[gentoo-commits] proj/linux-patches:4.19 commit in: /

["Mike Pagano" <mpagano@gentoo.org>]

commit:     96339a934e3be4fc8007433e7229ad6074feab5a
Author:     Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Tue Nov 10 13:56:24 2020 +0000
Commit:     Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Tue Nov 10 13:56:24 2020 +0000
URL:        https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=96339a93

Linux patch 4.19.156

Signed-off-by: Mike Pagano <mpagano <AT> gentoo.org>

 0000_README               |    4 +
 1155_linux-4.19.156.patch | 2339 +++++++++++++++++++++++++++++++++++++++++++++
 2 files changed, 2343 insertions(+)

diff --git a/0000_README b/0000_README
index e9e0833..54a0fb2 100644
--- a/0000_README
+++ b/0000_README
@@ -659,6 +659,10 @@ Patch:  1154_linux-4.19.155.patch
 From:   https://www.kernel.org
 Desc:   Linux 4.19.155
 
+Patch:  1155_linux-4.19.156.patch
+From:   https://www.kernel.org
+Desc:   Linux 4.19.156
+
 Patch:  1500_XATTR_USER_PREFIX.patch
 From:   https://bugs.gentoo.org/show_bug.cgi?id=470644
 Desc:   Support for namespace user.pax.* on tmpfs.

diff --git a/1155_linux-4.19.156.patch b/1155_linux-4.19.156.patch
new file mode 100644
index 0000000..8a1ecce
--- /dev/null
+++ b/1155_linux-4.19.156.patch
@@ -0,0 +1,2339 @@
+diff --git a/Makefile b/Makefile
+index 9fc16d34e1bb9..82891b34e19e0 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,7 +1,7 @@
+ # SPDX-License-Identifier: GPL-2.0
+ VERSION = 4
+ PATCHLEVEL = 19
+-SUBLEVEL = 155
++SUBLEVEL = 156
+ EXTRAVERSION =
+ NAME = "People's Front"
+ 
+diff --git a/arch/arc/kernel/entry.S b/arch/arc/kernel/entry.S
+index 705a682084232..85d9ea4a0accc 100644
+--- a/arch/arc/kernel/entry.S
++++ b/arch/arc/kernel/entry.S
+@@ -156,6 +156,7 @@ END(EV_Extension)
+ tracesys:
+ 	; save EFA in case tracer wants the PC of traced task
+ 	; using ERET won't work since next-PC has already committed
++	lr  r12, [efa]
+ 	GET_CURR_TASK_FIELD_PTR   TASK_THREAD, r11
+ 	st  r12, [r11, THREAD_FAULT_ADDR]	; thread.fault_address
+ 
+@@ -198,9 +199,15 @@ tracesys_exit:
+ ; Breakpoint TRAP
+ ; ---------------------------------------------
+ trap_with_param:
+-	mov r0, r12	; EFA in case ptracer/gdb wants stop_pc
++
++	; stop_pc info by gdb needs this info
++	lr  r0, [efa]
+ 	mov r1, sp
+ 
++	; Now that we have read EFA, it is safe to do "fake" rtie
++	;   and get out of CPU exception mode
++	FAKE_RET_FROM_EXCPN
++
+ 	; Save callee regs in case gdb wants to have a look
+ 	; SP will grow up by size of CALLEE Reg-File
+ 	; NOTE: clobbers r12
+@@ -227,10 +234,6 @@ ENTRY(EV_Trap)
+ 
+ 	EXCEPTION_PROLOGUE
+ 
+-	lr  r12, [efa]
+-
+-	FAKE_RET_FROM_EXCPN
+-
+ 	;============ TRAP 1   :breakpoints
+ 	; Check ECR for trap with arg (PROLOGUE ensures r9 has ECR)
+ 	bmsk.f 0, r9, 7
+@@ -238,6 +241,9 @@ ENTRY(EV_Trap)
+ 
+ 	;============ TRAP  (no param): syscall top level
+ 
++	; First return from Exception to pure K mode (Exception/IRQs renabled)
++	FAKE_RET_FROM_EXCPN
++
+ 	; If syscall tracing ongoing, invoke pre-post-hooks
+ 	GET_CURR_THR_INFO_FLAGS   r10
+ 	btst r10, TIF_SYSCALL_TRACE
+diff --git a/arch/arc/kernel/stacktrace.c b/arch/arc/kernel/stacktrace.c
+index bf40e06f3fb84..0fed32b959232 100644
+--- a/arch/arc/kernel/stacktrace.c
++++ b/arch/arc/kernel/stacktrace.c
+@@ -115,7 +115,7 @@ arc_unwind_core(struct task_struct *tsk, struct pt_regs *regs,
+ 		int (*consumer_fn) (unsigned int, void *), void *arg)
+ {
+ #ifdef CONFIG_ARC_DW2_UNWIND
+-	int ret = 0;
++	int ret = 0, cnt = 0;
+ 	unsigned int address;
+ 	struct unwind_frame_info frame_info;
+ 
+@@ -135,6 +135,11 @@ arc_unwind_core(struct task_struct *tsk, struct pt_regs *regs,
+ 			break;
+ 
+ 		frame_info.regs.r63 = frame_info.regs.r31;
++
++		if (cnt++ > 128) {
++			printk("unwinder looping too long, aborting !\n");
++			return 0;
++		}
+ 	}
+ 
+ 	return address;		/* return the last address it saw */
+diff --git a/arch/arm/boot/dts/sun4i-a10.dtsi b/arch/arm/boot/dts/sun4i-a10.dtsi
+index 5d46bb0139fad..707ad5074878a 100644
+--- a/arch/arm/boot/dts/sun4i-a10.dtsi
++++ b/arch/arm/boot/dts/sun4i-a10.dtsi
+@@ -143,7 +143,7 @@
+ 			trips {
+ 				cpu_alert0: cpu-alert0 {
+ 					/* milliCelsius */
+-					temperature = <850000>;
++					temperature = <85000>;
+ 					hysteresis = <2000>;
+ 					type = "passive";
+ 				};
+diff --git a/arch/arm64/boot/dts/marvell/armada-3720-espressobin.dts b/arch/arm64/boot/dts/marvell/armada-3720-espressobin.dts
+index 6cbdd66921aab..1a3e6e3b04eba 100644
+--- a/arch/arm64/boot/dts/marvell/armada-3720-espressobin.dts
++++ b/arch/arm64/boot/dts/marvell/armada-3720-espressobin.dts
+@@ -21,6 +21,10 @@
+ 
+ 	aliases {
+ 		ethernet0 = &eth0;
++		/* for dsa slave device */
++		ethernet1 = &switch0port1;
++		ethernet2 = &switch0port2;
++		ethernet3 = &switch0port3;
+ 		serial0 = &uart0;
+ 		serial1 = &uart1;
+ 	};
+@@ -136,25 +140,25 @@
+ 			#address-cells = <1>;
+ 			#size-cells = <0>;
+ 
+-			port@0 {
++			switch0port0: port@0 {
+ 				reg = <0>;
+ 				label = "cpu";
+ 				ethernet = <&eth0>;
+ 			};
+ 
+-			port@1 {
++			switch0port1: port@1 {
+ 				reg = <1>;
+ 				label = "wan";
+ 				phy-handle = <&switch0phy0>;
+ 			};
+ 
+-			port@2 {
++			switch0port2: port@2 {
+ 				reg = <2>;
+ 				label = "lan0";
+ 				phy-handle = <&switch0phy1>;
+ 			};
+ 
+-			port@3 {
++			switch0port3: port@3 {
+ 				reg = <3>;
+ 				label = "lan1";
+ 				phy-handle = <&switch0phy2>;
+diff --git a/arch/x86/kernel/kexec-bzimage64.c b/arch/x86/kernel/kexec-bzimage64.c
+index 9490a2845f14b..273687986a263 100644
+--- a/arch/x86/kernel/kexec-bzimage64.c
++++ b/arch/x86/kernel/kexec-bzimage64.c
+@@ -211,8 +211,7 @@ setup_boot_parameters(struct kimage *image, struct boot_params *params,
+ 	params->hdr.hardware_subarch = boot_params.hdr.hardware_subarch;
+ 
+ 	/* Copying screen_info will do? */
+-	memcpy(&params->screen_info, &boot_params.screen_info,
+-				sizeof(struct screen_info));
++	memcpy(&params->screen_info, &screen_info, sizeof(struct screen_info));
+ 
+ 	/* Fill in memsize later */
+ 	params->screen_info.ext_mem_k = 0;
+diff --git a/block/blk-cgroup.c b/block/blk-cgroup.c
+index a06547fe6f6b4..85bd46e0a745f 100644
+--- a/block/blk-cgroup.c
++++ b/block/blk-cgroup.c
+@@ -876,13 +876,20 @@ int blkg_conf_prep(struct blkcg *blkcg, const struct blkcg_policy *pol,
+ 			goto fail;
+ 		}
+ 
++		if (radix_tree_preload(GFP_KERNEL)) {
++			blkg_free(new_blkg);
++			ret = -ENOMEM;
++			goto fail;
++		}
++
+ 		rcu_read_lock();
+ 		spin_lock_irq(q->queue_lock);
+ 
+ 		blkg = blkg_lookup_check(pos, pol, q);
+ 		if (IS_ERR(blkg)) {
+ 			ret = PTR_ERR(blkg);
+-			goto fail_unlock;
++			blkg_free(new_blkg);
++			goto fail_preloaded;
+ 		}
+ 
+ 		if (blkg) {
+@@ -891,10 +898,12 @@ int blkg_conf_prep(struct blkcg *blkcg, const struct blkcg_policy *pol,
+ 			blkg = blkg_create(pos, q, new_blkg);
+ 			if (unlikely(IS_ERR(blkg))) {
+ 				ret = PTR_ERR(blkg);
+-				goto fail_unlock;
++				goto fail_preloaded;
+ 			}
+ 		}
+ 
++		radix_tree_preload_end();
++
+ 		if (pos == blkcg)
+ 			goto success;
+ 	}
+@@ -904,6 +913,8 @@ success:
+ 	ctx->body = body;
+ 	return 0;
+ 
++fail_preloaded:
++	radix_tree_preload_end();
+ fail_unlock:
+ 	spin_unlock_irq(q->queue_lock);
+ 	rcu_read_unlock();
+diff --git a/drivers/acpi/nfit/core.c b/drivers/acpi/nfit/core.c
+index dd4c7289610ec..cb88f3b43a940 100644
+--- a/drivers/acpi/nfit/core.c
++++ b/drivers/acpi/nfit/core.c
+@@ -1535,7 +1535,7 @@ static ssize_t format1_show(struct device *dev,
+ 					le16_to_cpu(nfit_dcr->dcr->code));
+ 			break;
+ 		}
+-		if (rc != ENXIO)
++		if (rc != -ENXIO)
+ 			break;
+ 	}
+ 	mutex_unlock(&acpi_desc->init_mutex);
+diff --git a/drivers/base/dd.c b/drivers/base/dd.c
+index b3c569412f4e2..4ba9231a6be80 100644
+--- a/drivers/base/dd.c
++++ b/drivers/base/dd.c
+@@ -931,6 +931,8 @@ static void __device_release_driver(struct device *dev, struct device *parent)
+ 
+ 	drv = dev->driver;
+ 	if (drv) {
++		pm_runtime_get_sync(dev);
++
+ 		while (device_links_busy(dev)) {
+ 			device_unlock(dev);
+ 			if (parent && dev->bus->need_parent_lock)
+@@ -946,11 +948,12 @@ static void __device_release_driver(struct device *dev, struct device *parent)
+ 			 * have released the driver successfully while this one
+ 			 * was waiting, so check for that.
