From: "Alice Ferrazzi" <alicef@gentoo.org>
To: gentoo-commits@lists.gentoo.org
Subject: [gentoo-commits] proj/linux-patches:4.14 commit in: /
Date: Sun, 25 Feb 2018 13:40:14 +0000 (UTC) [thread overview]
Message-ID: <1519566006.b6564907ab32c1a8c890c671c1c1e8b83e4967bc.alicef@gentoo> (raw)
commit: b6564907ab32c1a8c890c671c1c1e8b83e4967bc
Author: Alice Ferrazzi <alicef <AT> gentoo <DOT> org>
AuthorDate: Sun Feb 25 13:40:06 2018 +0000
Commit: Alice Ferrazzi <alicef <AT> gentoo <DOT> org>
CommitDate: Sun Feb 25 13:40:06 2018 +0000
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=b6564907
linux kernel 4.14.21
0000_README | 4 +
1021_linux-4.14.22.patch | 5047 ++++++++++++++++++++++++++++++++++++++++++++++
2 files changed, 5051 insertions(+)
diff --git a/0000_README b/0000_README
index f9abc2d..d7b4bf6 100644
--- a/0000_README
+++ b/0000_README
@@ -127,6 +127,10 @@ Patch: 1020_linux-4.14.21.patch
From: http://www.kernel.org
Desc: Linux 4.14.21
+Patch: 1021_linux-4.14.22.patch
+From: http://www.kernel.org
+Desc: Linux 4.14.22
+
Patch: 1500_XATTR_USER_PREFIX.patch
From: https://bugs.gentoo.org/show_bug.cgi?id=470644
Desc: Support for namespace user.pax.* on tmpfs.
diff --git a/1021_linux-4.14.22.patch b/1021_linux-4.14.22.patch
new file mode 100644
index 0000000..e7dd4a5
--- /dev/null
+++ b/1021_linux-4.14.22.patch
@@ -0,0 +1,5047 @@
+diff --git a/Makefile b/Makefile
+index 68d70485b088..03d41143900c 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,7 +1,7 @@
+ # SPDX-License-Identifier: GPL-2.0
+ VERSION = 4
+ PATCHLEVEL = 14
+-SUBLEVEL = 21
++SUBLEVEL = 22
+ EXTRAVERSION =
+ NAME = Petit Gorille
+
+diff --git a/arch/arm/boot/dts/am4372.dtsi b/arch/arm/boot/dts/am4372.dtsi
+index e5b061469bf8..4714a59fd86d 100644
+--- a/arch/arm/boot/dts/am4372.dtsi
++++ b/arch/arm/boot/dts/am4372.dtsi
+@@ -927,7 +927,8 @@
+ reg = <0x48038000 0x2000>,
+ <0x46000000 0x400000>;
+ reg-names = "mpu", "dat";
+- interrupts = <80>, <81>;
++ interrupts = <GIC_SPI 80 IRQ_TYPE_LEVEL_HIGH>,
++ <GIC_SPI 81 IRQ_TYPE_LEVEL_HIGH>;
+ interrupt-names = "tx", "rx";
+ status = "disabled";
+ dmas = <&edma 8 2>,
+@@ -941,7 +942,8 @@
+ reg = <0x4803C000 0x2000>,
+ <0x46400000 0x400000>;
+ reg-names = "mpu", "dat";
+- interrupts = <82>, <83>;
++ interrupts = <GIC_SPI 82 IRQ_TYPE_LEVEL_HIGH>,
++ <GIC_SPI 83 IRQ_TYPE_LEVEL_HIGH>;
+ interrupt-names = "tx", "rx";
+ status = "disabled";
+ dmas = <&edma 10 2>,
+diff --git a/arch/arm/boot/dts/am437x-cm-t43.dts b/arch/arm/boot/dts/am437x-cm-t43.dts
+index 9e92d480576b..3b9a94c274a7 100644
+--- a/arch/arm/boot/dts/am437x-cm-t43.dts
++++ b/arch/arm/boot/dts/am437x-cm-t43.dts
+@@ -301,8 +301,8 @@
+ status = "okay";
+ pinctrl-names = "default";
+ pinctrl-0 = <&spi0_pins>;
+- dmas = <&edma 16
+- &edma 17>;
++ dmas = <&edma 16 0
++ &edma 17 0>;
+ dma-names = "tx0", "rx0";
+
+ flash: w25q64cvzpig@0 {
+diff --git a/arch/arm/boot/dts/logicpd-som-lv-37xx-devkit.dts b/arch/arm/boot/dts/logicpd-som-lv-37xx-devkit.dts
+index 38faa90007d7..2fa5eb4bd402 100644
+--- a/arch/arm/boot/dts/logicpd-som-lv-37xx-devkit.dts
++++ b/arch/arm/boot/dts/logicpd-som-lv-37xx-devkit.dts
+@@ -72,7 +72,8 @@
+ };
+
+ &gpmc {
+- ranges = <1 0 0x08000000 0x1000000>; /* CS1: 16MB for LAN9221 */
++ ranges = <0 0 0x30000000 0x1000000 /* CS0: 16MB for NAND */
++ 1 0 0x2c000000 0x1000000>; /* CS1: 16MB for LAN9221 */
+
+ ethernet@gpmc {
+ pinctrl-names = "default";
+diff --git a/arch/arm/boot/dts/logicpd-som-lv.dtsi b/arch/arm/boot/dts/logicpd-som-lv.dtsi
+index 26cce4d18405..4f2c5ec75714 100644
+--- a/arch/arm/boot/dts/logicpd-som-lv.dtsi
++++ b/arch/arm/boot/dts/logicpd-som-lv.dtsi
+@@ -37,7 +37,7 @@
+ };
+
+ &gpmc {
+- ranges = <0 0 0x00000000 0x1000000>; /* CS0: 16MB for NAND */
++ ranges = <0 0 0x30000000 0x1000000>; /* CS0: 16MB for NAND */
+
+ nand@0,0 {
+ compatible = "ti,omap2-nand";
+@@ -121,7 +121,7 @@
+
+ &mmc3 {
+ interrupts-extended = <&intc 94 &omap3_pmx_core2 0x46>;
+- pinctrl-0 = <&mmc3_pins>;
++ pinctrl-0 = <&mmc3_pins &wl127x_gpio>;
+ pinctrl-names = "default";
+ vmmc-supply = <&wl12xx_vmmc>;
+ non-removable;
+@@ -132,8 +132,8 @@
+ wlcore: wlcore@2 {
+ compatible = "ti,wl1273";
+ reg = <2>;
+- interrupt-parent = <&gpio5>;
+- interrupts = <24 IRQ_TYPE_LEVEL_HIGH>; /* gpio 152 */
++ interrupt-parent = <&gpio1>;
++ interrupts = <2 IRQ_TYPE_LEVEL_HIGH>; /* gpio 2 */
+ ref-clock-frequency = <26000000>;
+ };
+ };
+@@ -157,8 +157,6 @@
+ OMAP3_CORE1_IOPAD(0x2166, PIN_INPUT_PULLUP | MUX_MODE3) /* sdmmc2_dat5.sdmmc3_dat1 */
+ OMAP3_CORE1_IOPAD(0x2168, PIN_INPUT_PULLUP | MUX_MODE3) /* sdmmc2_dat6.sdmmc3_dat2 */
+ OMAP3_CORE1_IOPAD(0x216a, PIN_INPUT_PULLUP | MUX_MODE3) /* sdmmc2_dat6.sdmmc3_dat3 */
+- OMAP3_CORE1_IOPAD(0x2184, PIN_INPUT_PULLUP | MUX_MODE4) /* mcbsp4_clkx.gpio_152 */
+- OMAP3_CORE1_IOPAD(0x2a0c, PIN_OUTPUT | MUX_MODE4) /* sys_boot1.gpio_3 */
+ OMAP3_CORE1_IOPAD(0x21d0, PIN_INPUT_PULLUP | MUX_MODE3) /* mcspi1_cs1.sdmmc3_cmd */
+ OMAP3_CORE1_IOPAD(0x21d2, PIN_INPUT_PULLUP | MUX_MODE3) /* mcspi1_cs2.sdmmc_clk */
+ >;
+@@ -228,6 +226,12 @@
+ OMAP3_WKUP_IOPAD(0x2a0e, PIN_OUTPUT | MUX_MODE4) /* sys_boot2.gpio_4 */
+ >;
+ };
++ wl127x_gpio: pinmux_wl127x_gpio_pin {
++ pinctrl-single,pins = <
++ OMAP3_WKUP_IOPAD(0x2a0c, PIN_INPUT | MUX_MODE4) /* sys_boot0.gpio_2 */
++ OMAP3_WKUP_IOPAD(0x2a0c, PIN_OUTPUT | MUX_MODE4) /* sys_boot1.gpio_3 */
++ >;
++ };
+ };
+
+ &omap3_pmx_core2 {
+diff --git a/arch/arm/boot/dts/omap4.dtsi b/arch/arm/boot/dts/omap4.dtsi
+index 64d00f5893a6..28d10abd8b04 100644
+--- a/arch/arm/boot/dts/omap4.dtsi
++++ b/arch/arm/boot/dts/omap4.dtsi
+@@ -354,7 +354,7 @@
+ elm: elm@48078000 {
+ compatible = "ti,am3352-elm";
+ reg = <0x48078000 0x2000>;
+- interrupts = <4>;
++ interrupts = <GIC_SPI 4 IRQ_TYPE_LEVEL_HIGH>;
+ ti,hwmods = "elm";
+ status = "disabled";
+ };
+@@ -861,14 +861,12 @@
+ usbhsohci: ohci@4a064800 {
+ compatible = "ti,ohci-omap3";
+ reg = <0x4a064800 0x400>;
+- interrupt-parent = <&gic>;
+ interrupts = <GIC_SPI 76 IRQ_TYPE_LEVEL_HIGH>;
+ };
+
+ usbhsehci: ehci@4a064c00 {
+ compatible = "ti,ehci-omap";
+ reg = <0x4a064c00 0x400>;
+- interrupt-parent = <&gic>;
+ interrupts = <GIC_SPI 77 IRQ_TYPE_LEVEL_HIGH>;
+ };
+ };
+diff --git a/arch/arm/common/bL_switcher_dummy_if.c b/arch/arm/common/bL_switcher_dummy_if.c
+index 4c10c6452678..f4dc1714a79e 100644
+--- a/arch/arm/common/bL_switcher_dummy_if.c
++++ b/arch/arm/common/bL_switcher_dummy_if.c
+@@ -57,3 +57,7 @@ static struct miscdevice bL_switcher_device = {
+ &bL_switcher_fops
+ };
+ module_misc_device(bL_switcher_device);
++
++MODULE_AUTHOR("Nicolas Pitre <nico@linaro.org>");
++MODULE_LICENSE("GPL v2");
++MODULE_DESCRIPTION("big.LITTLE switcher dummy user interface");
+diff --git a/arch/arm/mach-omap2/omap-secure.c b/arch/arm/mach-omap2/omap-secure.c
+index 5ac122e88f67..9ff92050053c 100644
+--- a/arch/arm/mach-omap2/omap-secure.c
++++ b/arch/arm/mach-omap2/omap-secure.c
+@@ -73,6 +73,25 @@ phys_addr_t omap_secure_ram_mempool_base(void)
+ return omap_secure_memblock_base;
+ }
+
++u32 omap3_save_secure_ram(void __iomem *addr, int size)
++{
++ u32 ret;
++ u32 param[5];
++
++ if (size != OMAP3_SAVE_SECURE_RAM_SZ)
++ return OMAP3_SAVE_SECURE_RAM_SZ;
++
++ param[0] = 4; /* Number of arguments */
++ param[1] = __pa(addr); /* Physical address for saving */
++ param[2] = 0;
++ param[3] = 1;
++ param[4] = 1;
++
++ ret = save_secure_ram_context(__pa(param));
++
++ return ret;
++}
++
+ /**
+ * rx51_secure_dispatcher: Routine to dispatch secure PPA API calls
+ * @idx: The PPA API index
+diff --git a/arch/arm/mach-omap2/omap-secure.h b/arch/arm/mach-omap2/omap-secure.h
+index bae263fba640..c509cde71f93 100644
+--- a/arch/arm/mach-omap2/omap-secure.h
++++ b/arch/arm/mach-omap2/omap-secure.h
+@@ -31,6 +31,8 @@
+ /* Maximum Secure memory storage size */
+ #define OMAP_SECURE_RAM_STORAGE (88 * SZ_1K)
+
++#define OMAP3_SAVE_SECURE_RAM_SZ 0x803F
++
+ /* Secure low power HAL API index */
+ #define OMAP4_HAL_SAVESECURERAM_INDEX 0x1a
+ #define OMAP4_HAL_SAVEHW_INDEX 0x1b
+@@ -65,6 +67,8 @@ extern u32 omap_smc2(u32 id, u32 falg, u32 pargs);
+ extern u32 omap_smc3(u32 id, u32 process, u32 flag, u32 pargs);
+ extern phys_addr_t omap_secure_ram_mempool_base(void);
+ extern int omap_secure_ram_reserve_memblock(void);
++extern u32 save_secure_ram_context(u32 args_pa);
++extern u32 omap3_save_secure_ram(void __iomem *save_regs, int size);
+
+ extern u32 rx51_secure_dispatcher(u32 idx, u32 process, u32 flag, u32 nargs,
+ u32 arg1, u32 arg2, u32 arg3, u32 arg4);
+diff --git a/arch/arm/mach-omap2/pm.h b/arch/arm/mach-omap2/pm.h
+index b668719b9b25..8e30772cfe32 100644
+--- a/arch/arm/mach-omap2/pm.h
++++ b/arch/arm/mach-omap2/pm.h
+@@ -81,10 +81,6 @@ extern unsigned int omap3_do_wfi_sz;
+ /* ... and its pointer from SRAM after copy */
+ extern void (*omap3_do_wfi_sram)(void);
+
+-/* save_secure_ram_context function pointer and size, for copy to SRAM */
+-extern int save_secure_ram_context(u32 *addr);
+-extern unsigned int save_secure_ram_context_sz;
+-
+ extern void omap3_save_scratchpad_contents(void);
+
+ #define PM_RTA_ERRATUM_i608 (1 << 0)
+diff --git a/arch/arm/mach-omap2/pm34xx.c b/arch/arm/mach-omap2/pm34xx.c
+index 841ba19d64a6..36c55547137c 100644
+--- a/arch/arm/mach-omap2/pm34xx.c
++++ b/arch/arm/mach-omap2/pm34xx.c
+@@ -48,6 +48,7 @@
+ #include "prm3xxx.h"
+ #include "pm.h"
+ #include "sdrc.h"
++#include "omap-secure.h"
+ #include "sram.h"
+ #include "control.h"
+ #include "vc.h"
+@@ -66,7 +67,6 @@ struct power_state {
+
+ static LIST_HEAD(pwrst_list);
+
+-static int (*_omap_save_secure_sram)(u32 *addr);
+ void (*omap3_do_wfi_sram)(void);
+
+ static struct powerdomain *mpu_pwrdm, *neon_pwrdm;
+@@ -121,8 +121,8 @@ static void omap3_save_secure_ram_context(void)
+ * will hang the system.
+ */
+ pwrdm_set_next_pwrst(mpu_pwrdm, PWRDM_POWER_ON);
+- ret = _omap_save_secure_sram((u32 *)(unsigned long)
+- __pa(omap3_secure_ram_storage));
++ ret = omap3_save_secure_ram(omap3_secure_ram_storage,
++ OMAP3_SAVE_SECURE_RAM_SZ);
+ pwrdm_set_next_pwrst(mpu_pwrdm, mpu_next_state);
+ /* Following is for error tracking, it should not happen */
+ if (ret) {
+@@ -434,15 +434,10 @@ static int __init pwrdms_setup(struct powerdomain *pwrdm, void *unused)
+ *
+ * The minimum set of functions is pushed to SRAM for execution:
+ * - omap3_do_wfi for erratum i581 WA,
+- * - save_secure_ram_context for security extensions.
+ */
+ void omap_push_sram_idle(void)
+ {
+ omap3_do_wfi_sram = omap_sram_push(omap3_do_wfi, omap3_do_wfi_sz);
+-
+- if (omap_type() != OMAP2_DEVICE_TYPE_GP)
+- _omap_save_secure_sram = omap_sram_push(save_secure_ram_context,
+- save_secure_ram_context_sz);
+ }
+
+ static void __init pm_errata_configure(void)
+@@ -553,7 +548,7 @@ int __init omap3_pm_init(void)
+ clkdm_add_wkdep(neon_clkdm, mpu_clkdm);
+ if (omap_type() != OMAP2_DEVICE_TYPE_GP) {
+ omap3_secure_ram_storage =
+- kmalloc(0x803F, GFP_KERNEL);
++ kmalloc(OMAP3_SAVE_SECURE_RAM_SZ, GFP_KERNEL);
+ if (!omap3_secure_ram_storage)
+ pr_err("Memory allocation failed when allocating for secure sram context\n");
+
+diff --git a/arch/arm/mach-omap2/prm33xx.c b/arch/arm/mach-omap2/prm33xx.c
+index d2c5bcabdbeb..ebaf80d72a10 100644
+--- a/arch/arm/mach-omap2/prm33xx.c
++++ b/arch/arm/mach-omap2/prm33xx.c
+@@ -176,17 +176,6 @@ static int am33xx_pwrdm_read_pwrst(struct powerdomain *pwrdm)
+ return v;
+ }
+
+-static int am33xx_pwrdm_read_prev_pwrst(struct powerdomain *pwrdm)
+-{
+- u32 v;
+-
+- v = am33xx_prm_read_reg(pwrdm->prcm_offs, pwrdm->pwrstst_offs);
+- v &= AM33XX_LASTPOWERSTATEENTERED_MASK;
+- v >>= AM33XX_LASTPOWERSTATEENTERED_SHIFT;
+-
+- return v;
+-}
+-
+ static int am33xx_pwrdm_set_lowpwrstchange(struct powerdomain *pwrdm)
+ {
+ am33xx_prm_rmw_reg_bits(AM33XX_LOWPOWERSTATECHANGE_MASK,
+@@ -357,7 +346,6 @@ struct pwrdm_ops am33xx_pwrdm_operations = {
+ .pwrdm_set_next_pwrst = am33xx_pwrdm_set_next_pwrst,
+ .pwrdm_read_next_pwrst = am33xx_pwrdm_read_next_pwrst,
+ .pwrdm_read_pwrst = am33xx_pwrdm_read_pwrst,
+- .pwrdm_read_prev_pwrst = am33xx_pwrdm_read_prev_pwrst,
+ .pwrdm_set_logic_retst = am33xx_pwrdm_set_logic_retst,
+ .pwrdm_read_logic_pwrst = am33xx_pwrdm_read_logic_pwrst,
+ .pwrdm_read_logic_retst = am33xx_pwrdm_read_logic_retst,
+diff --git a/arch/arm/mach-omap2/sleep34xx.S b/arch/arm/mach-omap2/sleep34xx.S
+index fa5fd24f524c..22daf4efed68 100644
+--- a/arch/arm/mach-omap2/sleep34xx.S
++++ b/arch/arm/mach-omap2/sleep34xx.S
+@@ -93,20 +93,13 @@ ENTRY(enable_omap3630_toggle_l2_on_restore)
+ ENDPROC(enable_omap3630_toggle_l2_on_restore)
+
+ /*
+- * Function to call rom code to save secure ram context. This gets
+- * relocated to SRAM, so it can be all in .data section. Otherwise
+- * we need to initialize api_params separately.
++ * Function to call rom code to save secure ram context.
++ *
++ * r0 = physical address of the parameters
+ */
+- .data
+- .align 3
+ ENTRY(save_secure_ram_context)
+ stmfd sp!, {r4 - r11, lr} @ save registers on stack
+- adr r3, api_params @ r3 points to parameters
+- str r0, [r3,#0x4] @ r0 has sdram address
+- ldr r12, high_mask
+- and r3, r3, r12
+- ldr r12, sram_phy_addr_mask
+- orr r3, r3, r12
++ mov r3, r0 @ physical address of parameters
+ mov r0, #25 @ set service ID for PPA
+ mov r12, r0 @ copy secure service ID in r12
+ mov r1, #0 @ set task id for ROM code in r1
+@@ -120,18 +113,7 @@ ENTRY(save_secure_ram_context)
+ nop
+ nop
+ ldmfd sp!, {r4 - r11, pc}
+- .align
+-sram_phy_addr_mask:
+- .word SRAM_BASE_P
+-high_mask:
+- .word 0xffff
+-api_params:
+- .word 0x4, 0x0, 0x0, 0x1, 0x1
+ ENDPROC(save_secure_ram_context)
+-ENTRY(save_secure_ram_context_sz)
+- .word . - save_secure_ram_context
+-
+- .text
+
+ /*
+ * ======================
+diff --git a/arch/arm64/boot/dts/mediatek/mt8173.dtsi b/arch/arm64/boot/dts/mediatek/mt8173.dtsi
+index b99a27372965..da64e1cab233 100644
+--- a/arch/arm64/boot/dts/mediatek/mt8173.dtsi
++++ b/arch/arm64/boot/dts/mediatek/mt8173.dtsi
+@@ -81,6 +81,7 @@
+ reg = <0x000>;
+ enable-method = "psci";
+ cpu-idle-states = <&CPU_SLEEP_0>;
++ #cooling-cells = <2>;
+ };
+
+ cpu1: cpu@1 {
+@@ -97,6 +98,7 @@
+ reg = <0x100>;
+ enable-method = "psci";
+ cpu-idle-states = <&CPU_SLEEP_0>;
++ #cooling-cells = <2>;
+ };
+
+ cpu3: cpu@101 {
+diff --git a/arch/m68k/kernel/vmlinux-nommu.lds b/arch/m68k/kernel/vmlinux-nommu.lds
+index 3aa571a513b5..cf6edda38971 100644
+--- a/arch/m68k/kernel/vmlinux-nommu.lds
++++ b/arch/m68k/kernel/vmlinux-nommu.lds
+@@ -45,6 +45,8 @@ SECTIONS {
+ .text : {
+ HEAD_TEXT
+ TEXT_TEXT
++ IRQENTRY_TEXT
++ SOFTIRQENTRY_TEXT
+ SCHED_TEXT
+ CPUIDLE_TEXT
+ LOCK_TEXT
+diff --git a/arch/m68k/kernel/vmlinux-std.lds b/arch/m68k/kernel/vmlinux-std.lds
+index 89172b8974b9..625a5785804f 100644
+--- a/arch/m68k/kernel/vmlinux-std.lds
++++ b/arch/m68k/kernel/vmlinux-std.lds
+@@ -16,6 +16,8 @@ SECTIONS
+ .text : {
+ HEAD_TEXT
+ TEXT_TEXT
++ IRQENTRY_TEXT
++ SOFTIRQENTRY_TEXT
+ SCHED_TEXT
+ CPUIDLE_TEXT
+ LOCK_TEXT
+diff --git a/arch/m68k/kernel/vmlinux-sun3.lds b/arch/m68k/kernel/vmlinux-sun3.lds
+index 293990efc917..9868270b0984 100644
+--- a/arch/m68k/kernel/vmlinux-sun3.lds
++++ b/arch/m68k/kernel/vmlinux-sun3.lds
+@@ -16,6 +16,8 @@ SECTIONS
+ .text : {
+ HEAD_TEXT
+ TEXT_TEXT
++ IRQENTRY_TEXT
++ SOFTIRQENTRY_TEXT
+ SCHED_TEXT
+ CPUIDLE_TEXT
+ LOCK_TEXT
+diff --git a/arch/powerpc/perf/core-book3s.c b/arch/powerpc/perf/core-book3s.c
+index b4209a68b85d..fce545774d50 100644
+--- a/arch/powerpc/perf/core-book3s.c
++++ b/arch/powerpc/perf/core-book3s.c
+@@ -1419,7 +1419,7 @@ static int collect_events(struct perf_event *group, int max_count,
+ int n = 0;
+ struct perf_event *event;
+
+- if (!is_software_event(group)) {
++ if (group->pmu->task_ctx_nr == perf_hw_context) {
+ if (n >= max_count)
+ return -1;
+ ctrs[n] = group;
+@@ -1427,7 +1427,7 @@ static int collect_events(struct perf_event *group, int max_count,
+ events[n++] = group->hw.config;
+ }
+ list_for_each_entry(event, &group->sibling_list, group_entry) {
+- if (!is_software_event(event) &&
++ if (event->pmu->task_ctx_nr == perf_hw_context &&
+ event->state != PERF_EVENT_STATE_OFF) {
+ if (n >= max_count)
+ return -1;
+diff --git a/arch/powerpc/perf/imc-pmu.c b/arch/powerpc/perf/imc-pmu.c
+index cf64e16f92c2..da6ba9ba73ed 100644
+--- a/arch/powerpc/perf/imc-pmu.c
++++ b/arch/powerpc/perf/imc-pmu.c
+@@ -308,6 +308,19 @@ static int ppc_nest_imc_cpu_offline(unsigned int cpu)
+ if (!cpumask_test_and_clear_cpu(cpu, &nest_imc_cpumask))
+ return 0;
+
++ /*
++ * Check whether nest_imc is registered. We could end up here if the
++ * cpuhotplug callback registration fails. i.e, callback invokes the
++ * offline path for all successfully registered nodes. At this stage,
++ * nest_imc pmu will not be registered and we should return here.
++ *
++ * We return with a zero since this is not an offline failure. And
++ * cpuhp_setup_state() returns the actual failure reason to the caller,
++ * which in turn will call the cleanup routine.
++ */
++ if (!nest_pmus)
++ return 0;
++
+ /*
+ * Now that this cpu is one of the designated,
+ * find a next cpu a) which is online and b) in same chip.
+diff --git a/arch/s390/include/uapi/asm/virtio-ccw.h b/arch/s390/include/uapi/asm/virtio-ccw.h
+index 967aad390105..9e62587d9472 100644
+--- a/arch/s390/include/uapi/asm/virtio-ccw.h
++++ b/arch/s390/include/uapi/asm/virtio-ccw.h
+@@ -1,4 +1,4 @@
+-/* SPDX-License-Identifier: GPL-2.0 WITH Linux-syscall-note */
++/* SPDX-License-Identifier: ((GPL-2.0 WITH Linux-syscall-note) OR BSD-3-Clause) */
+ /*
+ * Definitions for virtio-ccw devices.
+ *
+diff --git a/arch/x86/crypto/twofish-x86_64-asm_64-3way.S b/arch/x86/crypto/twofish-x86_64-asm_64-3way.S
+index 1c3b7ceb36d2..e7273a606a07 100644
+--- a/arch/x86/crypto/twofish-x86_64-asm_64-3way.S
++++ b/arch/x86/crypto/twofish-x86_64-asm_64-3way.S
+@@ -55,29 +55,31 @@
+ #define RAB1bl %bl
+ #define RAB2bl %cl
+
++#define CD0 0x0(%rsp)
++#define CD1 0x8(%rsp)
++#define CD2 0x10(%rsp)
++
++# used only before/after all rounds
+ #define RCD0 %r8
+ #define RCD1 %r9
+ #define RCD2 %r10
+
+-#define RCD0d %r8d
+-#define RCD1d %r9d
+-#define RCD2d %r10d
+-
+-#define RX0 %rbp
+-#define RX1 %r11
+-#define RX2 %r12
++# used only during rounds
++#define RX0 %r8
++#define RX1 %r9
++#define RX2 %r10
+
+-#define RX0d %ebp
+-#define RX1d %r11d
+-#define RX2d %r12d
++#define RX0d %r8d
++#define RX1d %r9d
++#define RX2d %r10d
+
+-#define RY0 %r13
+-#define RY1 %r14
+-#define RY2 %r15
++#define RY0 %r11
++#define RY1 %r12
++#define RY2 %r13
+
+-#define RY0d %r13d
+-#define RY1d %r14d
+-#define RY2d %r15d
++#define RY0d %r11d
++#define RY1d %r12d
++#define RY2d %r13d
+
+ #define RT0 %rdx
+ #define RT1 %rsi
+@@ -85,6 +87,8 @@
+ #define RT0d %edx
+ #define RT1d %esi
+
++#define RT1bl %sil
++
+ #define do16bit_ror(rot, op1, op2, T0, T1, tmp1, tmp2, ab, dst) \
+ movzbl ab ## bl, tmp2 ## d; \
+ movzbl ab ## bh, tmp1 ## d; \
+@@ -92,6 +96,11 @@
+ op1##l T0(CTX, tmp2, 4), dst ## d; \
+ op2##l T1(CTX, tmp1, 4), dst ## d;
+
++#define swap_ab_with_cd(ab, cd, tmp) \
++ movq cd, tmp; \
++ movq ab, cd; \
++ movq tmp, ab;
++
+ /*
+ * Combined G1 & G2 function. Reordered with help of rotates to have moves
+ * at begining.
+@@ -110,15 +119,15 @@
+ /* G1,2 && G2,2 */ \
+ do16bit_ror(32, xor, xor, Tx2, Tx3, RT0, RT1, ab ## 0, x ## 0); \
+ do16bit_ror(16, xor, xor, Ty3, Ty0, RT0, RT1, ab ## 0, y ## 0); \
+- xchgq cd ## 0, ab ## 0; \
++ swap_ab_with_cd(ab ## 0, cd ## 0, RT0); \
+ \
+ do16bit_ror(32, xor, xor, Tx2, Tx3, RT0, RT1, ab ## 1, x ## 1); \
+ do16bit_ror(16, xor, xor, Ty3, Ty0, RT0, RT1, ab ## 1, y ## 1); \
+- xchgq cd ## 1, ab ## 1; \
++ swap_ab_with_cd(ab ## 1, cd ## 1, RT0); \
+ \
+ do16bit_ror(32, xor, xor, Tx2, Tx3, RT0, RT1, ab ## 2, x ## 2); \
+ do16bit_ror(16, xor, xor, Ty3, Ty0, RT0, RT1, ab ## 2, y ## 2); \
+- xchgq cd ## 2, ab ## 2;
++ swap_ab_with_cd(ab ## 2, cd ## 2, RT0);
+
+ #define enc_round_end(ab, x, y, n) \
+ addl y ## d, x ## d; \
+@@ -168,6 +177,16 @@
+ decrypt_round3(ba, dc, (n*2)+1); \
+ decrypt_round3(ba, dc, (n*2));
+
++#define push_cd() \
++ pushq RCD2; \
++ pushq RCD1; \
++ pushq RCD0;
++
++#define pop_cd() \
++ popq RCD0; \
++ popq RCD1; \
++ popq RCD2;
++
+ #define inpack3(in, n, xy, m) \
+ movq 4*(n)(in), xy ## 0; \
+ xorq w+4*m(CTX), xy ## 0; \
+@@ -223,11 +242,8 @@ ENTRY(__twofish_enc_blk_3way)
+ * %rdx: src, RIO
+ * %rcx: bool, if true: xor output
+ */
+- pushq %r15;
+- pushq %r14;
+ pushq %r13;
+ pushq %r12;
+- pushq %rbp;
+ pushq %rbx;
+
+ pushq %rcx; /* bool xor */
+@@ -235,40 +251,36 @@ ENTRY(__twofish_enc_blk_3way)
+
+ inpack_enc3();
+
+- encrypt_cycle3(RAB, RCD, 0);
+- encrypt_cycle3(RAB, RCD, 1);
+- encrypt_cycle3(RAB, RCD, 2);
+- encrypt_cycle3(RAB, RCD, 3);
+- encrypt_cycle3(RAB, RCD, 4);
+- encrypt_cycle3(RAB, RCD, 5);
+- encrypt_cycle3(RAB, RCD, 6);
+- encrypt_cycle3(RAB, RCD, 7);
++ push_cd();
++ encrypt_cycle3(RAB, CD, 0);
++ encrypt_cycle3(RAB, CD, 1);
++ encrypt_cycle3(RAB, CD, 2);
++ encrypt_cycle3(RAB, CD, 3);
++ encrypt_cycle3(RAB, CD, 4);
++ encrypt_cycle3(RAB, CD, 5);
++ encrypt_cycle3(RAB, CD, 6);
++ encrypt_cycle3(RAB, CD, 7);
++ pop_cd();
+
+ popq RIO; /* dst */
+- popq %rbp; /* bool xor */
++ popq RT1; /* bool xor */
+
+- testb %bpl, %bpl;
++ testb RT1bl, RT1bl;
+ jnz .L__enc_xor3;
+
+ outunpack_enc3(mov);
+
+ popq %rbx;
+- popq %rbp;
+ popq %r12;
+ popq %r13;
+- popq %r14;
+- popq %r15;
+ ret;
+
+ .L__enc_xor3:
+ outunpack_enc3(xor);
+
+ popq %rbx;
+- popq %rbp;
+ popq %r12;
+ popq %r13;
+- popq %r14;
+- popq %r15;
+ ret;
+ ENDPROC(__twofish_enc_blk_3way)
+
+@@ -278,35 +290,31 @@ ENTRY(twofish_dec_blk_3way)
+ * %rsi: dst
+ * %rdx: src, RIO
+ */
+- pushq %r15;
+- pushq %r14;
+ pushq %r13;
+ pushq %r12;
+- pushq %rbp;
+ pushq %rbx;
+
+ pushq %rsi; /* dst */
+
+ inpack_dec3();
+
+- decrypt_cycle3(RAB, RCD, 7);
+- decrypt_cycle3(RAB, RCD, 6);
+- decrypt_cycle3(RAB, RCD, 5);
+- decrypt_cycle3(RAB, RCD, 4);
+- decrypt_cycle3(RAB, RCD, 3);
+- decrypt_cycle3(RAB, RCD, 2);
+- decrypt_cycle3(RAB, RCD, 1);
+- decrypt_cycle3(RAB, RCD, 0);
++ push_cd();
++ decrypt_cycle3(RAB, CD, 7);
++ decrypt_cycle3(RAB, CD, 6);
++ decrypt_cycle3(RAB, CD, 5);
++ decrypt_cycle3(RAB, CD, 4);
++ decrypt_cycle3(RAB, CD, 3);
++ decrypt_cycle3(RAB, CD, 2);
++ decrypt_cycle3(RAB, CD, 1);
++ decrypt_cycle3(RAB, CD, 0);
++ pop_cd();
+
+ popq RIO; /* dst */
+
+ outunpack_dec3();
+
+ popq %rbx;
+- popq %rbp;
+ popq %r12;
+ popq %r13;
+- popq %r14;
+- popq %r15;
+ ret;
+ ENDPROC(twofish_dec_blk_3way)
+diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c
+index dd35c6c50516..5ffde16253cb 100644
+--- a/arch/x86/kvm/vmx.c
++++ b/arch/x86/kvm/vmx.c
+@@ -6950,7 +6950,6 @@ static __init int hardware_setup(void)
+ goto out;
+ }
+
+- vmx_io_bitmap_b = (unsigned long *)__get_free_page(GFP_KERNEL);
+ memset(vmx_vmread_bitmap, 0xff, PAGE_SIZE);
+ memset(vmx_vmwrite_bitmap, 0xff, PAGE_SIZE);
+
+diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
+index f97358423f9c..0dcd7bf45dc1 100644
+--- a/arch/x86/kvm/x86.c
++++ b/arch/x86/kvm/x86.c
+@@ -2926,6 +2926,12 @@ void kvm_arch_vcpu_put(struct kvm_vcpu *vcpu)
+ kvm_x86_ops->vcpu_put(vcpu);
+ kvm_put_guest_fpu(vcpu);
+ vcpu->arch.last_host_tsc = rdtsc();
++ /*
++ * If userspace has set any breakpoints or watchpoints, dr6 is restored
++ * on every vmexit, but if not, we might have a stale dr6 from the
++ * guest. do_debug expects dr6 to be cleared after it runs, do the same.
