cb, struct raid10_plug_cb,
++						    cb);
++			else
++				plug = NULL;
+ 			spin_lock_irqsave(&conf->device_lock, flags);
+-			bio_list_add(&conf->pending_bio_list, mbio);
+-			conf->pending_count++;
++			if (plug) {
++				bio_list_add(&plug->pending, mbio);
++				plug->pending_cnt++;
++			} else {
++				bio_list_add(&conf->pending_bio_list, mbio);
++				conf->pending_count++;
++			}
+ 			spin_unlock_irqrestore(&conf->device_lock, flags);
+-			if (!mddev_check_plugged(mddev))
++			if (!plug)
+ 				md_wakeup_thread(mddev->thread);
+ 		}
+ 	}
+diff --git a/drivers/media/pci/ttpci/av7110_hw.c b/drivers/media/pci/ttpci/av7110_hw.c
+index 300bd3c94738..0992bb0e207e 100644
+--- a/drivers/media/pci/ttpci/av7110_hw.c
++++ b/drivers/media/pci/ttpci/av7110_hw.c
+@@ -56,11 +56,11 @@
+    by Nathan Laredo <laredo@gnu.org> */
+ 
+ int av7110_debiwrite(struct av7110 *av7110, u32 config,
+-		     int addr, u32 val, int count)
++		     int addr, u32 val, unsigned int count)
+ {
+ 	struct saa7146_dev *dev = av7110->dev;
+ 
+-	if (count <= 0 || count > 32764) {
++	if (count > 32764) {
+ 		printk("%s: invalid count %d\n", __func__, count);
+ 		return -1;
+ 	}
+@@ -78,12 +78,12 @@ int av7110_debiwrite(struct av7110 *av7110, u32 config,
+ 	return 0;
+ }
+ 
+-u32 av7110_debiread(struct av7110 *av7110, u32 config, int addr, int count)
++u32 av7110_debiread(struct av7110 *av7110, u32 config, int addr, unsigned int count)
+ {
+ 	struct saa7146_dev *dev = av7110->dev;
+ 	u32 result = 0;
+ 
+-	if (count > 32764 || count <= 0) {
++	if (count > 32764) {
+ 		printk("%s: invalid count %d\n", __func__, count);
+ 		return 0;
+ 	}
+diff --git a/drivers/media/pci/ttpci/av7110_hw.h b/drivers/media/pci/ttpci/av7110_hw.h
+index 1634aba5cb84..ccb148059406 100644
+--- a/drivers/media/pci/ttpci/av7110_hw.h
++++ b/drivers/media/pci/ttpci/av7110_hw.h
+@@ -377,14 +377,14 @@ extern int av7110_fw_request(struct av7110 *av7110, u16 *request_buf,
+ 
+ /* DEBI (saa7146 data extension bus interface) access */
+ extern int av7110_debiwrite(struct av7110 *av7110, u32 config,
+-			    int addr, u32 val, int count);
++			    int addr, u32 val, unsigned int count);
+ extern u32 av7110_debiread(struct av7110 *av7110, u32 config,
+-			   int addr, int count);
++			   int addr, unsigned int count);
+ 
+ 
+ /* DEBI during interrupt */
+ /* single word writes */
+-static inline void iwdebi(struct av7110 *av7110, u32 config, int addr, u32 val, int count)
++static inline void iwdebi(struct av7110 *av7110, u32 config, int addr, u32 val, unsigned int count)
+ {
+ 	av7110_debiwrite(av7110, config, addr, val, count);
+ }
+@@ -397,7 +397,7 @@ static inline void mwdebi(struct av7110 *av7110, u32 config, int addr,
+ 	av7110_debiwrite(av7110, config, addr, 0, count);
+ }
+ 
+-static inline u32 irdebi(struct av7110 *av7110, u32 config, int addr, u32 val, int count)
++static inline u32 irdebi(struct av7110 *av7110, u32 config, int addr, u32 val, unsigned int count)
+ {
+ 	u32 res;
+ 
+@@ -408,7 +408,7 @@ static inline u32 irdebi(struct av7110 *av7110, u32 config, int addr, u32 val, i
+ }
+ 
+ /* DEBI outside interrupts, only for count <= 4! */
+-static inline void wdebi(struct av7110 *av7110, u32 config, int addr, u32 val, int count)
++static inline void wdebi(struct av7110 *av7110, u32 config, int addr, u32 val, unsigned int count)
+ {
+ 	unsigned long flags;
+ 
+@@ -417,7 +417,7 @@ static inline void wdebi(struct av7110 *av7110, u32 config, int addr, u32 val, i
+ 	spin_unlock_irqrestore(&av7110->debilock, flags);
+ }
+ 
+-static inline u32 rdebi(struct av7110 *av7110, u32 config, int addr, u32 val, int count)
++static inline u32 rdebi(struct av7110 *av7110, u32 config, int addr, u32 val, unsigned int count)
+ {
+ 	unsigned long flags;
+ 	u32 res;
+diff --git a/drivers/media/platform/exynos-gsc/gsc-core.c b/drivers/media/platform/exynos-gsc/gsc-core.c
+index 9b9e423e4fc4..15c543d4b366 100644
+--- a/drivers/media/platform/exynos-gsc/gsc-core.c
++++ b/drivers/media/platform/exynos-gsc/gsc-core.c
+@@ -849,9 +849,7 @@ int gsc_prepare_addr(struct gsc_ctx *ctx, struct vb2_buffer *vb,
+ 
+ 	if ((frame->fmt->pixelformat == V4L2_PIX_FMT_VYUY) ||
+ 		(frame->fmt->pixelformat == V4L2_PIX_FMT_YVYU) ||
+-		(frame->fmt->pixelformat == V4L2_PIX_FMT_NV61) ||
+ 		(frame->fmt->pixelformat == V4L2_PIX_FMT_YVU420) ||
+-		(frame->fmt->pixelformat == V4L2_PIX_FMT_NV21) ||
+ 		(frame->fmt->pixelformat == V4L2_PIX_FMT_YVU420M))
+ 		swap(addr->cb, addr->cr);
+ 
+diff --git a/drivers/mmc/core/sdio_bus.c b/drivers/mmc/core/sdio_bus.c
+index 7e327a6dd53d..c23bc4f331bd 100644
+--- a/drivers/mmc/core/sdio_bus.c
++++ b/drivers/mmc/core/sdio_bus.c
+@@ -266,7 +266,7 @@ static void sdio_release_func(struct device *dev)
+ 	sdio_free_func_cis(func);
+ 
+ 	kfree(func->info);
+-
++	kfree(func->tmpbuf);
+ 	kfree(func);
+ }
+ 
+@@ -281,6 +281,16 @@ struct sdio_func *sdio_alloc_func(struct mmc_card *card)
+ 	if (!func)
+ 		return ERR_PTR(-ENOMEM);
+ 
++	/*
++	 * allocate buffer separately to make sure it's properly aligned for
++	 * DMA usage (incl. 64 bit DMA)
++	 */
++	func->tmpbuf = kmalloc(4, GFP_KERNEL);
++	if (!func->tmpbuf) {
++		kfree(func);
++		return ERR_PTR(-ENOMEM);
++	}
++
+ 	func->card = card;
+ 
+ 	device_initialize(&func->dev);
+diff --git a/drivers/net/ethernet/intel/igb/igb_main.c b/drivers/net/ethernet/intel/igb/igb_main.c
+index fa3b4cbea23b..a481ea64e287 100644
+--- a/drivers/net/ethernet/intel/igb/igb_main.c
++++ b/drivers/net/ethernet/intel/igb/igb_main.c
+@@ -7658,6 +7658,11 @@ static pci_ers_result_t igb_io_slot_reset(struct pci_dev *pdev)
+ 		pci_enable_wake(pdev, PCI_D3hot, 0);
+ 		pci_enable_wake(pdev, PCI_D3cold, 0);
+ 
++		/* In case of PCI error, adapter lose its HW address
++		 * so we should re-assign it here.