+ 			 */
+-			if (dev->driver != drv)
++			if (dev->driver != drv) {
++				pm_runtime_put(dev);
+ 				return;
++			}
+ 		}
+ 
+-		pm_runtime_get_sync(dev);
+ 		pm_runtime_clean_up_links(dev);
+ 
+ 		driver_sysfs_remove(dev);
+diff --git a/drivers/crypto/chelsio/chtls/chtls_cm.c b/drivers/crypto/chelsio/chtls/chtls_cm.c
+index f7334c42ebd9e..35116cdb5e389 100644
+--- a/drivers/crypto/chelsio/chtls/chtls_cm.c
++++ b/drivers/crypto/chelsio/chtls/chtls_cm.c
+@@ -175,7 +175,7 @@ static struct sk_buff *alloc_ctrl_skb(struct sk_buff *skb, int len)
+ {
+ 	if (likely(skb && !skb_shared(skb) && !skb_cloned(skb))) {
+ 		__skb_trim(skb, 0);
+-		refcount_add(2, &skb->users);
++		refcount_inc(&skb->users);
+ 	} else {
+ 		skb = alloc_skb(len, GFP_KERNEL | __GFP_NOFAIL);
+ 	}
+diff --git a/drivers/crypto/chelsio/chtls/chtls_hw.c b/drivers/crypto/chelsio/chtls/chtls_hw.c
+index 64d24823c65aa..2294fb06bef36 100644
+--- a/drivers/crypto/chelsio/chtls/chtls_hw.c
++++ b/drivers/crypto/chelsio/chtls/chtls_hw.c
+@@ -368,6 +368,9 @@ int chtls_setkey(struct chtls_sock *csk, u32 keylen, u32 optname)
+ 	if (ret)
+ 		goto out_notcb;
+ 
++	if (unlikely(csk_flag(sk, CSK_ABORT_SHUTDOWN)))
++		goto out_notcb;
++
+ 	set_wr_txq(skb, CPL_PRIORITY_DATA, csk->tlshws.txqid);
+ 	csk->wr_credits -= DIV_ROUND_UP(len, 16);
+ 	csk->wr_unacked += DIV_ROUND_UP(len, 16);
+diff --git a/drivers/gpu/drm/i915/i915_gpu_error.c b/drivers/gpu/drm/i915/i915_gpu_error.c
+index a262a64f56256..ba24ac698e8bc 100644
+--- a/drivers/gpu/drm/i915/i915_gpu_error.c
++++ b/drivers/gpu/drm/i915/i915_gpu_error.c
+@@ -268,6 +268,8 @@ static int compress_page(struct compress *c,
+ 
+ 		if (zlib_deflate(zstream, Z_NO_FLUSH) != Z_OK)
+ 			return -EIO;
++
++		cond_resched();
+ 	} while (zstream->avail_in);
+ 
+ 	/* Fallback to uncompressed if we increase size? */
+@@ -347,6 +349,7 @@ static int compress_page(struct compress *c,
+ 	if (!i915_memcpy_from_wc(ptr, src, PAGE_SIZE))
+ 		memcpy(ptr, src, PAGE_SIZE);
+ 	dst->pages[dst->page_count++] = ptr;
++	cond_resched();
+ 
+ 	return 0;
+ }
+diff --git a/drivers/gpu/drm/vc4/vc4_drv.c b/drivers/gpu/drm/vc4/vc4_drv.c
+index 04270a14fcaaf..868dd1ef3b693 100644
+--- a/drivers/gpu/drm/vc4/vc4_drv.c
++++ b/drivers/gpu/drm/vc4/vc4_drv.c
+@@ -312,6 +312,7 @@ unbind_all:
+ 	component_unbind_all(dev, drm);
+ gem_destroy:
+ 	vc4_gem_destroy(drm);
++	drm_mode_config_cleanup(drm);
+ 	vc4_bo_cache_destroy(drm);
+ dev_put:
+ 	drm_dev_put(drm);
+diff --git a/drivers/net/ethernet/cadence/macb_main.c b/drivers/net/ethernet/cadence/macb_main.c
+index acae87f548a16..0374a1ba10103 100644
+--- a/drivers/net/ethernet/cadence/macb_main.c
++++ b/drivers/net/ethernet/cadence/macb_main.c
+@@ -1704,7 +1704,8 @@ static inline int macb_clear_csum(struct sk_buff *skb)
+ 
+ static int macb_pad_and_fcs(struct sk_buff **skb, struct net_device *ndev)
+ {
+-	bool cloned = skb_cloned(*skb) || skb_header_cloned(*skb);
++	bool cloned = skb_cloned(*skb) || skb_header_cloned(*skb) ||
++		      skb_is_nonlinear(*skb);
+ 	int padlen = ETH_ZLEN - (*skb)->len;
+ 	int headroom = skb_headroom(*skb);
+ 	int tailroom = skb_tailroom(*skb);
+diff --git a/drivers/net/ethernet/freescale/gianfar.c b/drivers/net/ethernet/freescale/gianfar.c
+index 8243501c37574..8db0924ec681c 100644
+--- a/drivers/net/ethernet/freescale/gianfar.c
++++ b/drivers/net/ethernet/freescale/gianfar.c
+@@ -1388,7 +1388,7 @@ static int gfar_probe(struct platform_device *ofdev)
+ 
+ 	if (dev->features & NETIF_F_IP_CSUM ||
+ 	    priv->device_flags & FSL_GIANFAR_DEV_HAS_TIMER)
+-		dev->needed_headroom = GMAC_FCB_LEN;
++		dev->needed_headroom = GMAC_FCB_LEN + GMAC_TXPAL_LEN;
+ 
+ 	/* Initializing some of the rx/tx queue level parameters */
+ 	for (i = 0; i < priv->num_tx_queues; i++) {
+@@ -2370,20 +2370,12 @@ static netdev_tx_t gfar_start_xmit(struct sk_buff *skb, struct net_device *dev)
+ 		fcb_len = GMAC_FCB_LEN + GMAC_TXPAL_LEN;
+ 
+ 	/* make space for additional header when fcb is needed */
+-	if (fcb_len && unlikely(skb_headroom(skb) < fcb_len)) {
+-		struct sk_buff *skb_new;
+-
+-		skb_new = skb_realloc_headroom(skb, fcb_len);
+-		if (!skb_new) {
++	if (fcb_len) {
++		if (unlikely(skb_cow_head(skb, fcb_len))) {
+ 			dev->stats.tx_errors++;
+ 			dev_kfree_skb_any(skb);
+ 			return NETDEV_TX_OK;
+ 		}
+-
+-		if (skb->sk)
+-			skb_set_owner_w(skb_new, skb->sk);
+-		dev_consume_skb_any(skb);
+-		skb = skb_new;
+ 	}
+ 
+ 	/* total number of fragments in the SKB */
+diff --git a/drivers/net/phy/sfp.c b/drivers/net/phy/sfp.c
+index 998d08ae7431a..47d518e6d5d4f 100644
+--- a/drivers/net/phy/sfp.c
++++ b/drivers/net/phy/sfp.c
+@@ -1886,7 +1886,8 @@ static int sfp_probe(struct platform_device *pdev)
+ 			continue;
+ 
+ 		irq = gpiod_to_irq(sfp->gpio[i]);
+-		if (!irq) {
++		if (irq < 0) {
++			irq = 0;
+ 			poll = true;
+ 			continue;
+ 		}
+diff --git a/drivers/net/usb/qmi_wwan.c b/drivers/net/usb/qmi_wwan.c
+index d2612b69257ea..6e0b3dc14aa47 100644
+--- a/drivers/net/usb/qmi_wwan.c
++++ b/drivers/net/usb/qmi_wwan.c
+@@ -1268,6 +1268,7 @@ static const struct usb_device_id products[] = {
+ 	{QMI_FIXED_INTF(0x1bc7, 0x1101, 3)},	/* Telit ME910 dual modem */
+ 	{QMI_FIXED_INTF(0x1bc7, 0x1200, 5)},	/* Telit LE920 */
+ 	{QMI_QUIRK_SET_DTR(0x1bc7, 0x1201, 2)},	/* Telit LE920, LE920A4 */
++	{QMI_QUIRK_SET_DTR(0x1bc7, 0x1230, 2)},	/* Telit LE910Cx */
+ 	{QMI_QUIRK_SET_DTR(0x1bc7, 0x1260, 2)},	/* Telit LE910Cx */
+ 	{QMI_QUIRK_SET_DTR(0x1bc7, 0x1261, 2)},	/* Telit LE910Cx */
+ 	{QMI_QUIRK_SET_DTR(0x1bc7, 0x1900, 1)},	/* Telit LN940 series */
+diff --git a/drivers/of/of_reserved_mem.c b/drivers/of/of_reserved_mem.c
+index 895c83e0c7b6c..19f95552da4d8 100644
+--- a/drivers/of/of_reserved_mem.c
++++ b/drivers/of/of_reserved_mem.c
+@@ -218,6 +218,16 @@ static int __init __rmem_cmp(const void *a, const void *b)
+ 	if (ra->base > rb->base)
+ 		return 1;
+ 
++	/*
++	 * Put the dynamic allocations (address == 0, size == 0) before static
++	 * allocations at address 0x0 so that overlap detection works
++	 * correctly.
++	 */
++	if (ra->size < rb->size)
++		return -1;
++	if (ra->size > rb->size)
++		return 1;
++
+ 	return 0;
+ }
+ 
+@@ -235,8 +245,7 @@ static void __init __rmem_check_for_overlap(void)
+ 
+ 		this = &reserved_mem[i];
+ 		next = &reserved_mem[i + 1];
+-		if (!(this->base && next->base))
+-			continue;
++
+ 		if (this->base + this->size > next->base) {
+ 			phys_addr_t this_end, next_end;
+ 
+diff --git a/drivers/scsi/scsi_scan.c b/drivers/scsi/scsi_scan.c
+index 9a7e3a3bd5ce8..009a5b2aa3d02 100644
+--- a/drivers/scsi/scsi_scan.c
++++ b/drivers/scsi/scsi_scan.c
+@@ -1722,15 +1722,16 @@ static void scsi_sysfs_add_devices(struct Scsi_Host *shost)
+  */
+ static struct async_scan_data *scsi_prep_async_scan(struct Scsi_Host *shost)
+ {
+-	struct async_scan_data *data;
++	struct async_scan_data *data = NULL;
+ 	unsigned long flags;
+ 
+ 	if (strncmp(scsi_scan_type, "sync", 4) == 0)
+ 		return NULL;
+ 
++	mutex_lock(&shost->scan_mutex);
+ 	if (shost->async_scan) {
+ 		shost_printk(KERN_DEBUG, shost, "%s called twice\n", __func__);
+-		return NULL;
++		goto err;
+ 	}
+ 
+ 	data = kmalloc(sizeof(*data), GFP_KERNEL);
+@@ -1741,7 +1742,6 @@ static struct async_scan_data *scsi_prep_async_scan(struct Scsi_Host *shost)
+ 		goto err;
+ 	init_completion(&data->prev_finished);
+ 
+-	mutex_lock(&shost->scan_mutex);
+ 	spin_lock_irqsave(shost->host_lock, flags);
+ 	shost->async_scan = 1;
+ 	spin_unlock_irqrestore(shost->host_lock, flags);
+@@ -1756,6 +1756,7 @@ static struct async_scan_data *scsi_prep_async_scan(struct Scsi_Host *shost)
+ 	return data;
+ 
+  err:
++	mutex_unlock(&shost->scan_mutex);
+ 	kfree(data);
+ 	return NULL;
+ }
+diff --git a/drivers/tty/serial/8250/8250_mtk.c b/drivers/tty/serial/8250/8250_mtk.c
+index 159169a48debe..cc4f0c5e5ddff 100644
+--- a/drivers/tty/serial/8250/8250_mtk.c
++++ b/drivers/tty/serial/8250/8250_mtk.c
+@@ -47,7 +47,7 @@ mtk8250_set_termios(struct uart_port *port, struct ktermios *termios,
+ 	 */
+ 	baud = tty_termios_baud_rate(termios);
+ 
+-	serial8250_do_set_termios(port, termios, old);
++	serial8250_do_set_termios(port, termios, NULL);
+ 
+ 	tty_termios_encode_baud_rate(termios, baud, baud);
+ 
+diff --git a/drivers/tty/serial/serial_txx9.c b/drivers/tty/serial/serial_txx9.c
+index 1b4008d022bfd..2f7ef64536a04 100644
+--- a/drivers/tty/serial/serial_txx9.c
++++ b/drivers/tty/serial/serial_txx9.c
+@@ -1284,6 +1284,9 @@ static int __init serial_txx9_init(void)
+ 
+ #ifdef ENABLE_SERIAL_TXX9_PCI
+ 	ret = pci_register_driver(&serial_txx9_pci_driver);
++	if (ret) {
++		platform_driver_unregister(&serial_txx9_plat_driver);
++	}
+ #endif
+ 	if (ret == 0)
+ 		goto out;
+diff --git a/drivers/tty/vt/vt.c b/drivers/tty/vt/vt.c
+index 758f522f331e4..13ea0579f104c 100644
+--- a/drivers/tty/vt/vt.c
++++ b/drivers/tty/vt/vt.c
+@@ -4574,27 +4574,6 @@ static int con_font_default(struct vc_data *vc, struct console_font_op *op)
+ 	return rc;
+ }
+ 
+-static int con_font_copy(struct vc_data *vc, struct console_font_op *op)
+-{
+-	int con = op->height;
+-	int rc;
+-
+-
+-	console_lock();
+-	if (vc->vc_mode != KD_TEXT)
+-		rc = -EINVAL;
+-	else if (!vc->vc_sw->con_font_copy)
+-		rc = -ENOSYS;
+-	else if (con < 0 || !vc_cons_allocated(con))
+-		rc = -ENOTTY;
+-	else if (con == vc->vc_num)	/* nothing to do */
+-		rc = 0;
+-	else
+-		rc = vc->vc_sw->con_font_copy(vc, con);
+-	console_unlock();
+-	return rc;
+-}
+-
+ int con_font_op(struct vc_data *vc, struct console_font_op *op)
+ {
+ 	switch (op->op) {
+@@ -4605,7 +4584,8 @@ int con_font_op(struct vc_data *vc, struct console_font_op *op)
+ 	case KD_FONT_OP_SET_DEFAULT:
+ 		return con_font_default(vc, op);
+ 	case KD_FONT_OP_COPY:
+-		return con_font_copy(vc, op);
++		/* was buggy and never really used */
++		return -EINVAL;
+ 	}
+ 	return -ENOSYS;
+ }
+diff --git a/drivers/usb/core/quirks.c b/drivers/usb/core/quirks.c
+index 4ee8105310989..5ad14cdd97623 100644
+--- a/drivers/usb/core/quirks.c
++++ b/drivers/usb/core/quirks.c
+@@ -378,6 +378,9 @@ static const struct usb_device_id usb_quirk_list[] = {
+ 	{ USB_DEVICE(0x0926, 0x3333), .driver_info =
+ 			USB_QUIRK_CONFIG_INTF_STRINGS },
+ 
++	/* Kingston DataTraveler 3.0 */
++	{ USB_DEVICE(0x0951, 0x1666), .driver_info = USB_QUIRK_NO_LPM },
++
+ 	/* X-Rite/Gretag-Macbeth Eye-One Pro display colorimeter */
+ 	{ USB_DEVICE(0x0971, 0x2000), .driver_info = USB_QUIRK_NO_SET_INTF },
+ 
+diff --git a/drivers/usb/mtu3/mtu3_gadget.c b/drivers/usb/mtu3/mtu3_gadget.c
+index bbcd3332471dc..3828ed6d38a21 100644