++ */
++ set_debugreg(0, 6);
+ }
+
+ static int kvm_vcpu_ioctl_get_lapic(struct kvm_vcpu *vcpu,
+@@ -7474,6 +7480,29 @@ int kvm_task_switch(struct kvm_vcpu *vcpu, u16 tss_selector, int idt_index,
+ }
+ EXPORT_SYMBOL_GPL(kvm_task_switch);
+
++int kvm_valid_sregs(struct kvm_vcpu *vcpu, struct kvm_sregs *sregs)
++{
++ if ((sregs->efer & EFER_LME) && (sregs->cr0 & X86_CR0_PG_BIT)) {
++ /*
++ * When EFER.LME and CR0.PG are set, the processor is in
++ * 64-bit mode (though maybe in a 32-bit code segment).
++ * CR4.PAE and EFER.LMA must be set.
++ */
++ if (!(sregs->cr4 & X86_CR4_PAE_BIT)
++ || !(sregs->efer & EFER_LMA))
++ return -EINVAL;
++ } else {
++ /*
++ * Not in 64-bit mode: EFER.LMA is clear and the code
++ * segment cannot be 64-bit.
++ */
++ if (sregs->efer & EFER_LMA || sregs->cs.l)
++ return -EINVAL;
++ }
++
++ return 0;
++}
++
+ int kvm_arch_vcpu_ioctl_set_sregs(struct kvm_vcpu *vcpu,
+ struct kvm_sregs *sregs)
+ {
+@@ -7486,6 +7515,9 @@ int kvm_arch_vcpu_ioctl_set_sregs(struct kvm_vcpu *vcpu,
+ (sregs->cr4 & X86_CR4_OSXSAVE))
+ return -EINVAL;
+
++ if (kvm_valid_sregs(vcpu, sregs))
++ return -EINVAL;
++
+ apic_base_msr.data = sregs->apic_base;
+ apic_base_msr.host_initiated = true;
+ if (kvm_set_apic_base(vcpu, &apic_base_msr))
+diff --git a/arch/x86/mm/ioremap.c b/arch/x86/mm/ioremap.c
+index bb120e59c597..7bebdd0273d3 100644
+--- a/arch/x86/mm/ioremap.c
++++ b/arch/x86/mm/ioremap.c
+@@ -349,11 +349,11 @@ void iounmap(volatile void __iomem *addr)
+ return;
+ }
+
++ mmiotrace_iounmap(addr);
++
+ addr = (volatile void __iomem *)
+ (PAGE_MASK & (unsigned long __force)addr);
+
+- mmiotrace_iounmap(addr);
+-
+ /* Use the vm area unlocked, assuming the caller
+ ensures there isn't another iounmap for the same address
+ in parallel. Reuse of the virtual address is prevented by
+diff --git a/arch/x86/mm/kmmio.c b/arch/x86/mm/kmmio.c
+index aa44c3aa4cd5..7c8686709636 100644
+--- a/arch/x86/mm/kmmio.c
++++ b/arch/x86/mm/kmmio.c
+@@ -435,17 +435,18 @@ int register_kmmio_probe(struct kmmio_probe *p)
+ unsigned long flags;
+ int ret = 0;
+ unsigned long size = 0;
++ unsigned long addr = p->addr & PAGE_MASK;
+ const unsigned long size_lim = p->len + (p->addr & ~PAGE_MASK);
+ unsigned int l;
+ pte_t *pte;
+
+ spin_lock_irqsave(&kmmio_lock, flags);
+- if (get_kmmio_probe(p->addr)) {
++ if (get_kmmio_probe(addr)) {
+ ret = -EEXIST;
+ goto out;
+ }
+
+- pte = lookup_address(p->addr, &l);
++ pte = lookup_address(addr, &l);
+ if (!pte) {
+ ret = -EINVAL;
+ goto out;
+@@ -454,7 +455,7 @@ int register_kmmio_probe(struct kmmio_probe *p)
+ kmmio_count++;
+ list_add_rcu(&p->list, &kmmio_probes);
+ while (size < size_lim) {
+- if (add_kmmio_fault_page(p->addr + size))
++ if (add_kmmio_fault_page(addr + size))
+ pr_err("Unable to set page fault.\n");
+ size += page_level_size(l);
+ }
+@@ -528,19 +529,20 @@ void unregister_kmmio_probe(struct kmmio_probe *p)
+ {
+ unsigned long flags;
+ unsigned long size = 0;
++ unsigned long addr = p->addr & PAGE_MASK;
+ const unsigned long size_lim = p->len + (p->addr & ~PAGE_MASK);
+ struct kmmio_fault_page *release_list = NULL;
+ struct kmmio_delayed_release *drelease;
+ unsigned int l;
+ pte_t *pte;
+
+- pte = lookup_address(p->addr, &l);
++ pte = lookup_address(addr, &l);
+ if (!pte)
+ return;
+
+ spin_lock_irqsave(&kmmio_lock, flags);
+ while (size < size_lim) {
+- release_kmmio_fault_page(p->addr + size, &release_list);
++ release_kmmio_fault_page(addr + size, &release_list);
+ size += page_level_size(l);
+ }
+ list_del_rcu(&p->list);
+diff --git a/block/blk-map.c b/block/blk-map.c
+index 368daa02714e..e31be14da8ea 100644
+--- a/block/blk-map.c
++++ b/block/blk-map.c
+@@ -126,7 +126,7 @@ int blk_rq_map_user_iov(struct request_queue *q, struct request *rq,
+ unsigned long align = q->dma_pad_mask | queue_dma_alignment(q);
+ struct bio *bio = NULL;
+ struct iov_iter i;
+- int ret;
++ int ret = -EINVAL;
+
+ if (!iter_is_iovec(iter))
+ goto fail;
+@@ -155,7 +155,7 @@ int blk_rq_map_user_iov(struct request_queue *q, struct request *rq,
+ __blk_rq_unmap_user(bio);
+ fail:
+ rq->bio = NULL;
+- return -EINVAL;
++ return ret;
+ }
+ EXPORT_SYMBOL(blk_rq_map_user_iov);
+
+diff --git a/drivers/Makefile b/drivers/Makefile
+index d242d3514d30..5f5ccdbad21a 100644
+--- a/drivers/Makefile
++++ b/drivers/Makefile
+@@ -105,6 +105,7 @@ obj-$(CONFIG_TC) += tc/
+ obj-$(CONFIG_UWB) += uwb/
+ obj-$(CONFIG_USB_PHY) += usb/
+ obj-$(CONFIG_USB) += usb/
++obj-$(CONFIG_USB_SUPPORT) += usb/
+ obj-$(CONFIG_PCI) += usb/
+ obj-$(CONFIG_USB_GADGET) += usb/
+ obj-$(CONFIG_OF) += usb/
+diff --git a/drivers/android/binder.c b/drivers/android/binder.c
+index 2ef8bd29e188..b7efdc8badee 100644
+--- a/drivers/android/binder.c
++++ b/drivers/android/binder.c
+@@ -1933,8 +1933,14 @@ static void binder_send_failed_reply(struct binder_transaction *t,
+ &target_thread->todo);
+ wake_up_interruptible(&target_thread->wait);
+ } else {
+- WARN(1, "Unexpected reply error: %u\n",
+- target_thread->reply_error.cmd);
++ /*
++ * Cannot get here for normal operation, but
++ * we can if multiple synchronous transactions
++ * are sent without blocking for responses.
++ * Just ignore the 2nd error in this case.
++ */
++ pr_warn("Unexpected reply error: %u\n",
++ target_thread->reply_error.cmd);
+ }
+ binder_inner_proc_unlock(target_thread->proc);
+ binder_thread_dec_tmpref(target_thread);
+@@ -2135,7 +2141,7 @@ static void binder_transaction_buffer_release(struct binder_proc *proc,
+ int debug_id = buffer->debug_id;
+
+ binder_debug(BINDER_DEBUG_TRANSACTION,
+- "%d buffer release %d, size %zd-%zd, failed at %p\n",
++ "%d buffer release %d, size %zd-%zd, failed at %pK\n",
+ proc->pid, buffer->debug_id,
+ buffer->data_size, buffer->offsets_size, failed_at);
+
+@@ -3647,7 +3653,7 @@ static int binder_thread_write(struct binder_proc *proc,
+ }
+ }
+ binder_debug(BINDER_DEBUG_DEAD_BINDER,
+- "%d:%d BC_DEAD_BINDER_DONE %016llx found %p\n",
++ "%d:%d BC_DEAD_BINDER_DONE %016llx found %pK\n",
+ proc->pid, thread->pid, (u64)cookie,
+ death);
+ if (death == NULL) {
+@@ -4316,6 +4322,15 @@ static int binder_thread_release(struct binder_proc *proc,
+
+ binder_inner_proc_unlock(thread->proc);
+
++ /*
++ * This is needed to avoid races between wake_up_poll() above and
++ * and ep_remove_waitqueue() called for other reasons (eg the epoll file
++ * descriptor being closed); ep_remove_waitqueue() holds an RCU read
++ * lock, so we can be sure it's done after calling synchronize_rcu().
++ */
++ if (thread->looper & BINDER_LOOPER_STATE_POLL)
++ synchronize_rcu();
++
+ if (send_reply)
+ binder_send_failed_reply(send_reply, BR_DEAD_REPLY);
+ binder_release_work(proc, &thread->todo);
+@@ -4331,6 +4346,8 @@ static unsigned int binder_poll(struct file *filp,
+ bool wait_for_proc_work;
+
+ thread = binder_get_thread(proc);
++ if (!thread)
++ return POLLERR;
+
+ binder_inner_proc_lock(thread->proc);
+ thread->looper |= BINDER_LOOPER_STATE_POLL;
+@@ -4974,7 +4991,7 @@ static void print_binder_transaction_ilocked(struct seq_file *m,
+ spin_lock(&t->lock);
+ to_proc = t->to_proc;
+ seq_printf(m,
+- "%s %d: %p from %d:%d to %d:%d code %x flags %x pri %ld r%d",
++ "%s %d: %pK from %d:%d to %d:%d code %x flags %x pri %ld r%d",
+ prefix, t->debug_id, t,
+ t->from ? t->from->proc->pid : 0,
+ t->from ? t->from->pid : 0,
+@@ -4998,7 +5015,7 @@ static void print_binder_transaction_ilocked(struct seq_file *m,
+ }
+ if (buffer->target_node)
+ seq_printf(m, " node %d", buffer->target_node->debug_id);
+- seq_printf(m, " size %zd:%zd data %p\n",
++ seq_printf(m, " size %zd:%zd data %pK\n",
+ buffer->data_size, buffer->offsets_size,
+ buffer->data);
+ }
+diff --git a/drivers/base/power/runtime.c b/drivers/base/power/runtime.c
+index 7bcf80fa9ada..b2b1eece0db1 100644
+--- a/drivers/base/power/runtime.c
++++ b/drivers/base/power/runtime.c
+@@ -276,7 +276,8 @@ static int rpm_get_suppliers(struct device *dev)
+ continue;
+
+ retval = pm_runtime_get_sync(link->supplier);
+- if (retval < 0) {
++ /* Ignore suppliers with disabled runtime PM. */
++ if (retval < 0 && retval != -EACCES) {
+ pm_runtime_put_noidle(link->supplier);
+ return retval;
+ }
+diff --git a/drivers/crypto/s5p-sss.c b/drivers/crypto/s5p-sss.c
+index 7ac657f46d15..aec66159566d 100644
+--- a/drivers/crypto/s5p-sss.c
++++ b/drivers/crypto/s5p-sss.c
+@@ -601,15 +601,21 @@ static void s5p_aes_crypt_start(struct s5p_aes_dev *dev, unsigned long mode)
+ uint32_t aes_control;
+ unsigned long flags;
+ int err;
++ u8 *iv;
+
+ aes_control = SSS_AES_KEY_CHANGE_MODE;
+ if (mode & FLAGS_AES_DECRYPT)
+ aes_control |= SSS_AES_MODE_DECRYPT;
+
+- if ((mode & FLAGS_AES_MODE_MASK) == FLAGS_AES_CBC)
++ if ((mode & FLAGS_AES_MODE_MASK) == FLAGS_AES_CBC) {
+ aes_control |= SSS_AES_CHAIN_MODE_CBC;
+- else if ((mode & FLAGS_AES_MODE_MASK) == FLAGS_AES_CTR)
++ iv = req->info;
++ } else if ((mode & FLAGS_AES_MODE_MASK) == FLAGS_AES_CTR) {
+ aes_control |= SSS_AES_CHAIN_MODE_CTR;
++ iv = req->info;
++ } else {
++ iv = NULL; /* AES_ECB */
++ }
+
+ if (dev->ctx->keylen == AES_KEYSIZE_192)
+ aes_control |= SSS_AES_KEY_SIZE_192;
+@@ -640,7 +646,7 @@ static void s5p_aes_crypt_start(struct s5p_aes_dev *dev, unsigned long mode)
+ goto outdata_error;
+
+ SSS_AES_WRITE(dev, AES_CONTROL, aes_control);
+- s5p_set_aes(dev, dev->ctx->aes_key, req->info, dev->ctx->keylen);
++ s5p_set_aes(dev, dev->ctx->aes_key, iv, dev->ctx->keylen);
+
+ s5p_set_dma_indata(dev, dev->sg_src);
+ s5p_set_dma_outdata(dev, dev->sg_dst);
+diff --git a/drivers/crypto/talitos.c b/drivers/crypto/talitos.c
+index a19b5d0300a9..ceae25112acd 100644
+--- a/drivers/crypto/talitos.c
++++ b/drivers/crypto/talitos.c
+@@ -1124,6 +1124,11 @@ int talitos_sg_map(struct device *dev, struct scatterlist *src,
+ struct talitos_private *priv = dev_get_drvdata(dev);
+ bool is_sec1 = has_ftr_sec1(priv);
+
++ if (!src) {
++ *ptr = zero_entry;
++ return 1;
++ }
++
+ to_talitos_ptr_len(ptr, len, is_sec1);
+ to_talitos_ptr_ext_set(ptr, 0, is_sec1);
+
+diff --git a/drivers/dma/at_hdmac.c b/drivers/dma/at_hdmac.c
+index fbab271b3bf9..a861b5b4d443 100644
+--- a/drivers/dma/at_hdmac.c
++++ b/drivers/dma/at_hdmac.c
+@@ -708,7 +708,7 @@ atc_prep_dma_interleaved(struct dma_chan *chan,
+ unsigned long flags)
+ {
+ struct at_dma_chan *atchan = to_at_dma_chan(chan);
+- struct data_chunk *first = xt->sgl;
++ struct data_chunk *first;
+ struct at_desc *desc = NULL;
+ size_t xfer_count;
+ unsigned int dwidth;
+@@ -720,6 +720,8 @@ atc_prep_dma_interleaved(struct dma_chan *chan,
+ if (unlikely(!xt || xt->numf != 1 || !xt->frame_size))
+ return NULL;
+
++ first = xt->sgl;
++
+ dev_info(chan2dev(chan),
+ "%s: src=%pad, dest=%pad, numf=%d, frame_size=%d, flags=0x%lx\n",
+ __func__, &xt->src_start, &xt->dst_start, xt->numf,
+diff --git a/drivers/dma/dma-jz4740.c b/drivers/dma/dma-jz4740.c
+index d50273fed715..afd5e10f8927 100644
+--- a/drivers/dma/dma-jz4740.c
++++ b/drivers/dma/dma-jz4740.c
+@@ -555,7 +555,7 @@ static int jz4740_dma_probe(struct platform_device *pdev)
+
+ ret = dma_async_device_register(dd);
+ if (ret)
+- return ret;
++ goto err_clk;
+
+ irq = platform_get_irq(pdev, 0);
+ ret = request_irq(irq, jz4740_dma_irq, 0, dev_name(&pdev->dev), dmadev);
+@@ -568,6 +568,8 @@ static int jz4740_dma_probe(struct platform_device *pdev)
+
+ err_unregister:
+ dma_async_device_unregister(dd);
++err_clk:
++ clk_disable_unprepare(dmadev->clk);
+ return ret;
+ }
+
+diff --git a/drivers/dma/ioat/init.c b/drivers/dma/ioat/init.c
+index 93e006c3441d..854deb0da07c 100644
+--- a/drivers/dma/ioat/init.c
++++ b/drivers/dma/ioat/init.c
+@@ -390,7 +390,7 @@ static int ioat_dma_self_test(struct ioatdma_device *ioat_dma)
+ if (memcmp(src, dest, IOAT_TEST_SIZE)) {
+ dev_err(dev, "Self-test copy failed compare, disabling\n");
+ err = -ENODEV;
+- goto free_resources;
++ goto unmap_dma;
+ }
+
+ unmap_dma:
+diff --git a/drivers/gpio/gpio-74x164.c b/drivers/gpio/gpio-74x164.c
+index 6b535ec858cc..15a1f4b348c4 100644
+--- a/drivers/gpio/gpio-74x164.c
++++ b/drivers/gpio/gpio-74x164.c
+@@ -23,6 +23,7 @@
+ struct gen_74x164_chip {
+ struct gpio_chip gpio_chip;
+ struct mutex lock;
++ struct gpio_desc *gpiod_oe;
+ u32 registers;
+ /*
+ * Since the registers are chained, every byte sent will make
+@@ -31,8 +32,7 @@ struct gen_74x164_chip {
+ * register at the end of the transfer. So, to have a logical
+ * numbering, store the bytes in reverse order.
+ */
+- u8 buffer[0];
+- struct gpio_desc *gpiod_oe;
++ u8 buffer[];
+ };
+
+ static int __gen_74x164_write_config(struct gen_74x164_chip *chip)
+diff --git a/drivers/gpio/gpio-davinci.c b/drivers/gpio/gpio-davinci.c
+index f75d8443ecaf..e4b3d7db68c9 100644
+--- a/drivers/gpio/gpio-davinci.c
++++ b/drivers/gpio/gpio-davinci.c
+@@ -383,7 +383,7 @@ static int gpio_irq_type_unbanked(struct irq_data *data, unsigned trigger)
+ u32 mask;
+
+ d = (struct davinci_gpio_controller *)irq_data_get_irq_handler_data(data);
+- g = (struct davinci_gpio_regs __iomem *)d->regs;
++ g = (struct davinci_gpio_regs __iomem *)d->regs[0];
+ mask = __gpio_mask(data->irq - d->base_irq);
+
+ if (trigger & ~(IRQ_TYPE_EDGE_FALLING | IRQ_TYPE_EDGE_RISING))
+diff --git a/drivers/gpu/drm/armada/armada_crtc.c b/drivers/gpu/drm/armada/armada_crtc.c
+index 2a4d163ac76f..79ce877bf45f 100644
+--- a/drivers/gpu/drm/armada/armada_crtc.c
++++ b/drivers/gpu/drm/armada/armada_crtc.c
+@@ -1225,17 +1225,13 @@ static int armada_drm_crtc_create(struct drm_device *drm, struct device *dev,
+
+ ret = devm_request_irq(dev, irq, armada_drm_irq, 0, "armada_drm_crtc",
+ dcrtc);
+- if (ret < 0) {
+- kfree(dcrtc);
+- return ret;
+- }
++ if (ret < 0)
++ goto err_crtc;
+
+ if (dcrtc->variant->init) {
+ ret = dcrtc->variant->init(dcrtc, dev);
+- if (ret) {
+- kfree(dcrtc);
+- return ret;
+- }
++ if (ret)
++ goto err_crtc;
+ }
+
+ /* Ensure AXI pipeline is enabled */
+@@ -1246,13 +1242,15 @@ static int armada_drm_crtc_create(struct drm_device *drm, struct device *dev,
+ dcrtc->crtc.port = port;
+
+ primary = kzalloc(sizeof(*primary), GFP_KERNEL);
+- if (!primary)
+- return -ENOMEM;
++ if (!primary) {
++ ret = -ENOMEM;
++ goto err_crtc;
++ }
+
+ ret = armada_drm_plane_init(primary);
+ if (ret) {
+ kfree(primary);
+- return ret;
++ goto err_crtc;
+ }
+
+ ret = drm_universal_plane_init(drm, &primary->base, 0,
+@@ -1263,7 +1261,7 @@ static int armada_drm_crtc_create(struct drm_device *drm, struct device *dev,
+ DRM_PLANE_TYPE_PRIMARY, NULL);
+ if (ret) {
+ kfree(primary);
+- return ret;
++ goto err_crtc;
+ }
+
+ ret = drm_crtc_init_with_planes(drm, &dcrtc->crtc, &primary->base, NULL,
+@@ -1282,6 +1280,9 @@ static int armada_drm_crtc_create(struct drm_device *drm, struct device *dev,
+
+ err_crtc_init:
+ primary->base.funcs->destroy(&primary->base);
++err_crtc:
++ kfree(dcrtc);
++
+ return ret;
+ }
+
+diff --git a/drivers/gpu/drm/drm_modeset_lock.c b/drivers/gpu/drm/drm_modeset_lock.c
+index af4e906c630d..56b9f9b1c3ae 100644
+--- a/drivers/gpu/drm/drm_modeset_lock.c
++++ b/drivers/gpu/drm/drm_modeset_lock.c
+@@ -88,7 +88,7 @@ void drm_modeset_lock_all(struct drm_device *dev)
+ struct drm_modeset_acquire_ctx *ctx;
+ int ret;
+
+- ctx = kzalloc(sizeof(*ctx), GFP_KERNEL);
++ ctx = kzalloc(sizeof(*ctx), GFP_KERNEL | __GFP_NOFAIL);
+ if (WARN_ON(!ctx))
+ return;
+
+diff --git a/drivers/gpu/drm/i915/intel_drv.h b/drivers/gpu/drm/i915/intel_drv.h
+index 10ae9681f02d..589905aab185 100644
+--- a/drivers/gpu/drm/i915/intel_drv.h
++++ b/drivers/gpu/drm/i915/intel_drv.h
+@@ -1708,7 +1708,7 @@ extern struct drm_display_mode *intel_find_panel_downclock(
+ int intel_backlight_device_register(struct intel_connector *connector);
+ void intel_backlight_device_unregister(struct intel_connector *connector);
+ #else /* CONFIG_BACKLIGHT_CLASS_DEVICE */
+-static int intel_backlight_device_register(struct intel_connector *connector)
++static inline int intel_backlight_device_register(struct intel_connector *connector)
+ {
+ return 0;
+ }
+diff --git a/drivers/gpu/drm/vc4/vc4_gem.c b/drivers/gpu/drm/vc4/vc4_gem.c
+index c50debb1986f..d31b3d0c9955 100644
+--- a/drivers/gpu/drm/vc4/vc4_gem.c
++++ b/drivers/gpu/drm/vc4/vc4_gem.c
+@@ -829,8 +829,10 @@ vc4_complete_exec(struct drm_device *dev, struct vc4_exec_info *exec)
+ /* If we got force-completed because of GPU reset rather than
+ * through our IRQ handler, signal the fence now.
+ */
+- if (exec->fence)
++ if (exec->fence) {
+ dma_fence_signal(exec->fence);
++ dma_fence_put(exec->fence);
++ }
+
+ if (exec->bo) {
+ for (i = 0; i < exec->bo_count; i++)
+diff --git a/drivers/gpu/drm/vc4/vc4_irq.c b/drivers/gpu/drm/vc4/vc4_irq.c
+index 521addec831e..3dd62d75f531 100644
+--- a/drivers/gpu/drm/vc4/vc4_irq.c
++++ b/drivers/gpu/drm/vc4/vc4_irq.c
+@@ -139,6 +139,7 @@ vc4_irq_finish_render_job(struct drm_device *dev)
+ list_move_tail(&exec->head, &vc4->job_done_list);
+ if (exec->fence) {
+ dma_fence_signal_locked(exec->fence);
++ dma_fence_put(exec->fence);
+ exec->fence = NULL;
+ }
+ vc4_submit_next_render_job(dev);
+diff --git a/drivers/iio/industrialio-core.c b/drivers/iio/industrialio-core.c
+index a47428b4d31b..e565fd4fc414 100644
+--- a/drivers/iio/industrialio-core.c
++++ b/drivers/iio/industrialio-core.c
+@@ -631,7 +631,7 @@ static ssize_t __iio_format_value(char *buf, size_t len, unsigned int type,
+ * iio_format_value() - Formats a IIO value into its string representation
+ * @buf: The buffer to which the formatted value gets written
+ * which is assumed to be big enough (i.e. PAGE_SIZE).
+- * @type: One of the IIO_VAL_... constants. This decides how the val
++ * @type: One of the IIO_VAL_* constants. This decides how the val
+ * and val2 parameters are formatted.
+ * @size: Number of IIO value entries contained in vals
+ * @vals: Pointer to the values, exact meaning depends on the
+@@ -639,7 +639,7 @@ static ssize_t __iio_format_value(char *buf, size_t len, unsigned int type,
+ *
+ * Return: 0 by default, a negative number on failure or the
+ * total number of characters written for a type that belongs
+- * to the IIO_VAL_... constant.
++ * to the IIO_VAL_* constant.