++		 */
++		hw->hw_addr = adapter->io_addr;
++
+ 		igb_reset(adapter);
+ 		wr32(E1000_WUS, ~0);
+ 		result = PCI_ERS_RESULT_RECOVERED;
+diff --git a/drivers/net/ethernet/renesas/sh_eth.h b/drivers/net/ethernet/renesas/sh_eth.h
+index 72fcfc924589..0d18be0fed8e 100644
+--- a/drivers/net/ethernet/renesas/sh_eth.h
++++ b/drivers/net/ethernet/renesas/sh_eth.h
+@@ -339,7 +339,7 @@ enum FELIC_MODE_BIT {
+ 	ECMR_DPAD = 0x00200000, ECMR_RZPF = 0x00100000,
+ 	ECMR_ZPF = 0x00080000, ECMR_PFR = 0x00040000, ECMR_RXF = 0x00020000,
+ 	ECMR_TXF = 0x00010000, ECMR_MCT = 0x00002000, ECMR_PRCEF = 0x00001000,
+-	ECMR_PMDE = 0x00000200, ECMR_RE = 0x00000040, ECMR_TE = 0x00000020,
++	ECMR_MPDE = 0x00000200, ECMR_RE = 0x00000040, ECMR_TE = 0x00000020,
+ 	ECMR_RTM = 0x00000010, ECMR_ILB = 0x00000008, ECMR_ELB = 0x00000004,
+ 	ECMR_DM = 0x00000002, ECMR_PRM = 0x00000001,
+ };
+diff --git a/drivers/net/team/team.c b/drivers/net/team/team.c
+index a5f392ae30d5..61cd53838360 100644
+--- a/drivers/net/team/team.c
++++ b/drivers/net/team/team.c
+@@ -2343,8 +2343,10 @@ start_again:
+ 
+ 	hdr = genlmsg_put(skb, portid, seq, &team_nl_family, flags | NLM_F_MULTI,
+ 			  TEAM_CMD_OPTIONS_GET);
+-	if (!hdr)
++	if (!hdr) {
++		nlmsg_free(skb);
+ 		return -EMSGSIZE;
++	}
+ 
+ 	if (nla_put_u32(skb, TEAM_ATTR_TEAM_IFINDEX, team->dev->ifindex))
+ 		goto nla_put_failure;
+@@ -2611,8 +2613,10 @@ start_again:
+ 
+ 	hdr = genlmsg_put(skb, portid, seq, &team_nl_family, flags | NLM_F_MULTI,
+ 			  TEAM_CMD_PORT_LIST_GET);
+-	if (!hdr)
++	if (!hdr) {
++		nlmsg_free(skb);
+ 		return -EMSGSIZE;
++	}
+ 
+ 	if (nla_put_u32(skb, TEAM_ATTR_TEAM_IFINDEX, team->dev->ifindex))
+ 		goto nla_put_failure;
+diff --git a/drivers/net/usb/Kconfig b/drivers/net/usb/Kconfig
+index 7f83504dfa69..1f6893ebce16 100644
+--- a/drivers/net/usb/Kconfig
++++ b/drivers/net/usb/Kconfig
+@@ -364,7 +364,7 @@ config USB_NET_NET1080
+ 	  optionally with LEDs that indicate traffic
+ 
+ config USB_NET_PLUSB
+-	tristate "Prolific PL-2301/2302/25A1 based cables"
++	tristate "Prolific PL-2301/2302/25A1/27A1 based cables"
+ 	# if the handshake/init/reset problems, from original 'plusb',
+ 	# are ever resolved ... then remove "experimental"
+ 	depends on USB_USBNET
+diff --git a/drivers/net/usb/plusb.c b/drivers/net/usb/plusb.c
+index 1bfe0fcaccf5..7c02231c1a1b 100644
+--- a/drivers/net/usb/plusb.c
++++ b/drivers/net/usb/plusb.c
+@@ -102,7 +102,7 @@ static int pl_reset(struct usbnet *dev)
+ }
+ 
+ static const struct driver_info	prolific_info = {
+-	.description =	"Prolific PL-2301/PL-2302/PL-25A1",
++	.description =	"Prolific PL-2301/PL-2302/PL-25A1/PL-27A1",
+ 	.flags =	FLAG_POINTTOPOINT | FLAG_NO_SETINT,
+ 		/* some PL-2302 versions seem to fail usb_set_interface() */
+ 	.reset =	pl_reset,
+@@ -139,6 +139,17 @@ static const struct usb_device_id	products [] = {
+ 					 * Host-to-Host Cable
+ 					 */
+ 	.driver_info =  (unsigned long) &prolific_info,
++
++},
++
++/* super speed cables */
++{
++	USB_DEVICE(0x067b, 0x27a1),     /* PL-27A1, no eeprom
++					 * also: goobay Active USB 3.0
++					 * Data Link,
++					 * Unitek Y-3501
++					 */
++	.driver_info =  (unsigned long) &prolific_info,
+ },
+ 
+ 	{ },		// END
+@@ -158,5 +169,5 @@ static struct usb_driver plusb_driver = {
+ module_usb_driver(plusb_driver);
+ 
+ MODULE_AUTHOR("David Brownell");
+-MODULE_DESCRIPTION("Prolific PL-2301/2302/25A1 USB Host to Host Link Driver");
++MODULE_DESCRIPTION("Prolific PL-2301/2302/25A1/27A1 USB Host to Host Link Driver");
+ MODULE_LICENSE("GPL");
+diff --git a/drivers/tty/goldfish.c b/drivers/tty/goldfish.c
+index 0f82c0b146f6..e04b57f79df8 100644
+--- a/drivers/tty/goldfish.c
++++ b/drivers/tty/goldfish.c
+@@ -293,7 +293,7 @@ static int goldfish_tty_probe(struct platform_device *pdev)
+ 	return 0;
+ 
+ err_tty_register_device_failed:
+-	free_irq(irq, pdev);
++	free_irq(irq, qtty);
+ err_request_irq_failed:
+ 	goldfish_tty_current_line_count--;
+ 	if (goldfish_tty_current_line_count == 0)
+diff --git a/drivers/usb/chipidea/otg.c b/drivers/usb/chipidea/otg.c
+index 0cf149edddd8..f36a1ac3bfbd 100644
+--- a/drivers/usb/chipidea/otg.c
++++ b/drivers/usb/chipidea/otg.c
+@@ -134,9 +134,9 @@ void ci_handle_vbus_change(struct ci_hdrc *ci)
+ 	if (!ci->is_otg)
+ 		return;
+ 
+-	if (hw_read_otgsc(ci, OTGSC_BSV))
++	if (hw_read_otgsc(ci, OTGSC_BSV) && !ci->vbus_active)
+ 		usb_gadget_vbus_connect(&ci->gadget);
+-	else
++	else if (!hw_read_otgsc(ci, OTGSC_BSV) && ci->vbus_active)
+ 		usb_gadget_vbus_disconnect(&ci->gadget);
+ }
+ 
+@@ -175,14 +175,21 @@ static void ci_handle_id_switch(struct ci_hdrc *ci)
+ 
+ 		ci_role_stop(ci);
+ 
+-		if (role == CI_ROLE_GADGET)
++		if (role == CI_ROLE_GADGET &&
++				IS_ERR(ci->platdata->vbus_extcon.edev))
+ 			/*
+-			 * wait vbus lower than OTGSC_BSV before connecting
+-			 * to host
++			 * Wait vbus lower than OTGSC_BSV before connecting
++			 * to host. If connecting status is from an external
++			 * connector instead of register, we don't need to
++			 * care vbus on the board, since it will not affect
++			 * external connector status.