+--- a/drivers/usb/mtu3/mtu3_gadget.c
++++ b/drivers/usb/mtu3/mtu3_gadget.c
+@@ -573,6 +573,7 @@ static int mtu3_gadget_stop(struct usb_gadget *g)
+ 
+ 	spin_unlock_irqrestore(&mtu->lock, flags);
+ 
++	synchronize_irq(mtu->irq);
+ 	return 0;
+ }
+ 
+diff --git a/drivers/usb/serial/cyberjack.c b/drivers/usb/serial/cyberjack.c
+index ebd76ab07b722..36dd688b5795c 100644
+--- a/drivers/usb/serial/cyberjack.c
++++ b/drivers/usb/serial/cyberjack.c
+@@ -357,11 +357,12 @@ static void cyberjack_write_bulk_callback(struct urb *urb)
+ 	struct device *dev = &port->dev;
+ 	int status = urb->status;
+ 	unsigned long flags;
++	bool resubmitted = false;
+ 
+-	set_bit(0, &port->write_urbs_free);
+ 	if (status) {
+ 		dev_dbg(dev, "%s - nonzero write bulk status received: %d\n",
+ 			__func__, status);
++		set_bit(0, &port->write_urbs_free);
+ 		return;
+ 	}
+ 
+@@ -394,6 +395,8 @@ static void cyberjack_write_bulk_callback(struct urb *urb)
+ 			goto exit;
+ 		}
+ 
++		resubmitted = true;
++
+ 		dev_dbg(dev, "%s - priv->wrsent=%d\n", __func__, priv->wrsent);
+ 		dev_dbg(dev, "%s - priv->wrfilled=%d\n", __func__, priv->wrfilled);
+ 
+@@ -410,6 +413,8 @@ static void cyberjack_write_bulk_callback(struct urb *urb)
+ 
+ exit:
+ 	spin_unlock_irqrestore(&priv->lock, flags);
++	if (!resubmitted)
++		set_bit(0, &port->write_urbs_free);
+ 	usb_serial_port_softint(port);
+ }
+ 
+diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c
+index c773db129bf94..f28344f03141d 100644
+--- a/drivers/usb/serial/option.c
++++ b/drivers/usb/serial/option.c
+@@ -250,6 +250,7 @@ static void option_instat_callback(struct urb *urb);
+ #define QUECTEL_PRODUCT_EP06			0x0306
+ #define QUECTEL_PRODUCT_EM12			0x0512
+ #define QUECTEL_PRODUCT_RM500Q			0x0800
++#define QUECTEL_PRODUCT_EC200T			0x6026
+ 
+ #define CMOTECH_VENDOR_ID			0x16d8
+ #define CMOTECH_PRODUCT_6001			0x6001
+@@ -1117,6 +1118,7 @@ static const struct usb_device_id option_ids[] = {
+ 	{ USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_RM500Q, 0xff, 0, 0) },
+ 	{ USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_RM500Q, 0xff, 0xff, 0x10),
+ 	  .driver_info = ZLP },
++	{ USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EC200T, 0xff, 0, 0) },
+ 
+ 	{ USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_6001) },
+ 	{ USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_CMU_300) },
+@@ -1189,6 +1191,8 @@ static const struct usb_device_id option_ids[] = {
+ 	  .driver_info = NCTRL(0) | RSVD(1) },
+ 	{ USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1054, 0xff),	/* Telit FT980-KS */
+ 	  .driver_info = NCTRL(2) | RSVD(3) },
++	{ USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1055, 0xff),	/* Telit FN980 (PCIe) */
++	  .driver_info = NCTRL(0) | RSVD(1) },
+ 	{ USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_ME910),
+ 	  .driver_info = NCTRL(0) | RSVD(1) | RSVD(3) },
+ 	{ USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_ME910_DUAL_MODEM),
+@@ -1201,6 +1205,8 @@ static const struct usb_device_id option_ids[] = {
+ 	  .driver_info = NCTRL(0) },
+ 	{ USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_LE910),
+ 	  .driver_info = NCTRL(0) | RSVD(1) | RSVD(2) },
++	{ USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1203, 0xff),	/* Telit LE910Cx (RNDIS) */
++	  .driver_info = NCTRL(2) | RSVD(3) },
+ 	{ USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_LE910_USBCFG4),
+ 	  .driver_info = NCTRL(0) | RSVD(1) | RSVD(2) | RSVD(3) },
+ 	{ USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_LE920),
+@@ -1215,6 +1221,10 @@ static const struct usb_device_id option_ids[] = {
+ 	{ USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, TELIT_PRODUCT_LE920A4_1213, 0xff) },
+ 	{ USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_LE920A4_1214),
+ 	  .driver_info = NCTRL(0) | RSVD(1) | RSVD(2) | RSVD(3) },
++	{ USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1230, 0xff),	/* Telit LE910Cx (rmnet) */
++	  .driver_info = NCTRL(0) | RSVD(1) | RSVD(2) },
++	{ USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1231, 0xff),	/* Telit LE910Cx (RNDIS) */
++	  .driver_info = NCTRL(2) | RSVD(3) },
+ 	{ USB_DEVICE(TELIT_VENDOR_ID, 0x1260),
+ 	  .driver_info = NCTRL(0) | RSVD(1) | RSVD(2) },
+ 	{ USB_DEVICE(TELIT_VENDOR_ID, 0x1261),
+diff --git a/fs/btrfs/ctree.h b/fs/btrfs/ctree.h
+index 554727d82d432..4d1c12faada89 100644
+--- a/fs/btrfs/ctree.h
++++ b/fs/btrfs/ctree.h
+@@ -1459,6 +1459,21 @@ do {                                                                   \
+ 
+ #define BTRFS_INODE_ROOT_ITEM_INIT	(1 << 31)
+ 
++#define BTRFS_INODE_FLAG_MASK						\
++	(BTRFS_INODE_NODATASUM |					\
++	 BTRFS_INODE_NODATACOW |					\
++	 BTRFS_INODE_READONLY |						\
++	 BTRFS_INODE_NOCOMPRESS |					\
++	 BTRFS_INODE_PREALLOC |						\
++	 BTRFS_INODE_SYNC |						\
++	 BTRFS_INODE_IMMUTABLE |					\
++	 BTRFS_INODE_APPEND |						\
++	 BTRFS_INODE_NODUMP |						\
++	 BTRFS_INODE_NOATIME |						\
++	 BTRFS_INODE_DIRSYNC |						\
++	 BTRFS_INODE_COMPRESS |						\
++	 BTRFS_INODE_ROOT_ITEM_INIT)
++
+ struct btrfs_map_token {
+ 	const struct extent_buffer *eb;
+ 	char *kaddr;
+diff --git a/fs/btrfs/extent_io.c b/fs/btrfs/extent_io.c
+index 82d597b16152c..301111922a1a2 100644
+--- a/fs/btrfs/extent_io.c
++++ b/fs/btrfs/extent_io.c
+@@ -138,7 +138,61 @@ static int add_extent_changeset(struct extent_state *state, unsigned bits,
+ 	return ret;
+ }
+ 
+-static void flush_write_bio(struct extent_page_data *epd);
++static int __must_check submit_one_bio(struct bio *bio, int mirror_num,
++				       unsigned long bio_flags)
++{
++	blk_status_t ret = 0;
++	struct bio_vec *bvec = bio_last_bvec_all(bio);
++	struct page *page = bvec->bv_page;
++	struct extent_io_tree *tree = bio->bi_private;
++	u64 start;
++
++	start = page_offset(page) + bvec->bv_offset;
++
++	bio->bi_private = NULL;
++
++	if (tree->ops)
++		ret = tree->ops->submit_bio_hook(tree->private_data, bio,
++					   mirror_num, bio_flags, start);
++	else
++		btrfsic_submit_bio(bio);
++
++	return blk_status_to_errno(ret);
++}
++
++/* Cleanup unsubmitted bios */
++static void end_write_bio(struct extent_page_data *epd, int ret)
++{
++	if (epd->bio) {
++		epd->bio->bi_status = errno_to_blk_status(ret);
++		bio_endio(epd->bio);
++		epd->bio = NULL;
++	}
++}
++
++/*
++ * Submit bio from extent page data via submit_one_bio
++ *
++ * Return 0 if everything is OK.
++ * Return <0 for error.
++ */
++static int __must_check flush_write_bio(struct extent_page_data *epd)
++{
++	int ret = 0;
++
++	if (epd->bio) {
++		ret = submit_one_bio(epd->bio, 0, 0);
++		/*
++		 * Clean up of epd->bio is handled by its endio function.
++		 * And endio is either triggered by successful bio execution
++		 * or the error handler of submit bio hook.
++		 * So at this point, no matter what happened, we don't need
++		 * to clean up epd->bio.
++		 */
++		epd->bio = NULL;
++	}
++	return ret;
++}
+ 
+ int __init extent_io_init(void)
+ {
+@@ -2710,28 +2764,6 @@ struct bio *btrfs_bio_clone_partial(struct bio *orig, int offset, int size)
+ 	return bio;
+ }
+ 
+-static int __must_check submit_one_bio(struct bio *bio, int mirror_num,
+-				       unsigned long bio_flags)
+-{
+-	blk_status_t ret = 0;
+-	struct bio_vec *bvec = bio_last_bvec_all(bio);
+-	struct page *page = bvec->bv_page;
+-	struct extent_io_tree *tree = bio->bi_private;
+-	u64 start;
+-
+-	start = page_offset(page) + bvec->bv_offset;
+-
+-	bio->bi_private = NULL;
+-
+-	if (tree->ops)
+-		ret = tree->ops->submit_bio_hook(tree->private_data, bio,
+-					   mirror_num, bio_flags, start);
+-	else
+-		btrfsic_submit_bio(bio);
+-
+-	return blk_status_to_errno(ret);
+-}
+-
+ /*
+  * @opf:	bio REQ_OP_* and REQ_* flags as one value
+  * @tree:	tree so we can call our merge_bio hook
+@@ -3439,6 +3471,9 @@ done:
+  * records are inserted to lock ranges in the tree, and as dirty areas
+  * are found, they are marked writeback.  Then the lock bits are removed
+  * and the end_io handler clears the writeback ranges
++ *
++ * Return 0 if everything goes well.
++ * Return <0 for error.
+  */
+ static int __extent_writepage(struct page *page, struct writeback_control *wbc,
+ 			      struct extent_page_data *epd)
+@@ -3506,6 +3541,7 @@ done:
+ 		end_extent_writepage(page, ret, start, page_end);
+ 	}
+ 	unlock_page(page);
++	ASSERT(ret <= 0);
+ 	return ret;
+ 
+ done_unlocked:
+@@ -3518,18 +3554,34 @@ void wait_on_extent_buffer_writeback(struct extent_buffer *eb)
+ 		       TASK_UNINTERRUPTIBLE);
+ }
+ 
++static void end_extent_buffer_writeback(struct extent_buffer *eb)
++{
++	clear_bit(EXTENT_BUFFER_WRITEBACK, &eb->bflags);
++	smp_mb__after_atomic();
++	wake_up_bit(&eb->bflags, EXTENT_BUFFER_WRITEBACK);
++}
++
++/*
++ * Lock eb pages and flush the bio if we can't the locks
++ *
++ * Return  0 if nothing went wrong
++ * Return >0 is same as 0, except bio is not submitted
++ * Return <0 if something went wrong, no page is locked
++ */
+ static noinline_for_stack int
+ lock_extent_buffer_for_io(struct extent_buffer *eb,
+ 			  struct btrfs_fs_info *fs_info,
+ 			  struct extent_page_data *epd)
+ {
+-	int i, num_pages;
++	int i, num_pages, failed_page_nr;
+ 	int flush = 0;
+ 	int ret = 0;
+ 
+ 	if (!btrfs_try_tree_write_lock(eb)) {
++		ret = flush_write_bio(epd);
++		if (ret < 0)
++			return ret;
+ 		flush = 1;
+-		flush_write_bio(epd);
+ 		btrfs_tree_lock(eb);
+ 	}
+ 
+@@ -3538,7 +3590,9 @@ lock_extent_buffer_for_io(struct extent_buffer *eb,
+ 		if (!epd->sync_io)
+ 			return 0;
+ 		if (!flush) {
+-			flush_write_bio(epd);
++			ret = flush_write_bio(epd);
++			if (ret < 0)
++				return ret;
+ 			flush = 1;
+ 		}
+ 		while (1) {
+@@ -3579,7 +3633,14 @@ lock_extent_buffer_for_io(struct extent_buffer *eb,
+ 
+ 		if (!trylock_page(p)) {
+ 			if (!flush) {
+-				flush_write_bio(epd);
++				int err;
++
++				err = flush_write_bio(epd);
++				if (err < 0) {
++					ret = err;
++					failed_page_nr = i;
++					goto err_unlock;
++				}
+ 				flush = 1;
+ 			}
+ 			lock_page(p);
+@@ -3587,13 +3648,25 @@ lock_extent_buffer_for_io(struct extent_buffer *eb,
+ 	}
+ 
+ 	return ret;
+-}
+-
+-static void end_extent_buffer_writeback(struct extent_buffer *eb)
+-{
+-	clear_bit(EXTENT_BUFFER_WRITEBACK, &eb->bflags);
+-	smp_mb__after_atomic();
+-	wake_up_bit(&eb->bflags, EXTENT_BUFFER_WRITEBACK);
++err_unlock:
++	/* Unlock already locked pages */
++	for (i = 0; i < failed_page_nr; i++)
++		unlock_page(eb->pages[i]);
++	/*
++	 * Clear EXTENT_BUFFER_WRITEBACK and wake up anyone waiting on it.