+ */
+ ssize_t iio_format_value(char *buf, unsigned int type, int size, int *vals)
+ {
+diff --git a/drivers/iio/proximity/sx9500.c b/drivers/iio/proximity/sx9500.c
+index f42b3a1c75ff..dba796c06ba6 100644
+--- a/drivers/iio/proximity/sx9500.c
++++ b/drivers/iio/proximity/sx9500.c
+@@ -871,6 +871,7 @@ static int sx9500_init_device(struct iio_dev *indio_dev)
+ static void sx9500_gpio_probe(struct i2c_client *client,
+ struct sx9500_data *data)
+ {
++ struct gpio_desc *gpiod_int;
+ struct device *dev;
+
+ if (!client)
+@@ -878,6 +879,14 @@ static void sx9500_gpio_probe(struct i2c_client *client,
+
+ dev = &client->dev;
+
++ if (client->irq <= 0) {
++ gpiod_int = devm_gpiod_get(dev, SX9500_GPIO_INT, GPIOD_IN);
++ if (IS_ERR(gpiod_int))
++ dev_err(dev, "gpio get irq failed\n");
++ else
++ client->irq = gpiod_to_irq(gpiod_int);
++ }
++
+ data->gpiod_rst = devm_gpiod_get(dev, SX9500_GPIO_RESET, GPIOD_OUT_HIGH);
+ if (IS_ERR(data->gpiod_rst)) {
+ dev_warn(dev, "gpio get reset pin failed\n");
+diff --git a/drivers/infiniband/core/cma.c b/drivers/infiniband/core/cma.c
+index fa79c7076ccd..e457dface2d2 100644
+--- a/drivers/infiniband/core/cma.c
++++ b/drivers/infiniband/core/cma.c
+@@ -801,6 +801,7 @@ struct rdma_cm_id *rdma_create_id(struct net *net,
+ INIT_LIST_HEAD(&id_priv->mc_list);
+ get_random_bytes(&id_priv->seq_num, sizeof id_priv->seq_num);
+ id_priv->id.route.addr.dev_addr.net = get_net(net);
++ id_priv->seq_num &= 0x00ffffff;
+
+ return &id_priv->id;
+ }
+@@ -4461,7 +4462,7 @@ static int cma_get_id_stats(struct sk_buff *skb, struct netlink_callback *cb)
+ return skb->len;
+ }
+
+-static const struct rdma_nl_cbs cma_cb_table[] = {
++static const struct rdma_nl_cbs cma_cb_table[RDMA_NL_RDMA_CM_NUM_OPS] = {
+ [RDMA_NL_RDMA_CM_ID_STATS] = { .dump = cma_get_id_stats},
+ };
+
+diff --git a/drivers/infiniband/core/device.c b/drivers/infiniband/core/device.c
+index ebfdb5503701..b4b28ff8b7dc 100644
+--- a/drivers/infiniband/core/device.c
++++ b/drivers/infiniband/core/device.c
+@@ -1154,7 +1154,7 @@ struct net_device *ib_get_net_dev_by_params(struct ib_device *dev,
+ }
+ EXPORT_SYMBOL(ib_get_net_dev_by_params);
+
+-static const struct rdma_nl_cbs ibnl_ls_cb_table[] = {
++static const struct rdma_nl_cbs ibnl_ls_cb_table[RDMA_NL_LS_NUM_OPS] = {
+ [RDMA_NL_LS_OP_RESOLVE] = {
+ .doit = ib_nl_handle_resolve_resp,
+ .flags = RDMA_NL_ADMIN_PERM,
+@@ -1261,5 +1261,5 @@ static void __exit ib_core_cleanup(void)
+
+ MODULE_ALIAS_RDMA_NETLINK(RDMA_NL_LS, 4);
+
+-module_init(ib_core_init);
++subsys_initcall(ib_core_init);
+ module_exit(ib_core_cleanup);
+diff --git a/drivers/infiniband/core/iwcm.c b/drivers/infiniband/core/iwcm.c
+index fcf42f6bb82a..30d7277249b8 100644
+--- a/drivers/infiniband/core/iwcm.c
++++ b/drivers/infiniband/core/iwcm.c
+@@ -80,7 +80,7 @@ const char *__attribute_const__ iwcm_reject_msg(int reason)
+ }
+ EXPORT_SYMBOL(iwcm_reject_msg);
+
+-static struct rdma_nl_cbs iwcm_nl_cb_table[] = {
++static struct rdma_nl_cbs iwcm_nl_cb_table[RDMA_NL_IWPM_NUM_OPS] = {
+ [RDMA_NL_IWPM_REG_PID] = {.dump = iwpm_register_pid_cb},
+ [RDMA_NL_IWPM_ADD_MAPPING] = {.dump = iwpm_add_mapping_cb},
+ [RDMA_NL_IWPM_QUERY_MAPPING] = {.dump = iwpm_add_and_query_mapping_cb},
+diff --git a/drivers/infiniband/core/nldev.c b/drivers/infiniband/core/nldev.c
+index 2fae850a3eff..9a05245a1acf 100644
+--- a/drivers/infiniband/core/nldev.c
++++ b/drivers/infiniband/core/nldev.c
+@@ -303,7 +303,7 @@ out: cb->args[0] = idx;
+ return skb->len;
+ }
+
+-static const struct rdma_nl_cbs nldev_cb_table[] = {
++static const struct rdma_nl_cbs nldev_cb_table[RDMA_NLDEV_NUM_OPS] = {
+ [RDMA_NLDEV_CMD_GET] = {
+ .doit = nldev_get_doit,
+ .dump = nldev_get_dumpit,
+diff --git a/drivers/infiniband/hw/hfi1/rc.c b/drivers/infiniband/hw/hfi1/rc.c
+index e1cf0c08ca6f..84c6a6ff4a67 100644
+--- a/drivers/infiniband/hw/hfi1/rc.c
++++ b/drivers/infiniband/hw/hfi1/rc.c
+@@ -815,7 +815,7 @@ static inline void hfi1_make_rc_ack_16B(struct rvt_qp *qp,
+ struct hfi1_pportdata *ppd = ppd_from_ibp(ibp);
+ struct hfi1_16b_header *hdr = &opa_hdr->opah;
+ struct ib_other_headers *ohdr;
+- u32 bth0, bth1;
++ u32 bth0, bth1 = 0;
+ u16 len, pkey;
+ u8 becn = !!is_fecn;
+ u8 l4 = OPA_16B_L4_IB_LOCAL;
+diff --git a/drivers/infiniband/hw/i40iw/i40iw_cm.c b/drivers/infiniband/hw/i40iw/i40iw_cm.c
+index 5230dd3c938c..d6a1a308c6a0 100644
+--- a/drivers/infiniband/hw/i40iw/i40iw_cm.c
++++ b/drivers/infiniband/hw/i40iw/i40iw_cm.c
+@@ -1043,7 +1043,7 @@ static int i40iw_parse_mpa(struct i40iw_cm_node *cm_node, u8 *buffer, u32 *type,
+ * i40iw_schedule_cm_timer
+ * @@cm_node: connection's node
+ * @sqbuf: buffer to send
+- * @type: if it es send ot close
++ * @type: if it is send or close
+ * @send_retrans: if rexmits to be done
+ * @close_when_complete: is cm_node to be removed
+ *
+@@ -1067,7 +1067,8 @@ int i40iw_schedule_cm_timer(struct i40iw_cm_node *cm_node,
+
+ new_send = kzalloc(sizeof(*new_send), GFP_ATOMIC);
+ if (!new_send) {
+- i40iw_free_sqbuf(vsi, (void *)sqbuf);
++ if (type != I40IW_TIMER_TYPE_CLOSE)
++ i40iw_free_sqbuf(vsi, (void *)sqbuf);
+ return -ENOMEM;
+ }
+ new_send->retrycount = I40IW_DEFAULT_RETRYS;
+@@ -1082,7 +1083,6 @@ int i40iw_schedule_cm_timer(struct i40iw_cm_node *cm_node,
+ new_send->timetosend += (HZ / 10);
+ if (cm_node->close_entry) {
+ kfree(new_send);
+- i40iw_free_sqbuf(vsi, (void *)sqbuf);
+ i40iw_pr_err("already close entry\n");
+ return -EINVAL;
+ }
+diff --git a/drivers/infiniband/hw/i40iw/i40iw_ctrl.c b/drivers/infiniband/hw/i40iw/i40iw_ctrl.c
+index 42ca5346777d..d86f3e670804 100644
+--- a/drivers/infiniband/hw/i40iw/i40iw_ctrl.c
++++ b/drivers/infiniband/hw/i40iw/i40iw_ctrl.c
+@@ -506,7 +506,7 @@ static enum i40iw_status_code i40iw_sc_cqp_create(struct i40iw_sc_cqp *cqp,
+
+ ret_code = i40iw_allocate_dma_mem(cqp->dev->hw,
+ &cqp->sdbuf,
+- 128,
++ I40IW_UPDATE_SD_BUF_SIZE * cqp->sq_size,
+ I40IW_SD_BUF_ALIGNMENT);
+
+ if (ret_code)
+@@ -589,14 +589,15 @@ void i40iw_sc_cqp_post_sq(struct i40iw_sc_cqp *cqp)
+ }
+
+ /**
+- * i40iw_sc_cqp_get_next_send_wqe - get next wqe on cqp sq
+- * @cqp: struct for cqp hw
+- * @wqe_idx: we index of cqp ring
++ * i40iw_sc_cqp_get_next_send_wqe_idx - get next WQE on CQP SQ and pass back the index
++ * @cqp: pointer to CQP structure
++ * @scratch: private data for CQP WQE
++ * @wqe_idx: WQE index for next WQE on CQP SQ
+ */
+-u64 *i40iw_sc_cqp_get_next_send_wqe(struct i40iw_sc_cqp *cqp, u64 scratch)
++static u64 *i40iw_sc_cqp_get_next_send_wqe_idx(struct i40iw_sc_cqp *cqp,
++ u64 scratch, u32 *wqe_idx)
+ {
+ u64 *wqe = NULL;
+- u32 wqe_idx;
+ enum i40iw_status_code ret_code;
+
+ if (I40IW_RING_FULL_ERR(cqp->sq_ring)) {
+@@ -609,20 +610,32 @@ u64 *i40iw_sc_cqp_get_next_send_wqe(struct i40iw_sc_cqp *cqp, u64 scratch)
+ cqp->sq_ring.size);
+ return NULL;
+ }
+- I40IW_ATOMIC_RING_MOVE_HEAD(cqp->sq_ring, wqe_idx, ret_code);
++ I40IW_ATOMIC_RING_MOVE_HEAD(cqp->sq_ring, *wqe_idx, ret_code);
+ cqp->dev->cqp_cmd_stats[OP_REQUESTED_COMMANDS]++;
+ if (ret_code)
+ return NULL;
+- if (!wqe_idx)
++ if (!*wqe_idx)
+ cqp->polarity = !cqp->polarity;
+
+- wqe = cqp->sq_base[wqe_idx].elem;
+- cqp->scratch_array[wqe_idx] = scratch;
++ wqe = cqp->sq_base[*wqe_idx].elem;
++ cqp->scratch_array[*wqe_idx] = scratch;
+ I40IW_CQP_INIT_WQE(wqe);
+
+ return wqe;
+ }
+
++/**
++ * i40iw_sc_cqp_get_next_send_wqe - get next wqe on cqp sq
++ * @cqp: struct for cqp hw
++ * @scratch: private data for CQP WQE
++ */
++u64 *i40iw_sc_cqp_get_next_send_wqe(struct i40iw_sc_cqp *cqp, u64 scratch)
++{
++ u32 wqe_idx;
++
++ return i40iw_sc_cqp_get_next_send_wqe_idx(cqp, scratch, &wqe_idx);
++}
++
+ /**
+ * i40iw_sc_cqp_destroy - destroy cqp during close
+ * @cqp: struct for cqp hw
+@@ -3534,8 +3547,10 @@ static enum i40iw_status_code cqp_sds_wqe_fill(struct i40iw_sc_cqp *cqp,
+ u64 *wqe;
+ int mem_entries, wqe_entries;
+ struct i40iw_dma_mem *sdbuf = &cqp->sdbuf;
++ u64 offset;
++ u32 wqe_idx;
+
+- wqe = i40iw_sc_cqp_get_next_send_wqe(cqp, scratch);
++ wqe = i40iw_sc_cqp_get_next_send_wqe_idx(cqp, scratch, &wqe_idx);
+ if (!wqe)
+ return I40IW_ERR_RING_FULL;
+
+@@ -3548,8 +3563,10 @@ static enum i40iw_status_code cqp_sds_wqe_fill(struct i40iw_sc_cqp *cqp,
+ LS_64(mem_entries, I40IW_CQPSQ_UPESD_ENTRY_COUNT);
+
+ if (mem_entries) {
+- memcpy(sdbuf->va, &info->entry[3], (mem_entries << 4));
+- data = sdbuf->pa;
++ offset = wqe_idx * I40IW_UPDATE_SD_BUF_SIZE;
++ memcpy((char *)sdbuf->va + offset, &info->entry[3],
++ mem_entries << 4);
++ data = (u64)sdbuf->pa + offset;
+ } else {
+ data = 0;
+ }
+diff --git a/drivers/infiniband/hw/i40iw/i40iw_d.h b/drivers/infiniband/hw/i40iw/i40iw_d.h
+index 2ebaadbed379..24eabcad5e40 100644
+--- a/drivers/infiniband/hw/i40iw/i40iw_d.h
++++ b/drivers/infiniband/hw/i40iw/i40iw_d.h
+@@ -1109,7 +1109,7 @@
+ #define I40IWQPC_VLANTAG_MASK (0xffffULL << I40IWQPC_VLANTAG_SHIFT)
+
+ #define I40IWQPC_ARPIDX_SHIFT 48
+-#define I40IWQPC_ARPIDX_MASK (0xfffULL << I40IWQPC_ARPIDX_SHIFT)
++#define I40IWQPC_ARPIDX_MASK (0xffffULL << I40IWQPC_ARPIDX_SHIFT)
+
+ #define I40IWQPC_FLOWLABEL_SHIFT 0
+ #define I40IWQPC_FLOWLABEL_MASK (0xfffffUL << I40IWQPC_FLOWLABEL_SHIFT)
+@@ -1516,7 +1516,7 @@ enum i40iw_alignment {
+ I40IW_AEQ_ALIGNMENT = 0x100,
+ I40IW_CEQ_ALIGNMENT = 0x100,
+ I40IW_CQ0_ALIGNMENT = 0x100,
+- I40IW_SD_BUF_ALIGNMENT = 0x100
++ I40IW_SD_BUF_ALIGNMENT = 0x80
+ };
+
+ #define I40IW_WQE_SIZE_64 64
+@@ -1524,6 +1524,8 @@ enum i40iw_alignment {
+ #define I40IW_QP_WQE_MIN_SIZE 32
+ #define I40IW_QP_WQE_MAX_SIZE 128
+
++#define I40IW_UPDATE_SD_BUF_SIZE 128
++
+ #define I40IW_CQE_QTYPE_RQ 0
+ #define I40IW_CQE_QTYPE_SQ 1
+
+diff --git a/drivers/infiniband/hw/mlx4/qp.c b/drivers/infiniband/hw/mlx4/qp.c
+index fcfa08747899..9354fec8efe7 100644
+--- a/drivers/infiniband/hw/mlx4/qp.c
++++ b/drivers/infiniband/hw/mlx4/qp.c
+@@ -666,6 +666,19 @@ static int set_qp_rss(struct mlx4_ib_dev *dev, struct mlx4_ib_rss *rss_ctx,
+ return (-EOPNOTSUPP);
+ }
+
++ if (ucmd->rx_hash_fields_mask & ~(MLX4_IB_RX_HASH_SRC_IPV4 |
++ MLX4_IB_RX_HASH_DST_IPV4 |
++ MLX4_IB_RX_HASH_SRC_IPV6 |
++ MLX4_IB_RX_HASH_DST_IPV6 |
++ MLX4_IB_RX_HASH_SRC_PORT_TCP |
++ MLX4_IB_RX_HASH_DST_PORT_TCP |
++ MLX4_IB_RX_HASH_SRC_PORT_UDP |
++ MLX4_IB_RX_HASH_DST_PORT_UDP)) {
++ pr_debug("RX Hash fields_mask has unsupported mask (0x%llx)\n",
++ ucmd->rx_hash_fields_mask);
++ return (-EOPNOTSUPP);
++ }
++
+ if ((ucmd->rx_hash_fields_mask & MLX4_IB_RX_HASH_SRC_IPV4) &&
+ (ucmd->rx_hash_fields_mask & MLX4_IB_RX_HASH_DST_IPV4)) {
+ rss_ctx->flags = MLX4_RSS_IPV4;
+@@ -691,11 +704,11 @@ static int set_qp_rss(struct mlx4_ib_dev *dev, struct mlx4_ib_rss *rss_ctx,
+ return (-EOPNOTSUPP);
+ }
+
+- if (rss_ctx->flags & MLX4_RSS_IPV4) {
++ if (rss_ctx->flags & MLX4_RSS_IPV4)
+ rss_ctx->flags |= MLX4_RSS_UDP_IPV4;
+- } else if (rss_ctx->flags & MLX4_RSS_IPV6) {
++ if (rss_ctx->flags & MLX4_RSS_IPV6)
+ rss_ctx->flags |= MLX4_RSS_UDP_IPV6;
+- } else {
++ if (!(rss_ctx->flags & (MLX4_RSS_IPV6 | MLX4_RSS_IPV4))) {
+ pr_debug("RX Hash fields_mask is not supported - UDP must be set with IPv4 or IPv6\n");
+ return (-EOPNOTSUPP);
+ }
+@@ -707,15 +720,14 @@ static int set_qp_rss(struct mlx4_ib_dev *dev, struct mlx4_ib_rss *rss_ctx,
+
+ if ((ucmd->rx_hash_fields_mask & MLX4_IB_RX_HASH_SRC_PORT_TCP) &&
+ (ucmd->rx_hash_fields_mask & MLX4_IB_RX_HASH_DST_PORT_TCP)) {
+- if (rss_ctx->flags & MLX4_RSS_IPV4) {
++ if (rss_ctx->flags & MLX4_RSS_IPV4)
+ rss_ctx->flags |= MLX4_RSS_TCP_IPV4;
+- } else if (rss_ctx->flags & MLX4_RSS_IPV6) {
++ if (rss_ctx->flags & MLX4_RSS_IPV6)
+ rss_ctx->flags |= MLX4_RSS_TCP_IPV6;
+- } else {
++ if (!(rss_ctx->flags & (MLX4_RSS_IPV6 | MLX4_RSS_IPV4))) {
+ pr_debug("RX Hash fields_mask is not supported - TCP must be set with IPv4 or IPv6\n");
+ return (-EOPNOTSUPP);
+ }
+-
+ } else if ((ucmd->rx_hash_fields_mask & MLX4_IB_RX_HASH_SRC_PORT_TCP) ||
+ (ucmd->rx_hash_fields_mask & MLX4_IB_RX_HASH_DST_PORT_TCP)) {
+ pr_debug("RX Hash fields_mask is not supported - both TCP SRC and DST must be set\n");
+diff --git a/drivers/md/raid1.c b/drivers/md/raid1.c
+index 5a8216b50e38..788fc0800465 100644
+--- a/drivers/md/raid1.c
++++ b/drivers/md/raid1.c
+@@ -810,11 +810,15 @@ static void flush_pending_writes(struct r1conf *conf)
+ spin_lock_irq(&conf->device_lock);
+
+ if (conf->pending_bio_list.head) {
++ struct blk_plug plug;
+ struct bio *bio;
++
+ bio = bio_list_get(&conf->pending_bio_list);
+ conf->pending_count = 0;
+ spin_unlock_irq(&conf->device_lock);
++ blk_start_plug(&plug);
+ flush_bio_list(conf, bio);
++ blk_finish_plug(&plug);
+ } else
+ spin_unlock_irq(&conf->device_lock);
+ }
+diff --git a/drivers/md/raid10.c b/drivers/md/raid10.c
+index 374df5796649..0d18d3b95201 100644
+--- a/drivers/md/raid10.c
++++ b/drivers/md/raid10.c
+@@ -890,10 +890,13 @@ static void flush_pending_writes(struct r10conf *conf)
+ spin_lock_irq(&conf->device_lock);
+
+ if (conf->pending_bio_list.head) {
++ struct blk_plug plug;
+ struct bio *bio;
++
+ bio = bio_list_get(&conf->pending_bio_list);
+ conf->pending_count = 0;
+ spin_unlock_irq(&conf->device_lock);
++ blk_start_plug(&plug);
+ /* flush any pending bitmap writes to disk
+ * before proceeding w/ I/O */
+ bitmap_unplug(conf->mddev->bitmap);
+@@ -914,6 +917,7 @@ static void flush_pending_writes(struct r10conf *conf)
+ generic_make_request(bio);
+ bio = next;
+ }
++ blk_finish_plug(&plug);
+ } else
+ spin_unlock_irq(&conf->device_lock);
+ }
+diff --git a/drivers/md/raid5.c b/drivers/md/raid5.c
+index c406f16f5295..7ec822ced80b 100644
+--- a/drivers/md/raid5.c
++++ b/drivers/md/raid5.c
+@@ -2678,13 +2678,13 @@ static void raid5_error(struct mddev *mddev, struct md_rdev *rdev)
+ pr_debug("raid456: error called\n");
+
+ spin_lock_irqsave(&conf->device_lock, flags);
++ set_bit(Faulty, &rdev->flags);
+ clear_bit(In_sync, &rdev->flags);
+ mddev->degraded = raid5_calc_degraded(conf);
+ spin_unlock_irqrestore(&conf->device_lock, flags);
+ set_bit(MD_RECOVERY_INTR, &mddev->recovery);
+
+ set_bit(Blocked, &rdev->flags);
+- set_bit(Faulty, &rdev->flags);
+ set_mask_bits(&mddev->sb_flags, 0,
+ BIT(MD_SB_CHANGE_DEVS) | BIT(MD_SB_CHANGE_PENDING));
+ pr_crit("md/raid:%s: Disk failure on %s, disabling device.\n"
+diff --git a/drivers/media/i2c/Kconfig b/drivers/media/i2c/Kconfig
+index 94153895fcd4..3bdc34deae7b 100644
+--- a/drivers/media/i2c/Kconfig
++++ b/drivers/media/i2c/Kconfig
+@@ -660,6 +660,7 @@ config VIDEO_OV13858
+ tristate "OmniVision OV13858 sensor support"
+ depends on I2C && VIDEO_V4L2 && VIDEO_V4L2_SUBDEV_API
+ depends on MEDIA_CAMERA_SUPPORT
++ select V4L2_FWNODE
+ ---help---
+ This is a Video4Linux2 sensor-level driver for the OmniVision
+ OV13858 camera.
+diff --git a/drivers/media/i2c/s5k6aa.c b/drivers/media/i2c/s5k6aa.c
+index 9fd254a8e20d..13c10b5e2b45 100644
+--- a/drivers/media/i2c/s5k6aa.c
++++ b/drivers/media/i2c/s5k6aa.c
+@@ -421,6 +421,7 @@ static int s5k6aa_set_ahb_address(struct i2c_client *client)
+
+ /**
+ * s5k6aa_configure_pixel_clock - apply ISP main clock/PLL configuration
++ * @s5k6aa: pointer to &struct s5k6aa describing the device
+ *
+ * Configure the internal ISP PLL for the required output frequency.
+ * Locking: called with s5k6aa.lock mutex held.
+@@ -669,6 +670,7 @@ static int s5k6aa_set_input_params(struct s5k6aa *s5k6aa)
+
+ /**
+ * s5k6aa_configure_video_bus - configure the video output interface
++ * @s5k6aa: pointer to &struct s5k6aa describing the device
+ * @bus_type: video bus type: parallel or MIPI-CSI
+ * @nlanes: number of MIPI lanes to be used (MIPI-CSI only)
+ *
+@@ -724,6 +726,8 @@ static int s5k6aa_new_config_sync(struct i2c_client *client, int timeout,
+
+ /**
+ * s5k6aa_set_prev_config - write user preview register set
++ * @s5k6aa: pointer to &struct s5k6aa describing the device
++ * @preset: s5kaa preset to be applied
+ *
+ * Configure output resolution and color fromat, pixel clock
+ * frequency range, device frame rate type and frame period range.
+@@ -777,6 +781,7 @@ static int s5k6aa_set_prev_config(struct s5k6aa *s5k6aa,
+
+ /**
+ * s5k6aa_initialize_isp - basic ISP MCU initialization
++ * @sd: pointer to V4L2 sub-device descriptor
+ *
+ * Configure AHB addresses for registers read/write; configure PLLs for
+ * required output pixel clock. The ISP power supply needs to be already
+diff --git a/drivers/media/usb/pvrusb2/pvrusb2-hdw.c b/drivers/media/usb/pvrusb2/pvrusb2-hdw.c
+index ad5b25b89699..44975061b953 100644
+--- a/drivers/media/usb/pvrusb2/pvrusb2-hdw.c
++++ b/drivers/media/usb/pvrusb2/pvrusb2-hdw.c
+@@ -3642,6 +3642,12 @@ static int pvr2_send_request_ex(struct pvr2_hdw *hdw,
+ hdw);
+ hdw->ctl_write_urb->actual_length = 0;
+ hdw->ctl_write_pend_flag = !0;
++ if (usb_urb_ep_type_check(hdw->ctl_write_urb)) {
++ pvr2_trace(
++ PVR2_TRACE_ERROR_LEGS,
++ "Invalid write control endpoint");
++ return -EINVAL;
++ }
+ status = usb_submit_urb(hdw->ctl_write_urb,GFP_KERNEL);
+ if (status < 0) {
+ pvr2_trace(PVR2_TRACE_ERROR_LEGS,
+@@ -3666,6 +3672,12 @@ status);
+ hdw);
+ hdw->ctl_read_urb->actual_length = 0;
+ hdw->ctl_read_pend_flag = !0;
++ if (usb_urb_ep_type_check(hdw->ctl_read_urb)) {
++ pvr2_trace(
++ PVR2_TRACE_ERROR_LEGS,
++ "Invalid read control endpoint");
++ return -EINVAL;
++ }
+ status = usb_submit_urb(hdw->ctl_read_urb,GFP_KERNEL);
+ if (status < 0) {
+ pvr2_trace(PVR2_TRACE_ERROR_LEGS,
+diff --git a/drivers/misc/mei/hw-me-regs.h b/drivers/misc/mei/hw-me-regs.h
+index 0ccccbaf530d..e4b10b2d1a08 100644
+--- a/drivers/misc/mei/hw-me-regs.h
++++ b/drivers/misc/mei/hw-me-regs.h
+@@ -132,6 +132,11 @@
+ #define MEI_DEV_ID_KBP 0xA2BA /* Kaby Point */
+ #define MEI_DEV_ID_KBP_2 0xA2BB /* Kaby Point 2 */
+
++#define MEI_DEV_ID_CNP_LP 0x9DE0 /* Cannon Point LP */
++#define MEI_DEV_ID_CNP_LP_4 0x9DE4 /* Cannon Point LP 4 (iTouch) */
++#define MEI_DEV_ID_CNP_H 0xA360 /* Cannon Point H */
++#define MEI_DEV_ID_CNP_H_4 0xA364 /* Cannon Point H 4 (iTouch) */
++
+ /*
+ * MEI HW Section
+ */
+diff --git a/drivers/misc/mei/pci-me.c b/drivers/misc/mei/pci-me.c
+index d46cb1f0868f..c77e08cbbfd1 100644
+--- a/drivers/misc/mei/pci-me.c
++++ b/drivers/misc/mei/pci-me.c
+@@ -98,6 +98,11 @@ static const struct pci_device_id mei_me_pci_tbl[] = {
+ {MEI_PCI_DEVICE(MEI_DEV_ID_KBP, MEI_ME_PCH8_CFG)},
+ {MEI_PCI_DEVICE(MEI_DEV_ID_KBP_2, MEI_ME_PCH8_CFG)},
+
++ {MEI_PCI_DEVICE(MEI_DEV_ID_CNP_LP, MEI_ME_PCH8_CFG)},
++ {MEI_PCI_DEVICE(MEI_DEV_ID_CNP_LP_4, MEI_ME_PCH8_CFG)},
++ {MEI_PCI_DEVICE(MEI_DEV_ID_CNP_H, MEI_ME_PCH8_CFG)},
++ {MEI_PCI_DEVICE(MEI_DEV_ID_CNP_H_4, MEI_ME_PCH8_CFG)},
++
+ /* required last entry */
+ {0, }
+ };
+diff --git a/drivers/net/dsa/mv88e6xxx/chip.c b/drivers/net/dsa/mv88e6xxx/chip.c
+index d74c7335c512..eebda5ec9676 100644
+--- a/drivers/net/dsa/mv88e6xxx/chip.c
++++ b/drivers/net/dsa/mv88e6xxx/chip.c
+@@ -339,7 +339,7 @@ static void mv88e6xxx_g1_irq_free(struct mv88e6xxx_chip *chip)
+ u16 mask;
+
+ mv88e6xxx_g1_read(chip, MV88E6XXX_G1_CTL1, &mask);
+- mask |= GENMASK(chip->g1_irq.nirqs, 0);
++ mask &= ~GENMASK(chip->g1_irq.nirqs, 0);
+ mv88e6xxx_g1_write(chip, MV88E6XXX_G1_CTL1, mask);
+
+ free_irq(chip->irq, chip);
+@@ -395,7 +395,7 @@ static int mv88e6xxx_g1_irq_setup(struct mv88e6xxx_chip *chip)
+ return 0;
+
+ out_disable:
+- mask |= GENMASK(chip->g1_irq.nirqs, 0);
++ mask &= ~GENMASK(chip->g1_irq.nirqs, 0);
+ mv88e6xxx_g1_write(chip, MV88E6XXX_G1_CTL1, mask);
+
+ out_mapping:
+@@ -2153,6 +2153,19 @@ static const struct of_device_id mv88e6xxx_mdio_external_match[] = {
+ { },
+ };
+
++static void mv88e6xxx_mdios_unregister(struct mv88e6xxx_chip *chip)
++
++{
++ struct mv88e6xxx_mdio_bus *mdio_bus;
++ struct mii_bus *bus;
++
++ list_for_each_entry(mdio_bus, &chip->mdios, list) {
++ bus = mdio_bus->bus;
++
++ mdiobus_unregister(bus);
++ }
++}
++
+ static int mv88e6xxx_mdios_register(struct mv88e6xxx_chip *chip,
+ struct device_node *np)
+ {
+@@ -2177,27 +2190,16 @@ static int mv88e6xxx_mdios_register(struct mv88e6xxx_chip *chip,
+ match = of_match_node(mv88e6xxx_mdio_external_match, child);
+ if (match) {
+ err = mv88e6xxx_mdio_register(chip, child, true);
+- if (err)
++ if (err) {
++ mv88e6xxx_mdios_unregister(chip);
+ return err;
++ }
+ }
+ }
+
+ return 0;
+ }
+
+-static void mv88e6xxx_mdios_unregister(struct mv88e6xxx_chip *chip)
+-
+-{
+- struct mv88e6xxx_mdio_bus *mdio_bus;
+- struct mii_bus *bus;
+-
+- list_for_each_entry(mdio_bus, &chip->mdios, list) {
+- bus = mdio_bus->bus;
+-
+- mdiobus_unregister(bus);
+- }
+-}
+-
+ static int mv88e6xxx_get_eeprom_len(struct dsa_switch *ds)
+ {
+ struct mv88e6xxx_chip *chip = ds->priv;
+diff --git a/drivers/net/ethernet/arc/emac_rockchip.c b/drivers/net/ethernet/arc/emac_rockchip.c
+index e278e3d96ee0..c6163874e4e7 100644
+--- a/drivers/net/ethernet/arc/emac_rockchip.c
++++ b/drivers/net/ethernet/arc/emac_rockchip.c
+@@ -220,9 +220,11 @@ static int emac_rockchip_probe(struct platform_device *pdev)
+
+ /* RMII TX/RX needs always a rate of 25MHz */
+ err = clk_set_rate(priv->macclk, 25000000);
+- if (err)
++ if (err) {
+ dev_err(dev,
+ "failed to change mac clock rate (%d)\n", err);
++ goto out_clk_disable_macclk;
++ }
+ }
+
+ err = arc_emac_probe(ndev, interface);
+@@ -232,7 +234,8 @@ static int emac_rockchip_probe(struct platform_device *pdev)
+ }
+
+ return 0;
+-
++out_clk_disable_macclk:
++ clk_disable_unprepare(priv->macclk);
+ out_regulator_disable:
+ if (priv->regulator)
+ regulator_disable(priv->regulator);
+diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.c b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
+index aa764c5e3c6b..b66689a6eac0 100644
+--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c
++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
+@@ -8218,8 +8218,9 @@ static void bnxt_shutdown(struct pci_dev *pdev)
+ if (netif_running(dev))
+ dev_close(dev);
+
++ bnxt_ulp_shutdown(bp);
++
+ if (system_state == SYSTEM_POWER_OFF) {
+- bnxt_ulp_shutdown(bp);
+ bnxt_clear_int_mode(bp);
+ pci_wake_from_d3(pdev, bp->wol);
+ pci_set_power_state(pdev, PCI_D3hot);
+diff --git a/drivers/net/ethernet/freescale/gianfar.c b/drivers/net/ethernet/freescale/gianfar.c
+index 5be52d89b182..7f837006bb6a 100644
+--- a/drivers/net/ethernet/freescale/gianfar.c
++++ b/drivers/net/ethernet/freescale/gianfar.c
+@@ -1378,9 +1378,11 @@ static int gfar_probe(struct platform_device *ofdev)
+
+ gfar_init_addr_hash_table(priv);
+
+- /* Insert receive time stamps into padding alignment bytes */
++ /* Insert receive time stamps into padding alignment bytes, and
++ * plus 2 bytes padding to ensure the cpu alignment.
++ */
+ if (priv->device_flags & FSL_GIANFAR_DEV_HAS_TIMER)
+- priv->padding = 8;
++ priv->padding = 8 + DEFAULT_PADDING;
+
+ if (dev->features & NETIF_F_IP_CSUM ||
+ priv->device_flags & FSL_GIANFAR_DEV_HAS_TIMER)
+@@ -1790,6 +1792,7 @@ static int init_phy(struct net_device *dev)
+ GFAR_SUPPORTED_GBIT : 0;
+ phy_interface_t interface;
+ struct phy_device *phydev;
++ struct ethtool_eee edata;
+
+ priv->oldlink = 0;
+ priv->oldspeed = 0;
+@@ -1814,6 +1817,10 @@ static int init_phy(struct net_device *dev)
+ /* Add support for flow control, but don't advertise it by default */
+ phydev->supported |= (SUPPORTED_Pause | SUPPORTED_Asym_Pause);
+
++ /* disable EEE autoneg, EEE not supported by eTSEC */
++ memset(&edata, 0, sizeof(struct ethtool_eee));
++ phy_ethtool_set_eee(phydev, &edata);
++
+ return 0;
+ }
+
+diff --git a/drivers/net/ethernet/marvell/mvpp2.c b/drivers/net/ethernet/marvell/mvpp2.c
+index 06f3fe429d82..529be74f609d 100644
+--- a/drivers/net/ethernet/marvell/mvpp2.c
++++ b/drivers/net/ethernet/marvell/mvpp2.c
+@@ -5399,7 +5399,7 @@ static int mvpp2_aggr_txq_init(struct platform_device *pdev,
+ u32 txq_dma;
+
+ /* Allocate memory for TX descriptors */
+- aggr_txq->descs = dma_alloc_coherent(&pdev->dev,
++ aggr_txq->descs = dma_zalloc_coherent(&pdev->dev,
+ MVPP2_AGGR_TXQ_SIZE * MVPP2_DESC_ALIGNED_SIZE,
+ &aggr_txq->descs_dma, GFP_KERNEL);
+ if (!aggr_txq->descs)
+diff --git a/drivers/net/ethernet/netronome/nfp/nfp_net_repr.c b/drivers/net/ethernet/netronome/nfp/nfp_net_repr.c
+index 1c43aca8162d..9a7655560629 100644
+--- a/drivers/net/ethernet/netronome/nfp/nfp_net_repr.c
++++ b/drivers/net/ethernet/netronome/nfp/nfp_net_repr.c
+@@ -84,16 +84,13 @@ nfp_repr_phy_port_get_stats64(struct nfp_port *port,
+ {
+ u8 __iomem *mem = port->eth_stats;
+
+- /* TX and RX stats are flipped as we are returning the stats as seen
+- * at the switch port corresponding to the phys port.