+ 			 */
+ 			hw_wait_vbus_lower_bsv(ci);
+ 
+ 		ci_role_start(ci, role);
++		/* vbus change may have already occurred */
++		if (role == CI_ROLE_GADGET)
++			ci_handle_vbus_change(ci);
+ 	}
+ }
+ /**
+diff --git a/drivers/usb/serial/mos7720.c b/drivers/usb/serial/mos7720.c
+index e56cdb436de3..4581fa1dec98 100644
+--- a/drivers/usb/serial/mos7720.c
++++ b/drivers/usb/serial/mos7720.c
+@@ -234,11 +234,16 @@ static int read_mos_reg(struct usb_serial *serial, unsigned int serial_portnum,
+ 
+ 	status = usb_control_msg(usbdev, pipe, request, requesttype, value,
+ 				     index, buf, 1, MOS_WDR_TIMEOUT);
+-	if (status == 1)
++	if (status == 1) {
+ 		*data = *buf;
+-	else if (status < 0)
++	} else {
+ 		dev_err(&usbdev->dev,
+ 			"mos7720: usb_control_msg() failed: %d\n", status);
++		if (status >= 0)
++			status = -EIO;
++		*data = 0;
++	}
++
+ 	kfree(buf);
+ 
+ 	return status;
+diff --git a/drivers/usb/serial/mos7840.c b/drivers/usb/serial/mos7840.c
+index d17685cc00c9..ed883a7ad533 100644
+--- a/drivers/usb/serial/mos7840.c
++++ b/drivers/usb/serial/mos7840.c
+@@ -285,9 +285,15 @@ static int mos7840_get_reg_sync(struct usb_serial_port *port, __u16 reg,
+ 	ret = usb_control_msg(dev, usb_rcvctrlpipe(dev, 0), MCS_RDREQ,
+ 			      MCS_RD_RTYPE, 0, reg, buf, VENDOR_READ_LENGTH,
+ 			      MOS_WDR_TIMEOUT);
++	if (ret < VENDOR_READ_LENGTH) {
++		if (ret >= 0)
++			ret = -EIO;
++		goto out;
++	}
++
+ 	*val = buf[0];
+ 	dev_dbg(&port->dev, "%s offset is %x, return val %x\n", __func__, reg, *val);
+-
++out:
+ 	kfree(buf);
+ 	return ret;
+ }
+@@ -353,8 +359,13 @@ static int mos7840_get_uart_reg(struct usb_serial_port *port, __u16 reg,
+ 	ret = usb_control_msg(dev, usb_rcvctrlpipe(dev, 0), MCS_RDREQ,
+ 			      MCS_RD_RTYPE, Wval, reg, buf, VENDOR_READ_LENGTH,
+ 			      MOS_WDR_TIMEOUT);
++	if (ret < VENDOR_READ_LENGTH) {
++		if (ret >= 0)
++			ret = -EIO;
++		goto out;
++	}
+ 	*val = buf[0];
+-
++out:
+ 	kfree(buf);
+ 	return ret;
+ }
+@@ -1490,10 +1501,10 @@ static int mos7840_tiocmget(struct tty_struct *tty)
+ 		return -ENODEV;
+ 
+ 	status = mos7840_get_uart_reg(port, MODEM_STATUS_REGISTER, &msr);
+-	if (status != 1)
++	if (status < 0)
+ 		return -EIO;
+ 	status = mos7840_get_uart_reg(port, MODEM_CONTROL_REGISTER, &mcr);
+-	if (status != 1)
++	if (status < 0)
+ 		return -EIO;
+ 	result = ((mcr & MCR_DTR) ? TIOCM_DTR : 0)
+ 	    | ((mcr & MCR_RTS) ? TIOCM_RTS : 0)
+diff --git a/fs/gfs2/glock.c b/fs/gfs2/glock.c
+index ff36f5475d7e..09a0cf5f3dd8 100644
+--- a/fs/gfs2/glock.c
++++ b/fs/gfs2/glock.c
+@@ -1798,16 +1798,18 @@ void gfs2_glock_exit(void)
+ 
+ static void gfs2_glock_iter_next(struct gfs2_glock_iter *gi)
+ {
+-	do {
+-		gi->gl = rhashtable_walk_next(&gi->hti);
++	while ((gi->gl = rhashtable_walk_next(&gi->hti))) {
+ 		if (IS_ERR(gi->gl)) {
+ 			if (PTR_ERR(gi->gl) == -EAGAIN)
+ 				continue;
+ 			gi->gl = NULL;
++			return;
+ 		}
+-	/* Skip entries for other sb and dead entries */
+-	} while ((gi->gl) && ((gi->sdp != gi->gl->gl_name.ln_sbd) ||
+-			      __lockref_is_dead(&gi->gl->gl_lockref)));
++		/* Skip entries for other sb and dead entries */
++		if (gi->sdp == gi->gl->gl_name.ln_sbd &&
++		    !__lockref_is_dead(&gi->gl->gl_lockref))
++			return;
++	}
+ }
+ 
+ static void *gfs2_glock_seq_start(struct seq_file *seq, loff_t *pos)
+diff --git a/fs/xfs/kmem.c b/fs/xfs/kmem.c
+index 686ba6fb20dd..8067364c602f 100644
+--- a/fs/xfs/kmem.c
++++ b/fs/xfs/kmem.c
+@@ -24,24 +24,6 @@
+ #include "kmem.h"
+ #include "xfs_message.h"
+ 
+-/*
+- * Greedy allocation.  May fail and may return vmalloced memory.