++	 * Also set back EXTENT_BUFFER_DIRTY so future attempts to this eb can
++	 * be made and undo everything done before.
++	 */
++	btrfs_tree_lock(eb);
++	spin_lock(&eb->refs_lock);
++	set_bit(EXTENT_BUFFER_DIRTY, &eb->bflags);
++	end_extent_buffer_writeback(eb);
++	spin_unlock(&eb->refs_lock);
++	percpu_counter_add_batch(&fs_info->dirty_metadata_bytes, eb->len,
++				 fs_info->dirty_metadata_batch);
++	btrfs_clear_header_flag(eb, BTRFS_HEADER_FLAG_WRITTEN);
++	btrfs_tree_unlock(eb);
++	return ret;
+ }
+ 
+ static void set_btree_ioerr(struct page *page)
+@@ -3869,7 +3942,44 @@ retry:
+ 		index = 0;
+ 		goto retry;
+ 	}
+-	flush_write_bio(&epd);
++	ASSERT(ret <= 0);
++	if (ret < 0) {
++		end_write_bio(&epd, ret);
++		return ret;
++	}
++	/*
++	 * If something went wrong, don't allow any metadata write bio to be
++	 * submitted.
++	 *
++	 * This would prevent use-after-free if we had dirty pages not
++	 * cleaned up, which can still happen by fuzzed images.
++	 *
++	 * - Bad extent tree
++	 *   Allowing existing tree block to be allocated for other trees.
++	 *
++	 * - Log tree operations
++	 *   Exiting tree blocks get allocated to log tree, bumps its
++	 *   generation, then get cleaned in tree re-balance.
++	 *   Such tree block will not be written back, since it's clean,
++	 *   thus no WRITTEN flag set.
++	 *   And after log writes back, this tree block is not traced by
++	 *   any dirty extent_io_tree.
++	 *
++	 * - Offending tree block gets re-dirtied from its original owner
++	 *   Since it has bumped generation, no WRITTEN flag, it can be
++	 *   reused without COWing. This tree block will not be traced
++	 *   by btrfs_transaction::dirty_pages.
++	 *
++	 *   Now such dirty tree block will not be cleaned by any dirty
++	 *   extent io tree. Thus we don't want to submit such wild eb
++	 *   if the fs already has error.
++	 */
++	if (!test_bit(BTRFS_FS_STATE_ERROR, &fs_info->fs_state)) {
++		ret = flush_write_bio(&epd);
++	} else {
++		ret = -EUCLEAN;
++		end_write_bio(&epd, ret);
++	}
+ 	return ret;
+ }
+ 
+@@ -3966,7 +4076,8 @@ retry:
+ 			 * tmpfs file mapping
+ 			 */
+ 			if (!trylock_page(page)) {
+-				flush_write_bio(epd);
++				ret = flush_write_bio(epd);
++				BUG_ON(ret < 0);
+ 				lock_page(page);
+ 			}
+ 
+@@ -3976,8 +4087,10 @@ retry:
+ 			}
+ 
+ 			if (wbc->sync_mode != WB_SYNC_NONE) {
+-				if (PageWriteback(page))
+-					flush_write_bio(epd);
++				if (PageWriteback(page)) {
++					ret = flush_write_bio(epd);
++					BUG_ON(ret < 0);
++				}
+ 				wait_on_page_writeback(page);
+ 			}
+ 
+@@ -4022,8 +4135,9 @@ retry:
+ 		 * page in our current bio, and thus deadlock, so flush the
+ 		 * write bio here.
+ 		 */
+-		flush_write_bio(epd);
+-		goto retry;
++		ret = flush_write_bio(epd);
++		if (!ret)
++			goto retry;
+ 	}
+ 
+ 	if (wbc->range_cyclic || (wbc->nr_to_write > 0 && range_whole))
+@@ -4033,17 +4147,6 @@ retry:
+ 	return ret;
+ }
+ 
+-static void flush_write_bio(struct extent_page_data *epd)
+-{
+-	if (epd->bio) {
+-		int ret;
+-
+-		ret = submit_one_bio(epd->bio, 0, 0);
+-		BUG_ON(ret < 0); /* -ENOMEM */
+-		epd->bio = NULL;
+-	}
+-}
+-
+ int extent_write_full_page(struct page *page, struct writeback_control *wbc)
+ {
+ 	int ret;
+@@ -4055,8 +4158,14 @@ int extent_write_full_page(struct page *page, struct writeback_control *wbc)
+ 	};
+ 
+ 	ret = __extent_writepage(page, wbc, &epd);
++	ASSERT(ret <= 0);
++	if (ret < 0) {
++		end_write_bio(&epd, ret);
++		return ret;
++	}
+ 
+-	flush_write_bio(&epd);
++	ret = flush_write_bio(&epd);
++	ASSERT(ret <= 0);
+ 	return ret;
+ }
+ 
+@@ -4064,6 +4173,7 @@ int extent_write_locked_range(struct inode *inode, u64 start, u64 end,
+ 			      int mode)
+ {
+ 	int ret = 0;
++	int flush_ret;
+ 	struct address_space *mapping = inode->i_mapping;
+ 	struct extent_io_tree *tree = &BTRFS_I(inode)->io_tree;
+ 	struct page *page;
+@@ -4098,7 +4208,8 @@ int extent_write_locked_range(struct inode *inode, u64 start, u64 end,
+ 		start += PAGE_SIZE;
+ 	}
+ 
+-	flush_write_bio(&epd);
++	flush_ret = flush_write_bio(&epd);
++	BUG_ON(flush_ret < 0);
+ 	return ret;
+ }
+ 
+@@ -4106,6 +4217,7 @@ int extent_writepages(struct address_space *mapping,
+ 		      struct writeback_control *wbc)
+ {
+ 	int ret = 0;
++	int flush_ret;
+ 	struct extent_page_data epd = {
+ 		.bio = NULL,
+ 		.tree = &BTRFS_I(mapping->host)->io_tree,
+@@ -4114,7 +4226,8 @@ int extent_writepages(struct address_space *mapping,
+ 	};
+ 
+ 	ret = extent_write_cache_pages(mapping, wbc, &epd);
+-	flush_write_bio(&epd);
++	flush_ret = flush_write_bio(&epd);
++	BUG_ON(flush_ret < 0);
+ 	return ret;
+ }
+ 
+diff --git a/fs/btrfs/tree-checker.c b/fs/btrfs/tree-checker.c
+index d98ec885b72a1..9023e6b46396a 100644
+--- a/fs/btrfs/tree-checker.c
++++ b/fs/btrfs/tree-checker.c
+@@ -448,6 +448,320 @@ static int check_block_group_item(struct btrfs_fs_info *fs_info,
+ 	return 0;
+ }
+ 
++__printf(5, 6)
++__cold
++static void chunk_err(const struct btrfs_fs_info *fs_info,
++		      const struct extent_buffer *leaf,
++		      const struct btrfs_chunk *chunk, u64 logical,
++		      const char *fmt, ...)
++{
++	bool is_sb;
++	struct va_format vaf;
++	va_list args;
++	int i;
++	int slot = -1;
++
++	/* Only superblock eb is able to have such small offset */
++	is_sb = (leaf->start == BTRFS_SUPER_INFO_OFFSET);
++
++	if (!is_sb) {
++		/*
++		 * Get the slot number by iterating through all slots, this
++		 * would provide better readability.
++		 */
++		for (i = 0; i < btrfs_header_nritems(leaf); i++) {
++			if (btrfs_item_ptr_offset(leaf, i) ==
++					(unsigned long)chunk) {
++				slot = i;
++				break;
++			}
++		}
++	}
++	va_start(args, fmt);
++	vaf.fmt = fmt;
++	vaf.va = &args;
++
++	if (is_sb)
++		btrfs_crit(fs_info,
++		"corrupt superblock syschunk array: chunk_start=%llu, %pV",
++			   logical, &vaf);
++	else
++		btrfs_crit(fs_info,
++	"corrupt leaf: root=%llu block=%llu slot=%d chunk_start=%llu, %pV",
++			   BTRFS_CHUNK_TREE_OBJECTID, leaf->start, slot,
++			   logical, &vaf);
++	va_end(args);
++}
++
++/*
++ * The common chunk check which could also work on super block sys chunk array.
++ *
++ * Return -EUCLEAN if anything is corrupted.
++ * Return 0 if everything is OK.
++ */
++int btrfs_check_chunk_valid(struct btrfs_fs_info *fs_info,
++			    struct extent_buffer *leaf,
++			    struct btrfs_chunk *chunk, u64 logical)
++{
++	u64 length;
++	u64 stripe_len;
++	u16 num_stripes;
++	u16 sub_stripes;
++	u64 type;
++	u64 features;
++	bool mixed = false;
++
++	length = btrfs_chunk_length(leaf, chunk);
++	stripe_len = btrfs_chunk_stripe_len(leaf, chunk);
++	num_stripes = btrfs_chunk_num_stripes(leaf, chunk);
++	sub_stripes = btrfs_chunk_sub_stripes(leaf, chunk);
++	type = btrfs_chunk_type(leaf, chunk);
++
++	if (!num_stripes) {
++		chunk_err(fs_info, leaf, chunk, logical,
++			  "invalid chunk num_stripes, have %u", num_stripes);
++		return -EUCLEAN;
++	}
++	if (!IS_ALIGNED(logical, fs_info->sectorsize)) {
++		chunk_err(fs_info, leaf, chunk, logical,
++		"invalid chunk logical, have %llu should aligned to %u",
++			  logical, fs_info->sectorsize);
++		return -EUCLEAN;
++	}
++	if (btrfs_chunk_sector_size(leaf, chunk) != fs_info->sectorsize) {
++		chunk_err(fs_info, leaf, chunk, logical,
++			  "invalid chunk sectorsize, have %u expect %u",
++			  btrfs_chunk_sector_size(leaf, chunk),
++			  fs_info->sectorsize);
++		return -EUCLEAN;
++	}
++	if (!length || !IS_ALIGNED(length, fs_info->sectorsize)) {
++		chunk_err(fs_info, leaf, chunk, logical,
++			  "invalid chunk length, have %llu", length);
++		return -EUCLEAN;
++	}
++	if (!is_power_of_2(stripe_len) || stripe_len != BTRFS_STRIPE_LEN) {
++		chunk_err(fs_info, leaf, chunk, logical,
++			  "invalid chunk stripe length: %llu",
++			  stripe_len);
++		return -EUCLEAN;
++	}
++	if (~(BTRFS_BLOCK_GROUP_TYPE_MASK | BTRFS_BLOCK_GROUP_PROFILE_MASK) &
++	    type) {
++		chunk_err(fs_info, leaf, chunk, logical,
++			  "unrecognized chunk type: 0x%llx",
++			  ~(BTRFS_BLOCK_GROUP_TYPE_MASK |
++			    BTRFS_BLOCK_GROUP_PROFILE_MASK) &
++			  btrfs_chunk_type(leaf, chunk));
++		return -EUCLEAN;
++	}
++
++	if (!is_power_of_2(type & BTRFS_BLOCK_GROUP_PROFILE_MASK) &&
++	    (type & BTRFS_BLOCK_GROUP_PROFILE_MASK) != 0) {
++		chunk_err(fs_info, leaf, chunk, logical,
++		"invalid chunk profile flag: 0x%llx, expect 0 or 1 bit set",
++			  type & BTRFS_BLOCK_GROUP_PROFILE_MASK);
++		return -EUCLEAN;
++	}
++	if ((type & BTRFS_BLOCK_GROUP_TYPE_MASK) == 0) {
++		chunk_err(fs_info, leaf, chunk, logical,
++	"missing chunk type flag, have 0x%llx one bit must be set in 0x%llx",
++			  type, BTRFS_BLOCK_GROUP_TYPE_MASK);
++		return -EUCLEAN;
++	}
++
++	if ((type & BTRFS_BLOCK_GROUP_SYSTEM) &&
++	    (type & (BTRFS_BLOCK_GROUP_METADATA | BTRFS_BLOCK_GROUP_DATA))) {
++		chunk_err(fs_info, leaf, chunk, logical,
++			  "system chunk with data or metadata type: 0x%llx",
++			  type);
++		return -EUCLEAN;
++	}
++
++	features = btrfs_super_incompat_flags(fs_info->super_copy);
++	if (features & BTRFS_FEATURE_INCOMPAT_MIXED_GROUPS)
++		mixed = true;
++
++	if (!mixed) {
++		if ((type & BTRFS_BLOCK_GROUP_METADATA) &&
++		    (type & BTRFS_BLOCK_GROUP_DATA)) {
++			chunk_err(fs_info, leaf, chunk, logical,
++			"mixed chunk type in non-mixed mode: 0x%llx", type);
++			return -EUCLEAN;
++		}
++	}
++
++	if ((type & BTRFS_BLOCK_GROUP_RAID10 && sub_stripes != 2) ||
++	    (type & BTRFS_BLOCK_GROUP_RAID1 && num_stripes != 2) ||
++	    (type & BTRFS_BLOCK_GROUP_RAID5 && num_stripes < 2) ||
++	    (type & BTRFS_BLOCK_GROUP_RAID6 && num_stripes < 3) ||
++	    (type & BTRFS_BLOCK_GROUP_DUP && num_stripes != 2) ||
++	    ((type & BTRFS_BLOCK_GROUP_PROFILE_MASK) == 0 && num_stripes != 1)) {
++		chunk_err(fs_info, leaf, chunk, logical,
++			"invalid num_stripes:sub_stripes %u:%u for profile %llu",
++			num_stripes, sub_stripes,
++			type & BTRFS_BLOCK_GROUP_PROFILE_MASK);
++		return -EUCLEAN;
++	}
++
++	return 0;
++}
++
++__printf(4, 5)
++__cold
++static void dev_item_err(const struct btrfs_fs_info *fs_info,
++			 const struct extent_buffer *eb, int slot,
++			 const char *fmt, ...)