+- */
+- stats->tx_packets = readq(mem + NFP_MAC_STATS_RX_FRAMES_RECEIVED_OK);
+- stats->tx_bytes = readq(mem + NFP_MAC_STATS_RX_IN_OCTETS);
+- stats->tx_dropped = readq(mem + NFP_MAC_STATS_RX_IN_ERRORS);
++ stats->tx_packets = readq(mem + NFP_MAC_STATS_TX_FRAMES_TRANSMITTED_OK);
++ stats->tx_bytes = readq(mem + NFP_MAC_STATS_TX_OUT_OCTETS);
++ stats->tx_dropped = readq(mem + NFP_MAC_STATS_TX_OUT_ERRORS);
+
+- stats->rx_packets = readq(mem + NFP_MAC_STATS_TX_FRAMES_TRANSMITTED_OK);
+- stats->rx_bytes = readq(mem + NFP_MAC_STATS_TX_OUT_OCTETS);
+- stats->rx_dropped = readq(mem + NFP_MAC_STATS_TX_OUT_ERRORS);
++ stats->rx_packets = readq(mem + NFP_MAC_STATS_RX_FRAMES_RECEIVED_OK);
++ stats->rx_bytes = readq(mem + NFP_MAC_STATS_RX_IN_OCTETS);
++ stats->rx_dropped = readq(mem + NFP_MAC_STATS_RX_IN_ERRORS);
+ }
+
+ static void
+diff --git a/drivers/net/ethernet/qualcomm/rmnet/rmnet_handlers.c b/drivers/net/ethernet/qualcomm/rmnet/rmnet_handlers.c
+index 540c7622dcb1..929fb8d96ec0 100644
+--- a/drivers/net/ethernet/qualcomm/rmnet/rmnet_handlers.c
++++ b/drivers/net/ethernet/qualcomm/rmnet/rmnet_handlers.c
+@@ -166,12 +166,12 @@ static int rmnet_map_egress_handler(struct sk_buff *skb,
+
+ if (skb_headroom(skb) < required_headroom) {
+ if (pskb_expand_head(skb, required_headroom, 0, GFP_KERNEL))
+- return RMNET_MAP_CONSUMED;
++ goto fail;
+ }
+
+ map_header = rmnet_map_add_map_header(skb, additional_header_len, 0);
+ if (!map_header)
+- return RMNET_MAP_CONSUMED;
++ goto fail;
+
+ if (port->egress_data_format & RMNET_EGRESS_FORMAT_MUXING) {
+ if (ep->mux_id == 0xff)
+@@ -183,6 +183,10 @@ static int rmnet_map_egress_handler(struct sk_buff *skb,
+ skb->protocol = htons(ETH_P_MAP);
+
+ return RMNET_MAP_SUCCESS;
++
++fail:
++ kfree_skb(skb);
++ return RMNET_MAP_CONSUMED;
+ }
+
+ /* Ingress / Egress Entry Points */
+diff --git a/drivers/net/hippi/rrunner.c b/drivers/net/hippi/rrunner.c
+index 71ddadbf2368..d7ba2b813eff 100644
+--- a/drivers/net/hippi/rrunner.c
++++ b/drivers/net/hippi/rrunner.c
+@@ -1381,8 +1381,8 @@ static int rr_close(struct net_device *dev)
+ rrpriv->info_dma);
+ rrpriv->info = NULL;
+
+- free_irq(pdev->irq, dev);
+ spin_unlock_irqrestore(&rrpriv->lock, flags);
++ free_irq(pdev->irq, dev);
+
+ return 0;
+ }
+diff --git a/drivers/net/ipvlan/ipvlan_core.c b/drivers/net/ipvlan/ipvlan_core.c
+index 8feb84fd4ca7..c23dea48ad0f 100644
+--- a/drivers/net/ipvlan/ipvlan_core.c
++++ b/drivers/net/ipvlan/ipvlan_core.c
+@@ -375,6 +375,7 @@ static int ipvlan_process_v4_outbound(struct sk_buff *skb)
+ .flowi4_oif = dev->ifindex,
+ .flowi4_tos = RT_TOS(ip4h->tos),
+ .flowi4_flags = FLOWI_FLAG_ANYSRC,
++ .flowi4_mark = skb->mark,
+ .daddr = ip4h->daddr,
+ .saddr = ip4h->saddr,
+ };
+diff --git a/drivers/net/phy/phylink.c b/drivers/net/phy/phylink.c
+index cb85307f125b..1b2fe74a44ea 100644
+--- a/drivers/net/phy/phylink.c
++++ b/drivers/net/phy/phylink.c
+@@ -772,6 +772,7 @@ void phylink_stop(struct phylink *pl)
+ sfp_upstream_stop(pl->sfp_bus);
+
+ set_bit(PHYLINK_DISABLE_STOPPED, &pl->phylink_disable_state);
++ queue_work(system_power_efficient_wq, &pl->resolve);
+ flush_work(&pl->resolve);
+ }
+ EXPORT_SYMBOL_GPL(phylink_stop);
+diff --git a/drivers/net/phy/sfp.c b/drivers/net/phy/sfp.c
+index baee371bf767..8bf10aba7452 100644
+--- a/drivers/net/phy/sfp.c
++++ b/drivers/net/phy/sfp.c
+@@ -358,7 +358,7 @@ static void sfp_sm_link_check_los(struct sfp *sfp)
+ * SFP_OPTIONS_LOS_NORMAL are set? For now, we assume
+ * the same as SFP_OPTIONS_LOS_NORMAL set.
+ */
+- if (sfp->id.ext.options & SFP_OPTIONS_LOS_INVERTED)
++ if (sfp->id.ext.options & cpu_to_be16(SFP_OPTIONS_LOS_INVERTED))
+ los ^= SFP_F_LOS;
+
+ if (los)
+@@ -583,7 +583,8 @@ static void sfp_sm_event(struct sfp *sfp, unsigned int event)
+ if (event == SFP_E_TX_FAULT)
+ sfp_sm_fault(sfp, true);
+ else if (event ==
+- (sfp->id.ext.options & SFP_OPTIONS_LOS_INVERTED ?
++ (sfp->id.ext.options &
++ cpu_to_be16(SFP_OPTIONS_LOS_INVERTED) ?
+ SFP_E_LOS_HIGH : SFP_E_LOS_LOW))
+ sfp_sm_link_up(sfp);
+ break;
+@@ -593,7 +594,8 @@ static void sfp_sm_event(struct sfp *sfp, unsigned int event)
+ sfp_sm_link_down(sfp);
+ sfp_sm_fault(sfp, true);
+ } else if (event ==
+- (sfp->id.ext.options & SFP_OPTIONS_LOS_INVERTED ?
++ (sfp->id.ext.options &
++ cpu_to_be16(SFP_OPTIONS_LOS_INVERTED) ?
+ SFP_E_LOS_LOW : SFP_E_LOS_HIGH)) {
+ sfp_sm_link_down(sfp);
+ sfp_sm_next(sfp, SFP_S_WAIT_LOS, 0);
+diff --git a/drivers/net/virtio_net.c b/drivers/net/virtio_net.c
+index 511f8339fa96..7927e28f5336 100644
+--- a/drivers/net/virtio_net.c
++++ b/drivers/net/virtio_net.c
+@@ -714,7 +714,7 @@ static struct sk_buff *receive_mergeable(struct net_device *dev,
+ int num_skb_frags;
+
+ buf = virtqueue_get_buf_ctx(rq->vq, &len, &ctx);
+- if (unlikely(!ctx)) {
++ if (unlikely(!buf)) {
+ pr_debug("%s: rx error: %d buffers out of %d missing\n",
+ dev->name, num_buf,
+ virtio16_to_cpu(vi->vdev,
+diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
+index b3fa8ae80465..eccd25febfe6 100644
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/sdio.c
+@@ -2064,7 +2064,7 @@ static int brcmf_sdio_txpkt_hdalign(struct brcmf_sdio *bus, struct sk_buff *pkt)
+ return head_pad;
+ }
+
+-/**
++/*
+ * struct brcmf_skbuff_cb reserves first two bytes in sk_buff::cb for
+ * bus layer usage.
+ */
+diff --git a/drivers/net/wireless/mac80211_hwsim.c b/drivers/net/wireless/mac80211_hwsim.c
+index a59b54328c07..052e67bce6b3 100644
+--- a/drivers/net/wireless/mac80211_hwsim.c
++++ b/drivers/net/wireless/mac80211_hwsim.c
+@@ -3119,6 +3119,11 @@ static int hwsim_new_radio_nl(struct sk_buff *msg, struct genl_info *info)
+ if (info->attrs[HWSIM_ATTR_CHANNELS])
+ param.channels = nla_get_u32(info->attrs[HWSIM_ATTR_CHANNELS]);
+
++ if (param.channels > CFG80211_MAX_NUM_DIFFERENT_CHANNELS) {
++ GENL_SET_ERR_MSG(info, "too many channels specified");
++ return -EINVAL;
++ }
++
+ if (info->attrs[HWSIM_ATTR_NO_VIF])
+ param.no_vif = true;
+
+diff --git a/drivers/pci/host/pcie-rcar.c b/drivers/pci/host/pcie-rcar.c
+index 4e0b25d09b0c..f09ff4789bb5 100644
+--- a/drivers/pci/host/pcie-rcar.c
++++ b/drivers/pci/host/pcie-rcar.c
+@@ -1146,12 +1146,12 @@ static int rcar_pcie_probe(struct platform_device *pdev)
+ err = rcar_pcie_get_resources(pcie);
+ if (err < 0) {
+ dev_err(dev, "failed to request resources: %d\n", err);
+- goto err_free_bridge;
++ goto err_free_resource_list;
+ }
+
+ err = rcar_pcie_parse_map_dma_ranges(pcie, dev->of_node);
+ if (err)
+- goto err_free_bridge;
++ goto err_free_resource_list;
+
+ pm_runtime_enable(dev);
+ err = pm_runtime_get_sync(dev);
+@@ -1194,9 +1194,9 @@ static int rcar_pcie_probe(struct platform_device *pdev)
+ err_pm_disable:
+ pm_runtime_disable(dev);
+
+-err_free_bridge:
+- pci_free_host_bridge(bridge);
++err_free_resource_list:
+ pci_free_resource_list(&pcie->resources);
++ pci_free_host_bridge(bridge);
+
+ return err;
+ }
+diff --git a/drivers/pinctrl/intel/pinctrl-denverton.c b/drivers/pinctrl/intel/pinctrl-denverton.c
+index 4500880240f2..6572550cfe78 100644
+--- a/drivers/pinctrl/intel/pinctrl-denverton.c
++++ b/drivers/pinctrl/intel/pinctrl-denverton.c
+@@ -207,7 +207,7 @@ static const unsigned int dnv_uart0_pins[] = { 60, 61, 64, 65 };
+ static const unsigned int dnv_uart0_modes[] = { 2, 3, 1, 1 };
+ static const unsigned int dnv_uart1_pins[] = { 94, 95, 96, 97 };
+ static const unsigned int dnv_uart2_pins[] = { 60, 61, 62, 63 };
+-static const unsigned int dnv_uart2_modes[] = { 1, 1, 2, 2 };
++static const unsigned int dnv_uart2_modes[] = { 1, 2, 2, 2 };
+ static const unsigned int dnv_emmc_pins[] = {
+ 142, 143, 144, 145, 146, 147, 148, 149, 150, 151, 152,
+ };
+diff --git a/drivers/pinctrl/sunxi/pinctrl-sun50i-a64.c b/drivers/pinctrl/sunxi/pinctrl-sun50i-a64.c
+index 4f2a726bbaeb..f5f77432ce6f 100644
+--- a/drivers/pinctrl/sunxi/pinctrl-sun50i-a64.c
++++ b/drivers/pinctrl/sunxi/pinctrl-sun50i-a64.c
+@@ -428,7 +428,7 @@ static const struct sunxi_desc_pin a64_pins[] = {
+ SUNXI_FUNCTION(0x0, "gpio_in"),
+ SUNXI_FUNCTION(0x1, "gpio_out"),
+ SUNXI_FUNCTION(0x2, "mmc0"), /* D3 */
+- SUNXI_FUNCTION(0x4, "uart0")), /* RX */
++ SUNXI_FUNCTION(0x3, "uart0")), /* RX */
+ SUNXI_PIN(SUNXI_PINCTRL_PIN(F, 5),
+ SUNXI_FUNCTION(0x0, "gpio_in"),
+ SUNXI_FUNCTION(0x1, "gpio_out"),
+diff --git a/drivers/pinctrl/sunxi/pinctrl-sun9i-a80.c b/drivers/pinctrl/sunxi/pinctrl-sun9i-a80.c
+index bc14e954d7a2..b7ca9a40cc66 100644
+--- a/drivers/pinctrl/sunxi/pinctrl-sun9i-a80.c
++++ b/drivers/pinctrl/sunxi/pinctrl-sun9i-a80.c
+@@ -145,19 +145,19 @@ static const struct sunxi_desc_pin sun9i_a80_pins[] = {
+ SUNXI_FUNCTION(0x0, "gpio_in"),
+ SUNXI_FUNCTION(0x1, "gpio_out"),
+ SUNXI_FUNCTION(0x3, "mcsi"), /* MCLK */
+- SUNXI_FUNCTION_IRQ_BANK(0x6, 0, 14)), /* PB_EINT14 */
++ SUNXI_FUNCTION_IRQ_BANK(0x6, 1, 14)), /* PB_EINT14 */
+ SUNXI_PIN(SUNXI_PINCTRL_PIN(B, 15),
+ SUNXI_FUNCTION(0x0, "gpio_in"),
+ SUNXI_FUNCTION(0x1, "gpio_out"),
+ SUNXI_FUNCTION(0x3, "mcsi"), /* SCK */
+ SUNXI_FUNCTION(0x4, "i2c4"), /* SCK */
+- SUNXI_FUNCTION_IRQ_BANK(0x6, 0, 15)), /* PB_EINT15 */
++ SUNXI_FUNCTION_IRQ_BANK(0x6, 1, 15)), /* PB_EINT15 */
+ SUNXI_PIN(SUNXI_PINCTRL_PIN(B, 16),
+ SUNXI_FUNCTION(0x0, "gpio_in"),
+ SUNXI_FUNCTION(0x1, "gpio_out"),
+ SUNXI_FUNCTION(0x3, "mcsi"), /* SDA */
+ SUNXI_FUNCTION(0x4, "i2c4"), /* SDA */
+- SUNXI_FUNCTION_IRQ_BANK(0x6, 0, 16)), /* PB_EINT16 */
++ SUNXI_FUNCTION_IRQ_BANK(0x6, 1, 16)), /* PB_EINT16 */
+
+ /* Hole */
+ SUNXI_PIN(SUNXI_PINCTRL_PIN(C, 0),
+diff --git a/drivers/platform/x86/dell-laptop.c b/drivers/platform/x86/dell-laptop.c
+index f42159fd2031..7424e53157b0 100644
+--- a/drivers/platform/x86/dell-laptop.c
++++ b/drivers/platform/x86/dell-laptop.c
+@@ -49,6 +49,7 @@
+
+ struct quirk_entry {
+ u8 touchpad_led;
++ u8 kbd_led_levels_off_1;
+
+ int needs_kbd_timeouts;
+ /*
+@@ -79,6 +80,10 @@ static struct quirk_entry quirk_dell_xps13_9333 = {
+ .kbd_timeouts = { 0, 5, 15, 60, 5 * 60, 15 * 60, -1 },
+ };
+
++static struct quirk_entry quirk_dell_latitude_e6410 = {
++ .kbd_led_levels_off_1 = 1,
++};
++
+ static struct platform_driver platform_driver = {
+ .driver = {
+ .name = "dell-laptop",
+@@ -280,6 +285,15 @@ static const struct dmi_system_id dell_quirks[] __initconst = {
+ },
+ .driver_data = &quirk_dell_xps13_9333,
+ },
++ {
++ .callback = dmi_matched,
++ .ident = "Dell Latitude E6410",
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."),
++ DMI_MATCH(DMI_PRODUCT_NAME, "Latitude E6410"),
++ },
++ .driver_data = &quirk_dell_latitude_e6410,
++ },
+ { }
+ };
+
+@@ -1200,6 +1214,9 @@ static int kbd_get_info(struct kbd_info *info)
+ units = (buffer->output[2] >> 8) & 0xFF;
+ info->levels = (buffer->output[2] >> 16) & 0xFF;
+
++ if (quirks && quirks->kbd_led_levels_off_1 && info->levels)
++ info->levels--;
++
+ if (units & BIT(0))
+ info->seconds = (buffer->output[3] >> 0) & 0xFF;
+ if (units & BIT(1))
+diff --git a/drivers/s390/block/dasd_eckd.c b/drivers/s390/block/dasd_eckd.c
+index 8eafcd5fa004..5ede251c52ca 100644
+--- a/drivers/s390/block/dasd_eckd.c
++++ b/drivers/s390/block/dasd_eckd.c
+@@ -530,10 +530,12 @@ static int prefix_LRE(struct ccw1 *ccw, struct PFX_eckd_data *pfxdata,
+ pfxdata->validity.define_extent = 1;
+
+ /* private uid is kept up to date, conf_data may be outdated */
+- if (startpriv->uid.type != UA_BASE_DEVICE) {
++ if (startpriv->uid.type == UA_BASE_PAV_ALIAS)
+ pfxdata->validity.verify_base = 1;
+- if (startpriv->uid.type == UA_HYPER_PAV_ALIAS)
+- pfxdata->validity.hyper_pav = 1;
++
++ if (startpriv->uid.type == UA_HYPER_PAV_ALIAS) {
++ pfxdata->validity.verify_base = 1;
++ pfxdata->validity.hyper_pav = 1;
+ }
+
+ rc = define_extent(NULL, dedata, trk, totrk, cmd, basedev, blksize);
+@@ -3414,10 +3416,12 @@ static int prepare_itcw(struct itcw *itcw,
+ pfxdata.validity.define_extent = 1;
+
+ /* private uid is kept up to date, conf_data may be outdated */
+- if (startpriv->uid.type != UA_BASE_DEVICE) {
++ if (startpriv->uid.type == UA_BASE_PAV_ALIAS)
++ pfxdata.validity.verify_base = 1;
++
++ if (startpriv->uid.type == UA_HYPER_PAV_ALIAS) {
+ pfxdata.validity.verify_base = 1;
+- if (startpriv->uid.type == UA_HYPER_PAV_ALIAS)
+- pfxdata.validity.hyper_pav = 1;
++ pfxdata.validity.hyper_pav = 1;
+ }
+
+ switch (cmd) {
+diff --git a/drivers/scsi/bfa/bfad_bsg.c b/drivers/scsi/bfa/bfad_bsg.c
+index b2e8c0dfc79c..1aa46d0763a0 100644
+--- a/drivers/scsi/bfa/bfad_bsg.c
++++ b/drivers/scsi/bfa/bfad_bsg.c
+@@ -3135,7 +3135,8 @@ bfad_im_bsg_vendor_request(struct bsg_job *job)
+ struct fc_bsg_request *bsg_request = job->request;
+ struct fc_bsg_reply *bsg_reply = job->reply;
+ uint32_t vendor_cmd = bsg_request->rqst_data.h_vendor.vendor_cmd[0];
+- struct bfad_im_port_s *im_port = shost_priv(fc_bsg_to_shost(job));
++ struct Scsi_Host *shost = fc_bsg_to_shost(job);
++ struct bfad_im_port_s *im_port = bfad_get_im_port(shost);
+ struct bfad_s *bfad = im_port->bfad;
+ struct request_queue *request_q = job->req->q;
+ void *payload_kbuf;
+@@ -3357,7 +3358,8 @@ int
+ bfad_im_bsg_els_ct_request(struct bsg_job *job)
+ {
+ struct bfa_bsg_data *bsg_data;
+- struct bfad_im_port_s *im_port = shost_priv(fc_bsg_to_shost(job));
++ struct Scsi_Host *shost = fc_bsg_to_shost(job);
++ struct bfad_im_port_s *im_port = bfad_get_im_port(shost);
+ struct bfad_s *bfad = im_port->bfad;
+ bfa_bsg_fcpt_t *bsg_fcpt;
+ struct bfad_fcxp *drv_fcxp;
+diff --git a/drivers/scsi/bfa/bfad_im.c b/drivers/scsi/bfa/bfad_im.c
+index 24e657a4ec80..c05d6e91e4bd 100644
+--- a/drivers/scsi/bfa/bfad_im.c
++++ b/drivers/scsi/bfa/bfad_im.c
+@@ -546,6 +546,7 @@ int
+ bfad_im_scsi_host_alloc(struct bfad_s *bfad, struct bfad_im_port_s *im_port,
+ struct device *dev)
+ {
++ struct bfad_im_port_pointer *im_portp;
+ int error = 1;
+
+ mutex_lock(&bfad_mutex);
+@@ -564,7 +565,8 @@ bfad_im_scsi_host_alloc(struct bfad_s *bfad, struct bfad_im_port_s *im_port,
+ goto out_free_idr;
+ }
+
+- im_port->shost->hostdata[0] = (unsigned long)im_port;
++ im_portp = shost_priv(im_port->shost);
++ im_portp->p = im_port;
+ im_port->shost->unique_id = im_port->idr_id;
+ im_port->shost->this_id = -1;
+ im_port->shost->max_id = MAX_FCP_TARGET;
+@@ -748,7 +750,7 @@ bfad_scsi_host_alloc(struct bfad_im_port_s *im_port, struct bfad_s *bfad)
+
+ sht->sg_tablesize = bfad->cfg_data.io_max_sge;
+
+- return scsi_host_alloc(sht, sizeof(unsigned long));
++ return scsi_host_alloc(sht, sizeof(struct bfad_im_port_pointer));
+ }
+
+ void
+diff --git a/drivers/scsi/bfa/bfad_im.h b/drivers/scsi/bfa/bfad_im.h
+index c81ec2a77ef5..06ce4ba2b7bc 100644
+--- a/drivers/scsi/bfa/bfad_im.h
++++ b/drivers/scsi/bfa/bfad_im.h
+@@ -69,6 +69,16 @@ struct bfad_im_port_s {
+ struct fc_vport *fc_vport;
+ };
+
++struct bfad_im_port_pointer {
++ struct bfad_im_port_s *p;
++};
++
++static inline struct bfad_im_port_s *bfad_get_im_port(struct Scsi_Host *host)
++{
++ struct bfad_im_port_pointer *im_portp = shost_priv(host);
++ return im_portp->p;
++}
++
+ enum bfad_itnim_state {
+ ITNIM_STATE_NONE,
+ ITNIM_STATE_ONLINE,
+diff --git a/drivers/scsi/lpfc/lpfc_mem.c b/drivers/scsi/lpfc/lpfc_mem.c
+index 56faeb049b4a..87c08ff37ddd 100644
+--- a/drivers/scsi/lpfc/lpfc_mem.c
++++ b/drivers/scsi/lpfc/lpfc_mem.c
+@@ -753,12 +753,12 @@ lpfc_rq_buf_free(struct lpfc_hba *phba, struct lpfc_dmabuf *mp)
+ drqe.address_hi = putPaddrHigh(rqb_entry->dbuf.phys);
+ rc = lpfc_sli4_rq_put(rqb_entry->hrq, rqb_entry->drq, &hrqe, &drqe);
+ if (rc < 0) {
+- (rqbp->rqb_free_buffer)(phba, rqb_entry);
+ lpfc_printf_log(phba, KERN_ERR, LOG_INIT,
+ "6409 Cannot post to RQ %d: %x %x\n",
+ rqb_entry->hrq->queue_id,
+ rqb_entry->hrq->host_index,
+ rqb_entry->hrq->hba_index);
++ (rqbp->rqb_free_buffer)(phba, rqb_entry);
+ } else {
+ list_add_tail(&rqb_entry->hbuf.list, &rqbp->rqb_buffer_list);
+ rqbp->buffer_count++;
+diff --git a/drivers/soc/amlogic/meson-gx-socinfo.c b/drivers/soc/amlogic/meson-gx-socinfo.c
+index 89f4cf507be6..f2d8c3c53ea4 100644
+--- a/drivers/soc/amlogic/meson-gx-socinfo.c
++++ b/drivers/soc/amlogic/meson-gx-socinfo.c
+@@ -20,8 +20,8 @@
+ #define AO_SEC_SOCINFO_OFFSET AO_SEC_SD_CFG8
+
+ #define SOCINFO_MAJOR GENMASK(31, 24)
+-#define SOCINFO_MINOR GENMASK(23, 16)
+-#define SOCINFO_PACK GENMASK(15, 8)
++#define SOCINFO_PACK GENMASK(23, 16)
++#define SOCINFO_MINOR GENMASK(15, 8)
+ #define SOCINFO_MISC GENMASK(7, 0)
+
+ static const struct meson_gx_soc_id {
+diff --git a/drivers/spi/spi-sun4i.c b/drivers/spi/spi-sun4i.c
+index c5cd635c28f3..41410031f8e9 100644
+--- a/drivers/spi/spi-sun4i.c
++++ b/drivers/spi/spi-sun4i.c
+@@ -525,7 +525,7 @@ static int sun4i_spi_probe(struct platform_device *pdev)
+
+ static int sun4i_spi_remove(struct platform_device *pdev)
+ {
+- pm_runtime_disable(&pdev->dev);
++ pm_runtime_force_suspend(&pdev->dev);
+
+ return 0;
+ }
+diff --git a/drivers/staging/android/ashmem.c b/drivers/staging/android/ashmem.c
+index 372ce9913e6d..e7541dc90473 100644
+--- a/drivers/staging/android/ashmem.c
++++ b/drivers/staging/android/ashmem.c
+@@ -710,30 +710,32 @@ static int ashmem_pin_unpin(struct ashmem_area *asma, unsigned long cmd,
+ size_t pgstart, pgend;
+ int ret = -EINVAL;
+
++ mutex_lock(&ashmem_mutex);
++
+ if (unlikely(!asma->file))
+- return -EINVAL;
++ goto out_unlock;
+
+- if (unlikely(copy_from_user(&pin, p, sizeof(pin))))
+- return -EFAULT;
++ if (unlikely(copy_from_user(&pin, p, sizeof(pin)))) {
++ ret = -EFAULT;
++ goto out_unlock;
++ }
+
+ /* per custom, you can pass zero for len to mean "everything onward" */
+ if (!pin.len)
+ pin.len = PAGE_ALIGN(asma->size) - pin.offset;
+
+ if (unlikely((pin.offset | pin.len) & ~PAGE_MASK))
+- return -EINVAL;
++ goto out_unlock;
+
+ if (unlikely(((__u32)-1) - pin.offset < pin.len))
+- return -EINVAL;
++ goto out_unlock;
+
+ if (unlikely(PAGE_ALIGN(asma->size) < pin.offset + pin.len))
+- return -EINVAL;
++ goto out_unlock;
+
+ pgstart = pin.offset / PAGE_SIZE;
+ pgend = pgstart + (pin.len / PAGE_SIZE) - 1;
+
+- mutex_lock(&ashmem_mutex);
+-
+ switch (cmd) {
+ case ASHMEM_PIN:
+ ret = ashmem_pin(asma, pgstart, pgend);
+@@ -746,6 +748,7 @@ static int ashmem_pin_unpin(struct ashmem_area *asma, unsigned long cmd,
+ break;
+ }
+
++out_unlock:
+ mutex_unlock(&ashmem_mutex);
+
+ return ret;
+diff --git a/drivers/staging/android/ion/ion-ioctl.c b/drivers/staging/android/ion/ion-ioctl.c
+index d9f8b1424da1..021a956db1a8 100644
+--- a/drivers/staging/android/ion/ion-ioctl.c
++++ b/drivers/staging/android/ion/ion-ioctl.c
+@@ -71,8 +71,10 @@ long ion_ioctl(struct file *filp, unsigned int cmd, unsigned long arg)
+ return -EFAULT;
+
+ ret = validate_ioctl_arg(cmd, &data);
+- if (WARN_ON_ONCE(ret))
++ if (ret) {
++ pr_warn_once("%s: ioctl validate failed\n", __func__);
+ return ret;
++ }
+
+ if (!(dir & _IOC_WRITE))
+ memset(&data, 0, sizeof(data));
+diff --git a/drivers/staging/android/ion/ion_system_heap.c b/drivers/staging/android/ion/ion_system_heap.c
+index 4dc5d7a589c2..b6ece18e6a88 100644
+--- a/drivers/staging/android/ion/ion_system_heap.c
++++ b/drivers/staging/android/ion/ion_system_heap.c
+@@ -371,7 +371,7 @@ static int ion_system_contig_heap_allocate(struct ion_heap *heap,
+ unsigned long i;
+ int ret;
+
+- page = alloc_pages(low_order_gfp_flags, order);
++ page = alloc_pages(low_order_gfp_flags | __GFP_NOWARN, order);
+ if (!page)
+ return -ENOMEM;
+
+diff --git a/drivers/staging/ccree/ssi_hash.c b/drivers/staging/ccree/ssi_hash.c
+index f72ca485c86f..e266a70a1b32 100644
+--- a/drivers/staging/ccree/ssi_hash.c
++++ b/drivers/staging/ccree/ssi_hash.c
+@@ -1781,7 +1781,7 @@ static int ssi_ahash_import(struct ahash_request *req, const void *in)
+ struct device *dev = &ctx->drvdata->plat_dev->dev;
+ struct ahash_req_ctx *state = ahash_request_ctx(req);
+ u32 tmp;
+- int rc;
++ int rc = 0;
+
+ memcpy(&tmp, in, sizeof(u32));
+ if (tmp != CC_EXPORT_MAGIC) {
+diff --git a/drivers/staging/fsl-mc/bus/Kconfig b/drivers/staging/fsl-mc/bus/Kconfig
+index 504c987447f2..eee1c1b277fa 100644
+--- a/drivers/staging/fsl-mc/bus/Kconfig
++++ b/drivers/staging/fsl-mc/bus/Kconfig
+@@ -8,7 +8,7 @@
+
+ config FSL_MC_BUS
+ bool "QorIQ DPAA2 fsl-mc bus driver"
+- depends on OF && (ARCH_LAYERSCAPE || (COMPILE_TEST && (ARM || ARM64 || X86 || PPC)))
++ depends on OF && (ARCH_LAYERSCAPE || (COMPILE_TEST && (ARM || ARM64 || X86_LOCAL_APIC || PPC)))
+ select GENERIC_MSI_IRQ_DOMAIN
+ help
+ Driver to enable the bus infrastructure for the QorIQ DPAA2
+diff --git a/drivers/staging/iio/adc/ad7192.c b/drivers/staging/iio/adc/ad7192.c
+index 6150d2780e22..31a195d1bf05 100644
+--- a/drivers/staging/iio/adc/ad7192.c
++++ b/drivers/staging/iio/adc/ad7192.c
+@@ -141,6 +141,8 @@
+ #define AD7192_GPOCON_P1DAT BIT(1) /* P1 state */
+ #define AD7192_GPOCON_P0DAT BIT(0) /* P0 state */
+
++#define AD7192_EXT_FREQ_MHZ_MIN 2457600
++#define AD7192_EXT_FREQ_MHZ_MAX 5120000
+ #define AD7192_INT_FREQ_MHZ 4915200
+
+ /* NOTE:
+@@ -217,6 +219,12 @@ static int ad7192_calibrate_all(struct ad7192_state *st)
+ ARRAY_SIZE(ad7192_calib_arr));
+ }
+
++static inline bool ad7192_valid_external_frequency(u32 freq)
++{
++ return (freq >= AD7192_EXT_FREQ_MHZ_MIN &&
++ freq <= AD7192_EXT_FREQ_MHZ_MAX);
++}
++
+ static int ad7192_setup(struct ad7192_state *st,
+ const struct ad7192_platform_data *pdata)
+ {
+@@ -242,17 +250,20 @@ static int ad7192_setup(struct ad7192_state *st,
+ id);
+
+ switch (pdata->clock_source_sel) {
+- case AD7192_CLK_EXT_MCLK1_2:
+- case AD7192_CLK_EXT_MCLK2:
+- st->mclk = AD7192_INT_FREQ_MHZ;
+- break;
+ case AD7192_CLK_INT:
+ case AD7192_CLK_INT_CO:
+- if (pdata->ext_clk_hz)
+- st->mclk = pdata->ext_clk_hz;
+- else
+- st->mclk = AD7192_INT_FREQ_MHZ;
++ st->mclk = AD7192_INT_FREQ_MHZ;
+ break;
++ case AD7192_CLK_EXT_MCLK1_2:
++ case AD7192_CLK_EXT_MCLK2:
++ if (ad7192_valid_external_frequency(pdata->ext_clk_hz)) {
++ st->mclk = pdata->ext_clk_hz;
++ break;
++ }
++ dev_err(&st->sd.spi->dev, "Invalid frequency setting %u\n",
++ pdata->ext_clk_hz);
++ ret = -EINVAL;
++ goto out;
+ default:
+ ret = -EINVAL;
+ goto out;
+diff --git a/drivers/staging/iio/impedance-analyzer/ad5933.c b/drivers/staging/iio/impedance-analyzer/ad5933.c
+index 3d539eeb0e26..6d31001d1825 100644
+--- a/drivers/staging/iio/impedance-analyzer/ad5933.c
++++ b/drivers/staging/iio/impedance-analyzer/ad5933.c
+@@ -649,8 +649,6 @@ static int ad5933_register_ring_funcs_and_init(struct iio_dev *indio_dev)
+ /* Ring buffer functions - here trigger setup related */
+ indio_dev->setup_ops = &ad5933_ring_setup_ops;
+
+- indio_dev->modes |= INDIO_BUFFER_HARDWARE;
+-
+ return 0;
+ }
+
+@@ -763,7 +761,7 @@ static int ad5933_probe(struct i2c_client *client,
+ indio_dev->dev.parent = &client->dev;
+ indio_dev->info = &ad5933_info;
+ indio_dev->name = id->name;
+- indio_dev->modes = INDIO_DIRECT_MODE;
++ indio_dev->modes = (INDIO_BUFFER_SOFTWARE | INDIO_DIRECT_MODE);
+ indio_dev->channels = ad5933_channels;
+ indio_dev->num_channels = ARRAY_SIZE(ad5933_channels);
+
+diff --git a/drivers/usb/core/urb.c b/drivers/usb/core/urb.c
+index 47903d510955..8b800e34407b 100644
+--- a/drivers/usb/core/urb.c
++++ b/drivers/usb/core/urb.c
+@@ -187,6 +187,31 @@ EXPORT_SYMBOL_GPL(usb_unanchor_urb);
+
+ /*-------------------------------------------------------------------*/
+
++static const int pipetypes[4] = {
++ PIPE_CONTROL, PIPE_ISOCHRONOUS, PIPE_BULK, PIPE_INTERRUPT
++};
++
++/**
++ * usb_urb_ep_type_check - sanity check of endpoint in the given urb
++ * @urb: urb to be checked
++ *
++ * This performs a light-weight sanity check for the endpoint in the
++ * given urb. It returns 0 if the urb contains a valid endpoint, otherwise
++ * a negative error code.