+- */
+-void *
+-kmem_zalloc_greedy(size_t *size, size_t minsize, size_t maxsize)
+-{
+-	void		*ptr;
+-	size_t		kmsize = maxsize;
+-
+-	while (!(ptr = vzalloc(kmsize))) {
+-		if ((kmsize >>= 1) <= minsize)
+-			kmsize = minsize;
+-	}
+-	if (ptr)
+-		*size = kmsize;
+-	return ptr;
+-}
+-
+ void *
+ kmem_alloc(size_t size, xfs_km_flags_t flags)
+ {
+diff --git a/fs/xfs/kmem.h b/fs/xfs/kmem.h
+index cc6b768fc068..ae45f77ce33b 100644
+--- a/fs/xfs/kmem.h
++++ b/fs/xfs/kmem.h
+@@ -69,8 +69,6 @@ static inline void  kmem_free(const void *ptr)
+ }
+ 
+ 
+-extern void *kmem_zalloc_greedy(size_t *, size_t, size_t);
+-
+ static inline void *
+ kmem_zalloc(size_t size, xfs_km_flags_t flags)
+ {
+diff --git a/fs/xfs/xfs_itable.c b/fs/xfs/xfs_itable.c
+index 930ebd86beba..99a4891c00ab 100644
+--- a/fs/xfs/xfs_itable.c
++++ b/fs/xfs/xfs_itable.c
+@@ -351,7 +351,6 @@ xfs_bulkstat(
+ 	xfs_agino_t		agino;	/* inode # in allocation group */
+ 	xfs_agnumber_t		agno;	/* allocation group number */
+ 	xfs_btree_cur_t		*cur;	/* btree cursor for ialloc btree */
+-	size_t			irbsize; /* size of irec buffer in bytes */
+ 	xfs_inobt_rec_incore_t	*irbuf;	/* start of irec buffer */
+ 	int			nirbuf;	/* size of irbuf */
+ 	int			ubcount; /* size of user's buffer */
+@@ -378,11 +377,10 @@ xfs_bulkstat(
+ 	*ubcountp = 0;
+ 	*done = 0;
+ 
+-	irbuf = kmem_zalloc_greedy(&irbsize, PAGE_SIZE, PAGE_SIZE * 4);
++	irbuf = kmem_zalloc_large(PAGE_SIZE * 4, KM_SLEEP);
+ 	if (!irbuf)
+ 		return -ENOMEM;
+-
+-	nirbuf = irbsize / sizeof(*irbuf);
++	nirbuf = (PAGE_SIZE * 4) / sizeof(*irbuf);
+ 
+ 	/*
+ 	 * Loop over the allocation groups, starting from the last
+diff --git a/include/linux/audit.h b/include/linux/audit.h
+index 20eba1eb0a3c..faac391badac 100644
+--- a/include/linux/audit.h
++++ b/include/linux/audit.h
+@@ -281,6 +281,20 @@ static inline int audit_socketcall(int nargs, unsigned long *args)
+ 		return __audit_socketcall(nargs, args);
+ 	return 0;
+ }
++
++static inline int audit_socketcall_compat(int nargs, u32 *args)
++{
++	unsigned long a[AUDITSC_ARGS];
++	int i;
++
++	if (audit_dummy_context())
++		return 0;
++
++	for (i = 0; i < nargs; i++)
++		a[i] = (unsigned long)args[i];
++	return __audit_socketcall(nargs, a);
++}
++
+ static inline int audit_sockaddr(int len, void *addr)
+ {
+ 	if (unlikely(!audit_dummy_context()))
+@@ -407,6 +421,12 @@ static inline int audit_socketcall(int nargs, unsigned long *args)
+ {
+ 	return 0;
+ }
++
++static inline int audit_socketcall_compat(int nargs, u32 *args)
++{
++	return 0;
++}
++
+ static inline void audit_fd_pair(int fd1, int fd2)
+ { }
+ static inline int audit_sockaddr(int len, void *addr)
+diff --git a/include/linux/mmc/sdio_func.h b/include/linux/mmc/sdio_func.h
+index aab032a6ae61..97ca105347a6 100644
+--- a/include/linux/mmc/sdio_func.h
++++ b/include/linux/mmc/sdio_func.h
+@@ -53,7 +53,7 @@ struct sdio_func {
+ 	unsigned int		state;		/* function state */
+ #define SDIO_STATE_PRESENT	(1<<0)		/* present in sysfs */
+ 
+-	u8			tmpbuf[4];	/* DMA:able scratch buffer */
++	u8			*tmpbuf;	/* DMA:able scratch buffer */
+ 
+ 	unsigned		num_info;	/* number of info strings */
+ 	const char		**info;		/* info strings */
+diff --git a/include/uapi/drm/drm_fourcc.h b/include/uapi/drm/drm_fourcc.h
+index 0b69a7753558..f28f79966e9e 100644
+--- a/include/uapi/drm/drm_fourcc.h
++++ b/include/uapi/drm/drm_fourcc.h
+@@ -150,6 +150,7 @@
+ 
+ /* Vendor Ids: */
+ #define DRM_FORMAT_MOD_NONE           0
++#define DRM_FORMAT_MOD_VENDOR_NONE    0
+ #define DRM_FORMAT_MOD_VENDOR_INTEL   0x01
+ #define DRM_FORMAT_MOD_VENDOR_AMD     0x02
+ #define DRM_FORMAT_MOD_VENDOR_NV      0x03
+diff --git a/net/bridge/br_netlink.c b/net/bridge/br_netlink.c
+index ff8bb41d713f..a1f697ec4fc2 100644
+--- a/net/bridge/br_netlink.c
++++ b/net/bridge/br_netlink.c
+@@ -1073,11 +1073,14 @@ static int br_dev_newlink(struct net *src_net, struct net_device *dev,
+ 		spin_unlock_bh(&br->lock);
+ 	}
+ 
+-	err = br_changelink(dev, tb, data);
++	err = register_netdevice(dev);
+ 	if (err)
+ 		return err;
+ 
+-	return register_netdevice(dev);
++	err = br_changelink(dev, tb, data);
++	if (err)
++		unregister_netdevice(dev);
++	return err;
+ }
+ 
+ static size_t br_get_size(const struct net_device *brdev)
+diff --git a/net/compat.c b/net/compat.c
+index 5cfd26a0006f..0ccf3ecf6bbb 100644
+--- a/net/compat.c
++++ b/net/compat.c
+@@ -22,6 +22,7 @@
+ #include <linux/filter.h>
+ #include <linux/compat.h>
+ #include <linux/security.h>
++#include <linux/audit.h>
+ #include <linux/export.h>
+ 
+ #include <net/scm.h>
+@@ -767,14 +768,24 @@ COMPAT_SYSCALL_DEFINE5(recvmmsg, int, fd, struct compat_mmsghdr __user *, mmsg,
+ 