++{
++	struct btrfs_key key;
++	struct va_format vaf;
++	va_list args;
++
++	btrfs_item_key_to_cpu(eb, &key, slot);
++	va_start(args, fmt);
++
++	vaf.fmt = fmt;
++	vaf.va = &args;
++
++	btrfs_crit(fs_info,
++	"corrupt %s: root=%llu block=%llu slot=%d devid=%llu %pV",
++		btrfs_header_level(eb) == 0 ? "leaf" : "node",
++		btrfs_header_owner(eb), btrfs_header_bytenr(eb), slot,
++		key.objectid, &vaf);
++	va_end(args);
++}
++
++static int check_dev_item(struct btrfs_fs_info *fs_info,
++			  struct extent_buffer *leaf,
++			  struct btrfs_key *key, int slot)
++{
++	struct btrfs_dev_item *ditem;
++
++	if (key->objectid != BTRFS_DEV_ITEMS_OBJECTID) {
++		dev_item_err(fs_info, leaf, slot,
++			     "invalid objectid: has=%llu expect=%llu",
++			     key->objectid, BTRFS_DEV_ITEMS_OBJECTID);
++		return -EUCLEAN;
++	}
++	ditem = btrfs_item_ptr(leaf, slot, struct btrfs_dev_item);
++	if (btrfs_device_id(leaf, ditem) != key->offset) {
++		dev_item_err(fs_info, leaf, slot,
++			     "devid mismatch: key has=%llu item has=%llu",
++			     key->offset, btrfs_device_id(leaf, ditem));
++		return -EUCLEAN;
++	}
++
++	/*
++	 * For device total_bytes, we don't have reliable way to check it, as
++	 * it can be 0 for device removal. Device size check can only be done
++	 * by dev extents check.
++	 */
++	if (btrfs_device_bytes_used(leaf, ditem) >
++	    btrfs_device_total_bytes(leaf, ditem)) {
++		dev_item_err(fs_info, leaf, slot,
++			     "invalid bytes used: have %llu expect [0, %llu]",
++			     btrfs_device_bytes_used(leaf, ditem),
++			     btrfs_device_total_bytes(leaf, ditem));
++		return -EUCLEAN;
++	}
++	/*
++	 * Remaining members like io_align/type/gen/dev_group aren't really
++	 * utilized.  Skip them to make later usage of them easier.
++	 */
++	return 0;
++}
++
++/* Inode item error output has the same format as dir_item_err() */
++#define inode_item_err(fs_info, eb, slot, fmt, ...)			\
++	dir_item_err(fs_info, eb, slot, fmt, __VA_ARGS__)
++
++static int check_inode_item(struct btrfs_fs_info *fs_info,
++			    struct extent_buffer *leaf,
++			    struct btrfs_key *key, int slot)
++{
++	struct btrfs_inode_item *iitem;
++	u64 super_gen = btrfs_super_generation(fs_info->super_copy);
++	u32 valid_mask = (S_IFMT | S_ISUID | S_ISGID | S_ISVTX | 0777);
++	u32 mode;
++
++	if ((key->objectid < BTRFS_FIRST_FREE_OBJECTID ||
++	     key->objectid > BTRFS_LAST_FREE_OBJECTID) &&
++	    key->objectid != BTRFS_ROOT_TREE_DIR_OBJECTID &&
++	    key->objectid != BTRFS_FREE_INO_OBJECTID) {
++		generic_err(fs_info, leaf, slot,
++	"invalid key objectid: has %llu expect %llu or [%llu, %llu] or %llu",
++			    key->objectid, BTRFS_ROOT_TREE_DIR_OBJECTID,
++			    BTRFS_FIRST_FREE_OBJECTID,
++			    BTRFS_LAST_FREE_OBJECTID,
++			    BTRFS_FREE_INO_OBJECTID);
++		return -EUCLEAN;
++	}
++	if (key->offset != 0) {
++		inode_item_err(fs_info, leaf, slot,
++			"invalid key offset: has %llu expect 0",
++			key->offset);
++		return -EUCLEAN;
++	}
++	iitem = btrfs_item_ptr(leaf, slot, struct btrfs_inode_item);
++
++	/* Here we use super block generation + 1 to handle log tree */
++	if (btrfs_inode_generation(leaf, iitem) > super_gen + 1) {
++		inode_item_err(fs_info, leaf, slot,
++			"invalid inode generation: has %llu expect (0, %llu]",
++			       btrfs_inode_generation(leaf, iitem),
++			       super_gen + 1);
++		return -EUCLEAN;
++	}
++	/* Note for ROOT_TREE_DIR_ITEM, mkfs could set its transid 0 */
++	if (btrfs_inode_transid(leaf, iitem) > super_gen + 1) {
++		inode_item_err(fs_info, leaf, slot,
++			"invalid inode transid: has %llu expect [0, %llu]",
++			       btrfs_inode_transid(leaf, iitem), super_gen + 1);
++		return -EUCLEAN;
++	}
++
++	/*
++	 * For size and nbytes it's better not to be too strict, as for dir
++	 * item its size/nbytes can easily get wrong, but doesn't affect
++	 * anything in the fs. So here we skip the check.
++	 */
++	mode = btrfs_inode_mode(leaf, iitem);
++	if (mode & ~valid_mask) {
++		inode_item_err(fs_info, leaf, slot,
++			       "unknown mode bit detected: 0x%x",
++			       mode & ~valid_mask);
++		return -EUCLEAN;
++	}
++
++	/*
++	 * S_IFMT is not bit mapped so we can't completely rely on is_power_of_2,
++	 * but is_power_of_2() can save us from checking FIFO/CHR/DIR/REG.
++	 * Only needs to check BLK, LNK and SOCKS
++	 */
++	if (!is_power_of_2(mode & S_IFMT)) {
++		if (!S_ISLNK(mode) && !S_ISBLK(mode) && !S_ISSOCK(mode)) {
++			inode_item_err(fs_info, leaf, slot,
++			"invalid mode: has 0%o expect valid S_IF* bit(s)",
++				       mode & S_IFMT);
++			return -EUCLEAN;
++		}
++	}
++	if (S_ISDIR(mode) && btrfs_inode_nlink(leaf, iitem) > 1) {
++		inode_item_err(fs_info, leaf, slot,
++		       "invalid nlink: has %u expect no more than 1 for dir",
++			btrfs_inode_nlink(leaf, iitem));
++		return -EUCLEAN;
++	}
++	if (btrfs_inode_flags(leaf, iitem) & ~BTRFS_INODE_FLAG_MASK) {
++		inode_item_err(fs_info, leaf, slot,
++			       "unknown flags detected: 0x%llx",
++			       btrfs_inode_flags(leaf, iitem) &
++			       ~BTRFS_INODE_FLAG_MASK);
++		return -EUCLEAN;
++	}
++	return 0;
++}
++
+ /*
+  * Common point to switch the item-specific validation.
+  */
+@@ -456,6 +770,7 @@ static int check_leaf_item(struct btrfs_fs_info *fs_info,
+ 			   struct btrfs_key *key, int slot)
+ {
+ 	int ret = 0;
++	struct btrfs_chunk *chunk;
+ 
+ 	switch (key->type) {
+ 	case BTRFS_EXTENT_DATA_KEY:
+@@ -472,6 +787,17 @@ static int check_leaf_item(struct btrfs_fs_info *fs_info,
+ 	case BTRFS_BLOCK_GROUP_ITEM_KEY:
+ 		ret = check_block_group_item(fs_info, leaf, key, slot);
+ 		break;
++	case BTRFS_CHUNK_ITEM_KEY:
++		chunk = btrfs_item_ptr(leaf, slot, struct btrfs_chunk);
++		ret = btrfs_check_chunk_valid(fs_info, leaf, chunk,
++					      key->offset);
++		break;
++	case BTRFS_DEV_ITEM_KEY:
++		ret = check_dev_item(fs_info, leaf, key, slot);
++		break;
++	case BTRFS_INODE_ITEM_KEY:
++		ret = check_inode_item(fs_info, leaf, key, slot);
++		break;
+ 	}
+ 	return ret;
+ }
+diff --git a/fs/btrfs/tree-checker.h b/fs/btrfs/tree-checker.h
+index ff043275b7844..4df45e8a66595 100644
+--- a/fs/btrfs/tree-checker.h
++++ b/fs/btrfs/tree-checker.h
+@@ -25,4 +25,8 @@ int btrfs_check_leaf_relaxed(struct btrfs_fs_info *fs_info,
+ 			     struct extent_buffer *leaf);
+ int btrfs_check_node(struct btrfs_fs_info *fs_info, struct extent_buffer *node);
+ 
++int btrfs_check_chunk_valid(struct btrfs_fs_info *fs_info,
++			    struct extent_buffer *leaf,
++			    struct btrfs_chunk *chunk, u64 logical);
++
+ #endif
+diff --git a/fs/btrfs/volumes.c b/fs/btrfs/volumes.c
+index 0879e3dc39c8c..05daa2b816c31 100644
+--- a/fs/btrfs/volumes.c
++++ b/fs/btrfs/volumes.c
+@@ -28,6 +28,7 @@
+ #include "math.h"
+ #include "dev-replace.h"
+ #include "sysfs.h"
++#include "tree-checker.h"
+ 
+ const struct btrfs_raid_attr btrfs_raid_array[BTRFS_NR_RAID_TYPES] = {
+ 	[BTRFS_RAID_RAID10] = {
+@@ -4605,15 +4606,6 @@ static void check_raid56_incompat_flag(struct btrfs_fs_info *info, u64 type)
+ 	btrfs_set_fs_incompat(info, RAID56);
+ }
+ 
+-#define BTRFS_MAX_DEVS(info) ((BTRFS_MAX_ITEM_SIZE(info)	\
+-			- sizeof(struct btrfs_chunk))		\
+-			/ sizeof(struct btrfs_stripe) + 1)
+-
+-#define BTRFS_MAX_DEVS_SYS_CHUNK ((BTRFS_SYSTEM_CHUNK_ARRAY_SIZE	\
+-				- 2 * sizeof(struct btrfs_disk_key)	\
+-				- 2 * sizeof(struct btrfs_chunk))	\
+-				/ sizeof(struct btrfs_stripe) + 1)
+-
+ static int __btrfs_alloc_chunk(struct btrfs_trans_handle *trans,
+ 			       u64 start, u64 type)
+ {
+@@ -6370,99 +6362,6 @@ struct btrfs_device *btrfs_alloc_device(struct btrfs_fs_info *fs_info,
+ 	return dev;
+ }
+ 
+-/* Return -EIO if any error, otherwise return 0. */
+-static int btrfs_check_chunk_valid(struct btrfs_fs_info *fs_info,
+-				   struct extent_buffer *leaf,
+-				   struct btrfs_chunk *chunk, u64 logical)
+-{
+-	u64 length;
+-	u64 stripe_len;
+-	u16 num_stripes;
+-	u16 sub_stripes;
+-	u64 type;
+-	u64 features;
+-	bool mixed = false;
+-
+-	length = btrfs_chunk_length(leaf, chunk);
+-	stripe_len = btrfs_chunk_stripe_len(leaf, chunk);
+-	num_stripes = btrfs_chunk_num_stripes(leaf, chunk);
+-	sub_stripes = btrfs_chunk_sub_stripes(leaf, chunk);
+-	type = btrfs_chunk_type(leaf, chunk);
+-
+-	if (!num_stripes) {
+-		btrfs_err(fs_info, "invalid chunk num_stripes: %u",
+-			  num_stripes);
+-		return -EIO;
+-	}
+-	if (!IS_ALIGNED(logical, fs_info->sectorsize)) {
+-		btrfs_err(fs_info, "invalid chunk logical %llu", logical);
+-		return -EIO;
+-	}
+-	if (btrfs_chunk_sector_size(leaf, chunk) != fs_info->sectorsize) {
+-		btrfs_err(fs_info, "invalid chunk sectorsize %u",
+-			  btrfs_chunk_sector_size(leaf, chunk));
+-		return -EIO;
+-	}
+-	if (!length || !IS_ALIGNED(length, fs_info->sectorsize)) {
+-		btrfs_err(fs_info, "invalid chunk length %llu", length);
+-		return -EIO;
+-	}
+-	if (!is_power_of_2(stripe_len) || stripe_len != BTRFS_STRIPE_LEN) {
+-		btrfs_err(fs_info, "invalid chunk stripe length: %llu",
+-			  stripe_len);
+-		return -EIO;
+-	}
+-	if (~(BTRFS_BLOCK_GROUP_TYPE_MASK | BTRFS_BLOCK_GROUP_PROFILE_MASK) &
+-	    type) {
+-		btrfs_err(fs_info, "unrecognized chunk type: %llu",
+-			  ~(BTRFS_BLOCK_GROUP_TYPE_MASK |
+-			    BTRFS_BLOCK_GROUP_PROFILE_MASK) &
+-			  btrfs_chunk_type(leaf, chunk));
+-		return -EIO;
+-	}
+-
+-	if ((type & BTRFS_BLOCK_GROUP_TYPE_MASK) == 0) {
+-		btrfs_err(fs_info, "missing chunk type flag: 0x%llx", type);
+-		return -EIO;
+-	}
+-
+-	if ((type & BTRFS_BLOCK_GROUP_SYSTEM) &&
+-	    (type & (BTRFS_BLOCK_GROUP_METADATA | BTRFS_BLOCK_GROUP_DATA))) {
+-		btrfs_err(fs_info,
+-			"system chunk with data or metadata type: 0x%llx", type);
+-		return -EIO;
+-	}
+-
+-	features = btrfs_super_incompat_flags(fs_info->super_copy);
+-	if (features & BTRFS_FEATURE_INCOMPAT_MIXED_GROUPS)
+-		mixed = true;
+-
+-	if (!mixed) {
+-		if ((type & BTRFS_BLOCK_GROUP_METADATA) &&
+-		    (type & BTRFS_BLOCK_GROUP_DATA)) {
+-			btrfs_err(fs_info,
+-			"mixed chunk type in non-mixed mode: 0x%llx", type);
+-			return -EIO;
+-		}
+-	}
+-
+-	if ((type & BTRFS_BLOCK_GROUP_RAID10 && sub_stripes != 2) ||
+-	    (type & BTRFS_BLOCK_GROUP_RAID1 && num_stripes != 2) ||
+-	    (type & BTRFS_BLOCK_GROUP_RAID5 && num_stripes < 2) ||
+-	    (type & BTRFS_BLOCK_GROUP_RAID6 && num_stripes < 3) ||
+-	    (type & BTRFS_BLOCK_GROUP_DUP && num_stripes != 2) ||
+-	    ((type & BTRFS_BLOCK_GROUP_PROFILE_MASK) == 0 &&
+-	     num_stripes != 1)) {
+-		btrfs_err(fs_info,
+-			"invalid num_stripes:sub_stripes %u:%u for profile %llu",
+-			num_stripes, sub_stripes,
+-			type & BTRFS_BLOCK_GROUP_PROFILE_MASK);
+-		return -EIO;
+-	}
+-
+-	return 0;
+-}
+-
+ static void btrfs_report_missing_device(struct btrfs_fs_info *fs_info,
+ 					u64 devid, u8 *uuid, bool error)
+ {
+@@ -6493,9 +6392,15 @@ static int read_one_chunk(struct btrfs_fs_info *fs_info, struct btrfs_key *key,
+ 	length = btrfs_chunk_length(leaf, chunk);
+ 	num_stripes = btrfs_chunk_num_stripes(leaf, chunk);
+ 
+-	ret = btrfs_check_chunk_valid(fs_info, leaf, chunk, logical);
+-	if (ret)
+-		return ret;
++	/*
++	 * Only need to verify chunk item if we're reading from sys chunk array,
++	 * as chunk item in tree block is already verified by tree-checker.