++ */
++int usb_urb_ep_type_check(const struct urb *urb)
++{
++ const struct usb_host_endpoint *ep;
++
++ ep = usb_pipe_endpoint(urb->dev, urb->pipe);
++ if (!ep)
++ return -EINVAL;
++ if (usb_pipetype(urb->pipe) != pipetypes[usb_endpoint_type(&ep->desc)])
++ return -EINVAL;
++ return 0;
++}
++EXPORT_SYMBOL_GPL(usb_urb_ep_type_check);
++
+ /**
+ * usb_submit_urb - issue an asynchronous transfer request for an endpoint
+ * @urb: pointer to the urb describing the request
+@@ -326,9 +351,6 @@ EXPORT_SYMBOL_GPL(usb_unanchor_urb);
+ */
+ int usb_submit_urb(struct urb *urb, gfp_t mem_flags)
+ {
+- static int pipetypes[4] = {
+- PIPE_CONTROL, PIPE_ISOCHRONOUS, PIPE_BULK, PIPE_INTERRUPT
+- };
+ int xfertype, max;
+ struct usb_device *dev;
+ struct usb_host_endpoint *ep;
+@@ -444,7 +466,7 @@ int usb_submit_urb(struct urb *urb, gfp_t mem_flags)
+ */
+
+ /* Check that the pipe's type matches the endpoint's type */
+- if (usb_pipetype(urb->pipe) != pipetypes[xfertype])
++ if (usb_urb_ep_type_check(urb))
+ dev_WARN(&dev->dev, "BOGUS urb xfer, pipe %x != type %x\n",
+ usb_pipetype(urb->pipe), pipetypes[xfertype]);
+
+diff --git a/drivers/usb/dwc3/dwc3-of-simple.c b/drivers/usb/dwc3/dwc3-of-simple.c
+index a26d1fde0f5e..fbfc09ebd2ec 100644
+--- a/drivers/usb/dwc3/dwc3-of-simple.c
++++ b/drivers/usb/dwc3/dwc3-of-simple.c
+@@ -57,8 +57,10 @@ static int dwc3_of_simple_clk_init(struct dwc3_of_simple *simple, int count)
+
+ clk = of_clk_get(np, i);
+ if (IS_ERR(clk)) {
+- while (--i >= 0)
++ while (--i >= 0) {
++ clk_disable_unprepare(simple->clks[i]);
+ clk_put(simple->clks[i]);
++ }
+ return PTR_ERR(clk);
+ }
+
+diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c
+index f064f1549333..97e52c0d1a72 100644
+--- a/drivers/usb/dwc3/gadget.c
++++ b/drivers/usb/dwc3/gadget.c
+@@ -267,7 +267,7 @@ int dwc3_send_gadget_ep_cmd(struct dwc3_ep *dep, unsigned cmd,
+ {
+ const struct usb_endpoint_descriptor *desc = dep->endpoint.desc;
+ struct dwc3 *dwc = dep->dwc;
+- u32 timeout = 500;
++ u32 timeout = 1000;
+ u32 reg;
+
+ int cmd_status = 0;
+diff --git a/drivers/usb/usbip/stub_dev.c b/drivers/usb/usbip/stub_dev.c
+index 720408d39f11..b8915513fc84 100644
+--- a/drivers/usb/usbip/stub_dev.c
++++ b/drivers/usb/usbip/stub_dev.c
+@@ -87,6 +87,7 @@ static ssize_t store_sockfd(struct device *dev, struct device_attribute *attr,
+ goto err;
+
+ sdev->ud.tcp_socket = socket;
++ sdev->ud.sockfd = sockfd;
+
+ spin_unlock_irq(&sdev->ud.lock);
+
+@@ -186,6 +187,7 @@ static void stub_shutdown_connection(struct usbip_device *ud)
+ if (ud->tcp_socket) {
+ sockfd_put(ud->tcp_socket);
+ ud->tcp_socket = NULL;
++ ud->sockfd = -1;
+ }
+
+ /* 3. free used data */
+@@ -280,6 +282,7 @@ static struct stub_device *stub_device_alloc(struct usb_device *udev)
+ sdev->ud.status = SDEV_ST_AVAILABLE;
+ spin_lock_init(&sdev->ud.lock);
+ sdev->ud.tcp_socket = NULL;
++ sdev->ud.sockfd = -1;
+
+ INIT_LIST_HEAD(&sdev->priv_init);
+ INIT_LIST_HEAD(&sdev->priv_tx);
+diff --git a/drivers/usb/usbip/vhci_hcd.c b/drivers/usb/usbip/vhci_hcd.c
+index 692cfdef667e..89858aeed647 100644
+--- a/drivers/usb/usbip/vhci_hcd.c
++++ b/drivers/usb/usbip/vhci_hcd.c
+@@ -998,6 +998,7 @@ static void vhci_shutdown_connection(struct usbip_device *ud)
+ if (vdev->ud.tcp_socket) {
+ sockfd_put(vdev->ud.tcp_socket);
+ vdev->ud.tcp_socket = NULL;
++ vdev->ud.sockfd = -1;
+ }
+ pr_info("release socket\n");
+
+@@ -1044,6 +1045,7 @@ static void vhci_device_reset(struct usbip_device *ud)
+ if (ud->tcp_socket) {
+ sockfd_put(ud->tcp_socket);
+ ud->tcp_socket = NULL;
++ ud->sockfd = -1;
+ }
+ ud->status = VDEV_ST_NULL;
+
+diff --git a/drivers/vhost/vhost.c b/drivers/vhost/vhost.c
+index d6dbb28245e6..a827c1a684a9 100644
+--- a/drivers/vhost/vhost.c
++++ b/drivers/vhost/vhost.c
+@@ -904,7 +904,7 @@ static void vhost_dev_lock_vqs(struct vhost_dev *d)
+ {
+ int i = 0;
+ for (i = 0; i < d->nvqs; ++i)
+- mutex_lock(&d->vqs[i]->mutex);
++ mutex_lock_nested(&d->vqs[i]->mutex, i);
+ }
+
+ static void vhost_dev_unlock_vqs(struct vhost_dev *d)
+diff --git a/drivers/video/fbdev/mmp/core.c b/drivers/video/fbdev/mmp/core.c
+index a0f496049db7..3a6bb6561ba0 100644
+--- a/drivers/video/fbdev/mmp/core.c
++++ b/drivers/video/fbdev/mmp/core.c
+@@ -23,6 +23,7 @@
+ #include <linux/slab.h>
+ #include <linux/dma-mapping.h>
+ #include <linux/export.h>
++#include <linux/module.h>
+ #include <video/mmp_disp.h>
+
+ static struct mmp_overlay *path_get_overlay(struct mmp_path *path,
+@@ -249,3 +250,7 @@ void mmp_unregister_path(struct mmp_path *path)
+ mutex_unlock(&disp_lock);
+ }
+ EXPORT_SYMBOL_GPL(mmp_unregister_path);
++
++MODULE_AUTHOR("Zhou Zhu <zzhu3@marvell.com>");
++MODULE_DESCRIPTION("Marvell MMP display framework");
++MODULE_LICENSE("GPL");
+diff --git a/drivers/xen/Kconfig b/drivers/xen/Kconfig
+index 4545561954ee..30187b86729b 100644
+--- a/drivers/xen/Kconfig
++++ b/drivers/xen/Kconfig
+@@ -258,7 +258,7 @@ config XEN_ACPI_HOTPLUG_CPU
+
+ config XEN_ACPI_PROCESSOR
+ tristate "Xen ACPI processor"
+- depends on XEN && X86 && ACPI_PROCESSOR && CPU_FREQ
++ depends on XEN && XEN_DOM0 && X86 && ACPI_PROCESSOR && CPU_FREQ
+ default m
+ help
+ This ACPI processor uploads Power Management information to the Xen
+diff --git a/fs/btrfs/disk-io.c b/fs/btrfs/disk-io.c
+index dfdab849037b..167ce43cabe8 100644
+--- a/fs/btrfs/disk-io.c
++++ b/fs/btrfs/disk-io.c
+@@ -3391,6 +3391,7 @@ static int write_dev_supers(struct btrfs_device *device,
+ int errors = 0;
+ u32 crc;
+ u64 bytenr;
++ int op_flags;
+
+ if (max_mirrors == 0)
+ max_mirrors = BTRFS_SUPER_MIRROR_MAX;
+@@ -3433,13 +3434,10 @@ static int write_dev_supers(struct btrfs_device *device,
+ * we fua the first super. The others we allow
+ * to go down lazy.
+ */
+- if (i == 0) {
+- ret = btrfsic_submit_bh(REQ_OP_WRITE,
+- REQ_SYNC | REQ_FUA | REQ_META | REQ_PRIO, bh);
+- } else {
+- ret = btrfsic_submit_bh(REQ_OP_WRITE,
+- REQ_SYNC | REQ_META | REQ_PRIO, bh);
+- }
++ op_flags = REQ_SYNC | REQ_META | REQ_PRIO;
++ if (i == 0 && !btrfs_test_opt(device->fs_info, NOBARRIER))
++ op_flags |= REQ_FUA;
++ ret = btrfsic_submit_bh(REQ_OP_WRITE, op_flags, bh);
+ if (ret)
+ errors++;
+ }
+diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c
+index 1ae61f82e54b..59a01a0844c9 100644
+--- a/fs/btrfs/inode.c
++++ b/fs/btrfs/inode.c
+@@ -3016,6 +3016,8 @@ static int btrfs_finish_ordered_io(struct btrfs_ordered_extent *ordered_extent)
+ compress_type = ordered_extent->compress_type;
+ if (test_bit(BTRFS_ORDERED_PREALLOC, &ordered_extent->flags)) {
+ BUG_ON(compress_type);
++ btrfs_qgroup_free_data(inode, NULL, ordered_extent->file_offset,
++ ordered_extent->len);
+ ret = btrfs_mark_extent_written(trans, BTRFS_I(inode),
+ ordered_extent->file_offset,
+ ordered_extent->file_offset +
+diff --git a/fs/btrfs/ioctl.c b/fs/btrfs/ioctl.c
+index 1f1338d52303..2763f3184ac5 100644
+--- a/fs/btrfs/ioctl.c
++++ b/fs/btrfs/ioctl.c
+@@ -2221,7 +2221,7 @@ static noinline int btrfs_search_path_in_tree(struct btrfs_fs_info *info,
+ if (!path)
+ return -ENOMEM;
+
+- ptr = &name[BTRFS_INO_LOOKUP_PATH_MAX];
++ ptr = &name[BTRFS_INO_LOOKUP_PATH_MAX - 1];
+
+ key.objectid = tree_id;
+ key.type = BTRFS_ROOT_ITEM_KEY;
+diff --git a/fs/notify/dnotify/dnotify.c b/fs/notify/dnotify/dnotify.c
+index cba328315929..63a1ca4b9dee 100644
+--- a/fs/notify/dnotify/dnotify.c
++++ b/fs/notify/dnotify/dnotify.c
+@@ -319,7 +319,11 @@ int fcntl_dirnotify(int fd, struct file *filp, unsigned long arg)
+ dn_mark = container_of(fsn_mark, struct dnotify_mark, fsn_mark);
+ spin_lock(&fsn_mark->lock);
+ } else {
+- fsnotify_add_mark_locked(new_fsn_mark, inode, NULL, 0);
++ error = fsnotify_add_mark_locked(new_fsn_mark, inode, NULL, 0);
++ if (error) {
++ mutex_unlock(&dnotify_group->mark_mutex);
++ goto out_err;
++ }
+ spin_lock(&new_fsn_mark->lock);
+ fsn_mark = new_fsn_mark;
+ dn_mark = new_dn_mark;
+@@ -345,6 +349,7 @@ int fcntl_dirnotify(int fd, struct file *filp, unsigned long arg)
+ */
+ if (dn_mark == new_dn_mark)
+ destroy = 1;
++ error = 0;
+ goto out;
+ }
+
+diff --git a/include/linux/ptr_ring.h b/include/linux/ptr_ring.h
+index 6866df4f31b5..35d125569e68 100644
+--- a/include/linux/ptr_ring.h
++++ b/include/linux/ptr_ring.h
+@@ -445,9 +445,14 @@ static inline int ptr_ring_consume_batched_bh(struct ptr_ring *r,
+ __PTR_RING_PEEK_CALL_v; \
+ })
+
++/* Not all gfp_t flags (besides GFP_KERNEL) are allowed. See
++ * documentation for vmalloc for which of them are legal.
++ */
+ static inline void **__ptr_ring_init_queue_alloc(unsigned int size, gfp_t gfp)
+ {
+- return kcalloc(size, sizeof(void *), gfp);
++ if (size * sizeof(void *) > KMALLOC_MAX_SIZE)
++ return NULL;
++ return kvmalloc_array(size, sizeof(void *), gfp | __GFP_ZERO);
+ }
+
+ static inline void __ptr_ring_set_size(struct ptr_ring *r, int size)
+@@ -580,7 +585,7 @@ static inline int ptr_ring_resize(struct ptr_ring *r, int size, gfp_t gfp,
+ spin_unlock(&(r)->producer_lock);
+ spin_unlock_irqrestore(&(r)->consumer_lock, flags);
+
+- kfree(old);
++ kvfree(old);
+
+ return 0;
+ }
+@@ -620,7 +625,7 @@ static inline int ptr_ring_resize_multiple(struct ptr_ring **rings,
+ }
+
+ for (i = 0; i < nrings; ++i)
+- kfree(queues[i]);
++ kvfree(queues[i]);
+
+ kfree(queues);
+
+@@ -628,7 +633,7 @@ static inline int ptr_ring_resize_multiple(struct ptr_ring **rings,
+
+ nomem:
+ while (--i >= 0)
+- kfree(queues[i]);
++ kvfree(queues[i]);
+
+ kfree(queues);
+
+@@ -643,7 +648,7 @@ static inline void ptr_ring_cleanup(struct ptr_ring *r, void (*destroy)(void *))
+ if (destroy)
+ while ((ptr = ptr_ring_consume(r)))
+ destroy(ptr);
+- kfree(r->queue);
++ kvfree(r->queue);
+ }
+
+ #endif /* _LINUX_PTR_RING_H */
+diff --git a/include/linux/serdev.h b/include/linux/serdev.h
+index e69402d4a8ae..d609e6dc5bad 100644
+--- a/include/linux/serdev.h
++++ b/include/linux/serdev.h
+@@ -184,7 +184,7 @@ static inline int serdev_controller_receive_buf(struct serdev_controller *ctrl,
+ struct serdev_device *serdev = ctrl->serdev;
+
+ if (!serdev || !serdev->ops->receive_buf)
+- return -EINVAL;
++ return 0;
+
+ return serdev->ops->receive_buf(serdev, data, count);
+ }
+diff --git a/include/linux/usb.h b/include/linux/usb.h
+index 9c63792a8134..4192a1755ccb 100644
+--- a/include/linux/usb.h
++++ b/include/linux/usb.h
+@@ -1729,6 +1729,8 @@ static inline int usb_urb_dir_out(struct urb *urb)
+ return (urb->transfer_flags & URB_DIR_MASK) == URB_DIR_OUT;
+ }
+
++int usb_urb_ep_type_check(const struct urb *urb);
++
+ void *usb_alloc_coherent(struct usb_device *dev, size_t size,
+ gfp_t mem_flags, dma_addr_t *dma);
+ void usb_free_coherent(struct usb_device *dev, size_t size,
+diff --git a/include/net/cfg80211.h b/include/net/cfg80211.h
+index f12fa5245a45..ea0ed58db97e 100644
+--- a/include/net/cfg80211.h
++++ b/include/net/cfg80211.h
+@@ -815,6 +815,8 @@ struct cfg80211_csa_settings {
+ u8 count;
+ };
+
++#define CFG80211_MAX_NUM_DIFFERENT_CHANNELS 10
++
+ /**
+ * struct iface_combination_params - input parameters for interface combinations
+ *
+diff --git a/include/net/red.h b/include/net/red.h
+index 9a9347710701..9665582c4687 100644
+--- a/include/net/red.h
++++ b/include/net/red.h
+@@ -168,6 +168,17 @@ static inline void red_set_vars(struct red_vars *v)
+ v->qcount = -1;
+ }
+
++static inline bool red_check_params(u32 qth_min, u32 qth_max, u8 Wlog)
++{
++ if (fls(qth_min) + Wlog > 32)
++ return false;
++ if (fls(qth_max) + Wlog > 32)
++ return false;
++ if (qth_max < qth_min)
++ return false;
++ return true;
++}
++
+ static inline void red_set_parms(struct red_parms *p,
+ u32 qth_min, u32 qth_max, u8 Wlog, u8 Plog,
+ u8 Scell_log, u8 *stab, u32 max_P)
+@@ -179,7 +190,7 @@ static inline void red_set_parms(struct red_parms *p,
+ p->qth_max = qth_max << Wlog;
+ p->Wlog = Wlog;
+ p->Plog = Plog;
+- if (delta < 0)
++ if (delta <= 0)
+ delta = 1;
+ p->qth_delta = delta;
+ if (!max_P) {
+diff --git a/include/net/sctp/sctp.h b/include/net/sctp/sctp.h
+index d7d8cba01469..749a42882437 100644
+--- a/include/net/sctp/sctp.h
++++ b/include/net/sctp/sctp.h
+@@ -444,7 +444,8 @@ static inline int sctp_frag_point(const struct sctp_association *asoc, int pmtu)
+ if (asoc->user_frag)
+ frag = min_t(int, frag, asoc->user_frag);
+
+- frag = SCTP_TRUNC4(min_t(int, frag, SCTP_MAX_CHUNK_LEN));
++ frag = SCTP_TRUNC4(min_t(int, frag, SCTP_MAX_CHUNK_LEN -
++ sizeof(struct sctp_data_chunk)));
+
+ return frag;
+ }
+diff --git a/include/trace/events/clk.h b/include/trace/events/clk.h
+index 758607226bfd..2cd449328aee 100644
+--- a/include/trace/events/clk.h
++++ b/include/trace/events/clk.h
+@@ -134,12 +134,12 @@ DECLARE_EVENT_CLASS(clk_parent,
+
+ TP_STRUCT__entry(
+ __string( name, core->name )
+- __string( pname, parent->name )
++ __string( pname, parent ? parent->name : "none" )
+ ),
+
+ TP_fast_assign(
+ __assign_str(name, core->name);
+- __assign_str(pname, parent->name);
++ __assign_str(pname, parent ? parent->name : "none");
+ ),
+
+ TP_printk("%s %s", __get_str(name), __get_str(pname))
+diff --git a/include/trace/events/xdp.h b/include/trace/events/xdp.h
+index 810e94160c12..f7c73ae62b7a 100644
+--- a/include/trace/events/xdp.h
++++ b/include/trace/events/xdp.h
+@@ -8,6 +8,7 @@
+ #include <linux/netdevice.h>
+ #include <linux/filter.h>
+ #include <linux/tracepoint.h>
++#include <linux/bpf.h>
+
+ #define __XDP_ACT_MAP(FN) \
+ FN(ABORTED) \
+diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
+index f9339c3219bc..b5ae6488b890 100644
+--- a/kernel/bpf/verifier.c
++++ b/kernel/bpf/verifier.c
+@@ -1865,15 +1865,13 @@ static int adjust_ptr_min_max_vals(struct bpf_verifier_env *env,
+
+ dst_reg = ®s[dst];
+
+- if (WARN_ON_ONCE(known && (smin_val != smax_val))) {
+- print_verifier_state(&env->cur_state);
+- verbose("verifier internal error: known but bad sbounds\n");
+- return -EINVAL;
+- }
+- if (WARN_ON_ONCE(known && (umin_val != umax_val))) {
+- print_verifier_state(&env->cur_state);
+- verbose("verifier internal error: known but bad ubounds\n");
+- return -EINVAL;
++ if ((known && (smin_val != smax_val || umin_val != umax_val)) ||
++ smin_val > smax_val || umin_val > umax_val) {
++ /* Taint dst register if offset had invalid bounds derived from
++ * e.g. dead branches.
++ */
++ __mark_reg_unknown(dst_reg);
++ return 0;
+ }
+
+ if (BPF_CLASS(insn->code) != BPF_ALU64) {
+@@ -2075,6 +2073,15 @@ static int adjust_scalar_min_max_vals(struct bpf_verifier_env *env,
+ src_known = tnum_is_const(src_reg.var_off);
+ dst_known = tnum_is_const(dst_reg->var_off);
+
++ if ((src_known && (smin_val != smax_val || umin_val != umax_val)) ||
++ smin_val > smax_val || umin_val > umax_val) {
++ /* Taint dst register if offset had invalid bounds derived from
++ * e.g. dead branches.
++ */
++ __mark_reg_unknown(dst_reg);
++ return 0;
++ }
++
+ if (!src_known &&
+ opcode != BPF_ADD && opcode != BPF_SUB && opcode != BPF_AND) {
+ __mark_reg_unknown(dst_reg);
+diff --git a/kernel/events/core.c b/kernel/events/core.c
+index 8c20af8738ac..f42f7c7a8f84 100644
+--- a/kernel/events/core.c
++++ b/kernel/events/core.c
+@@ -6719,6 +6719,7 @@ static void perf_event_namespaces_output(struct perf_event *event,
+ struct perf_namespaces_event *namespaces_event = data;
+ struct perf_output_handle handle;
+ struct perf_sample_data sample;
++ u16 header_size = namespaces_event->event_id.header.size;
+ int ret;
+
+ if (!perf_event_namespaces_match(event))
+@@ -6729,7 +6730,7 @@ static void perf_event_namespaces_output(struct perf_event *event,
+ ret = perf_output_begin(&handle, event,
+ namespaces_event->event_id.header.size);
+ if (ret)
+- return;
++ goto out;
+
+ namespaces_event->event_id.pid = perf_event_pid(event,
+ namespaces_event->task);
+@@ -6741,6 +6742,8 @@ static void perf_event_namespaces_output(struct perf_event *event,
+ perf_event__output_id_sample(event, &handle, &sample);
+
+ perf_output_end(&handle);
++out:
++ namespaces_event->event_id.header.size = header_size;
+ }
+
+ static void perf_fill_ns_link_info(struct perf_ns_link_info *ns_link_info,
+diff --git a/kernel/kcov.c b/kernel/kcov.c
+index fc6af9e1308b..b11ef6e51f7e 100644
+--- a/kernel/kcov.c
++++ b/kernel/kcov.c
+@@ -225,9 +225,9 @@ static int kcov_ioctl_locked(struct kcov *kcov, unsigned int cmd,
+ if (unused != 0 || kcov->mode == KCOV_MODE_DISABLED ||
+ kcov->area == NULL)
+ return -EINVAL;
+- if (kcov->t != NULL)
+- return -EBUSY;
+ t = current;
++ if (kcov->t != NULL || t->kcov != NULL)
++ return -EBUSY;
+ /* Cache in task struct for performance. */
+ t->kcov_size = kcov->size;
+ t->kcov_area = kcov->area;
+diff --git a/kernel/locking/lockdep.c b/kernel/locking/lockdep.c
+index 4d362d3e4571..2f0f5720b123 100644
+--- a/kernel/locking/lockdep.c
++++ b/kernel/locking/lockdep.c
+@@ -4777,7 +4777,8 @@ void lockdep_invariant_state(bool force)
+ * Verify the former, enforce the latter.
+ */
+ WARN_ON_ONCE(!force && current->lockdep_depth);
+- invalidate_xhlock(&xhlock(current->xhlock_idx));
++ if (current->xhlocks)
++ invalidate_xhlock(&xhlock(current->xhlock_idx));
+ }
+
+ static int cross_lock(struct lockdep_map *lock)
+diff --git a/kernel/trace/blktrace.c b/kernel/trace/blktrace.c
+index 45a3928544ce..e73dcab8e9f0 100644
+--- a/kernel/trace/blktrace.c
++++ b/kernel/trace/blktrace.c
+@@ -66,7 +66,8 @@ static struct tracer_flags blk_tracer_flags = {
+ };
+
+ /* Global reference count of probes */
+-static atomic_t blk_probes_ref = ATOMIC_INIT(0);
++static DEFINE_MUTEX(blk_probe_mutex);
++static int blk_probes_ref;
+
+ static void blk_register_tracepoints(void);
+ static void blk_unregister_tracepoints(void);
+@@ -329,11 +330,26 @@ static void blk_trace_free(struct blk_trace *bt)
+ kfree(bt);
+ }
+
++static void get_probe_ref(void)
++{
++ mutex_lock(&blk_probe_mutex);
++ if (++blk_probes_ref == 1)
++ blk_register_tracepoints();
++ mutex_unlock(&blk_probe_mutex);
++}
++
++static void put_probe_ref(void)
++{
++ mutex_lock(&blk_probe_mutex);
++ if (!--blk_probes_ref)
++ blk_unregister_tracepoints();
++ mutex_unlock(&blk_probe_mutex);
++}
++
+ static void blk_trace_cleanup(struct blk_trace *bt)
+ {
+ blk_trace_free(bt);
+- if (atomic_dec_and_test(&blk_probes_ref))
+- blk_unregister_tracepoints();
++ put_probe_ref();
+ }
+
+ int blk_trace_remove(struct request_queue *q)
+@@ -538,8 +554,7 @@ static int do_blk_trace_setup(struct request_queue *q, char *name, dev_t dev,
+ if (cmpxchg(&q->blk_trace, NULL, bt))
+ goto err;
+
+- if (atomic_inc_return(&blk_probes_ref) == 1)
+- blk_register_tracepoints();
++ get_probe_ref();
+
+ ret = 0;
+ err:
+@@ -1558,9 +1573,7 @@ static int blk_trace_remove_queue(struct request_queue *q)
+ if (bt == NULL)
+ return -EINVAL;
+
+- if (atomic_dec_and_test(&blk_probes_ref))
+- blk_unregister_tracepoints();
+-
++ put_probe_ref();
+ blk_trace_free(bt);
+ return 0;
+ }
+@@ -1591,8 +1604,7 @@ static int blk_trace_setup_queue(struct request_queue *q,
+ if (cmpxchg(&q->blk_trace, NULL, bt))
+ goto free_bt;
+
+- if (atomic_inc_return(&blk_probes_ref) == 1)
+- blk_register_tracepoints();
++ get_probe_ref();
+ return 0;
+
+ free_bt:
+diff --git a/lib/oid_registry.c b/lib/oid_registry.c
+index 41b9e50711a7..b5f7d9986be1 100644
+--- a/lib/oid_registry.c
++++ b/lib/oid_registry.c
+@@ -116,7 +116,7 @@ int sprint_oid(const void *data, size_t datasize, char *buffer, size_t bufsize)
+ int count;
+
+ if (v >= end)
+- return -EBADMSG;
++ goto bad;
+
+ n = *v++;
+ ret = count = snprintf(buffer, bufsize, "%u.%u", n / 40, n % 40);
+@@ -134,7 +134,7 @@ int sprint_oid(const void *data, size_t datasize, char *buffer, size_t bufsize)
+ num = n & 0x7f;
+ do {
+ if (v >= end)
+- return -EBADMSG;
++ goto bad;
+ n = *v++;
+ num <<= 7;
+ num |= n & 0x7f;
+@@ -148,6 +148,10 @@ int sprint_oid(const void *data, size_t datasize, char *buffer, size_t bufsize)
+ }
+
+ return ret;
++
++bad:
++ snprintf(buffer, bufsize, "(bad)");
++ return -EBADMSG;
+ }
+ EXPORT_SYMBOL_GPL(sprint_oid);
+
+diff --git a/mm/early_ioremap.c b/mm/early_ioremap.c
+index d04ac1ec0559..1826f191e72c 100644
+--- a/mm/early_ioremap.c
++++ b/mm/early_ioremap.c
+@@ -111,7 +111,7 @@ __early_ioremap(resource_size_t phys_addr, unsigned long size, pgprot_t prot)
+ enum fixed_addresses idx;
+ int i, slot;
+
+- WARN_ON(system_state != SYSTEM_BOOTING);
++ WARN_ON(system_state >= SYSTEM_RUNNING);
+
+ slot = -1;
+ for (i = 0; i < FIX_BTMAPS_SLOTS; i++) {
+diff --git a/mm/vmalloc.c b/mm/vmalloc.c
+index 673942094328..ebff729cc956 100644
+--- a/mm/vmalloc.c
++++ b/mm/vmalloc.c
+@@ -1943,11 +1943,15 @@ void *vmalloc_exec(unsigned long size)
+ }
+
+ #if defined(CONFIG_64BIT) && defined(CONFIG_ZONE_DMA32)
+-#define GFP_VMALLOC32 GFP_DMA32 | GFP_KERNEL
++#define GFP_VMALLOC32 (GFP_DMA32 | GFP_KERNEL)
+ #elif defined(CONFIG_64BIT) && defined(CONFIG_ZONE_DMA)
+-#define GFP_VMALLOC32 GFP_DMA | GFP_KERNEL
++#define GFP_VMALLOC32 (GFP_DMA | GFP_KERNEL)
+ #else
+-#define GFP_VMALLOC32 GFP_KERNEL
++/*
++ * 64b systems should always have either DMA or DMA32 zones. For others
++ * GFP_DMA32 should do the right thing and use the normal zone.