+ COMPAT_SYSCALL_DEFINE2(socketcall, int, call, u32 __user *, args)
+ {
+-	int ret;
+-	u32 a[6];
++	u32 a[AUDITSC_ARGS];
++	unsigned int len;
+ 	u32 a0, a1;
++	int ret;
+ 
+ 	if (call < SYS_SOCKET || call > SYS_SENDMMSG)
+ 		return -EINVAL;
+-	if (copy_from_user(a, args, nas[call]))
++	len = nas[call];
++	if (len > sizeof(a))
++		return -EINVAL;
++
++	if (copy_from_user(a, args, len))
+ 		return -EFAULT;
++
++	ret = audit_socketcall_compat(len / sizeof(a[0]), a);
++	if (ret)
++		return ret;
++
+ 	a0 = a[0];
+ 	a1 = a[1];
+ 
+diff --git a/net/core/dev.c b/net/core/dev.c
+index 24d243084aab..dac52fa60f25 100644
+--- a/net/core/dev.c
++++ b/net/core/dev.c
+@@ -2338,6 +2338,9 @@ void __dev_kfree_skb_irq(struct sk_buff *skb, enum skb_free_reason reason)
+ {
+ 	unsigned long flags;
+ 
++	if (unlikely(!skb))
++		return;
++
+ 	if (likely(atomic_read(&skb->users) == 1)) {
+ 		smp_rmb();
+ 		atomic_set(&skb->users, 0);
+diff --git a/net/ipv4/netfilter/nf_nat_snmp_basic.c b/net/ipv4/netfilter/nf_nat_snmp_basic.c
+index ddb894ac1458..2689c9c4f1a0 100644
+--- a/net/ipv4/netfilter/nf_nat_snmp_basic.c
++++ b/net/ipv4/netfilter/nf_nat_snmp_basic.c
+@@ -1304,6 +1304,7 @@ static int __init nf_nat_snmp_basic_init(void)
+ static void __exit nf_nat_snmp_basic_fini(void)
+ {
+ 	RCU_INIT_POINTER(nf_nat_snmp_hook, NULL);
++	synchronize_rcu();
+ 	nf_conntrack_helper_unregister(&snmp_trap_helper);
+ }
+ 
+diff --git a/net/netfilter/nf_conntrack_ecache.c b/net/netfilter/nf_conntrack_ecache.c
+index 4e78c57b818f..f3b92ce463b0 100644
+--- a/net/netfilter/nf_conntrack_ecache.c
++++ b/net/netfilter/nf_conntrack_ecache.c
+@@ -200,6 +200,7 @@ void nf_conntrack_unregister_notifier(struct net *net,
+ 	BUG_ON(notify != new);
+ 	RCU_INIT_POINTER(net->ct.nf_conntrack_event_cb, NULL);
+ 	mutex_unlock(&nf_ct_ecache_mutex);
++	/* synchronize_rcu() is called from ctnetlink_exit. */
+ }
+ EXPORT_SYMBOL_GPL(nf_conntrack_unregister_notifier);
+ 
+@@ -236,6 +237,7 @@ void nf_ct_expect_unregister_notifier(struct net *net,
+ 	BUG_ON(notify != new);
+ 	RCU_INIT_POINTER(net->ct.nf_expect_event_cb, NULL);
+ 	mutex_unlock(&nf_ct_ecache_mutex);
++	/* synchronize_rcu() is called from ctnetlink_exit. */
+ }
+ EXPORT_SYMBOL_GPL(nf_ct_expect_unregister_notifier);
+ 
+diff --git a/net/netfilter/nf_conntrack_netlink.c b/net/netfilter/nf_conntrack_netlink.c
+index e565b2becb14..660939df7c94 100644
+--- a/net/netfilter/nf_conntrack_netlink.c
++++ b/net/netfilter/nf_conntrack_netlink.c
+@@ -3415,6 +3415,7 @@ static void __exit ctnetlink_exit(void)
+ #ifdef CONFIG_NETFILTER_NETLINK_GLUE_CT
+ 	RCU_INIT_POINTER(nfnl_ct_hook, NULL);
+ #endif
++	synchronize_rcu();
+ }
+ 
+ module_init(ctnetlink_init);
+diff --git a/net/netfilter/nf_nat_core.c b/net/netfilter/nf_nat_core.c
+index 06a9f45771ab..44516c90118a 100644
+--- a/net/netfilter/nf_nat_core.c
++++ b/net/netfilter/nf_nat_core.c
+@@ -892,6 +892,8 @@ static void __exit nf_nat_cleanup(void)
+ #ifdef CONFIG_XFRM
+ 	RCU_INIT_POINTER(nf_nat_decode_session_hook, NULL);
+ #endif
++	synchronize_rcu();
++
+ 	for (i = 0; i < NFPROTO_NUMPROTO; i++)
+ 		kfree(nf_nat_l4protos[i]);
+ 	synchronize_net();
+diff --git a/net/netfilter/nfnetlink_cthelper.c b/net/netfilter/nfnetlink_cthelper.c
+index 54330fb5efaf..6d10002d23f8 100644
+--- a/net/netfilter/nfnetlink_cthelper.c
++++ b/net/netfilter/nfnetlink_cthelper.c
+@@ -161,6 +161,7 @@ nfnl_cthelper_parse_expect_policy(struct nf_conntrack_helper *helper,
+ 	int i, ret;
+ 	struct nf_conntrack_expect_policy *expect_policy;
+ 	struct nlattr *tb[NFCTH_POLICY_SET_MAX+1];
++	unsigned int class_max;
+ 
+ 	ret = nla_parse_nested(tb, NFCTH_POLICY_SET_MAX, attr,
+ 			       nfnl_cthelper_expect_policy_set);
+@@ -170,19 +171,18 @@ nfnl_cthelper_parse_expect_policy(struct nf_conntrack_helper *helper,
+ 	if (!tb[NFCTH_POLICY_SET_NUM])
+ 		return -EINVAL;
+ 
+-	helper->expect_class_max =
+-		ntohl(nla_get_be32(tb[NFCTH_POLICY_SET_NUM]));
+-
+-	if (helper->expect_class_max != 0 &&
+-	    helper->expect_class_max > NF_CT_MAX_EXPECT_CLASSES)
++	class_max = ntohl(nla_get_be32(tb[NFCTH_POLICY_SET_NUM]));
++	if (class_max == 0)
++		return -EINVAL;
++	if (class_max > NF_CT_MAX_EXPECT_CLASSES)
+ 		return -EOVERFLOW;
+ 
+ 	expect_policy = kzalloc(sizeof(struct nf_conntrack_expect_policy) *
+-				helper->expect_class_max, GFP_KERNEL);
++				class_max, GFP_KERNEL);
+ 	if (expect_policy == NULL)
+ 		return -ENOMEM;
+ 
+-	for (i=0; i<helper->expect_class_max; i++) {
++	for (i = 0; i < class_max; i++) {
+ 		if (!tb[NFCTH_POLICY_SET+i])
+ 			goto err;
+ 
+@@ -191,6 +191,8 @@ nfnl_cthelper_parse_expect_policy(struct nf_conntrack_helper *helper,
+ 		if (ret < 0)
+ 			goto err;
+ 	}
++
++	helper->expect_class_max = class_max - 1;
+ 	helper->expect_policy = expect_policy;
+ 	return 0;
+ err:
+@@ -377,10 +379,10 @@ nfnl_cthelper_dump_policy(struct sk_buff *skb,
+ 		goto nla_put_failure;
+ 
+ 	if (nla_put_be32(skb, NFCTH_POLICY_SET_NUM,
+-			 htonl(helper->expect_class_max)))
++			 htonl(helper->expect_class_max + 1)))
+ 		goto nla_put_failure;
+ 
+-	for (i=0; i<helper->expect_class_max; i++) {
++	for (i = 0; i < helper->expect_class_max + 1; i++) {
+ 		nest_parms2 = nla_nest_start(skb,
+ 				(NFCTH_POLICY_SET+i) | NLA_F_NESTED);
+ 		if (nest_parms2 == NULL)
+diff --git a/net/netfilter/nfnetlink_cttimeout.c b/net/netfilter/nfnetlink_cttimeout.c
+index c7a2d0e1c462..ed9153bd7e73 100644
+--- a/net/netfilter/nfnetlink_cttimeout.c
++++ b/net/netfilter/nfnetlink_cttimeout.c
+@@ -611,8 +611,8 @@ static void __exit cttimeout_exit(void)
+ #ifdef CONFIG_NF_CONNTRACK_TIMEOUT
+ 	RCU_INIT_POINTER(nf_ct_timeout_find_get_hook, NULL);
+ 	RCU_INIT_POINTER(nf_ct_timeout_put_hook, NULL);
++	synchronize_rcu();
+ #endif /* CONFIG_NF_CONNTRACK_TIMEOUT */
+-	rcu_barrier();
+ }
+ 
+ module_init(cttimeout_init);
+diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c
+index 148ec130d99d..b70055fc30cb 100644
+--- a/net/packet/af_packet.c
++++ b/net/packet/af_packet.c
+@@ -3802,6 +3802,8 @@ static int packet_getsockopt(struct socket *sock, int level, int optname,
+ 	case PACKET_HDRLEN:
+ 		if (len > sizeof(int))
+ 			len = sizeof(int);
++		if (len < sizeof(int))
++			return -EINVAL;
+ 		if (copy_from_user(&val, optval, len))
+ 			return -EFAULT;
+ 		switch (val) {
+diff --git a/net/rds/ib_cm.c b/net/rds/ib_cm.c
+index da5a7fb98c77..a6f5b3d21571 100644
+--- a/net/rds/ib_cm.c
++++ b/net/rds/ib_cm.c
+@@ -381,7 +381,7 @@ static int rds_ib_setup_qp(struct rds_connection *conn)
+ 		ret = PTR_ERR(ic->i_send_cq);
+ 		ic->i_send_cq = NULL;
+ 		rdsdebug("ib_create_cq send failed: %d\n", ret);
+-		goto out;
++		goto rds_ibdev_out;
+ 	}
+ 
+ 	cq_attr.cqe = ic->i_recv_ring.w_nr;
+@@ -392,19 +392,19 @@ static int rds_ib_setup_qp(struct rds_connection *conn)
+ 		ret = PTR_ERR(ic->i_recv_cq);
+ 		ic->i_recv_cq = NULL;
+ 		rdsdebug("ib_create_cq recv failed: %d\n", ret);
+-		goto out;
++		goto send_cq_out;
+ 	}
+ 
+ 	ret = ib_req_notify_cq(ic->i_send_cq, IB_CQ_NEXT_COMP);
+ 	if (ret) {
+ 		rdsdebug("ib_req_notify_cq send failed: %d\n", ret);
+-		goto out;
++		goto recv_cq_out;
+ 	}
+ 
+ 	ret = ib_req_notify_cq(ic->i_recv_cq, IB_CQ_SOLICITED);
+ 	if (ret) {
+ 		rdsdebug("ib_req_notify_cq recv failed: %d\n", ret);
+-		goto out;
++		goto recv_cq_out;
+ 	}
+ 
+ 	/* XXX negotiate max send/recv with remote? */
+@@ -428,7 +428,7 @@ static int rds_ib_setup_qp(struct rds_connection *conn)
+ 	ret = rdma_create_qp(ic->i_cm_id, ic->i_pd, &attr);
+ 	if (ret) {
+ 		rdsdebug("rdma_create_qp failed: %d\n", ret);
+-		goto out;
++		goto recv_cq_out;
+ 	}
+ 
+ 	ic->i_send_hdrs = ib_dma_alloc_coherent(dev,
+@@ -438,7 +438,7 @@ static int rds_ib_setup_qp(struct rds_connection *conn)
+ 	if (!ic->i_send_hdrs) {
+ 		ret = -ENOMEM;
+ 		rdsdebug("ib_dma_alloc_coherent send failed\n");
+-		goto out;
++		goto qp_out;
+ 	}
+ 
+ 	ic->i_recv_hdrs = ib_dma_alloc_coherent(dev,
+@@ -448,7 +448,7 @@ static int rds_ib_setup_qp(struct rds_connection *conn)
+ 	if (!ic->i_recv_hdrs) {
+ 		ret = -ENOMEM;
+ 		rdsdebug("ib_dma_alloc_coherent recv failed\n");
+-		goto out;
++		goto send_hdrs_dma_out;
+ 	}
+ 
+ 	ic->i_ack = ib_dma_alloc_coherent(dev, sizeof(struct rds_header),
+@@ -456,7 +456,7 @@ static int rds_ib_setup_qp(struct rds_connection *conn)
+ 	if (!ic->i_ack) {
+ 		ret = -ENOMEM;
+ 		rdsdebug("ib_dma_alloc_coherent ack failed\n");
+-		goto out;
++		goto recv_hdrs_dma_out;
+ 	}
+ 
+ 	ic->i_sends = vzalloc_node(ic->i_send_ring.w_nr * sizeof(struct rds_ib_send_work),
+@@ -464,7 +464,7 @@ static int rds_ib_setup_qp(struct rds_connection *conn)
+ 	if (!ic->i_sends) {
+ 		ret = -ENOMEM;
+ 		rdsdebug("send allocation failed\n");
+-		goto out;
++		goto ack_dma_out;
+ 	}
+ 
+ 	ic->i_recvs = vzalloc_node(ic->i_recv_ring.w_nr * sizeof(struct rds_ib_recv_work),
+@@ -472,7 +472,7 @@ static int rds_ib_setup_qp(struct rds_connection *conn)
+ 	if (!ic->i_recvs) {
+ 		ret = -ENOMEM;
+ 		rdsdebug("recv allocation failed\n");
+-		goto out;
++		goto sends_out;
+ 	}
+ 
+ 	rds_ib_recv_init_ack(ic);
+@@ -480,8 +480,33 @@ static int rds_ib_setup_qp(struct rds_connection *conn)
+ 	rdsdebug("conn %p pd %p cq %p %p\n", conn, ic->i_pd,
+ 		 ic->i_send_cq, ic->i_recv_cq);
+ 
+-out:
++	return ret;
++
++sends_out:
++	vfree(ic->i_sends);
++ack_dma_out:
++	ib_dma_free_coherent(dev, sizeof(struct rds_header),
++			     ic->i_ack, ic->i_ack_dma);
++recv_hdrs_dma_out:
++	ib_dma_free_coherent(dev, ic->i_recv_ring.w_nr *
++					sizeof(struct rds_header),
++					ic->i_recv_hdrs, ic->i_recv_hdrs_dma);
++send_hdrs_dma_out:
++	ib_dma_free_coherent(dev, ic->i_send_ring.w_nr *
++					sizeof(struct rds_header),
++					ic->i_send_hdrs, ic->i_send_hdrs_dma);
++qp_out:
++	rdma_destroy_qp(ic->i_cm_id);
++recv_cq_out:
++	if (!ib_destroy_cq(ic->i_recv_cq))
++		ic->i_recv_cq = NULL;
++send_cq_out:
++	if (!ib_destroy_cq(ic->i_send_cq))
++		ic->i_send_cq = NULL;
++rds_ibdev_out:
++	rds_ib_remove_conn(rds_ibdev, conn);
+ 	rds_ib_dev_put(rds_ibdev);
++
+ 	return ret;
+ }
+ 
+diff --git a/net/rds/ib_send.c b/net/rds/ib_send.c
+index eac30bf486d7..094e2a12860a 100644
+--- a/net/rds/ib_send.c
++++ b/net/rds/ib_send.c
+@@ -68,16 +68,6 @@ static void rds_ib_send_complete(struct rds_message *rm,
+ 	complete(rm, notify_status);
+ }
+ 
+-static void rds_ib_send_unmap_data(struct rds_ib_connection *ic,
+-				   struct rm_data_op *op,
+-				   int wc_status)
+-{
+-	if (op->op_nents)
+-		ib_dma_unmap_sg(ic->i_cm_id->device,
+-				op->op_sg, op->op_nents,
+-				DMA_TO_DEVICE);
+-}
+-
+ static void rds_ib_send_unmap_rdma(struct rds_ib_connection *ic,
+ 				   struct rm_rdma_op *op,
+ 				   int wc_status)
+@@ -138,6 +128,21 @@ static void rds_ib_send_unmap_atomic(struct rds_ib_connection *ic,
+ 		rds_ib_stats_inc(s_ib_atomic_fadd);
+ }
+ 
++static void rds_ib_send_unmap_data(struct rds_ib_connection *ic,
++				   struct rm_data_op *op,
++				   int wc_status)
++{
++	struct rds_message *rm = container_of(op, struct rds_message, data);
++
++	if (op->op_nents)
++		ib_dma_unmap_sg(ic->i_cm_id->device,
++				op->op_sg, op->op_nents,
++				DMA_TO_DEVICE);
++
++	if (rm->rdma.op_active && rm->data.op_notify)
++		rds_ib_send_unmap_rdma(ic, &rm->rdma, wc_status);
++}
++
+ /*
+  * Unmap the resources associated with a struct send_work.
+  *
+diff --git a/net/rds/rdma.c b/net/rds/rdma.c
+index 4c93badeabf2..8d3a851a3476 100644
+--- a/net/rds/rdma.c
++++ b/net/rds/rdma.c
+@@ -626,6 +626,16 @@ int rds_cmsg_rdma_args(struct rds_sock *rs, struct rds_message *rm,
+ 		}
+ 		op->op_notifier->n_user_token = args->user_token;
+ 		op->op_notifier->n_status = RDS_RDMA_SUCCESS;
++
++		/* Enable rmda notification on data operation for composite
++		 * rds messages and make sure notification is enabled only
++		 * for the data operation which follows it so that application
++		 * gets notified only after full message gets delivered.
++		 */
++		if (rm->data.op_sg) {
++			rm->rdma.op_notify = 0;
++			rm->data.op_notify = !!(args->flags & RDS_RDMA_NOTIFY_ME);
++		}
+ 	}
+ 
+ 	/* The cookie contains the R_Key of the remote memory region, and
+diff --git a/net/rds/rds.h b/net/rds/rds.h
+index 0e2797bdc316..4588860f4c3b 100644
+--- a/net/rds/rds.h
++++ b/net/rds/rds.h
+@@ -378,6 +378,7 @@ struct rds_message {
+ 		} rdma;
+ 		struct rm_data_op {
+ 			unsigned int		op_active:1;
++			unsigned int		op_notify:1;
+ 			unsigned int		op_nents;
+ 			unsigned int		op_count;
+ 			unsigned int		op_dmasg;
+diff --git a/net/rds/send.c b/net/rds/send.c
+index c9cdb358ea88..6815f03324d7 100644
+--- a/net/rds/send.c
++++ b/net/rds/send.c
+@@ -467,12 +467,14 @@ void rds_rdma_send_complete(struct rds_message *rm, int status)
+ 	struct rm_rdma_op *ro;
+ 	struct rds_notifier *notifier;
+ 	unsigned long flags;
++	unsigned int notify = 0;
+ 
+ 	spin_lock_irqsave(&rm->m_rs_lock, flags);
+ 
++	notify =  rm->rdma.op_notify | rm->data.op_notify;
+ 	ro = &rm->rdma;
+ 	if (test_bit(RDS_MSG_ON_SOCK, &rm->m_flags) &&
+-	    ro->op_active && ro->op_notify && ro->op_notifier) {
++	    ro->op_active && notify && ro->op_notifier) {
+ 		notifier = ro->op_notifier;
+ 		rs = rm->m_rs;
+ 		sock_hold(rds_rs_to_sk(rs));
+diff --git a/sound/pci/au88x0/au88x0_core.c b/sound/pci/au88x0/au88x0_core.c
+index d3125c169684..065a69cf6118 100644
+--- a/sound/pci/au88x0/au88x0_core.c
++++ b/sound/pci/au88x0/au88x0_core.c
+@@ -2279,6 +2279,9 @@ vortex_adb_allocroute(vortex_t *vortex, int dma, int nr_ch, int dir,
+ 	} else {
+ 		int src[2], mix[2];
+ 
++		if (nr_ch < 1)
++			return -EINVAL;
++
+ 		/* Get SRC and MIXER hardware resources. */
+ 		for (i = 0; i < nr_ch; i++) {
+ 			if ((mix[i] =
+diff --git a/sound/soc/soc-dapm.c b/sound/soc/soc-dapm.c
+index b8a256dfed7e..6a438a361592 100644
+--- a/sound/soc/soc-dapm.c
++++ b/sound/soc/soc-dapm.c
+@@ -358,6 +358,10 @@ static int dapm_kcontrol_data_alloc(struct snd_soc_dapm_widget *widget,
+ 				snd_soc_dapm_new_control_unlocked(widget->dapm,
+ 				&template);
+ 			kfree(name);
++			if (IS_ERR(data->widget)) {
++				ret = PTR_ERR(data->widget);
++				goto err_data;
++			}
+ 			if (!data->widget) {
+ 				ret = -ENOMEM;
+ 				goto err_data;
+@@ -392,6 +396,10 @@ static int dapm_kcontrol_data_alloc(struct snd_soc_dapm_widget *widget,
+ 			data->widget = snd_soc_dapm_new_control_unlocked(
+ 						widget->dapm, &template);
+ 			kfree(name);
++			if (IS_ERR(data->widget)) {
++				ret = PTR_ERR(data->widget);
++				goto err_data;
++			}
+ 			if (!data->widget) {
+ 				ret = -ENOMEM;
+ 				goto err_data;
+@@ -3278,11 +3286,22 @@ snd_soc_dapm_new_control(struct snd_soc_dapm_context *dapm,
+ 
+ 	mutex_lock_nested(&dapm->card->dapm_mutex, SND_SOC_DAPM_CLASS_RUNTIME);
+ 	w = snd_soc_dapm_new_control_unlocked(dapm, widget);
++	/* Do not nag about probe deferrals */
++	if (IS_ERR(w)) {
++		int ret = PTR_ERR(w);
++
++		if (ret != -EPROBE_DEFER)
++			dev_err(dapm->dev,
++				"ASoC: Failed to create DAPM control %s (%d)\n",
++				widget->name, ret);
++		goto out_unlock;
++	}
+ 	if (!w)
+ 		dev_err(dapm->dev,
+ 			"ASoC: Failed to create DAPM control %s\n",
+ 			widget->name);
+ 
++out_unlock:
+ 	mutex_unlock(&dapm->card->dapm_mutex);
+ 	return w;
+ }
+@@ -3304,6 +3323,8 @@ snd_soc_dapm_new_control_unlocked(struct snd_soc_dapm_context *dapm,
+ 		w->regulator = devm_regulator_get(dapm->dev, w->name);
+ 		if (IS_ERR(w->regulator)) {
+ 			ret = PTR_ERR(w->regulator);
++			if (ret == -EPROBE_DEFER)
++				return ERR_PTR(ret);
+ 			dev_err(dapm->dev, "ASoC: Failed to request %s: %d\n",
+ 				w->name, ret);
+ 			return NULL;
+@@ -3322,6 +3343,8 @@ snd_soc_dapm_new_control_unlocked(struct snd_soc_dapm_context *dapm,
+ 		w->clk = devm_clk_get(dapm->dev, w->name);
+ 		if (IS_ERR(w->clk)) {
+ 			ret = PTR_ERR(w->clk);
++			if (ret == -EPROBE_DEFER)
++				return ERR_PTR(ret);
+ 			dev_err(dapm->dev, "ASoC: Failed to request %s: %d\n",
+ 				w->name, ret);
+ 			return NULL;
+@@ -3435,6 +3458,16 @@ int snd_soc_dapm_new_controls(struct snd_soc_dapm_context *dapm,
+ 	mutex_lock_nested(&dapm->card->dapm_mutex, SND_SOC_DAPM_CLASS_INIT);
+ 	for (i = 0; i < num; i++) {
+ 		w = snd_soc_dapm_new_control_unlocked(dapm, widget);
++		if (IS_ERR(w)) {
++			ret = PTR_ERR(w);
++			/* Do not nag about probe deferrals */
++			if (ret == -EPROBE_DEFER)
++				break;
++			dev_err(dapm->dev,
++				"ASoC: Failed to create DAPM control %s (%d)\n",
++				widget->name, ret);
++			break;
++		}
+ 		if (!w) {
+ 			dev_err(dapm->dev,
+ 				"ASoC: Failed to create DAPM control %s\n",
+@@ -3701,6 +3734,15 @@ int snd_soc_dapm_new_pcm(struct snd_soc_card *card,
+ 	dev_dbg(card->dev, "ASoC: adding %s widget\n", link_name);
+ 
+ 	w = snd_soc_dapm_new_control_unlocked(&card->dapm, &template);
++	if (IS_ERR(w)) {
++		ret = PTR_ERR(w);
++		/* Do not nag about probe deferrals */
++		if (ret != -EPROBE_DEFER)
++			dev_err(card->dev,
++				"ASoC: Failed to create %s widget (%d)\n",
++				link_name, ret);
++		goto outfree_kcontrol_news;
++	}
+ 	if (!w) {
+ 		dev_err(card->dev, "ASoC: Failed to create %s widget\n",
+ 			link_name);
+@@ -3752,6 +3794,16 @@ int snd_soc_dapm_new_dai_widgets(struct snd_soc_dapm_context *dapm,
+ 			template.name);
+ 
+ 		w = snd_soc_dapm_new_control_unlocked(dapm, &template);
++		if (IS_ERR(w)) {
++			int ret = PTR_ERR(w);
++
++			/* Do not nag about probe deferrals */
++			if (ret != -EPROBE_DEFER)
++				dev_err(dapm->dev,
++				"ASoC: Failed to create %s widget (%d)\n",
++				dai->driver->playback.stream_name, ret);
++			return ret;
++		}
+ 		if (!w) {
+ 			dev_err(dapm->dev, "ASoC: Failed to create %s widget\n",
+ 				dai->driver->playback.stream_name);
+@@ -3771,6 +3823,16 @@ int snd_soc_dapm_new_dai_widgets(struct snd_soc_dapm_context *dapm,
+ 			template.name);
+ 
+ 		w = snd_soc_dapm_new_control_unlocked(dapm, &template);
++		if (IS_ERR(w)) {
++			int ret = PTR_ERR(w);
++
++			/* Do not nag about probe deferrals */
++			if (ret != -EPROBE_DEFER)
++				dev_err(dapm->dev,
++				"ASoC: Failed to create %s widget (%d)\n",
++				dai->driver->playback.stream_name, ret);
++			return ret;
++		}
+ 		if (!w) {
+ 			dev_err(dapm->dev, "ASoC: Failed to create %s widget\n",
+ 				dai->driver->capture.stream_name);
+diff --git a/sound/soc/soc-topology.c b/sound/soc/soc-topology.c
+index 70396d3f6472..e3f34a86413c 100644
+--- a/sound/soc/soc-topology.c
++++ b/sound/soc/soc-topology.c
+@@ -1481,6 +1481,15 @@ widget:
+ 		widget = snd_soc_dapm_new_control(dapm, &template);
+ 	else
+ 		widget = snd_soc_dapm_new_control_unlocked(dapm, &template);
++	if (IS_ERR(widget)) {
++		ret = PTR_ERR(widget);
++		/* Do not nag about probe deferrals */
++		if (ret != -EPROBE_DEFER)
++			dev_err(tplg->dev,
++				"ASoC: failed to create widget %s controls (%d)\n",
++				w->name, ret);
++		goto hdr_err;
++	}
+ 	if (widget == NULL) {
+ 		dev_err(tplg->dev, "ASoC: failed to create widget %s controls\n",
+ 			w->name);