++	 */
++	if (leaf->start == BTRFS_SUPER_INFO_OFFSET) {
++		ret = btrfs_check_chunk_valid(fs_info, leaf, chunk, logical);
++		if (ret)
++			return ret;
++	}
+ 
+ 	read_lock(&map_tree->map_tree.lock);
+ 	em = lookup_extent_mapping(&map_tree->map_tree, logical, 1);
+diff --git a/fs/btrfs/volumes.h b/fs/btrfs/volumes.h
+index 8e8bf3246de18..65cd023b097c1 100644
+--- a/fs/btrfs/volumes.h
++++ b/fs/btrfs/volumes.h
+@@ -257,6 +257,15 @@ struct btrfs_fs_devices {
+ 
+ #define BTRFS_BIO_INLINE_CSUM_SIZE	64
+ 
++#define BTRFS_MAX_DEVS(info) ((BTRFS_MAX_ITEM_SIZE(info)	\
++			- sizeof(struct btrfs_chunk))		\
++			/ sizeof(struct btrfs_stripe) + 1)
++
++#define BTRFS_MAX_DEVS_SYS_CHUNK ((BTRFS_SYSTEM_CHUNK_ARRAY_SIZE	\
++				- 2 * sizeof(struct btrfs_disk_key)	\
++				- 2 * sizeof(struct btrfs_chunk))	\
++				/ sizeof(struct btrfs_stripe) + 1)
++
+ /*
+  * we need the mirror number and stripe index to be passed around
+  * the call chain while we are processing end_io (especially errors).
+diff --git a/fs/gfs2/glock.c b/fs/gfs2/glock.c
+index ccdd8c821abd7..c20d71d86812a 100644
+--- a/fs/gfs2/glock.c
++++ b/fs/gfs2/glock.c
+@@ -870,7 +870,8 @@ int gfs2_glock_get(struct gfs2_sbd *sdp, u64 number,
+ out_free:
+ 	kfree(gl->gl_lksb.sb_lvbptr);
+ 	kmem_cache_free(cachep, gl);
+-	atomic_dec(&sdp->sd_glock_disposal);
++	if (atomic_dec_and_test(&sdp->sd_glock_disposal))
++		wake_up(&sdp->sd_glock_wait);
+ 
+ out:
+ 	return ret;
+diff --git a/include/asm-generic/pgtable.h b/include/asm-generic/pgtable.h
+index 15fd0277ffa69..5901b00059294 100644
+--- a/include/asm-generic/pgtable.h
++++ b/include/asm-generic/pgtable.h
+@@ -1115,10 +1115,6 @@ static inline bool arch_has_pfn_modify_check(void)
+ 
+ #endif /* !__ASSEMBLY__ */
+ 
+-#ifndef io_remap_pfn_range
+-#define io_remap_pfn_range remap_pfn_range
+-#endif
+-
+ #ifndef has_transparent_hugepage
+ #ifdef CONFIG_TRANSPARENT_HUGEPAGE
+ #define has_transparent_hugepage() 1
+diff --git a/include/linux/mm.h b/include/linux/mm.h
+index 83828c118b6b7..f6ecf41aea83d 100644
+--- a/include/linux/mm.h
++++ b/include/linux/mm.h
+@@ -2561,6 +2561,15 @@ static inline vm_fault_t vmf_insert_pfn(struct vm_area_struct *vma,
+ 	return VM_FAULT_NOPAGE;
+ }
+ 
++#ifndef io_remap_pfn_range
++static inline int io_remap_pfn_range(struct vm_area_struct *vma,
++				     unsigned long addr, unsigned long pfn,
++				     unsigned long size, pgprot_t prot)
++{
++	return remap_pfn_range(vma, addr, pfn, size, pgprot_decrypted(prot));
++}
++#endif
++
+ static inline vm_fault_t vmf_error(int err)
+ {
+ 	if (err == -ENOMEM)
+diff --git a/include/net/dsa.h b/include/net/dsa.h
+index 461e8a7661b78..d28df7adf948a 100644
+--- a/include/net/dsa.h
++++ b/include/net/dsa.h
+@@ -196,6 +196,7 @@ struct dsa_port {
+ 	unsigned int		index;
+ 	const char		*name;
+ 	const struct dsa_port	*cpu_dp;
++	const char		*mac;
+ 	struct device_node	*dn;
+ 	unsigned int		ageing_time;
+ 	u8			stp_state;
+diff --git a/kernel/events/core.c b/kernel/events/core.c
+index a35d742b0ba82..8b94eb6437c18 100644
+--- a/kernel/events/core.c
++++ b/kernel/events/core.c
+@@ -9047,6 +9047,7 @@ perf_event_parse_addr_filter(struct perf_event *event, char *fstr,
+ 			if (token == IF_SRC_FILE || token == IF_SRC_FILEADDR) {
+ 				int fpos = token == IF_SRC_FILE ? 2 : 1;
+ 
++				kfree(filename);
+ 				filename = match_strdup(&args[fpos]);
+ 				if (!filename) {
+ 					ret = -ENOMEM;
+@@ -9093,16 +9094,13 @@ perf_event_parse_addr_filter(struct perf_event *event, char *fstr,
+ 				 */
+ 				ret = -EOPNOTSUPP;
+ 				if (!event->ctx->task)
+-					goto fail_free_name;
++					goto fail;
+ 
+ 				/* look up the path and grab its inode */
+ 				ret = kern_path(filename, LOOKUP_FOLLOW,
+ 						&filter->path);
+ 				if (ret)
+-					goto fail_free_name;
+-
+-				kfree(filename);
+-				filename = NULL;
++					goto fail;
+ 
+ 				ret = -EINVAL;
+ 				if (!filter->path.dentry ||
+@@ -9122,13 +9120,13 @@ perf_event_parse_addr_filter(struct perf_event *event, char *fstr,
+ 	if (state != IF_STATE_ACTION)
+ 		goto fail;
+ 
++	kfree(filename);
+ 	kfree(orig);
+ 
+ 	return 0;
+ 
+-fail_free_name:
+-	kfree(filename);
+ fail:
++	kfree(filename);
+ 	free_filters_list(filters);
+ 	kfree(orig);
+ 
+diff --git a/kernel/fork.c b/kernel/fork.c
+index 3ed29bf8eb291..f2c92c1001949 100644
+--- a/kernel/fork.c
++++ b/kernel/fork.c
+@@ -1965,14 +1965,9 @@ static __latent_entropy struct task_struct *copy_process(
+ 	/* ok, now we should be set up.. */
+ 	p->pid = pid_nr(pid);
+ 	if (clone_flags & CLONE_THREAD) {
+-		p->exit_signal = -1;
+ 		p->group_leader = current->group_leader;
+ 		p->tgid = current->tgid;
+ 	} else {
+-		if (clone_flags & CLONE_PARENT)
+-			p->exit_signal = current->group_leader->exit_signal;
+-		else
+-			p->exit_signal = (clone_flags & CSIGNAL);
+ 		p->group_leader = p;
+ 		p->tgid = p->pid;
+ 	}
+@@ -2017,9 +2012,14 @@ static __latent_entropy struct task_struct *copy_process(
+ 	if (clone_flags & (CLONE_PARENT|CLONE_THREAD)) {
+ 		p->real_parent = current->real_parent;
+ 		p->parent_exec_id = current->parent_exec_id;
++		if (clone_flags & CLONE_THREAD)
++			p->exit_signal = -1;
++		else
++			p->exit_signal = current->group_leader->exit_signal;
+ 	} else {
+ 		p->real_parent = current;
+ 		p->parent_exec_id = current->self_exec_id;
++		p->exit_signal = (clone_flags & CSIGNAL);
+ 	}
+ 
+ 	klp_copy_process(p);
+diff --git a/kernel/futex.c b/kernel/futex.c
+index eabb9180ffa89..52f641c00a65b 100644
+--- a/kernel/futex.c
++++ b/kernel/futex.c
+@@ -2417,10 +2417,22 @@ retry:
+ 		}
+ 
+ 		/*
+-		 * Since we just failed the trylock; there must be an owner.
++		 * The trylock just failed, so either there is an owner or
++		 * there is a higher priority waiter than this one.
+ 		 */
+ 		newowner = rt_mutex_owner(&pi_state->pi_mutex);
+-		BUG_ON(!newowner);
++		/*
++		 * If the higher priority waiter has not yet taken over the
++		 * rtmutex then newowner is NULL. We can't return here with
++		 * that state because it's inconsistent vs. the user space
++		 * state. So drop the locks and try again. It's a valid
++		 * situation and not any different from the other retry
++		 * conditions.
++		 */
++		if (unlikely(!newowner)) {
++			err = -EAGAIN;
++			goto handle_err;
++		}
+ 	} else {
+ 		WARN_ON_ONCE(argowner != current);
+ 		if (oldowner == current) {
+diff --git a/kernel/kthread.c b/kernel/kthread.c
+index b786eda90bb56..2eed853ab9cc5 100644
+--- a/kernel/kthread.c
++++ b/kernel/kthread.c
+@@ -863,7 +863,8 @@ void kthread_delayed_work_timer_fn(struct timer_list *t)
+ 	/* Move the work from worker->delayed_work_list. */
+ 	WARN_ON_ONCE(list_empty(&work->node));
+ 	list_del_init(&work->node);
+-	kthread_insert_work(worker, work, &worker->work_list);
++	if (!work->canceling)
++		kthread_insert_work(worker, work, &worker->work_list);
+ 
+ 	spin_unlock(&worker->lock);
+ }
+diff --git a/kernel/signal.c b/kernel/signal.c
+index 6a56921181393..a02a25acf2056 100644
+--- a/kernel/signal.c
++++ b/kernel/signal.c
+@@ -385,16 +385,17 @@ static bool task_participate_group_stop(struct task_struct *task)
+ 
+ void task_join_group_stop(struct task_struct *task)
+ {
++	unsigned long mask = current->jobctl & JOBCTL_STOP_SIGMASK;
++	struct signal_struct *sig = current->signal;
++
++	if (sig->group_stop_count) {
++		sig->group_stop_count++;
++		mask |= JOBCTL_STOP_CONSUME;
++	} else if (!(sig->flags & SIGNAL_STOP_STOPPED))
++		return;
++
+ 	/* Have the new thread join an on-going signal group stop */
+-	unsigned long jobctl = current->jobctl;
+-	if (jobctl & JOBCTL_STOP_PENDING) {
+-		struct signal_struct *sig = current->signal;
+-		unsigned long signr = jobctl & JOBCTL_STOP_SIGMASK;
+-		unsigned long gstop = JOBCTL_STOP_PENDING | JOBCTL_STOP_CONSUME;
+-		if (task_set_jobctl_pending(task, signr | gstop)) {
+-			sig->group_stop_count++;
+-		}
+-	}
++	task_set_jobctl_pending(task, mask | JOBCTL_STOP_PENDING);
+ }
+ 
+ /*
+diff --git a/kernel/trace/blktrace.c b/kernel/trace/blktrace.c
+index 1442f6152abc2..645048bb1e869 100644
+--- a/kernel/trace/blktrace.c
++++ b/kernel/trace/blktrace.c
+@@ -521,10 +521,18 @@ static int do_blk_trace_setup(struct request_queue *q, char *name, dev_t dev,
+ 	if (!bt->msg_data)
+ 		goto err;
+ 
+-	ret = -ENOENT;
+-
+-	dir = debugfs_lookup(buts->name, blk_debugfs_root);
+-	if (!dir)
++#ifdef CONFIG_BLK_DEBUG_FS
++	/*
++	 * When tracing whole make_request drivers (multiqueue) block devices,
++	 * reuse the existing debugfs directory created by the block layer on
++	 * init. For request-based block devices, all partitions block devices,
++	 * and scsi-generic block devices we create a temporary new debugfs
++	 * directory that will be removed once the trace ends.