++ */
++#define GFP_VMALLOC32 GFP_DMA32 | GFP_KERNEL
+ #endif
+
+ /**
+diff --git a/mm/vmscan.c b/mm/vmscan.c
+index eb2f0315b8c0..441f346fb5e2 100644
+--- a/mm/vmscan.c
++++ b/mm/vmscan.c
+@@ -297,10 +297,13 @@ EXPORT_SYMBOL(register_shrinker);
+ */
+ void unregister_shrinker(struct shrinker *shrinker)
+ {
++ if (!shrinker->nr_deferred)
++ return;
+ down_write(&shrinker_rwsem);
+ list_del(&shrinker->list);
+ up_write(&shrinker_rwsem);
+ kfree(shrinker->nr_deferred);
++ shrinker->nr_deferred = NULL;
+ }
+ EXPORT_SYMBOL(unregister_shrinker);
+
+diff --git a/net/core/dev.c b/net/core/dev.c
+index ffee085f0357..d33bbed640b1 100644
+--- a/net/core/dev.c
++++ b/net/core/dev.c
+@@ -2792,7 +2792,7 @@ struct sk_buff *__skb_gso_segment(struct sk_buff *skb,
+
+ segs = skb_mac_gso_segment(skb, features);
+
+- if (unlikely(skb_needs_check(skb, tx_path)))
++ if (unlikely(skb_needs_check(skb, tx_path) && !IS_ERR(segs)))
+ skb_warn_bad_offload(skb);
+
+ return segs;
+diff --git a/net/core/gen_estimator.c b/net/core/gen_estimator.c
+index 7c1ffd6f9501..00ecec4891f3 100644
+--- a/net/core/gen_estimator.c
++++ b/net/core/gen_estimator.c
+@@ -159,7 +159,11 @@ int gen_new_estimator(struct gnet_stats_basic_packed *bstats,
+ est->intvl_log = intvl_log;
+ est->cpu_bstats = cpu_bstats;
+
++ if (stats_lock)
++ local_bh_disable();
+ est_fetch_counters(est, &b);
++ if (stats_lock)
++ local_bh_enable();
+ est->last_bytes = b.bytes;
+ est->last_packets = b.packets;
+ old = rcu_dereference_protected(*rate_est, 1);
+diff --git a/net/decnet/af_decnet.c b/net/decnet/af_decnet.c
+index 73a0399dc7a2..8dbfcd388633 100644
+--- a/net/decnet/af_decnet.c
++++ b/net/decnet/af_decnet.c
+@@ -1339,6 +1339,12 @@ static int dn_setsockopt(struct socket *sock, int level, int optname, char __use
+ lock_sock(sk);
+ err = __dn_setsockopt(sock, level, optname, optval, optlen, 0);
+ release_sock(sk);
++#ifdef CONFIG_NETFILTER
++ /* we need to exclude all possible ENOPROTOOPTs except default case */
++ if (err == -ENOPROTOOPT && optname != DSO_LINKINFO &&
++ optname != DSO_STREAM && optname != DSO_SEQPACKET)
++ err = nf_setsockopt(sk, PF_DECnet, optname, optval, optlen);
++#endif
+
+ return err;
+ }
+@@ -1446,15 +1452,6 @@ static int __dn_setsockopt(struct socket *sock, int level,int optname, char __us
+ dn_nsp_send_disc(sk, 0x38, 0, sk->sk_allocation);
+ break;
+
+- default:
+-#ifdef CONFIG_NETFILTER
+- return nf_setsockopt(sk, PF_DECnet, optname, optval, optlen);
+-#endif
+- case DSO_LINKINFO:
+- case DSO_STREAM:
+- case DSO_SEQPACKET:
+- return -ENOPROTOOPT;
+-
+ case DSO_MAXWINDOW:
+ if (optlen != sizeof(unsigned long))
+ return -EINVAL;
+@@ -1502,6 +1499,12 @@ static int __dn_setsockopt(struct socket *sock, int level,int optname, char __us
+ return -EINVAL;
+ scp->info_loc = u.info;
+ break;
++
++ case DSO_LINKINFO:
++ case DSO_STREAM:
++ case DSO_SEQPACKET:
++ default:
++ return -ENOPROTOOPT;
+ }
+
+ return 0;
+@@ -1515,6 +1518,20 @@ static int dn_getsockopt(struct socket *sock, int level, int optname, char __use
+ lock_sock(sk);
+ err = __dn_getsockopt(sock, level, optname, optval, optlen, 0);
+ release_sock(sk);
++#ifdef CONFIG_NETFILTER
++ if (err == -ENOPROTOOPT && optname != DSO_STREAM &&
++ optname != DSO_SEQPACKET && optname != DSO_CONACCEPT &&
++ optname != DSO_CONREJECT) {
++ int len;
++
++ if (get_user(len, optlen))
++ return -EFAULT;
++
++ err = nf_getsockopt(sk, PF_DECnet, optname, optval, &len);
++ if (err >= 0)
++ err = put_user(len, optlen);
++ }
++#endif
+
+ return err;
+ }
+@@ -1580,26 +1597,6 @@ static int __dn_getsockopt(struct socket *sock, int level,int optname, char __us
+ r_data = &link;
+ break;
+
+- default:
+-#ifdef CONFIG_NETFILTER
+- {
+- int ret, len;
+-
+- if (get_user(len, optlen))
+- return -EFAULT;
+-
+- ret = nf_getsockopt(sk, PF_DECnet, optname, optval, &len);
+- if (ret >= 0)
+- ret = put_user(len, optlen);
+- return ret;
+- }
+-#endif
+- case DSO_STREAM:
+- case DSO_SEQPACKET:
+- case DSO_CONACCEPT:
+- case DSO_CONREJECT:
+- return -ENOPROTOOPT;
+-
+ case DSO_MAXWINDOW:
+ if (r_len > sizeof(unsigned long))
+ r_len = sizeof(unsigned long);
+@@ -1631,6 +1628,13 @@ static int __dn_getsockopt(struct socket *sock, int level,int optname, char __us
+ r_len = sizeof(unsigned char);
+ r_data = &scp->info_rem;
+ break;
++
++ case DSO_STREAM:
++ case DSO_SEQPACKET:
++ case DSO_CONACCEPT:
++ case DSO_CONREJECT:
++ default:
++ return -ENOPROTOOPT;
+ }
+
+ if (r_data) {
+diff --git a/net/ipv4/esp4_offload.c b/net/ipv4/esp4_offload.c
+index 56c49623bb9d..29b333a62ab0 100644
+--- a/net/ipv4/esp4_offload.c
++++ b/net/ipv4/esp4_offload.c
+@@ -38,7 +38,8 @@ static struct sk_buff **esp4_gro_receive(struct sk_buff **head,
+ __be32 spi;
+ int err;
+
+- skb_pull(skb, offset);
++ if (!pskb_pull(skb, offset))
++ return NULL;
+
+ if ((err = xfrm_parse_spi(skb, IPPROTO_ESP, &spi, &seq)) != 0)
+ goto out;
+diff --git a/net/ipv4/ip_sockglue.c b/net/ipv4/ip_sockglue.c
+index 60fb1eb7d7d8..c7df4969f80a 100644
+--- a/net/ipv4/ip_sockglue.c
++++ b/net/ipv4/ip_sockglue.c
+@@ -1251,11 +1251,8 @@ int ip_setsockopt(struct sock *sk, int level,
+ if (err == -ENOPROTOOPT && optname != IP_HDRINCL &&
+ optname != IP_IPSEC_POLICY &&
+ optname != IP_XFRM_POLICY &&
+- !ip_mroute_opt(optname)) {
+- lock_sock(sk);
++ !ip_mroute_opt(optname))
+ err = nf_setsockopt(sk, PF_INET, optname, optval, optlen);
+- release_sock(sk);
+- }
+ #endif
+ return err;
+ }
+@@ -1280,12 +1277,9 @@ int compat_ip_setsockopt(struct sock *sk, int level, int optname,
+ if (err == -ENOPROTOOPT && optname != IP_HDRINCL &&
+ optname != IP_IPSEC_POLICY &&
+ optname != IP_XFRM_POLICY &&
+- !ip_mroute_opt(optname)) {
+- lock_sock(sk);
+- err = compat_nf_setsockopt(sk, PF_INET, optname,
+- optval, optlen);
+- release_sock(sk);
+- }
++ !ip_mroute_opt(optname))
++ err = compat_nf_setsockopt(sk, PF_INET, optname, optval,
++ optlen);
+ #endif
+ return err;
+ }
+diff --git a/net/ipv4/netfilter/ipt_CLUSTERIP.c b/net/ipv4/netfilter/ipt_CLUSTERIP.c
+index 17b4ca562944..24a8c2e63e3d 100644
+--- a/net/ipv4/netfilter/ipt_CLUSTERIP.c
++++ b/net/ipv4/netfilter/ipt_CLUSTERIP.c
+@@ -431,7 +431,7 @@ static int clusterip_tg_check(const struct xt_tgchk_param *par)
+ struct ipt_clusterip_tgt_info *cipinfo = par->targinfo;
+ const struct ipt_entry *e = par->entryinfo;
+ struct clusterip_config *config;
+- int ret;
++ int ret, i;
+
+ if (par->nft_compat) {
+ pr_err("cannot use CLUSTERIP target from nftables compat\n");
+@@ -450,8 +450,18 @@ static int clusterip_tg_check(const struct xt_tgchk_param *par)
+ pr_info("Please specify destination IP\n");
+ return -EINVAL;
+ }
+-
+- /* FIXME: further sanity checks */
++ if (cipinfo->num_local_nodes > ARRAY_SIZE(cipinfo->local_nodes)) {
++ pr_info("bad num_local_nodes %u\n", cipinfo->num_local_nodes);
++ return -EINVAL;
++ }
++ for (i = 0; i < cipinfo->num_local_nodes; i++) {
++ if (cipinfo->local_nodes[i] - 1 >=
++ sizeof(config->local_nodes) * 8) {
++ pr_info("bad local_nodes[%d] %u\n",
++ i, cipinfo->local_nodes[i]);
++ return -EINVAL;
++ }
++ }
+
+ config = clusterip_config_find_get(par->net, e->ip.dst.s_addr, 1);
+ if (!config) {
+diff --git a/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c b/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c
+index fe374da4bc13..997a96896f1a 100644
+--- a/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c
++++ b/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c
+@@ -218,15 +218,19 @@ getorigdst(struct sock *sk, int optval, void __user *user, int *len)
+ struct nf_conntrack_tuple tuple;
+
+ memset(&tuple, 0, sizeof(tuple));
++
++ lock_sock(sk);
+ tuple.src.u3.ip = inet->inet_rcv_saddr;
+ tuple.src.u.tcp.port = inet->inet_sport;
+ tuple.dst.u3.ip = inet->inet_daddr;
+ tuple.dst.u.tcp.port = inet->inet_dport;
+ tuple.src.l3num = PF_INET;
+ tuple.dst.protonum = sk->sk_protocol;
++ release_sock(sk);
+
+ /* We only do TCP and SCTP at the moment: is there a better way? */
+- if (sk->sk_protocol != IPPROTO_TCP && sk->sk_protocol != IPPROTO_SCTP) {
++ if (tuple.dst.protonum != IPPROTO_TCP &&
++ tuple.dst.protonum != IPPROTO_SCTP) {
+ pr_debug("SO_ORIGINAL_DST: Not a TCP/SCTP socket\n");
+ return -ENOPROTOOPT;
+ }
+diff --git a/net/ipv6/esp6_offload.c b/net/ipv6/esp6_offload.c
+index 1ea9d794447e..f52c314d4c97 100644
+--- a/net/ipv6/esp6_offload.c
++++ b/net/ipv6/esp6_offload.c
+@@ -60,7 +60,8 @@ static struct sk_buff **esp6_gro_receive(struct sk_buff **head,
+ int nhoff;
+ int err;
+
+- skb_pull(skb, offset);
++ if (!pskb_pull(skb, offset))
++ return NULL;
+
+ if ((err = xfrm_parse_spi(skb, IPPROTO_ESP, &spi, &seq)) != 0)
+ goto out;
+diff --git a/net/ipv6/ipv6_sockglue.c b/net/ipv6/ipv6_sockglue.c
+index 3b251760cb8c..24b69384bdbf 100644
+--- a/net/ipv6/ipv6_sockglue.c
++++ b/net/ipv6/ipv6_sockglue.c
+@@ -915,12 +915,8 @@ int ipv6_setsockopt(struct sock *sk, int level, int optname,
+ #ifdef CONFIG_NETFILTER
+ /* we need to exclude all possible ENOPROTOOPTs except default case */
+ if (err == -ENOPROTOOPT && optname != IPV6_IPSEC_POLICY &&
+- optname != IPV6_XFRM_POLICY) {
+- lock_sock(sk);
+- err = nf_setsockopt(sk, PF_INET6, optname, optval,
+- optlen);
+- release_sock(sk);
+- }
++ optname != IPV6_XFRM_POLICY)
++ err = nf_setsockopt(sk, PF_INET6, optname, optval, optlen);
+ #endif
+ return err;
+ }
+@@ -950,12 +946,9 @@ int compat_ipv6_setsockopt(struct sock *sk, int level, int optname,
+ #ifdef CONFIG_NETFILTER
+ /* we need to exclude all possible ENOPROTOOPTs except default case */
+ if (err == -ENOPROTOOPT && optname != IPV6_IPSEC_POLICY &&
+- optname != IPV6_XFRM_POLICY) {
+- lock_sock(sk);
+- err = compat_nf_setsockopt(sk, PF_INET6, optname,
+- optval, optlen);
+- release_sock(sk);
+- }
++ optname != IPV6_XFRM_POLICY)
++ err = compat_nf_setsockopt(sk, PF_INET6, optname, optval,
++ optlen);
+ #endif
+ return err;
+ }
+diff --git a/net/ipv6/netfilter/nf_conntrack_l3proto_ipv6.c b/net/ipv6/netfilter/nf_conntrack_l3proto_ipv6.c
+index fe01dc953c56..b807478c4f7f 100644
+--- a/net/ipv6/netfilter/nf_conntrack_l3proto_ipv6.c
++++ b/net/ipv6/netfilter/nf_conntrack_l3proto_ipv6.c
+@@ -226,20 +226,27 @@ static const struct nf_hook_ops ipv6_conntrack_ops[] = {
+ static int
+ ipv6_getorigdst(struct sock *sk, int optval, void __user *user, int *len)
+ {
+- const struct inet_sock *inet = inet_sk(sk);
++ struct nf_conntrack_tuple tuple = { .src.l3num = NFPROTO_IPV6 };
+ const struct ipv6_pinfo *inet6 = inet6_sk(sk);
++ const struct inet_sock *inet = inet_sk(sk);
+ const struct nf_conntrack_tuple_hash *h;
+ struct sockaddr_in6 sin6;
+- struct nf_conntrack_tuple tuple = { .src.l3num = NFPROTO_IPV6 };
+ struct nf_conn *ct;
++ __be32 flow_label;
++ int bound_dev_if;
+
++ lock_sock(sk);
+ tuple.src.u3.in6 = sk->sk_v6_rcv_saddr;
+ tuple.src.u.tcp.port = inet->inet_sport;
+ tuple.dst.u3.in6 = sk->sk_v6_daddr;
+ tuple.dst.u.tcp.port = inet->inet_dport;
+ tuple.dst.protonum = sk->sk_protocol;
++ bound_dev_if = sk->sk_bound_dev_if;
++ flow_label = inet6->flow_label;
++ release_sock(sk);
+
+- if (sk->sk_protocol != IPPROTO_TCP && sk->sk_protocol != IPPROTO_SCTP)
++ if (tuple.dst.protonum != IPPROTO_TCP &&
++ tuple.dst.protonum != IPPROTO_SCTP)
+ return -ENOPROTOOPT;
+
+ if (*len < 0 || (unsigned int) *len < sizeof(sin6))
+@@ -257,14 +264,13 @@ ipv6_getorigdst(struct sock *sk, int optval, void __user *user, int *len)
+
+ sin6.sin6_family = AF_INET6;
+ sin6.sin6_port = ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple.dst.u.tcp.port;
+- sin6.sin6_flowinfo = inet6->flow_label & IPV6_FLOWINFO_MASK;
++ sin6.sin6_flowinfo = flow_label & IPV6_FLOWINFO_MASK;
+ memcpy(&sin6.sin6_addr,
+ &ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple.dst.u3.in6,
+ sizeof(sin6.sin6_addr));
+
+ nf_ct_put(ct);
+- sin6.sin6_scope_id = ipv6_iface_scope_id(&sin6.sin6_addr,
+- sk->sk_bound_dev_if);
++ sin6.sin6_scope_id = ipv6_iface_scope_id(&sin6.sin6_addr, bound_dev_if);
+ return copy_to_user(user, &sin6, sizeof(sin6)) ? -EFAULT : 0;
+ }
+
+diff --git a/net/kcm/kcmsock.c b/net/kcm/kcmsock.c
+index c5fa634e63ca..58d53b907d53 100644
+--- a/net/kcm/kcmsock.c
++++ b/net/kcm/kcmsock.c
+@@ -1387,8 +1387,13 @@ static int kcm_attach(struct socket *sock, struct socket *csock,
+ if (!csk)
+ return -EINVAL;
+
+- /* We must prevent loops or risk deadlock ! */
+- if (csk->sk_family == PF_KCM)
++ /* Only allow TCP sockets to be attached for now */
++ if ((csk->sk_family != AF_INET && csk->sk_family != AF_INET6) ||
++ csk->sk_protocol != IPPROTO_TCP)
++ return -EOPNOTSUPP;
++
++ /* Don't allow listeners or closed sockets */
++ if (csk->sk_state == TCP_LISTEN || csk->sk_state == TCP_CLOSE)
+ return -EOPNOTSUPP;
+
+ psock = kmem_cache_zalloc(kcm_psockp, GFP_KERNEL);
+@@ -1405,9 +1410,18 @@ static int kcm_attach(struct socket *sock, struct socket *csock,
+ return err;
+ }
+
+- sock_hold(csk);
+-
+ write_lock_bh(&csk->sk_callback_lock);
++
++ /* Check if sk_user_data is aready by KCM or someone else.
++ * Must be done under lock to prevent race conditions.
++ */
++ if (csk->sk_user_data) {
++ write_unlock_bh(&csk->sk_callback_lock);
++ strp_done(&psock->strp);
++ kmem_cache_free(kcm_psockp, psock);
++ return -EALREADY;
++ }
++
+ psock->save_data_ready = csk->sk_data_ready;
+ psock->save_write_space = csk->sk_write_space;
+ psock->save_state_change = csk->sk_state_change;
+@@ -1415,8 +1429,11 @@ static int kcm_attach(struct socket *sock, struct socket *csock,
+ csk->sk_data_ready = psock_data_ready;
+ csk->sk_write_space = psock_write_space;
+ csk->sk_state_change = psock_state_change;
++
+ write_unlock_bh(&csk->sk_callback_lock);
+
++ sock_hold(csk);
++
+ /* Finished initialization, now add the psock to the MUX. */
+ spin_lock_bh(&mux->lock);
+ head = &mux->psocks;
+diff --git a/net/netfilter/x_tables.c b/net/netfilter/x_tables.c
+index d8571f414208..60c92158a2cd 100644
+--- a/net/netfilter/x_tables.c
++++ b/net/netfilter/x_tables.c
+@@ -39,7 +39,6 @@ MODULE_LICENSE("GPL");
+ MODULE_AUTHOR("Harald Welte <laforge@netfilter.org>");
+ MODULE_DESCRIPTION("{ip,ip6,arp,eb}_tables backend module");
+
+-#define SMP_ALIGN(x) (((x) + SMP_CACHE_BYTES-1) & ~(SMP_CACHE_BYTES-1))
+ #define XT_PCPU_BLOCK_SIZE 4096
+
+ struct compat_delta {
+@@ -210,6 +209,9 @@ xt_request_find_match(uint8_t nfproto, const char *name, uint8_t revision)
+ {
+ struct xt_match *match;
+
++ if (strnlen(name, XT_EXTENSION_MAXNAMELEN) == XT_EXTENSION_MAXNAMELEN)
++ return ERR_PTR(-EINVAL);
++
+ match = xt_find_match(nfproto, name, revision);
+ if (IS_ERR(match)) {
+ request_module("%st_%s", xt_prefix[nfproto], name);
+@@ -252,6 +254,9 @@ struct xt_target *xt_request_find_target(u8 af, const char *name, u8 revision)
+ {
+ struct xt_target *target;
+
++ if (strnlen(name, XT_EXTENSION_MAXNAMELEN) == XT_EXTENSION_MAXNAMELEN)
++ return ERR_PTR(-EINVAL);
++
+ target = xt_find_target(af, name, revision);
+ if (IS_ERR(target)) {
+ request_module("%st_%s", xt_prefix[af], name);
+@@ -1000,7 +1005,7 @@ struct xt_table_info *xt_alloc_table_info(unsigned int size)
+ return NULL;
+
+ /* Pedantry: prevent them from hitting BUG() in vmalloc.c --RR */
+- if ((SMP_ALIGN(size) >> PAGE_SHIFT) + 2 > totalram_pages)
++ if ((size >> PAGE_SHIFT) + 2 > totalram_pages)
+ return NULL;
+
+ info = kvmalloc(sz, GFP_KERNEL);
+diff --git a/net/netfilter/xt_RATEEST.c b/net/netfilter/xt_RATEEST.c
+index 498b54fd04d7..141c295191f6 100644
+--- a/net/netfilter/xt_RATEEST.c
++++ b/net/netfilter/xt_RATEEST.c
+@@ -39,23 +39,31 @@ static void xt_rateest_hash_insert(struct xt_rateest *est)
+ hlist_add_head(&est->list, &rateest_hash[h]);
+ }
+
+-struct xt_rateest *xt_rateest_lookup(const char *name)
++static struct xt_rateest *__xt_rateest_lookup(const char *name)
+ {
+ struct xt_rateest *est;
+ unsigned int h;
+
+ h = xt_rateest_hash(name);
+- mutex_lock(&xt_rateest_mutex);
+ hlist_for_each_entry(est, &rateest_hash[h], list) {
+ if (strcmp(est->name, name) == 0) {
+ est->refcnt++;
+- mutex_unlock(&xt_rateest_mutex);
+ return est;
+ }
+ }
+- mutex_unlock(&xt_rateest_mutex);
++
+ return NULL;
+ }
++
++struct xt_rateest *xt_rateest_lookup(const char *name)
++{
++ struct xt_rateest *est;
++
++ mutex_lock(&xt_rateest_mutex);
++ est = __xt_rateest_lookup(name);
++ mutex_unlock(&xt_rateest_mutex);
++ return est;
++}
+ EXPORT_SYMBOL_GPL(xt_rateest_lookup);
+
+ void xt_rateest_put(struct xt_rateest *est)
+@@ -100,8 +108,10 @@ static int xt_rateest_tg_checkentry(const struct xt_tgchk_param *par)
+
+ net_get_random_once(&jhash_rnd, sizeof(jhash_rnd));
+
+- est = xt_rateest_lookup(info->name);
++ mutex_lock(&xt_rateest_mutex);
++ est = __xt_rateest_lookup(info->name);
+ if (est) {
++ mutex_unlock(&xt_rateest_mutex);
+ /*
+ * If estimator parameters are specified, they must match the
+ * existing estimator.
+@@ -139,11 +149,13 @@ static int xt_rateest_tg_checkentry(const struct xt_tgchk_param *par)
+
+ info->est = est;
+ xt_rateest_hash_insert(est);
++ mutex_unlock(&xt_rateest_mutex);
+ return 0;
+
+ err2:
+ kfree(est);
+ err1:
++ mutex_unlock(&xt_rateest_mutex);
+ return ret;
+ }
+
+diff --git a/net/netfilter/xt_bpf.c b/net/netfilter/xt_bpf.c
+index 29123934887b..5185ff0f8f58 100644
+--- a/net/netfilter/xt_bpf.c
++++ b/net/netfilter/xt_bpf.c
+@@ -27,6 +27,9 @@ static int __bpf_mt_check_bytecode(struct sock_filter *insns, __u16 len,
+ {
+ struct sock_fprog_kern program;
+
++ if (len > XT_BPF_MAX_NUM_INSTR)
++ return -EINVAL;
++
+ program.len = len;
+ program.filter = insns;
+
+@@ -55,6 +58,9 @@ static int __bpf_mt_check_path(const char *path, struct bpf_prog **ret)
+ mm_segment_t oldfs = get_fs();
+ int retval, fd;
+
++ if (strnlen(path, XT_BPF_PATH_MAX) == XT_BPF_PATH_MAX)
++ return -EINVAL;
++
+ set_fs(KERNEL_DS);
+ fd = bpf_obj_get_user(path);
+ set_fs(oldfs);
+diff --git a/net/netfilter/xt_cgroup.c b/net/netfilter/xt_cgroup.c
+index 1db1ce59079f..891f4e7e8ea7 100644
+--- a/net/netfilter/xt_cgroup.c
++++ b/net/netfilter/xt_cgroup.c
+@@ -52,6 +52,7 @@ static int cgroup_mt_check_v1(const struct xt_mtchk_param *par)
+ return -EINVAL;
+ }
+
++ info->priv = NULL;
+ if (info->has_path) {
+ cgrp = cgroup_get_from_path(info->path);
+ if (IS_ERR(cgrp)) {
+diff --git a/net/rds/connection.c b/net/rds/connection.c
+index 7ee2d5d68b78..9efc82c665b5 100644
+--- a/net/rds/connection.c
++++ b/net/rds/connection.c
+@@ -366,6 +366,8 @@ void rds_conn_shutdown(struct rds_conn_path *cp)
+ * to the conn hash, so we never trigger a reconnect on this
+ * conn - the reconnect is always triggered by the active peer. */
+ cancel_delayed_work_sync(&cp->cp_conn_w);
++ if (conn->c_destroy_in_prog)
++ return;
+ rcu_read_lock();
+ if (!hlist_unhashed(&conn->c_hash_node)) {
+ rcu_read_unlock();
+@@ -445,7 +447,6 @@ void rds_conn_destroy(struct rds_connection *conn)
+ */
+ rds_cong_remove_conn(conn);
+
+- put_net(conn->c_net);
+ kfree(conn->c_path);
+ kmem_cache_free(rds_conn_slab, conn);
+
+diff --git a/net/rds/rds.h b/net/rds/rds.h
+index c349c71babff..d09f6c1facb4 100644
+--- a/net/rds/rds.h
++++ b/net/rds/rds.h
+@@ -150,7 +150,7 @@ struct rds_connection {
+
+ /* Protocol version */
+ unsigned int c_version;
+- struct net *c_net;
++ possible_net_t c_net;
+
+ struct list_head c_map_item;
+ unsigned long c_map_queued;
+@@ -165,13 +165,13 @@ struct rds_connection {
+ static inline
+ struct net *rds_conn_net(struct rds_connection *conn)
+ {
+- return conn->c_net;
++ return read_pnet(&conn->c_net);
+ }
+
+ static inline
+ void rds_conn_net_set(struct rds_connection *conn, struct net *net)
+ {
+- conn->c_net = get_net(net);
++ write_pnet(&conn->c_net, net);
+ }
+
+ #define RDS_FLAG_CONG_BITMAP 0x01
+diff --git a/net/rds/tcp.c b/net/rds/tcp.c
+index 6b7ee71f40c6..2a08bf75d008 100644
+--- a/net/rds/tcp.c
++++ b/net/rds/tcp.c
+@@ -306,7 +306,8 @@ static void rds_tcp_conn_free(void *arg)
+ rdsdebug("freeing tc %p\n", tc);
+
+ spin_lock_irqsave(&rds_tcp_conn_lock, flags);
+- list_del(&tc->t_tcp_node);
++ if (!tc->t_tcp_node_detached)
++ list_del(&tc->t_tcp_node);
+ spin_unlock_irqrestore(&rds_tcp_conn_lock, flags);
+
+ kmem_cache_free(rds_tcp_conn_slab, tc);
+@@ -527,12 +528,16 @@ static void rds_tcp_kill_sock(struct net *net)
+ rds_tcp_listen_stop(lsock, &rtn->rds_tcp_accept_w);
+ spin_lock_irq(&rds_tcp_conn_lock);
+ list_for_each_entry_safe(tc, _tc, &rds_tcp_conn_list, t_tcp_node) {
+- struct net *c_net = tc->t_cpath->cp_conn->c_net;
++ struct net *c_net = read_pnet(&tc->t_cpath->cp_conn->c_net);
+
+ if (net != c_net || !tc->t_sock)
+ continue;
+- if (!list_has_conn(&tmp_list, tc->t_cpath->cp_conn))
++ if (!list_has_conn(&tmp_list, tc->t_cpath->cp_conn)) {
+ list_move_tail(&tc->t_tcp_node, &tmp_list);
++ } else {
++ list_del(&tc->t_tcp_node);
++ tc->t_tcp_node_detached = true;
++ }
+ }
+ spin_unlock_irq(&rds_tcp_conn_lock);
+ list_for_each_entry_safe(tc, _tc, &tmp_list, t_tcp_node) {
+@@ -586,7 +591,7 @@ static void rds_tcp_sysctl_reset(struct net *net)
+
+ spin_lock_irq(&rds_tcp_conn_lock);
+ list_for_each_entry_safe(tc, _tc, &rds_tcp_conn_list, t_tcp_node) {
+- struct net *c_net = tc->t_cpath->cp_conn->c_net;
++ struct net *c_net = read_pnet(&tc->t_cpath->cp_conn->c_net);
+
+ if (net != c_net || !tc->t_sock)
+ continue;
+diff --git a/net/rds/tcp.h b/net/rds/tcp.h
+index 1aafbf7c3011..e7858ee8ed8b 100644
+--- a/net/rds/tcp.h
++++ b/net/rds/tcp.h
+@@ -12,6 +12,7 @@ struct rds_tcp_incoming {
+ struct rds_tcp_connection {
+
+ struct list_head t_tcp_node;
++ bool t_tcp_node_detached;
+ struct rds_conn_path *t_cpath;
+ /* t_conn_path_lock synchronizes the connection establishment between
+ * rds_tcp_accept_one and rds_tcp_conn_path_connect
+diff --git a/net/sched/sch_choke.c b/net/sched/sch_choke.c
+index b30a2c70bd48..531250fceb9e 100644
+--- a/net/sched/sch_choke.c
++++ b/net/sched/sch_choke.c
+@@ -369,6 +369,9 @@ static int choke_change(struct Qdisc *sch, struct nlattr *opt)
+
+ ctl = nla_data(tb[TCA_CHOKE_PARMS]);
+
++ if (!red_check_params(ctl->qth_min, ctl->qth_max, ctl->Wlog))
++ return -EINVAL;
++
+ if (ctl->limit > CHOKE_MAX_QUEUE)
+ return -EINVAL;
+
+diff --git a/net/sched/sch_gred.c b/net/sched/sch_gred.c
+index 17c7130454bd..bc30f9186ac6 100644
+--- a/net/sched/sch_gred.c
++++ b/net/sched/sch_gred.c
+@@ -356,6 +356,9 @@ static inline int gred_change_vq(struct Qdisc *sch, int dp,
+ struct gred_sched *table = qdisc_priv(sch);
+ struct gred_sched_data *q = table->tab[dp];
+
++ if (!red_check_params(ctl->qth_min, ctl->qth_max, ctl->Wlog))
++ return -EINVAL;
++
+ if (!q) {
+ table->tab[dp] = q = *prealloc;
+ *prealloc = NULL;
+diff --git a/net/sched/sch_red.c b/net/sched/sch_red.c
+index 93b9d70a9b28..d87c41e82917 100644
+--- a/net/sched/sch_red.c
++++ b/net/sched/sch_red.c
+@@ -184,6 +184,8 @@ static int red_change(struct Qdisc *sch, struct nlattr *opt)
+ max_P = tb[TCA_RED_MAX_P] ? nla_get_u32(tb[TCA_RED_MAX_P]) : 0;
+
+ ctl = nla_data(tb[TCA_RED_PARMS]);
++ if (!red_check_params(ctl->qth_min, ctl->qth_max, ctl->Wlog))
++ return -EINVAL;
+
+ if (ctl->limit > 0) {
+ child = fifo_create_dflt(sch, &bfifo_qdisc_ops, ctl->limit);
+diff --git a/net/sched/sch_sfq.c b/net/sched/sch_sfq.c
+index 74ea863b8240..3fbf20126045 100644
+--- a/net/sched/sch_sfq.c
++++ b/net/sched/sch_sfq.c
+@@ -637,6 +637,9 @@ static int sfq_change(struct Qdisc *sch, struct nlattr *opt)
+ if (ctl->divisor &&
+ (!is_power_of_2(ctl->divisor) || ctl->divisor > 65536))
+ return -EINVAL;
++ if (ctl_v1 && !red_check_params(ctl_v1->qth_min, ctl_v1->qth_max,
++ ctl_v1->Wlog))
++ return -EINVAL;
+ if (ctl_v1 && ctl_v1->qth_min) {
+ p = kmalloc(sizeof(*p), GFP_KERNEL);
+ if (!p)
+diff --git a/net/sctp/outqueue.c b/net/sctp/outqueue.c
+index 2966ff400755..39ac91060bc2 100644
+--- a/net/sctp/outqueue.c
++++ b/net/sctp/outqueue.c
+@@ -368,7 +368,8 @@ static int sctp_prsctp_prune_sent(struct sctp_association *asoc,
+ asoc->abandoned_sent[SCTP_PR_INDEX(PRIO)]++;
+ streamout->abandoned_sent[SCTP_PR_INDEX(PRIO)]++;
+
+- if (!chk->tsn_gap_acked) {
++ if (queue != &asoc->outqueue.retransmit &&
++ !chk->tsn_gap_acked) {
+ if (chk->transport)
+ chk->transport->flight_size -=
+ sctp_data_size(chk);
+@@ -1429,7 +1430,8 @@ static void sctp_check_transmitted(struct sctp_outq *q,
+ /* If this chunk has not been acked, stop
+ * considering it as 'outstanding'.
+ */
+- if (!tchunk->tsn_gap_acked) {
++ if (transmitted_queue != &q->retransmit &&
++ !tchunk->tsn_gap_acked) {
+ if (tchunk->transport)
+ tchunk->transport->flight_size -=
+ sctp_data_size(tchunk);
+diff --git a/net/sctp/socket.c b/net/sctp/socket.c
+index 1c08d86efe94..3c8b92667866 100644
+--- a/net/sctp/socket.c
++++ b/net/sctp/socket.c
+@@ -3136,9 +3136,9 @@ static int sctp_setsockopt_mappedv4(struct sock *sk, char __user *optval, unsign
+ */
+ static int sctp_setsockopt_maxseg(struct sock *sk, char __user *optval, unsigned int optlen)
+ {
++ struct sctp_sock *sp = sctp_sk(sk);
+ struct sctp_assoc_value params;
+ struct sctp_association *asoc;
+- struct sctp_sock *sp = sctp_sk(sk);
+ int val;
+
+ if (optlen == sizeof(int)) {
+@@ -3154,26 +3154,35 @@ static int sctp_setsockopt_maxseg(struct sock *sk, char __user *optval, unsigned
+ if (copy_from_user(¶ms, optval, optlen))
+ return -EFAULT;
+ val = params.assoc_value;
+- } else
++ } else {
+ return -EINVAL;
++ }
+
+- if ((val != 0) && ((val < 8) || (val > SCTP_MAX_CHUNK_LEN)))
+- return -EINVAL;
++ if (val) {
++ int min_len, max_len;
+
+- asoc = sctp_id2assoc(sk, params.assoc_id);
+- if (!asoc && params.assoc_id && sctp_style(sk, UDP))
+- return -EINVAL;
++ min_len = SCTP_DEFAULT_MINSEGMENT - sp->pf->af->net_header_len;
++ min_len -= sizeof(struct sctphdr) +
++ sizeof(struct sctp_data_chunk);
++
++ max_len = SCTP_MAX_CHUNK_LEN - sizeof(struct sctp_data_chunk);
+
++ if (val < min_len || val > max_len)
++ return -EINVAL;
++ }
++
++ asoc = sctp_id2assoc(sk, params.assoc_id);
+ if (asoc) {
+ if (val == 0) {
+- val = asoc->pathmtu;
+- val -= sp->pf->af->net_header_len;
++ val = asoc->pathmtu - sp->pf->af->net_header_len;
+ val -= sizeof(struct sctphdr) +
+- sizeof(struct sctp_data_chunk);
++ sizeof(struct sctp_data_chunk);
+ }
+ asoc->user_frag = val;
+ asoc->frag_point = sctp_frag_point(asoc, asoc->pathmtu);
+ } else {
++ if (params.assoc_id && sctp_style(sk, UDP))
++ return -EINVAL;
+ sp->user_frag = val;
+ }
+
+diff --git a/net/vmw_vsock/hyperv_transport.c b/net/vmw_vsock/hyperv_transport.c
+index e21991fe883a..2c63f7b169b5 100644
+--- a/net/vmw_vsock/hyperv_transport.c
++++ b/net/vmw_vsock/hyperv_transport.c
+@@ -488,7 +488,7 @@ static void hvs_release(struct vsock_sock *vsk)
+
+ lock_sock(sk);
+
+- sk->sk_state = SS_DISCONNECTING;
++ sk->sk_state = TCP_CLOSING;
+ vsock_remove_sock(vsk);
+
+ release_sock(sk);
+diff --git a/net/wireless/core.c b/net/wireless/core.c
+index 7b33e8c366bc..33ce0484b2a0 100644
+--- a/net/wireless/core.c
++++ b/net/wireless/core.c
+@@ -439,6 +439,8 @@ struct wiphy *wiphy_new_nm(const struct cfg80211_ops *ops, int sizeof_priv,
+ if (rv)
+ goto use_default_name;
+ } else {
++ int rv;
++
+ use_default_name:
+ /* NOTE: This is *probably* safe w/out holding rtnl because of
+ * the restrictions on phy names. Probably this call could
+@@ -446,7 +448,11 @@ struct wiphy *wiphy_new_nm(const struct cfg80211_ops *ops, int sizeof_priv,
+ * phyX. But, might should add some locking and check return
+ * value, and use a different name if this one exists?
+ */
+- dev_set_name(&rdev->wiphy.dev, PHY_NAME "%d", rdev->wiphy_idx);
++ rv = dev_set_name(&rdev->wiphy.dev, PHY_NAME "%d", rdev->wiphy_idx);
++ if (rv < 0) {
++ kfree(rdev);
++ return NULL;
++ }
+ }
+
+ INIT_LIST_HEAD(&rdev->wiphy.wdev_list);
+diff --git a/net/wireless/core.h b/net/wireless/core.h
+index 705835047f98..90f90c7d8bf9 100644
+--- a/net/wireless/core.h
++++ b/net/wireless/core.h
+@@ -502,8 +502,6 @@ void cfg80211_stop_p2p_device(struct cfg80211_registered_device *rdev,
+ void cfg80211_stop_nan(struct cfg80211_registered_device *rdev,
+ struct wireless_dev *wdev);
+
+-#define CFG80211_MAX_NUM_DIFFERENT_CHANNELS 10
+-
+ #ifdef CONFIG_CFG80211_DEVELOPER_WARNINGS
+ #define CFG80211_DEV_WARN_ON(cond) WARN_ON(cond)
+ #else
+diff --git a/net/xfrm/xfrm_input.c b/net/xfrm/xfrm_input.c
+index 347ab31574d5..da6447389ffb 100644
+--- a/net/xfrm/xfrm_input.c
++++ b/net/xfrm/xfrm_input.c
+@@ -207,7 +207,7 @@ int xfrm_input(struct sk_buff *skb, int nexthdr, __be32 spi, int encap_type)
+ xfrm_address_t *daddr;
+ struct xfrm_mode *inner_mode;
+ u32 mark = skb->mark;
+- unsigned int family;
++ unsigned int family = AF_UNSPEC;
+ int decaps = 0;
+ int async = 0;
+ bool xfrm_gro = false;
+@@ -216,6 +216,16 @@ int xfrm_input(struct sk_buff *skb, int nexthdr, __be32 spi, int encap_type)
+
+ if (encap_type < 0) {
+ x = xfrm_input_state(skb);
++
++ if (unlikely(x->km.state != XFRM_STATE_VALID)) {
++ if (x->km.state == XFRM_STATE_ACQ)
++ XFRM_INC_STATS(net, LINUX_MIB_XFRMACQUIREERROR);
++ else
++ XFRM_INC_STATS(net,
++ LINUX_MIB_XFRMINSTATEINVALID);
++ goto drop;
++ }
++
+ family = x->outer_mode->afinfo->family;
+
+ /* An encap_type of -1 indicates async resumption. */
+diff --git a/net/xfrm/xfrm_policy.c b/net/xfrm/xfrm_policy.c
+index 688ed34f0671..22f5da66357b 100644
+--- a/net/xfrm/xfrm_policy.c
++++ b/net/xfrm/xfrm_policy.c
+@@ -610,7 +610,8 @@ static void xfrm_hash_rebuild(struct work_struct *work)
+
+ /* re-insert all policies by order of creation */
+ list_for_each_entry_reverse(policy, &net->xfrm.policy_all, walk.all) {
+- if (xfrm_policy_id2dir(policy->index) >= XFRM_POLICY_MAX) {
++ if (policy->walk.dead ||
++ xfrm_policy_id2dir(policy->index) >= XFRM_POLICY_MAX) {
+ /* skip socket policies */
+ continue;
+ }
+@@ -975,8 +976,6 @@ int xfrm_policy_flush(struct net *net, u8 type, bool task_valid)
+ }
+ if (!cnt)
+ err = -ESRCH;
+- else
+- xfrm_policy_cache_flush();
+ out:
+ spin_unlock_bh(&net->xfrm.xfrm_policy_lock);
+ return err;
+@@ -1169,9 +1168,15 @@ static struct xfrm_policy *xfrm_sk_policy_lookup(const struct sock *sk, int dir,
+ again:
+ pol = rcu_dereference(sk->sk_policy[dir]);
+ if (pol != NULL) {
+- bool match = xfrm_selector_match(&pol->selector, fl, family);
++ bool match;
+ int err = 0;
+
++ if (pol->family != family) {
++ pol = NULL;
++ goto out;
++ }
++
++ match = xfrm_selector_match(&pol->selector, fl, family);
+ if (match) {
+ if ((sk->sk_mark & pol->mark.m) != pol->mark.v) {
+ pol = NULL;
+@@ -1738,6 +1743,8 @@ void xfrm_policy_cache_flush(void)
+ bool found = 0;
+ int cpu;
+
++ might_sleep();
++
+ local_bh_disable();
+ rcu_read_lock();
+ for_each_possible_cpu(cpu) {
+diff --git a/net/xfrm/xfrm_state.c b/net/xfrm/xfrm_state.c
+index 1f5cee2269af..58be0e7f4c7d 100644
+--- a/net/xfrm/xfrm_state.c
++++ b/net/xfrm/xfrm_state.c
+@@ -313,13 +313,14 @@ xfrm_get_type_offload(u8 proto, unsigned short family, bool try_load)
+ if ((type && !try_module_get(type->owner)))
+ type = NULL;
+
++ rcu_read_unlock();
++
+ if (!type && try_load) {
+ request_module("xfrm-offload-%d-%d", family, proto);
+ try_load = 0;
+ goto retry;
+ }
+
+- rcu_read_unlock();
+ return type;
+ }
+
+diff --git a/net/xfrm/xfrm_user.c b/net/xfrm/xfrm_user.c
+index e44a0fed48dd..0edf38d2afd9 100644
+--- a/net/xfrm/xfrm_user.c
++++ b/net/xfrm/xfrm_user.c
+@@ -1417,11 +1417,14 @@ static void copy_templates(struct xfrm_policy *xp, struct xfrm_user_tmpl *ut,
+
+ static int validate_tmpl(int nr, struct xfrm_user_tmpl *ut, u16 family)
+ {
++ u16 prev_family;
+ int i;
+
+ if (nr > XFRM_MAX_DEPTH)
+ return -EINVAL;
+
++ prev_family = family;
++
+ for (i = 0; i < nr; i++) {
+ /* We never validated the ut->family value, so many
+ * applications simply leave it at zero. The check was
+@@ -1433,6 +1436,12 @@ static int validate_tmpl(int nr, struct xfrm_user_tmpl *ut, u16 family)
+ if (!ut[i].family)
+ ut[i].family = family;
+
++ if ((ut[i].mode == XFRM_MODE_TRANSPORT) &&
++ (ut[i].family != prev_family))
++ return -EINVAL;
++
++ prev_family = ut[i].family;
++
+ switch (ut[i].family) {
+ case AF_INET:
+ break;
+@@ -1443,6 +1452,21 @@ static int validate_tmpl(int nr, struct xfrm_user_tmpl *ut, u16 family)
+ default:
+ return -EINVAL;
+ }
++
++ switch (ut[i].id.proto) {
++ case IPPROTO_AH:
++ case IPPROTO_ESP:
++ case IPPROTO_COMP:
++#if IS_ENABLED(CONFIG_IPV6)
++ case IPPROTO_ROUTING:
++ case IPPROTO_DSTOPTS:
++#endif
++ case IPSEC_PROTO_ANY:
++ break;
++ default:
++ return -EINVAL;
++ }
++
+ }
+
+ return 0;
+diff --git a/scripts/kernel-doc b/scripts/kernel-doc
+index 8323ff9dec71..8bcf90407929 100755
+--- a/scripts/kernel-doc
++++ b/scripts/kernel-doc
+@@ -3216,4 +3216,4 @@ if ($verbose && $warnings) {
+ print STDERR "$warnings warnings\n";
+ }
+
+-exit($errors);
++exit($output_mode eq "none" ? 0 : $errors);
+diff --git a/security/selinux/ss/services.c b/security/selinux/ss/services.c
+index e4a1c0dc561a..c9c031e3d1ae 100644
+--- a/security/selinux/ss/services.c
++++ b/security/selinux/ss/services.c
+@@ -867,6 +867,9 @@ int security_bounded_transition(u32 old_sid, u32 new_sid)
+ int index;
+ int rc;
+
++ if (!ss_initialized)
++ return 0;
++
+ read_lock(&policy_rwlock);
+
+ rc = -EINVAL;
+@@ -1413,27 +1416,25 @@ static int security_context_to_sid_core(const char *scontext, u32 scontext_len,
+ if (!scontext_len)
+ return -EINVAL;
+
++ /* Copy the string to allow changes and ensure a NUL terminator */
++ scontext2 = kmemdup_nul(scontext, scontext_len, gfp_flags);
++ if (!scontext2)
++ return -ENOMEM;
++
+ if (!ss_initialized) {
+ int i;
+
+ for (i = 1; i < SECINITSID_NUM; i++) {
+- if (!strcmp(initial_sid_to_string[i], scontext)) {
++ if (!strcmp(initial_sid_to_string[i], scontext2)) {
+ *sid = i;
+- return 0;
++ goto out;
+ }
+ }
+ *sid = SECINITSID_KERNEL;
+- return 0;
++ goto out;
+ }
+ *sid = SECSID_NULL;
+
+- /* Copy the string so that we can modify the copy as we parse it. */
+- scontext2 = kmalloc(scontext_len + 1, gfp_flags);
+- if (!scontext2)
+- return -ENOMEM;
+- memcpy(scontext2, scontext, scontext_len);
+- scontext2[scontext_len] = 0;
+-
+ if (force) {
+ /* Save another copy for storing in uninterpreted form */
+ rc = -ENOMEM;
+diff --git a/sound/soc/rockchip/rockchip_spdif.c b/sound/soc/rockchip/rockchip_spdif.c
+index ee5055d47d13..a89fe9b6463b 100644
+--- a/sound/soc/rockchip/rockchip_spdif.c
++++ b/sound/soc/rockchip/rockchip_spdif.c
+@@ -322,26 +322,30 @@ static int rk_spdif_probe(struct platform_device *pdev)
+ spdif->mclk = devm_clk_get(&pdev->dev, "mclk");
+ if (IS_ERR(spdif->mclk)) {
+ dev_err(&pdev->dev, "Can't retrieve rk_spdif master clock\n");
+- return PTR_ERR(spdif->mclk);
++ ret = PTR_ERR(spdif->mclk);
++ goto err_disable_hclk;
+ }
+
+ ret = clk_prepare_enable(spdif->mclk);
+ if (ret) {
+ dev_err(spdif->dev, "clock enable failed %d\n", ret);
+- return ret;
++ goto err_disable_clocks;
+ }
+
+ res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
+ regs = devm_ioremap_resource(&pdev->dev, res);
+- if (IS_ERR(regs))
+- return PTR_ERR(regs);
++ if (IS_ERR(regs)) {
++ ret = PTR_ERR(regs);
++ goto err_disable_clocks;
++ }
+
+ spdif->regmap = devm_regmap_init_mmio_clk(&pdev->dev, "hclk", regs,
+ &rk_spdif_regmap_config);
+ if (IS_ERR(spdif->regmap)) {
+ dev_err(&pdev->dev,
+ "Failed to initialise managed register map\n");
+- return PTR_ERR(spdif->regmap);
++ ret = PTR_ERR(spdif->regmap);
++ goto err_disable_clocks;
+ }
+
+ spdif->playback_dma_data.addr = res->start + SPDIF_SMPDR;
+@@ -373,6 +377,10 @@ static int rk_spdif_probe(struct platform_device *pdev)
+
+ err_pm_runtime:
+ pm_runtime_disable(&pdev->dev);
++err_disable_clocks:
++ clk_disable_unprepare(spdif->mclk);
++err_disable_hclk:
++ clk_disable_unprepare(spdif->hclk);
+
+ return ret;
+ }
+diff --git a/sound/soc/sh/rcar/ssi.c b/sound/soc/sh/rcar/ssi.c
+index 2aef7c00cca1..f0fb85fda42d 100644
+--- a/sound/soc/sh/rcar/ssi.c
++++ b/sound/soc/sh/rcar/ssi.c
+@@ -449,25 +449,29 @@ static bool rsnd_ssi_pointer_update(struct rsnd_mod *mod,
+ int byte)
+ {
+ struct rsnd_ssi *ssi = rsnd_mod_to_ssi(mod);
++ bool ret = false;
++ int byte_pos;
+
+- ssi->byte_pos += byte;
++ byte_pos = ssi->byte_pos + byte;
+
+- if (ssi->byte_pos >= ssi->next_period_byte) {
++ if (byte_pos >= ssi->next_period_byte) {
+ struct snd_pcm_runtime *runtime = rsnd_io_to_runtime(io);
+
+ ssi->period_pos++;
+ ssi->next_period_byte += ssi->byte_per_period;
+
+ if (ssi->period_pos >= runtime->periods) {
+- ssi->byte_pos = 0;
++ byte_pos = 0;
+ ssi->period_pos = 0;
+ ssi->next_period_byte = ssi->byte_per_period;
+ }
+
+- return true;
++ ret = true;
+ }
+
+- return false;
++ WRITE_ONCE(ssi->byte_pos, byte_pos);
++
++ return ret;
+ }
+
+ /*
+@@ -838,7 +842,7 @@ static int rsnd_ssi_pointer(struct rsnd_mod *mod,
+ struct rsnd_ssi *ssi = rsnd_mod_to_ssi(mod);
+ struct snd_pcm_runtime *runtime = rsnd_io_to_runtime(io);
+
+- *pointer = bytes_to_frames(runtime, ssi->byte_pos);
++ *pointer = bytes_to_frames(runtime, READ_ONCE(ssi->byte_pos));
+
+ return 0;
+ }
+diff --git a/sound/soc/ux500/mop500.c b/sound/soc/ux500/mop500.c
+index 070a6880980e..c60a57797640 100644
+--- a/sound/soc/ux500/mop500.c
++++ b/sound/soc/ux500/mop500.c
+@@ -163,3 +163,7 @@ static struct platform_driver snd_soc_mop500_driver = {
+ };
+
+ module_platform_driver(snd_soc_mop500_driver);
++
++MODULE_LICENSE("GPL v2");
++MODULE_DESCRIPTION("ASoC MOP500 board driver");
++MODULE_AUTHOR("Ola Lilja");
+diff --git a/sound/soc/ux500/ux500_pcm.c b/sound/soc/ux500/ux500_pcm.c
+index f12c01dddc8d..d35ba7700f46 100644
+--- a/sound/soc/ux500/ux500_pcm.c
++++ b/sound/soc/ux500/ux500_pcm.c
+@@ -165,3 +165,8 @@ int ux500_pcm_unregister_platform(struct platform_device *pdev)
+ return 0;
+ }
+ EXPORT_SYMBOL_GPL(ux500_pcm_unregister_platform);
++
++MODULE_AUTHOR("Ola Lilja");
++MODULE_AUTHOR("Roger Nilsson");
++MODULE_DESCRIPTION("ASoC UX500 driver");
++MODULE_LICENSE("GPL v2");
+diff --git a/sound/usb/bcd2000/bcd2000.c b/sound/usb/bcd2000/bcd2000.c
+index 7371e5b06035..a6408209d7f1 100644
+--- a/sound/usb/bcd2000/bcd2000.c
++++ b/sound/usb/bcd2000/bcd2000.c
+@@ -342,6 +342,13 @@ static int bcd2000_init_midi(struct bcd2000 *bcd2k)
+ bcd2k->midi_out_buf, BUFSIZE,
+ bcd2000_output_complete, bcd2k, 1);
+
++ /* sanity checks of EPs before actually submitting */
++ if (usb_urb_ep_type_check(bcd2k->midi_in_urb) ||
++ usb_urb_ep_type_check(bcd2k->midi_out_urb)) {
++ dev_err(&bcd2k->dev->dev, "invalid MIDI EP\n");
++ return -EINVAL;
++ }
++
+ bcd2000_init_device(bcd2k);
+
+ return 0;
+diff --git a/sound/usb/caiaq/device.c b/sound/usb/caiaq/device.c
+index d8409d9ae55b..d55ca48de3ea 100644
+--- a/sound/usb/caiaq/device.c
++++ b/sound/usb/caiaq/device.c
+@@ -461,6 +461,13 @@ static int init_card(struct snd_usb_caiaqdev *cdev)
+ cdev->midi_out_buf, EP1_BUFSIZE,
+ snd_usb_caiaq_midi_output_done, cdev);
+
++ /* sanity checks of EPs before actually submitting */
++ if (usb_urb_ep_type_check(&cdev->ep1_in_urb) ||
++ usb_urb_ep_type_check(&cdev->midi_out_urb)) {
++ dev_err(dev, "invalid EPs\n");
++ return -EINVAL;
++ }
++
+ init_waitqueue_head(&cdev->ep1_wait_queue);
+ init_waitqueue_head(&cdev->prepare_wait_queue);
+
+diff --git a/sound/usb/line6/driver.c b/sound/usb/line6/driver.c
+index c8f723c3a033..167aebf8276e 100644
+--- a/sound/usb/line6/driver.c
++++ b/sound/usb/line6/driver.c
+@@ -78,6 +78,13 @@ static int line6_start_listen(struct usb_line6 *line6)
+ line6->buffer_listen, LINE6_BUFSIZE_LISTEN,
+ line6_data_received, line6);
+ }
++
++ /* sanity checks of EP before actually submitting */
++ if (usb_urb_ep_type_check(line6->urb_listen)) {
++ dev_err(line6->ifcdev, "invalid control EP\n");
++ return -EINVAL;
++ }
++
+ line6->urb_listen->actual_length = 0;
+ err = usb_submit_urb(line6->urb_listen, GFP_ATOMIC);
+ return err;
+diff --git a/tools/perf/bench/numa.c b/tools/perf/bench/numa.c
+index d95fdcc26f4b..944070e98a2c 100644
+--- a/tools/perf/bench/numa.c
++++ b/tools/perf/bench/numa.c
+@@ -216,6 +216,47 @@ static const char * const numa_usage[] = {
+ NULL
+ };
+
++/*
++ * To get number of numa nodes present.
++ */
++static int nr_numa_nodes(void)
++{
++ int i, nr_nodes = 0;
++
++ for (i = 0; i < g->p.nr_nodes; i++) {
++ if (numa_bitmask_isbitset(numa_nodes_ptr, i))
++ nr_nodes++;
++ }
++
++ return nr_nodes;
++}
++
++/*
++ * To check if given numa node is present.
++ */
++static int is_node_present(int node)
++{
++ return numa_bitmask_isbitset(numa_nodes_ptr, node);
++}
++
++/*
++ * To check given numa node has cpus.
++ */
++static bool node_has_cpus(int node)
++{
++ struct bitmask *cpu = numa_allocate_cpumask();
++ unsigned int i;
++
++ if (cpu && !numa_node_to_cpus(node, cpu)) {
++ for (i = 0; i < cpu->size; i++) {
++ if (numa_bitmask_isbitset(cpu, i))
++ return true;
++ }
++ }
++
++ return false; /* lets fall back to nocpus safely */
++}
++
+ static cpu_set_t bind_to_cpu(int target_cpu)
+ {
+ cpu_set_t orig_mask, mask;
+@@ -244,12 +285,12 @@ static cpu_set_t bind_to_cpu(int target_cpu)
+
+ static cpu_set_t bind_to_node(int target_node)
+ {
+- int cpus_per_node = g->p.nr_cpus/g->p.nr_nodes;
++ int cpus_per_node = g->p.nr_cpus / nr_numa_nodes();
+ cpu_set_t orig_mask, mask;
+ int cpu;
+ int ret;
+
+- BUG_ON(cpus_per_node*g->p.nr_nodes != g->p.nr_cpus);
++ BUG_ON(cpus_per_node * nr_numa_nodes() != g->p.nr_cpus);
+ BUG_ON(!cpus_per_node);
+
+ ret = sched_getaffinity(0, sizeof(orig_mask), &orig_mask);
+@@ -649,7 +690,7 @@ static int parse_setup_node_list(void)
+ int i;
+
+ for (i = 0; i < mul; i++) {
+- if (t >= g->p.nr_tasks) {
++ if (t >= g->p.nr_tasks || !node_has_cpus(bind_node)) {
+ printf("\n# NOTE: ignoring bind NODEs starting at NODE#%d\n", bind_node);
+ goto out;
+ }
+@@ -964,6 +1005,8 @@ static void calc_convergence(double runtime_ns_max, double *convergence)
+ sum = 0;
+
+ for (node = 0; node < g->p.nr_nodes; node++) {
++ if (!is_node_present(node))
++ continue;
+ nr = nodes[node];
+ nr_min = min(nr, nr_min);
+ nr_max = max(nr, nr_max);
+@@ -984,8 +1027,11 @@ static void calc_convergence(double runtime_ns_max, double *convergence)
+ process_groups = 0;
+
+ for (node = 0; node < g->p.nr_nodes; node++) {
+- int processes = count_node_processes(node);
++ int processes;
+
++ if (!is_node_present(node))
++ continue;
++ processes = count_node_processes(node);
+ nr = nodes[node];
+ tprintf(" %2d/%-2d", nr, processes);
+
+@@ -1291,7 +1337,7 @@ static void print_summary(void)
+
+ printf("\n ###\n");
+ printf(" # %d %s will execute (on %d nodes, %d CPUs):\n",
+- g->p.nr_tasks, g->p.nr_tasks == 1 ? "task" : "tasks", g->p.nr_nodes, g->p.nr_cpus);
++ g->p.nr_tasks, g->p.nr_tasks == 1 ? "task" : "tasks", nr_numa_nodes(), g->p.nr_cpus);
+ printf(" # %5dx %5ldMB global shared mem operations\n",
+ g->p.nr_loops, g->p.bytes_global/1024/1024);
+ printf(" # %5dx %5ldMB process shared mem operations\n",
+diff --git a/tools/perf/builtin-help.c b/tools/perf/builtin-help.c
+index bd1fedef3d1c..a0f7ed2b869b 100644
+--- a/tools/perf/builtin-help.c
++++ b/tools/perf/builtin-help.c
+@@ -284,7 +284,7 @@ static int perf_help_config(const char *var, const char *value, void *cb)
+ add_man_viewer(value);
+ return 0;
+ }
+- if (!strstarts(var, "man."))
++ if (strstarts(var, "man."))
+ return add_man_viewer_info(var, value);
+
+ return 0;
+@@ -314,7 +314,7 @@ static const char *cmd_to_page(const char *perf_cmd)
+
+ if (!perf_cmd)
+ return "perf";
+- else if (!strstarts(perf_cmd, "perf"))
++ else if (strstarts(perf_cmd, "perf"))
+ return perf_cmd;
+
+ return asprintf(&s, "perf-%s", perf_cmd) < 0 ? NULL : s;
+diff --git a/tools/perf/builtin-top.c b/tools/perf/builtin-top.c
+index ee954bde7e3e..dd57978b2096 100644
+--- a/tools/perf/builtin-top.c
++++ b/tools/perf/builtin-top.c
+@@ -77,6 +77,7 @@
+ #include "sane_ctype.h"
+
+ static volatile int done;
++static volatile int resize;
+
+ #define HEADER_LINE_NR 5
+
+@@ -86,10 +87,13 @@ static void perf_top__update_print_entries(struct perf_top *top)
+ }
+
+ static void perf_top__sig_winch(int sig __maybe_unused,
+- siginfo_t *info __maybe_unused, void *arg)
++ siginfo_t *info __maybe_unused, void *arg __maybe_unused)
+ {
+- struct perf_top *top = arg;
++ resize = 1;
++}
+
++static void perf_top__resize(struct perf_top *top)
++{
+ get_term_dimensions(&top->winsize);
+ perf_top__update_print_entries(top);
+ }
+@@ -477,7 +481,7 @@ static bool perf_top__handle_keypress(struct perf_top *top, int c)
+ .sa_sigaction = perf_top__sig_winch,
+ .sa_flags = SA_SIGINFO,
+ };
+- perf_top__sig_winch(SIGWINCH, NULL, top);
++ perf_top__resize(top);
+ sigaction(SIGWINCH, &act, NULL);
+ } else {
+ signal(SIGWINCH, SIG_DFL);
+@@ -1022,6 +1026,11 @@ static int __cmd_top(struct perf_top *top)
+
+ if (hits == top->samples)
+ ret = perf_evlist__poll(top->evlist, 100);
++
++ if (resize) {
++ perf_top__resize(top);
++ resize = 0;
++ }
+ }
+
+ ret = 0;
+diff --git a/tools/perf/tests/shell/trace+probe_vfs_getname.sh b/tools/perf/tests/shell/trace+probe_vfs_getname.sh
+index 2e68c5f120da..2a9ef080efd0 100755
+--- a/tools/perf/tests/shell/trace+probe_vfs_getname.sh
++++ b/tools/perf/tests/shell/trace+probe_vfs_getname.sh
+@@ -17,8 +17,10 @@ skip_if_no_perf_probe || exit 2
+ file=$(mktemp /tmp/temporary_file.XXXXX)
+
+ trace_open_vfs_getname() {
+- perf trace -e open touch $file 2>&1 | \
+- egrep " +[0-9]+\.[0-9]+ +\( +[0-9]+\.[0-9]+ ms\): +touch\/[0-9]+ open\(filename: +${file}, +flags: CREAT\|NOCTTY\|NONBLOCK\|WRONLY, +mode: +IRUGO\|IWUGO\) += +[0-9]+$"
++ test "$(uname -m)" = s390x && { svc="openat"; txt="dfd: +CWD, +"; }
++
++ perf trace -e ${svc:-open} touch $file 2>&1 | \
++ egrep " +[0-9]+\.[0-9]+ +\( +[0-9]+\.[0-9]+ ms\): +touch\/[0-9]+ ${svc:-open}\(${txt}filename: +${file}, +flags: CREAT\|NOCTTY\|NONBLOCK\|WRONLY, +mode: +IRUGO\|IWUGO\) += +[0-9]+$"
+ }
+
+
+diff --git a/tools/perf/tests/task-exit.c b/tools/perf/tests/task-exit.c
+index bc4a7344e274..89c8e1604ca7 100644
+--- a/tools/perf/tests/task-exit.c
++++ b/tools/perf/tests/task-exit.c
+@@ -84,7 +84,11 @@ int test__task_exit(struct test *test __maybe_unused, int subtest __maybe_unused
+
+ evsel = perf_evlist__first(evlist);
+ evsel->attr.task = 1;
++#ifdef __s390x__
++ evsel->attr.sample_freq = 1000000;
++#else
+ evsel->attr.sample_freq = 1;
++#endif
+ evsel->attr.inherit = 0;
+ evsel->attr.watermark = 0;
+ evsel->attr.wakeup_events = 1;
+diff --git a/tools/perf/util/annotate.c b/tools/perf/util/annotate.c
+index aa66791b1bfc..41d415707264 100644
+--- a/tools/perf/util/annotate.c
++++ b/tools/perf/util/annotate.c
+@@ -166,7 +166,7 @@ static void ins__delete(struct ins_operands *ops)
+ static int ins__raw_scnprintf(struct ins *ins, char *bf, size_t size,
+ struct ins_operands *ops)
+ {
+- return scnprintf(bf, size, "%-6.6s %s", ins->name, ops->raw);
++ return scnprintf(bf, size, "%-6s %s", ins->name, ops->raw);
+ }
+
+ int ins__scnprintf(struct ins *ins, char *bf, size_t size,
+@@ -231,12 +231,12 @@ static int call__scnprintf(struct ins *ins, char *bf, size_t size,
+ struct ins_operands *ops)
+ {
+ if (ops->target.name)
+- return scnprintf(bf, size, "%-6.6s %s", ins->name, ops->target.name);
++ return scnprintf(bf, size, "%-6s %s", ins->name, ops->target.name);
+
+ if (ops->target.addr == 0)
+ return ins__raw_scnprintf(ins, bf, size, ops);
+
+- return scnprintf(bf, size, "%-6.6s *%" PRIx64, ins->name, ops->target.addr);
++ return scnprintf(bf, size, "%-6s *%" PRIx64, ins->name, ops->target.addr);
+ }
+
+ static struct ins_ops call_ops = {
+@@ -300,7 +300,7 @@ static int jump__scnprintf(struct ins *ins, char *bf, size_t size,
+ c++;
+ }
+
+- return scnprintf(bf, size, "%-6.6s %.*s%" PRIx64,
++ return scnprintf(bf, size, "%-6s %.*s%" PRIx64,
+ ins->name, c ? c - ops->raw : 0, ops->raw,
+ ops->target.offset);
+ }
+@@ -373,7 +373,7 @@ static int lock__scnprintf(struct ins *ins, char *bf, size_t size,
+ if (ops->locked.ins.ops == NULL)
+ return ins__raw_scnprintf(ins, bf, size, ops);
+
+- printed = scnprintf(bf, size, "%-6.6s ", ins->name);
++ printed = scnprintf(bf, size, "%-6s ", ins->name);
+ return printed + ins__scnprintf(&ops->locked.ins, bf + printed,
+ size - printed, ops->locked.ops);
+ }
+@@ -449,7 +449,7 @@ static int mov__parse(struct arch *arch, struct ins_operands *ops, struct map *m
+ static int mov__scnprintf(struct ins *ins, char *bf, size_t size,
+ struct ins_operands *ops)
+ {
+- return scnprintf(bf, size, "%-6.6s %s,%s", ins->name,
++ return scnprintf(bf, size, "%-6s %s,%s", ins->name,
+ ops->source.name ?: ops->source.raw,
+ ops->target.name ?: ops->target.raw);
+ }
+@@ -489,7 +489,7 @@ static int dec__parse(struct arch *arch __maybe_unused, struct ins_operands *ops
+ static int dec__scnprintf(struct ins *ins, char *bf, size_t size,
+ struct ins_operands *ops)
+ {
+- return scnprintf(bf, size, "%-6.6s %s", ins->name,
++ return scnprintf(bf, size, "%-6s %s", ins->name,
+ ops->target.name ?: ops->target.raw);
+ }
+
+@@ -501,7 +501,7 @@ static struct ins_ops dec_ops = {
+ static int nop__scnprintf(struct ins *ins __maybe_unused, char *bf, size_t size,
+ struct ins_operands *ops __maybe_unused)
+ {
+- return scnprintf(bf, size, "%-6.6s", "nop");
++ return scnprintf(bf, size, "%-6s", "nop");
+ }
+
+ static struct ins_ops nop_ops = {
+@@ -925,7 +925,7 @@ void disasm_line__free(struct disasm_line *dl)
+ int disasm_line__scnprintf(struct disasm_line *dl, char *bf, size_t size, bool raw)
+ {
+ if (raw || !dl->ins.ops)
+- return scnprintf(bf, size, "%-6.6s %s", dl->ins.name, dl->ops.raw);
++ return scnprintf(bf, size, "%-6s %s", dl->ins.name, dl->ops.raw);
+
+ return ins__scnprintf(&dl->ins, bf, size, &dl->ops);
+ }
+diff --git a/tools/perf/util/evsel.c b/tools/perf/util/evsel.c
+index 0dccdb89572c..1f6beb3d0c68 100644
+--- a/tools/perf/util/evsel.c
++++ b/tools/perf/util/evsel.c
+@@ -733,12 +733,16 @@ static void apply_config_terms(struct perf_evsel *evsel,
+ list_for_each_entry(term, config_terms, list) {
+ switch (term->type) {
+ case PERF_EVSEL__CONFIG_TERM_PERIOD:
+- attr->sample_period = term->val.period;
+- attr->freq = 0;
++ if (!(term->weak && opts->user_interval != ULLONG_MAX)) {
++ attr->sample_period = term->val.period;
++ attr->freq = 0;
++ }
+ break;
+ case PERF_EVSEL__CONFIG_TERM_FREQ:
+- attr->sample_freq = term->val.freq;
+- attr->freq = 1;
++ if (!(term->weak && opts->user_freq != UINT_MAX)) {
++ attr->sample_freq = term->val.freq;
++ attr->freq = 1;
++ }
+ break;
+ case PERF_EVSEL__CONFIG_TERM_TIME:
+ if (term->val.time)
+diff --git a/tools/perf/util/evsel.h b/tools/perf/util/evsel.h
+index b4df79d72329..3ed0e9b42378 100644
+--- a/tools/perf/util/evsel.h
++++ b/tools/perf/util/evsel.h
+@@ -67,6 +67,7 @@ struct perf_evsel_config_term {
+ bool overwrite;
+ char *branch;
+ } val;
++ bool weak;
+ };
+
+ /** struct perf_evsel - event selector
+diff --git a/tools/perf/util/parse-events.c b/tools/perf/util/parse-events.c
+index 56694e3409ea..b25635e945f3 100644
+--- a/tools/perf/util/parse-events.c
++++ b/tools/perf/util/parse-events.c
+@@ -1115,6 +1115,7 @@ do { \
+ INIT_LIST_HEAD(&__t->list); \
+ __t->type = PERF_EVSEL__CONFIG_TERM_ ## __type; \
+ __t->val.__name = __val; \
++ __t->weak = term->weak; \
+ list_add_tail(&__t->list, head_terms); \
+ } while (0)
+
+@@ -2395,6 +2396,7 @@ static int new_term(struct parse_events_term **_term,
+
+ *term = *temp;
+ INIT_LIST_HEAD(&term->list);
++ term->weak = false;
+
+ switch (term->type_val) {
+ case PARSE_EVENTS__TERM_TYPE_NUM:
+diff --git a/tools/perf/util/parse-events.h b/tools/perf/util/parse-events.h
+index eed50b54bab3..458b72225a0a 100644
+--- a/tools/perf/util/parse-events.h
++++ b/tools/perf/util/parse-events.h
+@@ -101,6 +101,9 @@ struct parse_events_term {
+ /* error string indexes for within parsed string */
+ int err_term;
+ int err_val;
++
++ /* Coming from implicit alias */
++ bool weak;
+ };
+
+ struct parse_events_error {
+diff --git a/tools/perf/util/pmu.c b/tools/perf/util/pmu.c
+index b10b35a63138..9dff41bcc776 100644
+--- a/tools/perf/util/pmu.c
++++ b/tools/perf/util/pmu.c
+@@ -404,6 +404,11 @@ static int pmu_alias_terms(struct perf_pmu_alias *alias,
+ parse_events_terms__purge(&list);
+ return ret;
+ }
++ /*
++ * Weak terms don't override command line options,
++ * which we don't want for implicit terms in aliases.