++	 */
++	if (q->mq_ops && bdev && bdev == bdev->bd_contains)
++		dir = q->debugfs_dir;
++	else
++#endif
+ 		bt->dir = dir = debugfs_create_dir(buts->name, blk_debugfs_root);
+ 	if (!dir)
+ 		goto err;
+@@ -583,8 +591,6 @@ static int do_blk_trace_setup(struct request_queue *q, char *name, dev_t dev,
+ 
+ 	ret = 0;
+ err:
+-	if (dir && !bt->dir)
+-		dput(dir);
+ 	if (ret)
+ 		blk_trace_free(bt);
+ 	return ret;
+diff --git a/kernel/trace/ring_buffer.c b/kernel/trace/ring_buffer.c
+index eef05eb3b2841..87ce9736043da 100644
+--- a/kernel/trace/ring_buffer.c
++++ b/kernel/trace/ring_buffer.c
+@@ -444,14 +444,16 @@ struct rb_event_info {
+ 
+ /*
+  * Used for which event context the event is in.
+- *  NMI     = 0
+- *  IRQ     = 1
+- *  SOFTIRQ = 2
+- *  NORMAL  = 3
++ *  TRANSITION = 0
++ *  NMI     = 1
++ *  IRQ     = 2
++ *  SOFTIRQ = 3
++ *  NORMAL  = 4
+  *
+  * See trace_recursive_lock() comment below for more details.
+  */
+ enum {
++	RB_CTX_TRANSITION,
+ 	RB_CTX_NMI,
+ 	RB_CTX_IRQ,
+ 	RB_CTX_SOFTIRQ,
+@@ -2620,10 +2622,10 @@ rb_wakeups(struct ring_buffer *buffer, struct ring_buffer_per_cpu *cpu_buffer)
+  * a bit of overhead in something as critical as function tracing,
+  * we use a bitmask trick.
+  *
+- *  bit 0 =  NMI context
+- *  bit 1 =  IRQ context
+- *  bit 2 =  SoftIRQ context
+- *  bit 3 =  normal context.
++ *  bit 1 =  NMI context
++ *  bit 2 =  IRQ context
++ *  bit 3 =  SoftIRQ context
++ *  bit 4 =  normal context.
+  *
+  * This works because this is the order of contexts that can
+  * preempt other contexts. A SoftIRQ never preempts an IRQ
+@@ -2646,6 +2648,30 @@ rb_wakeups(struct ring_buffer *buffer, struct ring_buffer_per_cpu *cpu_buffer)
+  * The least significant bit can be cleared this way, and it
+  * just so happens that it is the same bit corresponding to
+  * the current context.
++ *
++ * Now the TRANSITION bit breaks the above slightly. The TRANSITION bit
++ * is set when a recursion is detected at the current context, and if
++ * the TRANSITION bit is already set, it will fail the recursion.
++ * This is needed because there's a lag between the changing of
++ * interrupt context and updating the preempt count. In this case,
++ * a false positive will be found. To handle this, one extra recursion
++ * is allowed, and this is done by the TRANSITION bit. If the TRANSITION
++ * bit is already set, then it is considered a recursion and the function
++ * ends. Otherwise, the TRANSITION bit is set, and that bit is returned.
++ *
++ * On the trace_recursive_unlock(), the TRANSITION bit will be the first
++ * to be cleared. Even if it wasn't the context that set it. That is,
++ * if an interrupt comes in while NORMAL bit is set and the ring buffer
++ * is called before preempt_count() is updated, since the check will
++ * be on the NORMAL bit, the TRANSITION bit will then be set. If an
++ * NMI then comes in, it will set the NMI bit, but when the NMI code
++ * does the trace_recursive_unlock() it will clear the TRANSTION bit
++ * and leave the NMI bit set. But this is fine, because the interrupt
++ * code that set the TRANSITION bit will then clear the NMI bit when it
++ * calls trace_recursive_unlock(). If another NMI comes in, it will
++ * set the TRANSITION bit and continue.
++ *
++ * Note: The TRANSITION bit only handles a single transition between context.
+  */
+ 
+ static __always_inline int
+@@ -2661,8 +2687,16 @@ trace_recursive_lock(struct ring_buffer_per_cpu *cpu_buffer)
+ 		bit = pc & NMI_MASK ? RB_CTX_NMI :
+ 			pc & HARDIRQ_MASK ? RB_CTX_IRQ : RB_CTX_SOFTIRQ;
+ 
+-	if (unlikely(val & (1 << (bit + cpu_buffer->nest))))
+-		return 1;
++	if (unlikely(val & (1 << (bit + cpu_buffer->nest)))) {
++		/*
++		 * It is possible that this was called by transitioning
++		 * between interrupt context, and preempt_count() has not
++		 * been updated yet. In this case, use the TRANSITION bit.
++		 */
++		bit = RB_CTX_TRANSITION;
++		if (val & (1 << (bit + cpu_buffer->nest)))
++			return 1;
++	}
+ 
+ 	val |= (1 << (bit + cpu_buffer->nest));
+ 	cpu_buffer->current_context = val;
+@@ -2677,8 +2711,8 @@ trace_recursive_unlock(struct ring_buffer_per_cpu *cpu_buffer)
+ 		cpu_buffer->current_context - (1 << cpu_buffer->nest);
+ }
+ 
+-/* The recursive locking above uses 4 bits */
+-#define NESTED_BITS 4
++/* The recursive locking above uses 5 bits */
++#define NESTED_BITS 5
+ 
+ /**
+  * ring_buffer_nest_start - Allow to trace while nested
+diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c
+index 6bf617ff03694..c3cc6aaa6f79d 100644
+--- a/kernel/trace/trace.c
++++ b/kernel/trace/trace.c
+@@ -2819,7 +2819,7 @@ static char *get_trace_buf(void)
+ 
+ 	/* Interrupts must see nesting incremented before we use the buffer */
+ 	barrier();
+-	return &buffer->buffer[buffer->nesting][0];
++	return &buffer->buffer[buffer->nesting - 1][0];
+ }
+ 
+ static void put_trace_buf(void)
+diff --git a/kernel/trace/trace.h b/kernel/trace/trace.h
+index ee0c6a313ed1a..01475411fd1b2 100644
+--- a/kernel/trace/trace.h
++++ b/kernel/trace/trace.h
+@@ -534,6 +534,12 @@ enum {
+ 
+ 	TRACE_GRAPH_DEPTH_START_BIT,
+ 	TRACE_GRAPH_DEPTH_END_BIT,
++
++	/*
++	 * When transitioning between context, the preempt_count() may
++	 * not be correct. Allow for a single recursion to cover this case.
++	 */
++	TRACE_TRANSITION_BIT,
+ };
+ 
+ #define trace_recursion_set(bit)	do { (current)->trace_recursion |= (1<<(bit)); } while (0)
+@@ -588,14 +594,27 @@ static __always_inline int trace_test_and_set_recursion(int start, int max)
+ 		return 0;
+ 
+ 	bit = trace_get_context_bit() + start;
+-	if (unlikely(val & (1 << bit)))
+-		return -1;
++	if (unlikely(val & (1 << bit))) {
++		/*
++		 * It could be that preempt_count has not been updated during
++		 * a switch between contexts. Allow for a single recursion.
++		 */
++		bit = TRACE_TRANSITION_BIT;
++		if (trace_recursion_test(bit))
++			return -1;
++		trace_recursion_set(bit);
++		barrier();
++		return bit + 1;
++	}
++
++	/* Normal check passed, clear the transition to allow it again */
++	trace_recursion_clear(TRACE_TRANSITION_BIT);
+ 
+ 	val |= 1 << bit;
+ 	current->trace_recursion = val;
+ 	barrier();
+ 
+-	return bit;
++	return bit + 1;
+ }
+ 
+ static __always_inline void trace_clear_recursion(int bit)
+@@ -605,6 +624,7 @@ static __always_inline void trace_clear_recursion(int bit)
+ 	if (!bit)
+ 		return;
+ 
++	bit--;
+ 	bit = 1 << bit;
+ 	val &= ~bit;
+ 
+diff --git a/kernel/trace/trace_selftest.c b/kernel/trace/trace_selftest.c
+index 11e9daa4a568a..330ba2b081ede 100644
+--- a/kernel/trace/trace_selftest.c
++++ b/kernel/trace/trace_selftest.c
+@@ -492,8 +492,13 @@ trace_selftest_function_recursion(void)
+ 	unregister_ftrace_function(&test_rec_probe);
+ 
+ 	ret = -1;
+-	if (trace_selftest_recursion_cnt != 1) {
+-		pr_cont("*callback not called once (%d)* ",
++	/*
++	 * Recursion allows for transitions between context,
++	 * and may call the callback twice.
++	 */
++	if (trace_selftest_recursion_cnt != 1 &&
++	    trace_selftest_recursion_cnt != 2) {
++		pr_cont("*callback not called once (or twice) (%d)* ",
+ 			trace_selftest_recursion_cnt);
+ 		goto out;
+ 	}
+diff --git a/lib/crc32test.c b/lib/crc32test.c
+index 97d6a57cefcc5..61ddce2cff777 100644
+--- a/lib/crc32test.c
++++ b/lib/crc32test.c
+@@ -683,7 +683,6 @@ static int __init crc32c_test(void)
+ 
+ 	/* reduce OS noise */
+ 	local_irq_save(flags);
+-	local_irq_disable();
+ 
+ 	nsec = ktime_get_ns();
+ 	for (i = 0; i < 100; i++) {
+@@ -694,7 +693,6 @@ static int __init crc32c_test(void)
+ 	nsec = ktime_get_ns() - nsec;
+ 
+ 	local_irq_restore(flags);
+-	local_irq_enable();
+ 
+ 	pr_info("crc32c: CRC_LE_BITS = %d\n", CRC_LE_BITS);
+ 
+@@ -768,7 +766,6 @@ static int __init crc32_test(void)
+ 
+ 	/* reduce OS noise */
+ 	local_irq_save(flags);
+-	local_irq_disable();
+ 
+ 	nsec = ktime_get_ns();
+ 	for (i = 0; i < 100; i++) {
+@@ -783,7 +780,6 @@ static int __init crc32_test(void)
+ 	nsec = ktime_get_ns() - nsec;
+ 
+ 	local_irq_restore(flags);
+-	local_irq_enable();
+ 
+ 	pr_info("crc32: CRC_LE_BITS = %d, CRC_BE BITS = %d\n",
+ 		 CRC_LE_BITS, CRC_BE_BITS);
+diff --git a/lib/fonts/font_10x18.c b/lib/fonts/font_10x18.c
+index 0e2deac97da0d..e02f9df24d1ee 100644
+--- a/lib/fonts/font_10x18.c
++++ b/lib/fonts/font_10x18.c
+@@ -8,7 +8,7 @@
+ 
+ #define FONTDATAMAX 9216
+ 
+-static struct font_data fontdata_10x18 = {
++static const struct font_data fontdata_10x18 = {
+ 	{ 0, 0, FONTDATAMAX, 0 }, {
+ 	/* 0 0x00 '^@' */
+ 	0x00, 0x00, /* 0000000000 */
+diff --git a/lib/fonts/font_6x10.c b/lib/fonts/font_6x10.c
+index 87da8acd07db0..6e3c4b7691c85 100644
+--- a/lib/fonts/font_6x10.c
++++ b/lib/fonts/font_6x10.c
+@@ -3,7 +3,7 @@
+ 
+ #define FONTDATAMAX 2560
+ 
+-static struct font_data fontdata_6x10 = {
++static const struct font_data fontdata_6x10 = {
+ 	{ 0, 0, FONTDATAMAX, 0 }, {
+ 	/* 0 0x00 '^@' */
+ 	0x00, /* 00000000 */
+diff --git a/lib/fonts/font_6x11.c b/lib/fonts/font_6x11.c
+index 5e975dfa10a53..2d22a24e816f0 100644
+--- a/lib/fonts/font_6x11.c
++++ b/lib/fonts/font_6x11.c
+@@ -9,7 +9,7 @@
+ 
+ #define FONTDATAMAX (11*256)
+ 
+-static struct font_data fontdata_6x11 = {
++static const struct font_data fontdata_6x11 = {
+ 	{ 0, 0, FONTDATAMAX, 0 }, {
+ 	/* 0 0x00 '^@' */
+ 	0x00, /* 00000000 */
+diff --git a/lib/fonts/font_7x14.c b/lib/fonts/font_7x14.c
+index 86d298f385058..9cc7ae2e03f7d 100644
+--- a/lib/fonts/font_7x14.c
++++ b/lib/fonts/font_7x14.c
+@@ -8,7 +8,7 @@
+ 
+ #define FONTDATAMAX 3584
+ 
+-static struct font_data fontdata_7x14 = {
++static const struct font_data fontdata_7x14 = {
+ 	{ 0, 0, FONTDATAMAX, 0 }, {
+ 	/* 0 0x00 '^@' */
+ 	0x00, /* 0000000 */
+diff --git a/lib/fonts/font_8x16.c b/lib/fonts/font_8x16.c
+index 37cedd36ca5ef..bab25dc59e8dd 100644
+--- a/lib/fonts/font_8x16.c
++++ b/lib/fonts/font_8x16.c
+@@ -10,7 +10,7 @@
+ 
+ #define FONTDATAMAX 4096
+ 
+-static struct font_data fontdata_8x16 = {
++static const struct font_data fontdata_8x16 = {
+ 	{ 0, 0, FONTDATAMAX, 0 }, {
+ 	/* 0 0x00 '^@' */
+ 	0x00, /* 00000000 */
+diff --git a/lib/fonts/font_8x8.c b/lib/fonts/font_8x8.c
+index 8ab695538395d..109d0572368f4 100644
+--- a/lib/fonts/font_8x8.c
++++ b/lib/fonts/font_8x8.c
+@@ -9,7 +9,7 @@
+ 
+ #define FONTDATAMAX 2048
+ 
+-static struct font_data fontdata_8x8 = {
++static const struct font_data fontdata_8x8 = {
+ 	{ 0, 0, FONTDATAMAX, 0 }, {
+ 	/* 0 0x00 '^@' */
+ 	0x00, /* 00000000 */
+diff --git a/lib/fonts/font_acorn_8x8.c b/lib/fonts/font_acorn_8x8.c
+index 069b3e80c4344..fb395f0d40317 100644
+--- a/lib/fonts/font_acorn_8x8.c
++++ b/lib/fonts/font_acorn_8x8.c
+@@ -5,7 +5,7 @@
+ 
+ #define FONTDATAMAX 2048
+ 
+-static struct font_data acorndata_8x8 = {
++static const struct font_data acorndata_8x8 = {
+ { 0, 0, FONTDATAMAX, 0 }, {
+ /* 00 */  0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, /* ^@ */
+ /* 01 */  0x7e, 0x81, 0xa5, 0x81, 0xbd, 0x99, 0x81, 0x7e, /* ^A */
+diff --git a/lib/fonts/font_mini_4x6.c b/lib/fonts/font_mini_4x6.c
+index 1449876c6a270..592774a90917b 100644
+--- a/lib/fonts/font_mini_4x6.c
++++ b/lib/fonts/font_mini_4x6.c
+@@ -43,7 +43,7 @@ __END__;
+ 
+ #define FONTDATAMAX 1536
+ 
+-static struct font_data fontdata_mini_4x6 = {
++static const struct font_data fontdata_mini_4x6 = {
+ 	{ 0, 0, FONTDATAMAX, 0 }, {
+ 	/*{*/
+ 	  	/*   Char 0: ' '  */
+diff --git a/lib/fonts/font_pearl_8x8.c b/lib/fonts/font_pearl_8x8.c
+index 32d65551e7ed2..a6f95ebce9507 100644
+--- a/lib/fonts/font_pearl_8x8.c
++++ b/lib/fonts/font_pearl_8x8.c
+@@ -14,7 +14,7 @@
+ 
+ #define FONTDATAMAX 2048
+ 
+-static struct font_data fontdata_pearl8x8 = {
++static const struct font_data fontdata_pearl8x8 = {
+    { 0, 0, FONTDATAMAX, 0 }, {
+    /* 0 0x00 '^@' */
+    0x00, /* 00000000 */
+diff --git a/lib/fonts/font_sun12x22.c b/lib/fonts/font_sun12x22.c
+index 641a6b4dca424..a5b65bd496045 100644
+--- a/lib/fonts/font_sun12x22.c
++++ b/lib/fonts/font_sun12x22.c
+@@ -3,7 +3,7 @@
+ 
+ #define FONTDATAMAX 11264
+ 
+-static struct font_data fontdata_sun12x22 = {
++static const struct font_data fontdata_sun12x22 = {
+ 	{ 0, 0, FONTDATAMAX, 0 }, {
+ 	/* 0 0x00 '^@' */
+ 	0x00, 0x00, /* 000000000000 */
+diff --git a/lib/fonts/font_sun8x16.c b/lib/fonts/font_sun8x16.c
+index 193fe6d988e08..e577e76a6a7c0 100644
+--- a/lib/fonts/font_sun8x16.c
++++ b/lib/fonts/font_sun8x16.c
+@@ -3,7 +3,7 @@
+ 
+ #define FONTDATAMAX 4096
+ 
+-static struct font_data fontdata_sun8x16 = {
++static const struct font_data fontdata_sun8x16 = {
+ { 0, 0, FONTDATAMAX, 0 }, {
+ /* */ 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
+ /* */ 0x00,0x00,0x7e,0x81,0xa5,0x81,0x81,0xbd,0x99,0x81,0x81,0x7e,0x00,0x00,0x00,0x00,
+diff --git a/mm/mempolicy.c b/mm/mempolicy.c
+index 68c46da82aac0..3cd27c1c729f6 100644
+--- a/mm/mempolicy.c
++++ b/mm/mempolicy.c
+@@ -496,7 +496,7 @@ static int queue_pages_pte_range(pmd_t *pmd, unsigned long addr,
+ 	unsigned long flags = qp->flags;
+ 	int ret;
+ 	bool has_unmovable = false;
+-	pte_t *pte;
++	pte_t *pte, *mapped_pte;
+ 	spinlock_t *ptl;
+ 
+ 	ptl = pmd_trans_huge_lock(pmd, vma);
+@@ -510,7 +510,7 @@ static int queue_pages_pte_range(pmd_t *pmd, unsigned long addr,
+ 	if (pmd_trans_unstable(pmd))
+ 		return 0;
+ 
+-	pte = pte_offset_map_lock(walk->mm, pmd, addr, &ptl);
++	mapped_pte = pte = pte_offset_map_lock(walk->mm, pmd, addr, &ptl);
+ 	for (; addr != end; pte++, addr += PAGE_SIZE) {
+ 		if (!pte_present(*pte))
+ 			continue;
+@@ -542,7 +542,7 @@ static int queue_pages_pte_range(pmd_t *pmd, unsigned long addr,
+ 		} else
+ 			break;
+ 	}
+-	pte_unmap_unlock(pte - 1, ptl);
++	pte_unmap_unlock(mapped_pte, ptl);
+ 	cond_resched();
+ 
+ 	if (has_unmovable)
+diff --git a/net/dsa/dsa2.c b/net/dsa/dsa2.c
+index b036c55f5cb1d..7c10bc4dacd31 100644
+--- a/net/dsa/dsa2.c
++++ b/net/dsa/dsa2.c
+@@ -261,6 +261,7 @@ static int dsa_port_setup(struct dsa_port *dp)
+ 	int err = 0;
+ 
+ 	memset(&dp->devlink_port, 0, sizeof(dp->devlink_port));
++	dp->mac = of_get_mac_address(dp->dn);
+ 
+ 	if (dp->type != DSA_PORT_TYPE_UNUSED)
+ 		err = devlink_port_register(ds->devlink, &dp->devlink_port,
+diff --git a/net/dsa/slave.c b/net/dsa/slave.c
+index 8ee28b6016d82..d03c67e761dfa 100644
+--- a/net/dsa/slave.c
++++ b/net/dsa/slave.c
+@@ -1313,7 +1313,10 @@ int dsa_slave_create(struct dsa_port *port)
+ 	slave_dev->features = master->vlan_features | NETIF_F_HW_TC;
+ 	slave_dev->hw_features |= NETIF_F_HW_TC;
+ 	slave_dev->ethtool_ops = &dsa_slave_ethtool_ops;
+-	eth_hw_addr_inherit(slave_dev, master);
++	if (port->mac && is_valid_ether_addr(port->mac))
++		ether_addr_copy(slave_dev->dev_addr, port->mac);
++	else
++		eth_hw_addr_inherit(slave_dev, master);
+ 	slave_dev->priv_flags |= IFF_NO_QUEUE;
+ 	slave_dev->netdev_ops = &dsa_slave_netdev_ops;
+ 	slave_dev->switchdev_ops = &dsa_slave_switchdev_ops;
+diff --git a/net/sctp/sm_sideeffect.c b/net/sctp/sm_sideeffect.c
+index 567517e448115..bb4f1d0da1533 100644
+--- a/net/sctp/sm_sideeffect.c
++++ b/net/sctp/sm_sideeffect.c
+@@ -1615,12 +1615,12 @@ static int sctp_cmd_interpreter(enum sctp_event event_type,
+ 			break;
+ 
+ 		case SCTP_CMD_INIT_FAILED:
+-			sctp_cmd_init_failed(commands, asoc, cmd->obj.u32);
++			sctp_cmd_init_failed(commands, asoc, cmd->obj.u16);
+ 			break;
+ 
+ 		case SCTP_CMD_ASSOC_FAILED:
+ 			sctp_cmd_assoc_failed(commands, asoc, event_type,
+-					      subtype, chunk, cmd->obj.u32);
++					      subtype, chunk, cmd->obj.u16);
+ 			break;
+ 
+ 		case SCTP_CMD_INIT_COUNTER_INC:
+diff --git a/net/tipc/core.c b/net/tipc/core.c
+index 49bb9fc0aa068..ce0f067d0faf7 100644
+--- a/net/tipc/core.c
++++ b/net/tipc/core.c
+@@ -93,6 +93,11 @@ out_sk_rht:
+ static void __net_exit tipc_exit_net(struct net *net)
+ {
+ 	tipc_net_stop(net);
++
++	/* Make sure the tipc_net_finalize_work stopped
++	 * before releasing the resources.
++	 */
++	flush_scheduled_work();
+ 	tipc_bcast_stop(net);
+ 	tipc_nametbl_stop(net);
+ 	tipc_sk_rht_destroy(net);
+diff --git a/net/vmw_vsock/af_vsock.c b/net/vmw_vsock/af_vsock.c
+index c88dc8ee3144b..02374459c4179 100644
+--- a/net/vmw_vsock/af_vsock.c
++++ b/net/vmw_vsock/af_vsock.c
+@@ -629,7 +629,7 @@ struct sock *__vsock_create(struct net *net,
+ 		vsk->owner = get_cred(psk->owner);
+ 		vsk->connect_timeout = psk->connect_timeout;
+ 	} else {
+-		vsk->trusted = capable(CAP_NET_ADMIN);
++		vsk->trusted = ns_capable_noaudit(&init_user_ns, CAP_NET_ADMIN);
+ 		vsk->owner = get_current_cred();
+ 		vsk->connect_timeout = VSOCK_DEFAULT_CONNECT_TIMEOUT;
+ 	}
+diff --git a/sound/usb/pcm.c b/sound/usb/pcm.c
+index 7743e7bc6bf22..e4d2fcc89c306 100644
+--- a/sound/usb/pcm.c
++++ b/sound/usb/pcm.c
+@@ -334,6 +334,7 @@ static int set_sync_ep_implicit_fb_quirk(struct snd_usb_substream *subs,
+ 	switch (subs->stream->chip->usb_id) {
+ 	case USB_ID(0x0763, 0x2030): /* M-Audio Fast Track C400 */
+ 	case USB_ID(0x0763, 0x2031): /* M-Audio Fast Track C600 */
++	case USB_ID(0x22f0, 0x0006): /* Allen&Heath Qu-16 */
+ 		ep = 0x81;
+ 		ifnum = 3;
+ 		goto add_sync_ep_from_ifnum;
+@@ -343,6 +344,7 @@ static int set_sync_ep_implicit_fb_quirk(struct snd_usb_substream *subs,
+ 		ifnum = 2;
+ 		goto add_sync_ep_from_ifnum;
+ 	case USB_ID(0x2466, 0x8003): /* Fractal Audio Axe-Fx II */
++	case USB_ID(0x0499, 0x172a): /* Yamaha MODX */
+ 		ep = 0x86;
+ 		ifnum = 2;
+ 		goto add_sync_ep_from_ifnum;
+@@ -350,6 +352,10 @@ static int set_sync_ep_implicit_fb_quirk(struct snd_usb_substream *subs,
+ 		ep = 0x81;
+ 		ifnum = 2;
+ 		goto add_sync_ep_from_ifnum;
++	case USB_ID(0x1686, 0xf029): /* Zoom UAC-2 */
++		ep = 0x82;
++		ifnum = 2;
++		goto add_sync_ep_from_ifnum;
+ 	case USB_ID(0x1397, 0x0001): /* Behringer UFX1604 */
+ 	case USB_ID(0x1397, 0x0002): /* Behringer UFX1204 */
+ 		ep = 0x81;
+diff --git a/sound/usb/quirks.c b/sound/usb/quirks.c
+index e6dea1c7112be..3effe2e86197d 100644
+--- a/sound/usb/quirks.c
++++ b/sound/usb/quirks.c
+@@ -1466,6 +1466,7 @@ u64 snd_usb_interface_dsd_format_quirks(struct snd_usb_audio *chip,
+ 	case 0x278b:  /* Rotel? */
+ 	case 0x292b:  /* Gustard/Ess based devices */
+ 	case 0x2ab6:  /* T+A devices */
++	case 0x3353:  /* Khadas devices */
+ 	case 0x3842:  /* EVGA */
+ 	case 0xc502:  /* HiBy devices */
+ 		if (fp->dsd_raw)
+diff --git a/tools/perf/util/util.h b/tools/perf/util/util.h
+index dc58254a2b696..8c01b2cfdb1ad 100644
+--- a/tools/perf/util/util.h
++++ b/tools/perf/util/util.h
+@@ -22,7 +22,7 @@ static inline void *zalloc(size_t size)
+ 	return calloc(1, size);
+ }
+ 
+-#define zfree(ptr) ({ free(*ptr); *ptr = NULL; })
++#define zfree(ptr) ({ free((void *)*ptr); *ptr = NULL; })
+ 
+ struct dirent;
+ struct nsinfo;