++ */
++ cloned->weak = true;
+ list_add_tail(&cloned->list, &list);
+ }
+ list_splice(&list, terms);
+diff --git a/tools/testing/selftests/bpf/test_verifier.c b/tools/testing/selftests/bpf/test_verifier.c
+index 16299939d3ff..c55d265489ca 100644
+--- a/tools/testing/selftests/bpf/test_verifier.c
++++ b/tools/testing/selftests/bpf/test_verifier.c
+@@ -6534,7 +6534,7 @@ static struct bpf_test tests[] = {
+ BPF_JMP_IMM(BPF_JA, 0, 0, -7),
+ },
+ .fixup_map1 = { 4 },
+- .errstr = "unbounded min value",
++ .errstr = "R0 invalid mem access 'inv'",
+ .result = REJECT,
+ },
+ {
+@@ -7714,6 +7714,127 @@ static struct bpf_test tests[] = {
+ .result = REJECT,
+ .prog_type = BPF_PROG_TYPE_XDP,
+ },
++ {
++ "check deducing bounds from const, 1",
++ .insns = {
++ BPF_MOV64_IMM(BPF_REG_0, 1),
++ BPF_JMP_IMM(BPF_JSGE, BPF_REG_0, 1, 0),
++ BPF_ALU64_REG(BPF_SUB, BPF_REG_0, BPF_REG_1),
++ BPF_EXIT_INSN(),
++ },
++ .result = REJECT,
++ .errstr = "R0 tried to subtract pointer from scalar",
++ },
++ {
++ "check deducing bounds from const, 2",
++ .insns = {
++ BPF_MOV64_IMM(BPF_REG_0, 1),
++ BPF_JMP_IMM(BPF_JSGE, BPF_REG_0, 1, 1),
++ BPF_EXIT_INSN(),
++ BPF_JMP_IMM(BPF_JSLE, BPF_REG_0, 1, 1),
++ BPF_EXIT_INSN(),
++ BPF_ALU64_REG(BPF_SUB, BPF_REG_1, BPF_REG_0),
++ BPF_EXIT_INSN(),
++ },
++ .result = ACCEPT,
++ },
++ {
++ "check deducing bounds from const, 3",
++ .insns = {
++ BPF_MOV64_IMM(BPF_REG_0, 0),
++ BPF_JMP_IMM(BPF_JSLE, BPF_REG_0, 0, 0),
++ BPF_ALU64_REG(BPF_SUB, BPF_REG_0, BPF_REG_1),
++ BPF_EXIT_INSN(),
++ },
++ .result = REJECT,
++ .errstr = "R0 tried to subtract pointer from scalar",
++ },
++ {
++ "check deducing bounds from const, 4",
++ .insns = {
++ BPF_MOV64_IMM(BPF_REG_0, 0),
++ BPF_JMP_IMM(BPF_JSLE, BPF_REG_0, 0, 1),
++ BPF_EXIT_INSN(),
++ BPF_JMP_IMM(BPF_JSGE, BPF_REG_0, 0, 1),
++ BPF_EXIT_INSN(),
++ BPF_ALU64_REG(BPF_SUB, BPF_REG_1, BPF_REG_0),
++ BPF_EXIT_INSN(),
++ },
++ .result = ACCEPT,
++ },
++ {
++ "check deducing bounds from const, 5",
++ .insns = {
++ BPF_MOV64_IMM(BPF_REG_0, 0),
++ BPF_JMP_IMM(BPF_JSGE, BPF_REG_0, 0, 1),
++ BPF_ALU64_REG(BPF_SUB, BPF_REG_0, BPF_REG_1),
++ BPF_EXIT_INSN(),
++ },
++ .result = REJECT,
++ .errstr = "R0 tried to subtract pointer from scalar",
++ },
++ {
++ "check deducing bounds from const, 6",
++ .insns = {
++ BPF_MOV64_IMM(BPF_REG_0, 0),
++ BPF_JMP_IMM(BPF_JSGE, BPF_REG_0, 0, 1),
++ BPF_EXIT_INSN(),
++ BPF_ALU64_REG(BPF_SUB, BPF_REG_0, BPF_REG_1),
++ BPF_EXIT_INSN(),
++ },
++ .result = REJECT,
++ .errstr = "R0 tried to subtract pointer from scalar",
++ },
++ {
++ "check deducing bounds from const, 7",
++ .insns = {
++ BPF_MOV64_IMM(BPF_REG_0, ~0),
++ BPF_JMP_IMM(BPF_JSGE, BPF_REG_0, 0, 0),
++ BPF_ALU64_REG(BPF_SUB, BPF_REG_1, BPF_REG_0),
++ BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
++ offsetof(struct __sk_buff, mark)),
++ BPF_EXIT_INSN(),
++ },
++ .result = REJECT,
++ .errstr = "dereference of modified ctx ptr",
++ },
++ {
++ "check deducing bounds from const, 8",
++ .insns = {
++ BPF_MOV64_IMM(BPF_REG_0, ~0),
++ BPF_JMP_IMM(BPF_JSGE, BPF_REG_0, 0, 1),
++ BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_0),
++ BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
++ offsetof(struct __sk_buff, mark)),
++ BPF_EXIT_INSN(),
++ },
++ .result = REJECT,
++ .errstr = "dereference of modified ctx ptr",
++ },
++ {
++ "check deducing bounds from const, 9",
++ .insns = {
++ BPF_MOV64_IMM(BPF_REG_0, 0),
++ BPF_JMP_IMM(BPF_JSGE, BPF_REG_0, 0, 0),
++ BPF_ALU64_REG(BPF_SUB, BPF_REG_0, BPF_REG_1),
++ BPF_EXIT_INSN(),
++ },
++ .result = REJECT,
++ .errstr = "R0 tried to subtract pointer from scalar",
++ },
++ {
++ "check deducing bounds from const, 10",
++ .insns = {
++ BPF_MOV64_IMM(BPF_REG_0, 0),
++ BPF_JMP_IMM(BPF_JSLE, BPF_REG_0, 0, 0),
++ /* Marks reg as unknown. */
++ BPF_ALU64_IMM(BPF_NEG, BPF_REG_0, 0),
++ BPF_ALU64_REG(BPF_SUB, BPF_REG_0, BPF_REG_1),
++ BPF_EXIT_INSN(),
++ },
++ .result = REJECT,
++ .errstr = "math between ctx pointer and register with unbounded min value is not allowed",
++ },
+ {
+ "XDP pkt read, pkt_end <= pkt_data', bad access 2",
+ .insns = {
+diff --git a/virt/kvm/arm/arm.c b/virt/kvm/arm/arm.c
+index 8b6c42dc1aa9..1366462a3ab2 100644
+--- a/virt/kvm/arm/arm.c
++++ b/virt/kvm/arm/arm.c
+@@ -1453,7 +1453,7 @@ int kvm_arch_init(void *opaque)
+ bool in_hyp_mode;
+
+ if (!is_hyp_mode_available()) {
+- kvm_err("HYP mode not available\n");
++ kvm_info("HYP mode not available\n");
+ return -ENODEV;
+ }
+
+diff --git a/virt/kvm/arm/vgic/vgic.c b/virt/kvm/arm/vgic/vgic.c
+index fed717e07938..da53c6e7d688 100644
+--- a/virt/kvm/arm/vgic/vgic.c
++++ b/virt/kvm/arm/vgic/vgic.c
+@@ -454,6 +454,7 @@ int kvm_vgic_unmap_phys_irq(struct kvm_vcpu *vcpu, unsigned int virt_irq)
+ int kvm_vgic_set_owner(struct kvm_vcpu *vcpu, unsigned int intid, void *owner)
+ {
+ struct vgic_irq *irq;
++ unsigned long flags;
+ int ret = 0;
+
+ if (!vgic_initialized(vcpu->kvm))
+@@ -464,12 +465,12 @@ int kvm_vgic_set_owner(struct kvm_vcpu *vcpu, unsigned int intid, void *owner)
+ return -EINVAL;
+
+ irq = vgic_get_irq(vcpu->kvm, vcpu, intid);
+- spin_lock(&irq->irq_lock);
++ spin_lock_irqsave(&irq->irq_lock, flags);
+ if (irq->owner && irq->owner != owner)
+ ret = -EEXIST;
+ else
+ irq->owner = owner;
+- spin_unlock(&irq->irq_lock);
++ spin_unlock_irqrestore(&irq->irq_lock, flags);
+
+ return ret;
+ }
next reply other threads:[~2018-02-25 13:40 UTC|newest]
Thread overview: 448+ messages / expand[flat|nested] mbox.gz Atom feed top
2018-02-25 13:40 Alice Ferrazzi [this message]
-- strict thread matches above, loose matches on Subject: below --
2023-08-30 15:01 [gentoo-commits] proj/linux-patches:4.14 commit in: / Mike Pagano
2023-08-16 16:58 Mike Pagano
2023-08-11 11:58 Mike Pagano
2023-08-08 18:44 Mike Pagano
2023-06-28 10:30 Mike Pagano
2023-06-21 14:56 Alice Ferrazzi
2023-06-14 10:22 Mike Pagano
2023-06-09 11:33 Mike Pagano
2023-05-30 12:58 Mike Pagano
2023-05-17 11:01 Mike Pagano
2023-04-26 9:35 Alice Ferrazzi
2023-04-20 11:18 Alice Ferrazzi
2023-04-05 10:02 Alice Ferrazzi
2023-03-22 14:16 Alice Ferrazzi
2023-03-17 10:47 Mike Pagano
2023-03-13 11:36 Alice Ferrazzi
2023-03-11 16:02 Mike Pagano
2023-02-25 11:40 Mike Pagano
2023-02-24 3:13 Alice Ferrazzi
2023-02-22 14:48 Alice Ferrazzi
2023-02-22 14:46 Alice Ferrazzi
2023-02-06 12:50 Mike Pagano
2023-01-24 7:18 Alice Ferrazzi
2023-01-18 11:11 Mike Pagano
2022-12-14 12:24 Mike Pagano
2022-12-08 12:39 Alice Ferrazzi
2022-11-25 17:03 Mike Pagano
2022-11-10 15:14 Mike Pagano
2022-11-03 15:09 Mike Pagano
2022-11-01 19:49 Mike Pagano
2022-10-26 11:42 Mike Pagano
2022-09-28 9:18 Mike Pagano
2022-09-20 12:04 Mike Pagano
2022-09-15 11:10 Mike Pagano
2022-09-05 12:06 Mike Pagano
2022-08-25 10:36 Mike Pagano
2022-07-29 15:27 Mike Pagano
2022-07-21 20:13 Mike Pagano
2022-07-12 16:02 Mike Pagano
2022-07-07 16:19 Mike Pagano
2022-07-02 16:06 Mike Pagano
2022-06-25 10:23 Mike Pagano
2022-06-16 11:41 Mike Pagano
2022-06-14 15:48 Mike Pagano
2022-06-06 11:06 Mike Pagano
2022-05-27 12:28 Mike Pagano
2022-05-25 11:56 Mike Pagano
2022-05-18 9:51 Mike Pagano
2022-05-15 22:13 Mike Pagano
2022-05-12 11:31 Mike Pagano
2022-04-27 11:38 Mike Pagano
2022-04-20 12:10 Mike Pagano
2022-04-02 16:32 Mike Pagano
2022-03-28 11:00 Mike Pagano
2022-03-23 11:58 Mike Pagano
2022-03-16 13:21 Mike Pagano
2022-03-11 10:57 Mike Pagano
2022-03-08 18:28 Mike Pagano
2022-03-02 13:08 Mike Pagano
2022-02-26 23:30 Mike Pagano
2022-02-23 12:40 Mike Pagano
2022-02-16 12:49 Mike Pagano
2022-02-11 12:48 Mike Pagano
2022-02-08 17:57 Mike Pagano
2022-01-29 17:45 Mike Pagano
2022-01-27 11:40 Mike Pagano
2022-01-11 13:16 Mike Pagano
2022-01-05 12:56 Mike Pagano
2021-12-29 13:12 Mike Pagano
2021-12-22 14:07 Mike Pagano
2021-12-14 10:36 Mike Pagano
2021-12-08 12:56 Mike Pagano
2021-11-26 12:00 Mike Pagano
2021-11-12 13:47 Mike Pagano
2021-11-02 19:36 Mike Pagano
2021-10-27 11:59 Mike Pagano
2021-10-20 13:33 Mike Pagano
2021-10-17 13:13 Mike Pagano
2021-10-09 21:34 Mike Pagano
2021-10-06 14:04 Mike Pagano
2021-09-26 14:14 Mike Pagano
2021-09-22 11:41 Mike Pagano
2021-09-20 22:05 Mike Pagano
2021-09-03 11:24 Mike Pagano
2021-08-26 14:05 Mike Pagano
2021-08-25 23:04 Mike Pagano
2021-08-15 20:08 Mike Pagano
2021-08-08 13:40 Mike Pagano
2021-08-04 11:55 Mike Pagano
2021-08-03 12:45 Mike Pagano
2021-07-28 12:38 Mike Pagano
2021-07-20 15:32 Alice Ferrazzi
2021-07-11 14:46 Mike Pagano
2021-06-30 14:26 Mike Pagano
2021-06-16 12:21 Mike Pagano
2021-06-10 11:16 Mike Pagano
2021-06-03 10:35 Alice Ferrazzi
2021-05-26 12:04 Mike Pagano
2021-05-22 10:03 Mike Pagano
2021-04-28 18:22 Mike Pagano
2021-04-28 11:31 Alice Ferrazzi
2021-04-16 11:17 Alice Ferrazzi
2021-04-10 13:23 Mike Pagano
2021-04-07 12:17 Mike Pagano
2021-03-30 14:15 Mike Pagano
2021-03-24 12:07 Mike Pagano
2021-03-17 16:18 Mike Pagano
2021-03-11 14:04 Mike Pagano
2021-03-07 15:14 Mike Pagano
2021-03-03 18:15 Alice Ferrazzi
2021-02-23 13:51 Alice Ferrazzi
2021-02-10 10:07 Alice Ferrazzi
2021-02-07 14:17 Alice Ferrazzi
2021-02-03 23:38 Mike Pagano
2021-01-30 12:58 Alice Ferrazzi
2021-01-23 16:35 Mike Pagano
2021-01-21 11:25 Alice Ferrazzi
2021-01-17 16:21 Mike Pagano
2021-01-12 20:07 Mike Pagano
2021-01-09 12:56 Mike Pagano
2020-12-29 14:20 Mike Pagano
2020-12-11 12:55 Mike Pagano
2020-12-08 12:05 Mike Pagano
2020-12-02 12:48 Mike Pagano
2020-11-24 13:44 Mike Pagano
2020-11-22 19:17 Mike Pagano
2020-11-18 19:24 Mike Pagano
2020-11-11 15:36 Mike Pagano
2020-11-10 13:55 Mike Pagano
2020-11-05 12:34 Mike Pagano
2020-10-29 11:17 Mike Pagano
2020-10-17 10:17 Mike Pagano
2020-10-14 20:35 Mike Pagano
2020-10-01 12:42 Mike Pagano
2020-10-01 12:34 Mike Pagano
2020-09-24 16:00 Mike Pagano
2020-09-23 12:05 Mike Pagano
2020-09-23 12:03 Mike Pagano
2020-09-12 17:50 Mike Pagano
2020-09-09 17:58 Mike Pagano
2020-09-03 11:36 Mike Pagano
2020-08-26 11:14 Mike Pagano
2020-08-21 10:51 Alice Ferrazzi
2020-08-07 19:14 Mike Pagano
2020-08-05 14:57 Thomas Deutschmann
2020-07-31 17:56 Mike Pagano
2020-07-29 12:30 Mike Pagano
2020-07-22 13:47 Mike Pagano
2020-07-09 12:10 Mike Pagano
2020-07-01 12:13 Mike Pagano
2020-06-29 17:43 Mike Pagano
2020-06-25 15:08 Mike Pagano
2020-06-22 14:45 Mike Pagano
2020-06-11 11:32 Mike Pagano
2020-06-03 11:39 Mike Pagano
2020-05-27 15:25 Mike Pagano
2020-05-20 11:26 Mike Pagano
2020-05-13 12:46 Mike Pagano
2020-05-11 22:51 Mike Pagano
2020-05-05 17:41 Mike Pagano
2020-05-02 19:23 Mike Pagano
2020-04-24 12:02 Mike Pagano
2020-04-15 17:38 Mike Pagano
2020-04-13 11:16 Mike Pagano
2020-04-02 15:23 Mike Pagano
2020-03-20 11:56 Mike Pagano
2020-03-11 18:19 Mike Pagano
2020-02-28 16:34 Mike Pagano
2020-02-14 23:46 Mike Pagano
2020-02-05 17:22 Mike Pagano
2020-02-05 14:49 Mike Pagano
2020-01-29 16:14 Mike Pagano
2020-01-27 14:24 Mike Pagano
2020-01-23 11:05 Mike Pagano
2020-01-17 19:53 Mike Pagano
2020-01-14 22:28 Mike Pagano
2020-01-12 14:53 Mike Pagano
2020-01-09 11:14 Mike Pagano
2020-01-04 16:49 Mike Pagano
2019-12-31 13:56 Mike Pagano
2019-12-21 15:00 Mike Pagano
2019-12-17 21:55 Mike Pagano
2019-12-05 15:20 Alice Ferrazzi
2019-12-01 14:08 Thomas Deutschmann
2019-11-24 15:42 Mike Pagano
2019-11-20 18:18 Mike Pagano
2019-11-12 20:59 Mike Pagano
2019-11-10 16:19 Mike Pagano
2019-11-06 14:25 Mike Pagano
2019-10-29 13:59 Mike Pagano
2019-10-29 13:59 Mike Pagano
2019-10-29 13:59 Mike Pagano
2019-10-29 13:59 Mike Pagano
2019-10-29 13:59 Mike Pagano
2019-10-29 13:59 Mike Pagano
2019-10-29 13:59 Mike Pagano
2019-10-29 13:59 Mike Pagano
2019-10-29 13:59 Mike Pagano
2019-10-29 13:59 Mike Pagano
2019-10-29 13:59 Mike Pagano
2019-10-29 13:59 Mike Pagano
2019-10-29 13:59 Mike Pagano
2019-10-29 13:59 Mike Pagano
2019-10-29 13:59 Mike Pagano
2019-10-29 13:59 Mike Pagano
2019-10-29 13:59 Mike Pagano
2019-10-29 13:59 Mike Pagano
2019-10-29 13:59 Mike Pagano
2019-10-29 13:59 Mike Pagano
2019-10-29 13:59 Mike Pagano
2019-10-29 13:59 Mike Pagano
2019-10-29 13:59 Mike Pagano
2019-10-29 13:59 Mike Pagano
2019-10-29 13:59 Mike Pagano
2019-10-29 11:33 Mike Pagano
2019-10-17 22:26 Mike Pagano
2019-10-11 17:02 Mike Pagano
2019-10-07 17:39 Mike Pagano
2019-10-05 11:40 Mike Pagano
2019-09-21 16:30 Mike Pagano
2019-09-19 23:28 Mike Pagano
2019-09-19 10:03 Mike Pagano
2019-09-16 12:23 Mike Pagano
2019-09-10 11:11 Mike Pagano
2019-09-06 17:19 Mike Pagano
2019-08-29 14:13 Mike Pagano
2019-08-25 17:36 Mike Pagano
2019-08-23 22:15 Mike Pagano
2019-08-16 12:14 Mike Pagano
2019-08-09 17:34 Mike Pagano
2019-08-06 19:16 Mike Pagano
2019-08-04 16:06 Mike Pagano
2019-07-31 10:23 Mike Pagano
2019-07-21 14:40 Mike Pagano
2019-07-10 11:04 Mike Pagano
2019-07-03 13:02 Mike Pagano
2019-06-27 11:09 Mike Pagano
2019-06-25 10:52 Mike Pagano
2019-06-22 19:09 Mike Pagano
2019-06-19 17:19 Thomas Deutschmann
2019-06-17 19:20 Mike Pagano
2019-06-15 15:05 Mike Pagano
2019-06-11 17:51 Mike Pagano
2019-06-11 12:40 Mike Pagano
2019-06-09 16:17 Mike Pagano
2019-05-31 16:41 Mike Pagano
2019-05-26 17:11 Mike Pagano
2019-05-21 17:17 Mike Pagano
2019-05-16 23:02 Mike Pagano
2019-05-14 20:55 Mike Pagano
2019-05-10 19:39 Mike Pagano
2019-05-08 10:05 Mike Pagano
2019-05-04 18:34 Mike Pagano
2019-05-04 18:27 Mike Pagano
2019-05-02 10:14 Mike Pagano
2019-04-27 17:35 Mike Pagano
2019-04-24 22:58 Mike Pagano
2019-04-20 11:08 Mike Pagano
2019-04-19 19:53 Mike Pagano
2019-04-05 21:45 Mike Pagano
2019-04-03 10:58 Mike Pagano
2019-03-27 10:21 Mike Pagano
2019-03-23 14:30 Mike Pagano
2019-03-23 14:19 Mike Pagano
2019-03-19 16:57 Mike Pagano
2019-03-13 22:07 Mike Pagano
2019-03-06 19:09 Mike Pagano
2019-03-05 18:03 Mike Pagano
2019-02-27 11:22 Mike Pagano
2019-02-23 14:43 Mike Pagano
2019-02-20 11:17 Mike Pagano
2019-02-16 0:44 Mike Pagano
2019-02-15 12:51 Mike Pagano
2019-02-12 20:52 Mike Pagano
2019-02-06 17:06 Mike Pagano
2019-01-31 11:24 Mike Pagano
2019-01-26 15:06 Mike Pagano
2019-01-23 11:30 Mike Pagano
2019-01-16 23:30 Mike Pagano
2019-01-13 19:27 Mike Pagano
2019-01-09 17:53 Mike Pagano
2018-12-29 22:47 Mike Pagano
2018-12-29 18:54 Mike Pagano
2018-12-21 14:46 Mike Pagano
2018-12-17 11:40 Mike Pagano
2018-12-13 11:38 Mike Pagano
2018-12-08 13:22 Mike Pagano
2018-12-05 19:42 Mike Pagano
2018-12-01 17:26 Mike Pagano
2018-12-01 15:06 Mike Pagano
2018-11-27 16:17 Mike Pagano
2018-11-23 12:44 Mike Pagano
2018-11-21 12:27 Mike Pagano
2018-11-14 14:00 Mike Pagano
2018-11-14 14:00 Mike Pagano
2018-11-14 14:00 Mike Pagano
2018-11-14 14:00 Mike Pagano
2018-11-14 14:00 Mike Pagano
2018-11-14 14:00 Mike Pagano
2018-11-14 14:00 Mike Pagano
2018-11-14 14:00 Mike Pagano
2018-11-14 14:00 Mike Pagano
2018-11-14 14:00 Mike Pagano
2018-11-14 14:00 Mike Pagano
2018-11-14 14:00 Mike Pagano
2018-11-14 14:00 Mike Pagano
2018-11-14 14:00 Mike Pagano
2018-11-14 14:00 Mike Pagano
2018-11-14 14:00 Mike Pagano
2018-11-14 14:00 Mike Pagano
2018-11-14 14:00 Mike Pagano
2018-11-14 14:00 Mike Pagano
2018-11-14 14:00 Mike Pagano
2018-11-14 14:00 Mike Pagano
2018-11-14 14:00 Mike Pagano
2018-11-14 14:00 Mike Pagano
2018-11-14 14:00 Mike Pagano
2018-11-14 14:00 Mike Pagano
2018-11-14 13:49 Mike Pagano
2018-11-14 13:49 Mike Pagano
2018-11-14 13:49 Mike Pagano
2018-11-14 13:49 Mike Pagano
2018-11-14 13:49 Mike Pagano
2018-11-14 13:49 Mike Pagano
2018-11-14 13:49 Mike Pagano
2018-11-14 13:49 Mike Pagano
2018-11-14 13:49 Mike Pagano
2018-11-14 13:49 Mike Pagano
2018-11-14 13:49 Mike Pagano
2018-11-14 13:49 Mike Pagano
2018-11-14 13:49 Mike Pagano
2018-11-14 13:49 Mike Pagano
2018-11-14 13:49 Mike Pagano
2018-11-14 13:49 Mike Pagano
2018-11-14 13:49 Mike Pagano
2018-11-14 13:49 Mike Pagano
2018-11-14 13:49 Mike Pagano
2018-11-14 13:49 Mike Pagano
2018-11-14 13:49 Mike Pagano
2018-11-14 13:49 Mike Pagano
2018-11-14 13:49 Mike Pagano
2018-11-14 13:49 Mike Pagano
2018-11-14 13:49 Mike Pagano
2018-11-14 13:33 Mike Pagano
2018-11-13 21:19 Mike Pagano
2018-11-11 1:19 Mike Pagano
2018-11-10 21:31 Mike Pagano
2018-11-04 17:31 Alice Ferrazzi
2018-10-20 12:41 Mike Pagano
2018-10-18 10:26 Mike Pagano
2018-10-13 16:33 Mike Pagano
2018-10-10 11:18 Mike Pagano
2018-10-04 10:42 Mike Pagano
2018-09-29 13:35 Mike Pagano
2018-09-26 10:41 Mike Pagano
2018-09-19 22:40 Mike Pagano
2018-09-15 10:12 Mike Pagano
2018-09-09 23:28 Mike Pagano
2018-09-05 15:28 Mike Pagano
2018-08-24 11:44 Mike Pagano
2018-08-22 10:01 Alice Ferrazzi
2018-08-18 18:12 Mike Pagano
2018-08-17 19:37 Mike Pagano
2018-08-17 19:26 Mike Pagano
2018-08-16 11:49 Mike Pagano
2018-08-15 16:48 Mike Pagano
2018-08-09 10:54 Mike Pagano
2018-08-07 18:11 Mike Pagano
2018-08-03 12:27 Mike Pagano
2018-07-28 10:39 Mike Pagano
2018-07-25 10:27 Mike Pagano
2018-07-22 15:13 Mike Pagano
2018-07-17 10:27 Mike Pagano
2018-07-12 16:13 Alice Ferrazzi
2018-07-09 15:07 Alice Ferrazzi
2018-07-03 13:18 Mike Pagano
2018-06-26 16:32 Alice Ferrazzi
2018-06-20 19:42 Mike Pagano
2018-06-16 15:43 Mike Pagano
2018-06-11 21:46 Mike Pagano
2018-06-08 23:48 Mike Pagano
2018-06-05 11:22 Mike Pagano
2018-05-30 22:33 Mike Pagano
2018-05-30 11:42 Mike Pagano
2018-05-25 15:36 Mike Pagano
2018-05-22 18:45 Mike Pagano
2018-05-20 22:21 Mike Pagano
2018-05-16 10:24 Mike Pagano
2018-05-09 10:55 Mike Pagano
2018-05-02 16:14 Mike Pagano
2018-04-30 10:30 Mike Pagano
2018-04-26 10:21 Mike Pagano
2018-04-24 11:27 Mike Pagano
2018-04-19 10:43 Mike Pagano
2018-04-12 15:10 Mike Pagano
2018-04-08 14:27 Mike Pagano
2018-03-31 22:18 Mike Pagano
2018-03-28 17:01 Mike Pagano
2018-03-25 13:38 Mike Pagano
2018-03-21 14:41 Mike Pagano
2018-03-19 12:01 Mike Pagano
2018-03-15 10:28 Mike Pagano
2018-03-11 17:38 Mike Pagano
2018-03-09 16:34 Alice Ferrazzi
2018-03-05 2:24 Alice Ferrazzi
2018-02-28 18:28 Alice Ferrazzi
2018-02-28 15:00 Alice Ferrazzi
2018-02-22 23:23 Mike Pagano
2018-02-17 14:28 Alice Ferrazzi
2018-02-17 14:27 Alice Ferrazzi
2018-02-13 13:19 Alice Ferrazzi
2018-02-08 0:41 Mike Pagano
2018-02-03 21:21 Mike Pagano
2018-01-31 13:50 Alice Ferrazzi
2018-01-23 21:20 Mike Pagano
2018-01-23 21:18 Mike Pagano
2018-01-17 9:39 Alice Ferrazzi
2018-01-17 9:14 Alice Ferrazzi
2018-01-10 11:52 Mike Pagano
2018-01-10 11:43 Mike Pagano
2018-01-05 15:41 Alice Ferrazzi
2018-01-05 15:41 Alice Ferrazzi
2018-01-05 15:02 Alice Ferrazzi
2018-01-04 15:18 Alice Ferrazzi
2018-01-04 7:40 Alice Ferrazzi
2018-01-04 7:32 Alice Ferrazzi
2018-01-04 0:23 Alice Ferrazzi
2018-01-02 20:19 Mike Pagano
2018-01-02 20:14 Mike Pagano
2017-12-30 12:20 Alice Ferrazzi
2017-12-29 17:54 Alice Ferrazzi
2017-12-29 17:18 Alice Ferrazzi
2017-12-25 14:34 Alice Ferrazzi
2017-12-20 17:51 Alice Ferrazzi
2017-12-20 12:43 Mike Pagano
2017-12-17 14:33 Alice Ferrazzi
2017-12-14 9:11 Alice Ferrazzi
2017-12-10 13:02 Alice Ferrazzi
2017-12-09 14:07 Alice Ferrazzi
2017-12-05 11:37 Mike Pagano
2017-11-30 12:15 Alice Ferrazzi
2017-11-24 9:18 Alice Ferrazzi
2017-11-24 9:15 Alice Ferrazzi
2017-11-21 11:34 Mike Pagano
2017-11-21 11:24 Mike Pagano
2017-11-16 19:08 Mike Pagano
2017-10-23 16:31 Mike Pagano
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=1519566006.b6564907ab32c1a8c890c671c1c1e8b83e4967bc.alicef@gentoo \
--to=alicef@gentoo.org \
--cc=gentoo-commits@lists.gentoo.org \
--cc=gentoo-dev@lists.gentoo.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox