From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from lists.gentoo.org (pigeon.gentoo.org [208.92.234.80]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits)) (No client certificate requested) by finch.gentoo.org (Postfix) with ESMTPS id B50E515808B for ; Fri, 15 Apr 2022 13:11:28 +0000 (UTC) Received: from pigeon.gentoo.org (localhost [127.0.0.1]) by pigeon.gentoo.org (Postfix) with SMTP id E2236E095A; Fri, 15 Apr 2022 13:11:27 +0000 (UTC) Received: from smtp.gentoo.org (mail.gentoo.org [IPv6:2001:470:ea4a:1:5054:ff:fec7:86e4]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits)) (No client certificate requested) by pigeon.gentoo.org (Postfix) with ESMTPS id 3F89FE0801 for ; Fri, 15 Apr 2022 13:11:23 +0000 (UTC) Received: from oystercatcher.gentoo.org (unknown [IPv6:2a01:4f8:202:4333:225:90ff:fed9:fc84]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (No client certificate requested) by smtp.gentoo.org (Postfix) with ESMTPS id 3B275341F80 for ; Fri, 15 Apr 2022 13:11:20 +0000 (UTC) Received: from localhost.localdomain (localhost [IPv6:::1]) by oystercatcher.gentoo.org (Postfix) with ESMTP id A0FCE250 for ; Fri, 15 Apr 2022 13:11:18 +0000 (UTC) From: "Mike Pagano" To: gentoo-commits@lists.gentoo.org Content-Transfer-Encoding: 8bit Content-type: text/plain; charset=UTF-8 Reply-To: gentoo-dev@lists.gentoo.org, "Mike Pagano" Message-ID: <1650028255.b13704d1a39b86e3ed659e39c4aed824a2210c92.mpagano@gentoo> Subject: [gentoo-commits] proj/linux-patches:4.19 commit in: / X-VCS-Repository: proj/linux-patches X-VCS-Files: 0000_README 1237_linux-4.19.238.patch X-VCS-Directories: / X-VCS-Committer: mpagano X-VCS-Committer-Name: Mike Pagano X-VCS-Revision: b13704d1a39b86e3ed659e39c4aed824a2210c92 X-VCS-Branch: 4.19 Date: Fri, 15 Apr 2022 13:11:18 +0000 (UTC) Precedence: bulk List-Post: List-Help: List-Unsubscribe: List-Subscribe: List-Id: Gentoo Linux mail X-BeenThere: gentoo-commits@lists.gentoo.org X-Auto-Response-Suppress: DR, RN, NRN, OOF, AutoReply X-Archives-Salt: 6b11be01-4bb3-46ef-b4a0-86623d834cf2 X-Archives-Hash: 161f1061472e9a1d6b1412bc4a410da5 commit: b13704d1a39b86e3ed659e39c4aed824a2210c92 Author: Mike Pagano gentoo org> AuthorDate: Fri Apr 15 13:10:55 2022 +0000 Commit: Mike Pagano gentoo org> CommitDate: Fri Apr 15 13:10:55 2022 +0000 URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=b13704d1 Linux patch 4.19.238 Signed-off-by: Mike Pagano gentoo.org> 0000_README | 4 + 1237_linux-4.19.238.patch | 10371 ++++++++++++++++++++++++++++++++++++++++++++ 2 files changed, 10375 insertions(+) diff --git a/0000_README b/0000_README index eccf1864..49064f71 100644 --- a/0000_README +++ b/0000_README @@ -987,6 +987,10 @@ Patch: 1236_linux-4.19.237.patch From: https://www.kernel.org Desc: Linux 4.19.237 +Patch: 1237_linux-4.19.238.patch +From: https://www.kernel.org +Desc: Linux 4.19.238 + Patch: 1500_XATTR_USER_PREFIX.patch From: https://bugs.gentoo.org/show_bug.cgi?id=470644 Desc: Support for namespace user.pax.* on tmpfs. diff --git a/1237_linux-4.19.238.patch b/1237_linux-4.19.238.patch new file mode 100644 index 00000000..3fbdab3e --- /dev/null +++ b/1237_linux-4.19.238.patch @@ -0,0 +1,10371 @@ +diff --git a/Documentation/process/stable-kernel-rules.rst b/Documentation/process/stable-kernel-rules.rst +index 7ba8cd567f843..e5561d78bb63a 100644 +--- a/Documentation/process/stable-kernel-rules.rst ++++ b/Documentation/process/stable-kernel-rules.rst +@@ -174,7 +174,16 @@ Trees + - The finalized and tagged releases of all stable kernels can be found + in separate branches per version at: + +- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git ++ https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git ++ ++ - The release candidate of all stable kernel versions can be found at: ++ ++ https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git/ ++ ++ .. warning:: ++ The -stable-rc tree is a snapshot in time of the stable-queue tree and ++ will change frequently, hence will be rebased often. It should only be ++ used for testing purposes (e.g. to be consumed by CI systems). + + + Review committee +diff --git a/Makefile b/Makefile +index 834336f971c15..c2a8f7c5d993b 100644 +--- a/Makefile ++++ b/Makefile +@@ -1,7 +1,7 @@ + # SPDX-License-Identifier: GPL-2.0 + VERSION = 4 + PATCHLEVEL = 19 +-SUBLEVEL = 237 ++SUBLEVEL = 238 + EXTRAVERSION = + NAME = "People's Front" + +diff --git a/arch/arm/boot/dts/bcm2837.dtsi b/arch/arm/boot/dts/bcm2837.dtsi +index beb6c502dadc7..bcad098a7fccb 100644 +--- a/arch/arm/boot/dts/bcm2837.dtsi ++++ b/arch/arm/boot/dts/bcm2837.dtsi +@@ -38,12 +38,26 @@ + #size-cells = <0>; + enable-method = "brcm,bcm2836-smp"; // for ARM 32-bit + ++ /* Source for d/i-cache-line-size and d/i-cache-sets ++ * https://developer.arm.com/documentation/ddi0500/e/level-1-memory-system ++ * /about-the-l1-memory-system?lang=en ++ * ++ * Source for d/i-cache-size ++ * https://magpi.raspberrypi.com/articles/raspberry-pi-3-specs-benchmarks ++ */ + cpu0: cpu@0 { + device_type = "cpu"; + compatible = "arm,cortex-a53"; + reg = <0>; + enable-method = "spin-table"; + cpu-release-addr = <0x0 0x000000d8>; ++ d-cache-size = <0x8000>; ++ d-cache-line-size = <64>; ++ d-cache-sets = <128>; // 32KiB(size)/64(line-size)=512ways/4-way set ++ i-cache-size = <0x8000>; ++ i-cache-line-size = <64>; ++ i-cache-sets = <256>; // 32KiB(size)/64(line-size)=512ways/2-way set ++ next-level-cache = <&l2>; + }; + + cpu1: cpu@1 { +@@ -52,6 +66,13 @@ + reg = <1>; + enable-method = "spin-table"; + cpu-release-addr = <0x0 0x000000e0>; ++ d-cache-size = <0x8000>; ++ d-cache-line-size = <64>; ++ d-cache-sets = <128>; // 32KiB(size)/64(line-size)=512ways/4-way set ++ i-cache-size = <0x8000>; ++ i-cache-line-size = <64>; ++ i-cache-sets = <256>; // 32KiB(size)/64(line-size)=512ways/2-way set ++ next-level-cache = <&l2>; + }; + + cpu2: cpu@2 { +@@ -60,6 +81,13 @@ + reg = <2>; + enable-method = "spin-table"; + cpu-release-addr = <0x0 0x000000e8>; ++ d-cache-size = <0x8000>; ++ d-cache-line-size = <64>; ++ d-cache-sets = <128>; // 32KiB(size)/64(line-size)=512ways/4-way set ++ i-cache-size = <0x8000>; ++ i-cache-line-size = <64>; ++ i-cache-sets = <256>; // 32KiB(size)/64(line-size)=512ways/2-way set ++ next-level-cache = <&l2>; + }; + + cpu3: cpu@3 { +@@ -68,6 +96,27 @@ + reg = <3>; + enable-method = "spin-table"; + cpu-release-addr = <0x0 0x000000f0>; ++ d-cache-size = <0x8000>; ++ d-cache-line-size = <64>; ++ d-cache-sets = <128>; // 32KiB(size)/64(line-size)=512ways/4-way set ++ i-cache-size = <0x8000>; ++ i-cache-line-size = <64>; ++ i-cache-sets = <256>; // 32KiB(size)/64(line-size)=512ways/2-way set ++ next-level-cache = <&l2>; ++ }; ++ ++ /* Source for cache-line-size + cache-sets ++ * https://developer.arm.com/documentation/ddi0500 ++ * /e/level-2-memory-system/about-the-l2-memory-system?lang=en ++ * Source for cache-size ++ * https://datasheets.raspberrypi.com/cm/cm1-and-cm3-datasheet.pdf ++ */ ++ l2: l2-cache0 { ++ compatible = "cache"; ++ cache-size = <0x80000>; ++ cache-line-size = <64>; ++ cache-sets = <512>; // 512KiB(size)/64(line-size)=8192ways/16-way set ++ cache-level = <2>; + }; + }; + }; +diff --git a/arch/arm/boot/dts/exynos5250-pinctrl.dtsi b/arch/arm/boot/dts/exynos5250-pinctrl.dtsi +index d31a68672bfac..d7d756614edd1 100644 +--- a/arch/arm/boot/dts/exynos5250-pinctrl.dtsi ++++ b/arch/arm/boot/dts/exynos5250-pinctrl.dtsi +@@ -260,7 +260,7 @@ + }; + + uart3_data: uart3-data { +- samsung,pins = "gpa1-4", "gpa1-4"; ++ samsung,pins = "gpa1-4", "gpa1-5"; + samsung,pin-function = ; + samsung,pin-pud = ; + samsung,pin-drv = ; +diff --git a/arch/arm/boot/dts/exynos5250-smdk5250.dts b/arch/arm/boot/dts/exynos5250-smdk5250.dts +index 594b246afbedc..80479ed69070c 100644 +--- a/arch/arm/boot/dts/exynos5250-smdk5250.dts ++++ b/arch/arm/boot/dts/exynos5250-smdk5250.dts +@@ -116,6 +116,9 @@ + status = "okay"; + ddc = <&i2c_2>; + hpd-gpios = <&gpx3 7 GPIO_ACTIVE_HIGH>; ++ vdd-supply = <&ldo8_reg>; ++ vdd_osc-supply = <&ldo10_reg>; ++ vdd_pll-supply = <&ldo8_reg>; + }; + + &i2c_0 { +diff --git a/arch/arm/boot/dts/exynos5420-smdk5420.dts b/arch/arm/boot/dts/exynos5420-smdk5420.dts +index 831c7336f2376..660a9ad05c9b6 100644 +--- a/arch/arm/boot/dts/exynos5420-smdk5420.dts ++++ b/arch/arm/boot/dts/exynos5420-smdk5420.dts +@@ -131,6 +131,9 @@ + hpd-gpios = <&gpx3 7 GPIO_ACTIVE_HIGH>; + pinctrl-names = "default"; + pinctrl-0 = <&hdmi_hpd_irq>; ++ vdd-supply = <&ldo6_reg>; ++ vdd_osc-supply = <&ldo7_reg>; ++ vdd_pll-supply = <&ldo6_reg>; + }; + + &hsi2c_4 { +diff --git a/arch/arm/boot/dts/qcom-ipq4019.dtsi b/arch/arm/boot/dts/qcom-ipq4019.dtsi +index 8328ad589e2ba..59527bb1225a9 100644 +--- a/arch/arm/boot/dts/qcom-ipq4019.dtsi ++++ b/arch/arm/boot/dts/qcom-ipq4019.dtsi +@@ -135,7 +135,8 @@ + clocks { + sleep_clk: sleep_clk { + compatible = "fixed-clock"; +- clock-frequency = <32768>; ++ clock-frequency = <32000>; ++ clock-output-names = "gcc_sleep_clk_src"; + #clock-cells = <0>; + }; + +diff --git a/arch/arm/boot/dts/qcom-msm8960.dtsi b/arch/arm/boot/dts/qcom-msm8960.dtsi +index 1733d8f40ab15..b256fda0f5ea4 100644 +--- a/arch/arm/boot/dts/qcom-msm8960.dtsi ++++ b/arch/arm/boot/dts/qcom-msm8960.dtsi +@@ -140,7 +140,9 @@ + reg = <0x108000 0x1000>; + qcom,ipc = <&l2cc 0x8 2>; + +- interrupts = <0 19 0>, <0 21 0>, <0 22 0>; ++ interrupts = , ++ , ++ ; + interrupt-names = "ack", "err", "wakeup"; + + regulators { +@@ -186,7 +188,7 @@ + compatible = "qcom,msm-uartdm-v1.3", "qcom,msm-uartdm"; + reg = <0x16440000 0x1000>, + <0x16400000 0x1000>; +- interrupts = <0 154 0x0>; ++ interrupts = ; + clocks = <&gcc GSBI5_UART_CLK>, <&gcc GSBI5_H_CLK>; + clock-names = "core", "iface"; + status = "disabled"; +@@ -312,7 +314,7 @@ + #address-cells = <1>; + #size-cells = <0>; + reg = <0x16080000 0x1000>; +- interrupts = <0 147 0>; ++ interrupts = ; + spi-max-frequency = <24000000>; + cs-gpios = <&msmgpio 8 0>; + +diff --git a/arch/arm/boot/dts/sama5d2.dtsi b/arch/arm/boot/dts/sama5d2.dtsi +index d856c16d00156..79696d4f4f65d 100644 +--- a/arch/arm/boot/dts/sama5d2.dtsi ++++ b/arch/arm/boot/dts/sama5d2.dtsi +@@ -1125,7 +1125,7 @@ + pmecc: ecc-engine@f8014070 { + compatible = "atmel,sama5d2-pmecc"; + reg = <0xf8014070 0x490>, +- <0xf8014500 0x100>; ++ <0xf8014500 0x200>; + }; + }; + +diff --git a/arch/arm/boot/dts/spear1340.dtsi b/arch/arm/boot/dts/spear1340.dtsi +index d4dbc4098653e..cf1139973bdad 100644 +--- a/arch/arm/boot/dts/spear1340.dtsi ++++ b/arch/arm/boot/dts/spear1340.dtsi +@@ -142,9 +142,9 @@ + reg = <0xb4100000 0x1000>; + interrupts = <0 105 0x4>; + status = "disabled"; +- dmas = <&dwdma0 12 0 1>, +- <&dwdma0 13 1 0>; +- dma-names = "tx", "rx"; ++ dmas = <&dwdma0 13 0 1>, ++ <&dwdma0 12 1 0>; ++ dma-names = "rx", "tx"; + }; + + thermal@e07008c4 { +diff --git a/arch/arm/boot/dts/spear13xx.dtsi b/arch/arm/boot/dts/spear13xx.dtsi +index 086b4b3332494..06eb7245d93e8 100644 +--- a/arch/arm/boot/dts/spear13xx.dtsi ++++ b/arch/arm/boot/dts/spear13xx.dtsi +@@ -290,9 +290,9 @@ + #size-cells = <0>; + interrupts = <0 31 0x4>; + status = "disabled"; +- dmas = <&dwdma0 4 0 0>, +- <&dwdma0 5 0 0>; +- dma-names = "tx", "rx"; ++ dmas = <&dwdma0 5 0 0>, ++ <&dwdma0 4 0 0>; ++ dma-names = "rx", "tx"; + }; + + rtc@e0580000 { +diff --git a/arch/arm/boot/dts/tegra20-tamonten.dtsi b/arch/arm/boot/dts/tegra20-tamonten.dtsi +index 394a6b4dc69d5..69cb65d86c467 100644 +--- a/arch/arm/boot/dts/tegra20-tamonten.dtsi ++++ b/arch/arm/boot/dts/tegra20-tamonten.dtsi +@@ -183,8 +183,8 @@ + }; + conf_ata { + nvidia,pins = "ata", "atb", "atc", "atd", "ate", +- "cdev1", "cdev2", "dap1", "dtb", "gma", +- "gmb", "gmc", "gmd", "gme", "gpu7", ++ "cdev1", "cdev2", "dap1", "dtb", "dtf", ++ "gma", "gmb", "gmc", "gmd", "gme", "gpu7", + "gpv", "i2cp", "irrx", "irtx", "pta", + "rm", "slxa", "slxk", "spia", "spib", + "uac"; +@@ -203,7 +203,7 @@ + }; + conf_crtp { + nvidia,pins = "crtp", "dap2", "dap3", "dap4", +- "dtc", "dte", "dtf", "gpu", "sdio1", ++ "dtc", "dte", "gpu", "sdio1", + "slxc", "slxd", "spdi", "spdo", "spig", + "uda"; + nvidia,pull = ; +diff --git a/arch/arm/mach-mmp/sram.c b/arch/arm/mach-mmp/sram.c +index ba91e4fe444d9..3c4e41dabb021 100644 +--- a/arch/arm/mach-mmp/sram.c ++++ b/arch/arm/mach-mmp/sram.c +@@ -76,6 +76,8 @@ static int sram_probe(struct platform_device *pdev) + if (!info) + return -ENOMEM; + ++ platform_set_drvdata(pdev, info); ++ + res = platform_get_resource(pdev, IORESOURCE_MEM, 0); + if (res == NULL) { + dev_err(&pdev->dev, "no memory resource defined\n"); +@@ -111,8 +113,6 @@ static int sram_probe(struct platform_device *pdev) + list_add(&info->node, &sram_bank_list); + mutex_unlock(&sram_lock); + +- platform_set_drvdata(pdev, info); +- + dev_info(&pdev->dev, "initialized\n"); + return 0; + +@@ -131,17 +131,19 @@ static int sram_remove(struct platform_device *pdev) + struct sram_bank_info *info; + + info = platform_get_drvdata(pdev); +- if (info == NULL) +- return -ENODEV; + +- mutex_lock(&sram_lock); +- list_del(&info->node); +- mutex_unlock(&sram_lock); ++ if (info->sram_size) { ++ mutex_lock(&sram_lock); ++ list_del(&info->node); ++ mutex_unlock(&sram_lock); ++ ++ gen_pool_destroy(info->gpool); ++ iounmap(info->sram_virt); ++ kfree(info->pool_name); ++ } + +- gen_pool_destroy(info->gpool); +- iounmap(info->sram_virt); +- kfree(info->pool_name); + kfree(info); ++ + return 0; + } + +diff --git a/arch/arm/mach-s3c24xx/mach-jive.c b/arch/arm/mach-s3c24xx/mach-jive.c +index 885e8f12e4b91..eedc9f8ed2109 100644 +--- a/arch/arm/mach-s3c24xx/mach-jive.c ++++ b/arch/arm/mach-s3c24xx/mach-jive.c +@@ -237,11 +237,11 @@ static int __init jive_mtdset(char *options) + unsigned long set; + + if (options == NULL || options[0] == '\0') +- return 0; ++ return 1; + + if (kstrtoul(options, 10, &set)) { + printk(KERN_ERR "failed to parse mtdset=%s\n", options); +- return 0; ++ return 1; + } + + switch (set) { +@@ -256,7 +256,7 @@ static int __init jive_mtdset(char *options) + "using default.", set); + } + +- return 0; ++ return 1; + } + + /* parse the mtdset= option given to the kernel command line */ +diff --git a/arch/arm64/boot/dts/broadcom/northstar2/ns2-svk.dts b/arch/arm64/boot/dts/broadcom/northstar2/ns2-svk.dts +index ec19fbf928a14..12a4b1c03390c 100644 +--- a/arch/arm64/boot/dts/broadcom/northstar2/ns2-svk.dts ++++ b/arch/arm64/boot/dts/broadcom/northstar2/ns2-svk.dts +@@ -111,8 +111,8 @@ + compatible = "silabs,si3226x"; + reg = <0>; + spi-max-frequency = <5000000>; +- spi-cpha = <1>; +- spi-cpol = <1>; ++ spi-cpha; ++ spi-cpol; + pl022,hierarchy = <0>; + pl022,interface = <0>; + pl022,slave-tx-disable = <0>; +@@ -135,8 +135,8 @@ + at25,byte-len = <0x8000>; + at25,addr-mode = <2>; + at25,page-size = <64>; +- spi-cpha = <1>; +- spi-cpol = <1>; ++ spi-cpha; ++ spi-cpol; + pl022,hierarchy = <0>; + pl022,interface = <0>; + pl022,slave-tx-disable = <0>; +diff --git a/arch/arm64/boot/dts/broadcom/northstar2/ns2.dtsi b/arch/arm64/boot/dts/broadcom/northstar2/ns2.dtsi +index 6bfb7bbd264af..772ecf4ed3e62 100644 +--- a/arch/arm64/boot/dts/broadcom/northstar2/ns2.dtsi ++++ b/arch/arm64/boot/dts/broadcom/northstar2/ns2.dtsi +@@ -687,7 +687,7 @@ + }; + }; + +- sata: ahci@663f2000 { ++ sata: sata@663f2000 { + compatible = "brcm,iproc-ahci", "generic-ahci"; + reg = <0x663f2000 0x1000>; + dma-coherent; +diff --git a/arch/arm64/include/asm/kvm_mmu.h b/arch/arm64/include/asm/kvm_mmu.h +index 44d3fdbcdf629..0243b6d224533 100644 +--- a/arch/arm64/include/asm/kvm_mmu.h ++++ b/arch/arm64/include/asm/kvm_mmu.h +@@ -439,7 +439,8 @@ static inline void *kvm_get_hyp_vector(void) + int slot = -1; + + if ((cpus_have_const_cap(ARM64_HARDEN_BRANCH_PREDICTOR) || +- cpus_have_const_cap(ARM64_SPECTRE_BHB)) && data->template_start) { ++ cpus_have_const_cap(ARM64_SPECTRE_BHB)) && ++ data && data->template_start) { + vect = kern_hyp_va(kvm_ksym_ref(__bp_harden_hyp_vecs_start)); + slot = data->hyp_vectors_slot; + } +diff --git a/arch/arm64/kernel/insn.c b/arch/arm64/kernel/insn.c +index cd37edbdedcb7..bc5112b471a51 100644 +--- a/arch/arm64/kernel/insn.c ++++ b/arch/arm64/kernel/insn.c +@@ -204,8 +204,8 @@ static int __kprobes aarch64_insn_patch_text_cb(void *arg) + int i, ret = 0; + struct aarch64_insn_patch *pp = arg; + +- /* The first CPU becomes master */ +- if (atomic_inc_return(&pp->cpu_count) == 1) { ++ /* The last CPU becomes master */ ++ if (atomic_inc_return(&pp->cpu_count) == num_online_cpus()) { + for (i = 0; ret == 0 && i < pp->insn_cnt; i++) + ret = aarch64_insn_patch_text_nosync(pp->text_addrs[i], + pp->new_insns[i]); +diff --git a/arch/arm64/kernel/module.lds b/arch/arm64/kernel/module.lds +index 09a0eef71d12b..9371abe2f4c2d 100644 +--- a/arch/arm64/kernel/module.lds ++++ b/arch/arm64/kernel/module.lds +@@ -1,5 +1,5 @@ + SECTIONS { +- .plt 0 (NOLOAD) : { BYTE(0) } +- .init.plt 0 (NOLOAD) : { BYTE(0) } +- .text.ftrace_trampoline 0 (NOLOAD) : { BYTE(0) } ++ .plt 0 : { BYTE(0) } ++ .init.plt 0 : { BYTE(0) } ++ .text.ftrace_trampoline 0 : { BYTE(0) } + } +diff --git a/arch/mips/dec/prom/Makefile b/arch/mips/dec/prom/Makefile +index ae73e42ac20b1..4c369359cdab5 100644 +--- a/arch/mips/dec/prom/Makefile ++++ b/arch/mips/dec/prom/Makefile +@@ -5,4 +5,4 @@ + + lib-y += init.o memory.o cmdline.o identify.o console.o + +-lib-$(CONFIG_32BIT) += locore.o ++lib-$(CONFIG_CPU_R3000) += locore.o +diff --git a/arch/mips/include/asm/dec/prom.h b/arch/mips/include/asm/dec/prom.h +index b59a2103b61a3..09538ff5e9245 100644 +--- a/arch/mips/include/asm/dec/prom.h ++++ b/arch/mips/include/asm/dec/prom.h +@@ -47,16 +47,11 @@ + */ + #define REX_PROM_MAGIC 0x30464354 + +-#ifdef CONFIG_64BIT +- +-#define prom_is_rex(magic) 1 /* KN04 and KN05 are REX PROMs. */ +- +-#else /* !CONFIG_64BIT */ +- +-#define prom_is_rex(magic) ((magic) == REX_PROM_MAGIC) +- +-#endif /* !CONFIG_64BIT */ +- ++/* KN04 and KN05 are REX PROMs, so only do the check for R3k systems. */ ++static inline bool prom_is_rex(u32 magic) ++{ ++ return !IS_ENABLED(CONFIG_CPU_R3000) || magic == REX_PROM_MAGIC; ++} + + /* + * 3MIN/MAXINE PROM entry points for DS5000/1xx's, DS5000/xx's and +diff --git a/arch/mips/include/asm/setup.h b/arch/mips/include/asm/setup.h +index bb36a400203df..8c56b862fd9c2 100644 +--- a/arch/mips/include/asm/setup.h ++++ b/arch/mips/include/asm/setup.h +@@ -16,7 +16,7 @@ static inline void setup_8250_early_printk_port(unsigned long base, + unsigned int reg_shift, unsigned int timeout) {} + #endif + +-extern void set_handler(unsigned long offset, void *addr, unsigned long len); ++void set_handler(unsigned long offset, const void *addr, unsigned long len); + extern void set_uncached_handler(unsigned long offset, void *addr, unsigned long len); + + typedef void (*vi_handler_t)(void); +diff --git a/arch/mips/kernel/traps.c b/arch/mips/kernel/traps.c +index b9da2cefb564c..0ca4185cc5e38 100644 +--- a/arch/mips/kernel/traps.c ++++ b/arch/mips/kernel/traps.c +@@ -1978,19 +1978,19 @@ static void *set_vi_srs_handler(int n, vi_handler_t addr, int srs) + * If no shadow set is selected then use the default handler + * that does normal register saving and standard interrupt exit + */ +- extern char except_vec_vi, except_vec_vi_lui; +- extern char except_vec_vi_ori, except_vec_vi_end; +- extern char rollback_except_vec_vi; +- char *vec_start = using_rollback_handler() ? +- &rollback_except_vec_vi : &except_vec_vi; ++ extern const u8 except_vec_vi[], except_vec_vi_lui[]; ++ extern const u8 except_vec_vi_ori[], except_vec_vi_end[]; ++ extern const u8 rollback_except_vec_vi[]; ++ const u8 *vec_start = using_rollback_handler() ? ++ rollback_except_vec_vi : except_vec_vi; + #if defined(CONFIG_CPU_MICROMIPS) || defined(CONFIG_CPU_BIG_ENDIAN) +- const int lui_offset = &except_vec_vi_lui - vec_start + 2; +- const int ori_offset = &except_vec_vi_ori - vec_start + 2; ++ const int lui_offset = except_vec_vi_lui - vec_start + 2; ++ const int ori_offset = except_vec_vi_ori - vec_start + 2; + #else +- const int lui_offset = &except_vec_vi_lui - vec_start; +- const int ori_offset = &except_vec_vi_ori - vec_start; ++ const int lui_offset = except_vec_vi_lui - vec_start; ++ const int ori_offset = except_vec_vi_ori - vec_start; + #endif +- const int handler_len = &except_vec_vi_end - vec_start; ++ const int handler_len = except_vec_vi_end - vec_start; + + if (handler_len > VECTORSPACING) { + /* +@@ -2210,7 +2210,7 @@ void per_cpu_trap_init(bool is_boot_cpu) + } + + /* Install CPU exception handler */ +-void set_handler(unsigned long offset, void *addr, unsigned long size) ++void set_handler(unsigned long offset, const void *addr, unsigned long size) + { + #ifdef CONFIG_CPU_MICROMIPS + memcpy((void *)(ebase + offset), ((unsigned char *)addr - 1), size); +diff --git a/arch/mips/rb532/devices.c b/arch/mips/rb532/devices.c +index 354d258396ff9..6624fe15839ad 100644 +--- a/arch/mips/rb532/devices.c ++++ b/arch/mips/rb532/devices.c +@@ -315,11 +315,9 @@ static int __init plat_setup_devices(void) + static int __init setup_kmac(char *s) + { + printk(KERN_INFO "korina mac = %s\n", s); +- if (!mac_pton(s, korina_dev0_data.mac)) { ++ if (!mac_pton(s, korina_dev0_data.mac)) + printk(KERN_ERR "Invalid mac\n"); +- return -EINVAL; +- } +- return 0; ++ return 1; + } + + __setup("kmac=", setup_kmac); +diff --git a/arch/powerpc/Makefile b/arch/powerpc/Makefile +index f51e21ea53492..26654d0c2af7e 100644 +--- a/arch/powerpc/Makefile ++++ b/arch/powerpc/Makefile +@@ -167,7 +167,7 @@ else + CFLAGS-$(CONFIG_GENERIC_CPU) += $(call cc-option,-mtune=power7,$(call cc-option,-mtune=power5)) + CFLAGS-$(CONFIG_GENERIC_CPU) += $(call cc-option,-mcpu=power5,-mcpu=power4) + endif +-else ++else ifdef CONFIG_PPC_BOOK3E_64 + CFLAGS-$(CONFIG_GENERIC_CPU) += -mcpu=powerpc64 + endif + +diff --git a/arch/powerpc/boot/dts/fsl/t104xrdb.dtsi b/arch/powerpc/boot/dts/fsl/t104xrdb.dtsi +index 099a598c74c00..bfe1ed5be3374 100644 +--- a/arch/powerpc/boot/dts/fsl/t104xrdb.dtsi ++++ b/arch/powerpc/boot/dts/fsl/t104xrdb.dtsi +@@ -139,12 +139,12 @@ + fman@400000 { + ethernet@e6000 { + phy-handle = <&phy_rgmii_0>; +- phy-connection-type = "rgmii"; ++ phy-connection-type = "rgmii-id"; + }; + + ethernet@e8000 { + phy-handle = <&phy_rgmii_1>; +- phy-connection-type = "rgmii"; ++ phy-connection-type = "rgmii-id"; + }; + + mdio0: mdio@fc000 { +diff --git a/arch/powerpc/include/asm/io.h b/arch/powerpc/include/asm/io.h +index b855f56489acc..4681d4c50567e 100644 +--- a/arch/powerpc/include/asm/io.h ++++ b/arch/powerpc/include/asm/io.h +@@ -372,25 +372,37 @@ static inline void __raw_writeq_be(unsigned long v, volatile void __iomem *addr) + */ + static inline void __raw_rm_writeb(u8 val, volatile void __iomem *paddr) + { +- __asm__ __volatile__("stbcix %0,0,%1" ++ __asm__ __volatile__(".machine push; \ ++ .machine power6; \ ++ stbcix %0,0,%1; \ ++ .machine pop;" + : : "r" (val), "r" (paddr) : "memory"); + } + + static inline void __raw_rm_writew(u16 val, volatile void __iomem *paddr) + { +- __asm__ __volatile__("sthcix %0,0,%1" ++ __asm__ __volatile__(".machine push; \ ++ .machine power6; \ ++ sthcix %0,0,%1; \ ++ .machine pop;" + : : "r" (val), "r" (paddr) : "memory"); + } + + static inline void __raw_rm_writel(u32 val, volatile void __iomem *paddr) + { +- __asm__ __volatile__("stwcix %0,0,%1" ++ __asm__ __volatile__(".machine push; \ ++ .machine power6; \ ++ stwcix %0,0,%1; \ ++ .machine pop;" + : : "r" (val), "r" (paddr) : "memory"); + } + + static inline void __raw_rm_writeq(u64 val, volatile void __iomem *paddr) + { +- __asm__ __volatile__("stdcix %0,0,%1" ++ __asm__ __volatile__(".machine push; \ ++ .machine power6; \ ++ stdcix %0,0,%1; \ ++ .machine pop;" + : : "r" (val), "r" (paddr) : "memory"); + } + +@@ -402,7 +414,10 @@ static inline void __raw_rm_writeq_be(u64 val, volatile void __iomem *paddr) + static inline u8 __raw_rm_readb(volatile void __iomem *paddr) + { + u8 ret; +- __asm__ __volatile__("lbzcix %0,0, %1" ++ __asm__ __volatile__(".machine push; \ ++ .machine power6; \ ++ lbzcix %0,0, %1; \ ++ .machine pop;" + : "=r" (ret) : "r" (paddr) : "memory"); + return ret; + } +@@ -410,7 +425,10 @@ static inline u8 __raw_rm_readb(volatile void __iomem *paddr) + static inline u16 __raw_rm_readw(volatile void __iomem *paddr) + { + u16 ret; +- __asm__ __volatile__("lhzcix %0,0, %1" ++ __asm__ __volatile__(".machine push; \ ++ .machine power6; \ ++ lhzcix %0,0, %1; \ ++ .machine pop;" + : "=r" (ret) : "r" (paddr) : "memory"); + return ret; + } +@@ -418,7 +436,10 @@ static inline u16 __raw_rm_readw(volatile void __iomem *paddr) + static inline u32 __raw_rm_readl(volatile void __iomem *paddr) + { + u32 ret; +- __asm__ __volatile__("lwzcix %0,0, %1" ++ __asm__ __volatile__(".machine push; \ ++ .machine power6; \ ++ lwzcix %0,0, %1; \ ++ .machine pop;" + : "=r" (ret) : "r" (paddr) : "memory"); + return ret; + } +@@ -426,7 +447,10 @@ static inline u32 __raw_rm_readl(volatile void __iomem *paddr) + static inline u64 __raw_rm_readq(volatile void __iomem *paddr) + { + u64 ret; +- __asm__ __volatile__("ldcix %0,0, %1" ++ __asm__ __volatile__(".machine push; \ ++ .machine power6; \ ++ ldcix %0,0, %1; \ ++ .machine pop;" + : "=r" (ret) : "r" (paddr) : "memory"); + return ret; + } +diff --git a/arch/powerpc/include/asm/uaccess.h b/arch/powerpc/include/asm/uaccess.h +index ab6612e35ace3..6ed40fcd8515f 100644 +--- a/arch/powerpc/include/asm/uaccess.h ++++ b/arch/powerpc/include/asm/uaccess.h +@@ -217,8 +217,11 @@ extern long __get_user_bad(void); + */ + #define __get_user_atomic_128_aligned(kaddr, uaddr, err) \ + __asm__ __volatile__( \ ++ ".machine push\n" \ ++ ".machine altivec\n" \ + "1: lvx 0,0,%1 # get user\n" \ + " stvx 0,0,%2 # put kernel\n" \ ++ ".machine pop\n" \ + "2:\n" \ + ".section .fixup,\"ax\"\n" \ + "3: li %0,%3\n" \ +diff --git a/arch/powerpc/kernel/kvm.c b/arch/powerpc/kernel/kvm.c +index cd381e2291dfe..2283b9bfd2d1c 100644 +--- a/arch/powerpc/kernel/kvm.c ++++ b/arch/powerpc/kernel/kvm.c +@@ -680,7 +680,7 @@ static void kvm_use_magic_page(void) + on_each_cpu(kvm_map_magic_page, &features, 1); + + /* Quick self-test to see if the mapping works */ +- if (!fault_in_pages_readable((const char *)KVM_MAGIC_PAGE, sizeof(u32))) { ++ if (fault_in_pages_readable((const char *)KVM_MAGIC_PAGE, sizeof(u32))) { + kvm_patching_worked = false; + return; + } +diff --git a/arch/powerpc/kernel/machine_kexec.c b/arch/powerpc/kernel/machine_kexec.c +index 094c37fb07a96..437c50bfe4e6b 100644 +--- a/arch/powerpc/kernel/machine_kexec.c ++++ b/arch/powerpc/kernel/machine_kexec.c +@@ -148,11 +148,18 @@ void __init reserve_crashkernel(void) + if (!crashk_res.start) { + #ifdef CONFIG_PPC64 + /* +- * On 64bit we split the RMO in half but cap it at half of +- * a small SLB (128MB) since the crash kernel needs to place +- * itself and some stacks to be in the first segment. ++ * On the LPAR platform place the crash kernel to mid of ++ * RMA size (512MB or more) to ensure the crash kernel ++ * gets enough space to place itself and some stack to be ++ * in the first segment. At the same time normal kernel ++ * also get enough space to allocate memory for essential ++ * system resource in the first segment. Keep the crash ++ * kernel starts at 128MB offset on other platforms. + */ +- crashk_res.start = min(0x8000000ULL, (ppc64_rma_size / 2)); ++ if (firmware_has_feature(FW_FEATURE_LPAR)) ++ crashk_res.start = ppc64_rma_size / 2; ++ else ++ crashk_res.start = min(0x8000000ULL, (ppc64_rma_size / 2)); + #else + crashk_res.start = KDUMP_KERNELBASE; + #endif +diff --git a/arch/powerpc/kernel/rtas.c b/arch/powerpc/kernel/rtas.c +index b3aa0cea6283f..362c20c8c22f9 100644 +--- a/arch/powerpc/kernel/rtas.c ++++ b/arch/powerpc/kernel/rtas.c +@@ -1357,6 +1357,12 @@ int __init early_init_dt_scan_rtas(unsigned long node, + entryp = of_get_flat_dt_prop(node, "linux,rtas-entry", NULL); + sizep = of_get_flat_dt_prop(node, "rtas-size", NULL); + ++#ifdef CONFIG_PPC64 ++ /* need this feature to decide the crashkernel offset */ ++ if (of_get_flat_dt_prop(node, "ibm,hypertas-functions", NULL)) ++ powerpc_firmware_features |= FW_FEATURE_LPAR; ++#endif ++ + if (basep && entryp && sizep) { + rtas.base = *basep; + rtas.entry = *entryp; +diff --git a/arch/powerpc/kvm/powerpc.c b/arch/powerpc/kvm/powerpc.c +index ad5a871a6cbfd..dd352842a1c72 100644 +--- a/arch/powerpc/kvm/powerpc.c ++++ b/arch/powerpc/kvm/powerpc.c +@@ -1479,7 +1479,7 @@ int kvmppc_handle_vmx_load(struct kvm_run *run, struct kvm_vcpu *vcpu, + { + enum emulation_result emulated = EMULATE_DONE; + +- if (vcpu->arch.mmio_vsx_copy_nums > 2) ++ if (vcpu->arch.mmio_vmx_copy_nums > 2) + return EMULATE_FAIL; + + while (vcpu->arch.mmio_vmx_copy_nums) { +@@ -1576,7 +1576,7 @@ int kvmppc_handle_vmx_store(struct kvm_run *run, struct kvm_vcpu *vcpu, + unsigned int index = rs & KVM_MMIO_REG_MASK; + enum emulation_result emulated = EMULATE_DONE; + +- if (vcpu->arch.mmio_vsx_copy_nums > 2) ++ if (vcpu->arch.mmio_vmx_copy_nums > 2) + return EMULATE_FAIL; + + vcpu->arch.io_gpr = rs; +diff --git a/arch/powerpc/lib/sstep.c b/arch/powerpc/lib/sstep.c +index e87ae0dabce12..30c434abe8616 100644 +--- a/arch/powerpc/lib/sstep.c ++++ b/arch/powerpc/lib/sstep.c +@@ -910,7 +910,10 @@ NOKPROBE_SYMBOL(emulate_dcbz); + + #define __put_user_asmx(x, addr, err, op, cr) \ + __asm__ __volatile__( \ ++ ".machine push\n" \ ++ ".machine power8\n" \ + "1: " op " %2,0,%3\n" \ ++ ".machine pop\n" \ + " mfcr %1\n" \ + "2:\n" \ + ".section .fixup,\"ax\"\n" \ +@@ -923,7 +926,10 @@ NOKPROBE_SYMBOL(emulate_dcbz); + + #define __get_user_asmx(x, addr, err, op) \ + __asm__ __volatile__( \ ++ ".machine push\n" \ ++ ".machine power8\n" \ + "1: "op" %1,0,%2\n" \ ++ ".machine pop\n" \ + "2:\n" \ + ".section .fixup,\"ax\"\n" \ + "3: li %0,%3\n" \ +@@ -2806,7 +2812,7 @@ int emulate_loadstore(struct pt_regs *regs, struct instruction_op *op) + __put_user_asmx(op->val, ea, err, "stbcx.", cr); + break; + case 2: +- __put_user_asmx(op->val, ea, err, "stbcx.", cr); ++ __put_user_asmx(op->val, ea, err, "sthcx.", cr); + break; + #endif + case 4: +diff --git a/arch/powerpc/platforms/powernv/rng.c b/arch/powerpc/platforms/powernv/rng.c +index 718f50ed22f1f..e15dd09f71dfb 100644 +--- a/arch/powerpc/platforms/powernv/rng.c ++++ b/arch/powerpc/platforms/powernv/rng.c +@@ -47,7 +47,11 @@ static unsigned long rng_whiten(struct powernv_rng *rng, unsigned long val) + unsigned long parity; + + /* Calculate the parity of the value */ +- asm ("popcntd %0,%1" : "=r" (parity) : "r" (val)); ++ asm (".machine push; \ ++ .machine power7; \ ++ popcntd %0,%1; \ ++ .machine pop;" ++ : "=r" (parity) : "r" (val)); + + /* xor our value with the previous mask */ + val ^= rng->mask; +diff --git a/arch/powerpc/sysdev/fsl_gtm.c b/arch/powerpc/sysdev/fsl_gtm.c +index d902306f47183..42fe959f6fc28 100644 +--- a/arch/powerpc/sysdev/fsl_gtm.c ++++ b/arch/powerpc/sysdev/fsl_gtm.c +@@ -90,7 +90,7 @@ static LIST_HEAD(gtms); + */ + struct gtm_timer *gtm_get_timer16(void) + { +- struct gtm *gtm = NULL; ++ struct gtm *gtm; + int i; + + list_for_each_entry(gtm, >ms, list_node) { +@@ -107,7 +107,7 @@ struct gtm_timer *gtm_get_timer16(void) + spin_unlock_irq(>m->lock); + } + +- if (gtm) ++ if (!list_empty(>ms)) + return ERR_PTR(-EBUSY); + return ERR_PTR(-ENODEV); + } +diff --git a/arch/riscv/kernel/module.lds b/arch/riscv/kernel/module.lds +index 295ecfb341a29..18ec719899e28 100644 +--- a/arch/riscv/kernel/module.lds ++++ b/arch/riscv/kernel/module.lds +@@ -2,7 +2,7 @@ + /* Copyright (C) 2017 Andes Technology Corporation */ + + SECTIONS { +- .plt (NOLOAD) : { BYTE(0) } +- .got (NOLOAD) : { BYTE(0) } +- .got.plt (NOLOAD) : { BYTE(0) } ++ .plt : { BYTE(0) } ++ .got : { BYTE(0) } ++ .got.plt : { BYTE(0) } + } +diff --git a/arch/um/drivers/mconsole_kern.c b/arch/um/drivers/mconsole_kern.c +index d5f9a2d1da1ba..ef4b00b9590b1 100644 +--- a/arch/um/drivers/mconsole_kern.c ++++ b/arch/um/drivers/mconsole_kern.c +@@ -218,7 +218,7 @@ void mconsole_go(struct mc_request *req) + + void mconsole_stop(struct mc_request *req) + { +- deactivate_fd(req->originating_fd, MCONSOLE_IRQ); ++ block_signals(); + os_set_fd_block(req->originating_fd, 1); + mconsole_reply(req, "stopped", 0, 0); + for (;;) { +@@ -242,6 +242,7 @@ void mconsole_stop(struct mc_request *req) + os_set_fd_block(req->originating_fd, 0); + reactivate_fd(req->originating_fd, MCONSOLE_IRQ); + mconsole_reply(req, "", 0, 0); ++ unblock_signals(); + } + + static DEFINE_SPINLOCK(mc_devices_lock); +diff --git a/arch/x86/events/intel/pt.c b/arch/x86/events/intel/pt.c +index 849f0ba53a9b9..49b3ea1c1ea19 100644 +--- a/arch/x86/events/intel/pt.c ++++ b/arch/x86/events/intel/pt.c +@@ -460,7 +460,7 @@ static u64 pt_config_filters(struct perf_event *event) + pt->filters.filter[range].msr_b = filter->msr_b; + } + +- rtit_ctl |= filter->config << pt_address_ranges[range].reg_off; ++ rtit_ctl |= (u64)filter->config << pt_address_ranges[range].reg_off; + } + + return rtit_ctl; +diff --git a/arch/x86/kernel/kvm.c b/arch/x86/kernel/kvm.c +index cee45d46e67dc..bd6ee0bfa1d28 100644 +--- a/arch/x86/kernel/kvm.c ++++ b/arch/x86/kernel/kvm.c +@@ -480,7 +480,7 @@ static void __send_ipi_mask(const struct cpumask *mask, int vector) + } else if (apic_id < min && max - apic_id < KVM_IPI_CLUSTER_SIZE) { + ipi_bitmap <<= min - apic_id; + min = apic_id; +- } else if (apic_id < min + KVM_IPI_CLUSTER_SIZE) { ++ } else if (apic_id > min && apic_id < min + KVM_IPI_CLUSTER_SIZE) { + max = apic_id < max ? max : apic_id; + } else { + ret = kvm_hypercall4(KVM_HC_SEND_IPI, (unsigned long)ipi_bitmap, +diff --git a/arch/x86/kvm/emulate.c b/arch/x86/kvm/emulate.c +index 3e182c7ae7714..63754d248dfbe 100644 +--- a/arch/x86/kvm/emulate.c ++++ b/arch/x86/kvm/emulate.c +@@ -1669,11 +1669,6 @@ static int __load_segment_descriptor(struct x86_emulate_ctxt *ctxt, + goto exception; + } + +- if (!seg_desc.p) { +- err_vec = (seg == VCPU_SREG_SS) ? SS_VECTOR : NP_VECTOR; +- goto exception; +- } +- + dpl = seg_desc.dpl; + + switch (seg) { +@@ -1713,6 +1708,10 @@ static int __load_segment_descriptor(struct x86_emulate_ctxt *ctxt, + case VCPU_SREG_TR: + if (seg_desc.s || (seg_desc.type != 1 && seg_desc.type != 9)) + goto exception; ++ if (!seg_desc.p) { ++ err_vec = NP_VECTOR; ++ goto exception; ++ } + old_desc = seg_desc; + seg_desc.type |= 2; /* busy */ + ret = ctxt->ops->cmpxchg_emulated(ctxt, desc_addr, &old_desc, &seg_desc, +@@ -1737,6 +1736,11 @@ static int __load_segment_descriptor(struct x86_emulate_ctxt *ctxt, + break; + } + ++ if (!seg_desc.p) { ++ err_vec = (seg == VCPU_SREG_SS) ? SS_VECTOR : NP_VECTOR; ++ goto exception; ++ } ++ + if (seg_desc.s) { + /* mark segment as accessed */ + if (!(seg_desc.type & 1)) { +diff --git a/arch/x86/kvm/hyperv.c b/arch/x86/kvm/hyperv.c +index 3fd6c4b2c2b7b..ca5a6c3f8c911 100644 +--- a/arch/x86/kvm/hyperv.c ++++ b/arch/x86/kvm/hyperv.c +@@ -237,7 +237,7 @@ static int synic_set_msr(struct kvm_vcpu_hv_synic *synic, + struct kvm_vcpu *vcpu = synic_to_vcpu(synic); + int ret; + +- if (!synic->active && !host) ++ if (!synic->active && (!host || data)) + return 1; + + trace_kvm_hv_synic_set_msr(vcpu->vcpu_id, msr, data, host); +@@ -283,6 +283,9 @@ static int synic_set_msr(struct kvm_vcpu_hv_synic *synic, + case HV_X64_MSR_EOM: { + int i; + ++ if (!synic->active) ++ break; ++ + for (i = 0; i < ARRAY_SIZE(synic->sint); i++) + kvm_hv_notify_acked_sint(vcpu, i); + break; +@@ -544,6 +547,12 @@ static int stimer_start(struct kvm_vcpu_hv_stimer *stimer) + static int stimer_set_config(struct kvm_vcpu_hv_stimer *stimer, u64 config, + bool host) + { ++ struct kvm_vcpu *vcpu = stimer_to_vcpu(stimer); ++ struct kvm_vcpu_hv_synic *synic = vcpu_to_synic(vcpu); ++ ++ if (!synic->active && (!host || config)) ++ return 1; ++ + trace_kvm_hv_stimer_set_config(stimer_to_vcpu(stimer)->vcpu_id, + stimer->index, config, host); + +@@ -558,6 +567,12 @@ static int stimer_set_config(struct kvm_vcpu_hv_stimer *stimer, u64 config, + static int stimer_set_count(struct kvm_vcpu_hv_stimer *stimer, u64 count, + bool host) + { ++ struct kvm_vcpu *vcpu = stimer_to_vcpu(stimer); ++ struct kvm_vcpu_hv_synic *synic = vcpu_to_synic(vcpu); ++ ++ if (!synic->active && (!host || count)) ++ return 1; ++ + trace_kvm_hv_stimer_set_count(stimer_to_vcpu(stimer)->vcpu_id, + stimer->index, count, host); + +diff --git a/arch/x86/kvm/lapic.c b/arch/x86/kvm/lapic.c +index 56a4b9762b0c1..89d07312e58cf 100644 +--- a/arch/x86/kvm/lapic.c ++++ b/arch/x86/kvm/lapic.c +@@ -2045,10 +2045,7 @@ void kvm_set_lapic_tscdeadline_msr(struct kvm_vcpu *vcpu, u64 data) + + void kvm_lapic_set_tpr(struct kvm_vcpu *vcpu, unsigned long cr8) + { +- struct kvm_lapic *apic = vcpu->arch.apic; +- +- apic_set_tpr(apic, ((cr8 & 0x0f) << 4) +- | (kvm_lapic_get_reg(apic, APIC_TASKPRI) & 4)); ++ apic_set_tpr(vcpu->arch.apic, (cr8 & 0x0f) << 4); + } + + u64 kvm_lapic_get_cr8(struct kvm_vcpu *vcpu) +diff --git a/arch/x86/kvm/pmu_amd.c b/arch/x86/kvm/pmu_amd.c +index 41dff881e0f03..93a135f216b28 100644 +--- a/arch/x86/kvm/pmu_amd.c ++++ b/arch/x86/kvm/pmu_amd.c +@@ -247,12 +247,10 @@ static int amd_pmu_set_msr(struct kvm_vcpu *vcpu, struct msr_data *msr_info) + /* MSR_EVNTSELn */ + pmc = get_gp_pmc_amd(pmu, msr, PMU_TYPE_EVNTSEL); + if (pmc) { +- if (data == pmc->eventsel) +- return 0; +- if (!(data & pmu->reserved_bits)) { ++ data &= ~pmu->reserved_bits; ++ if (data != pmc->eventsel) + reprogram_gp_counter(pmc, data); +- return 0; +- } ++ return 0; + } + + return 1; +diff --git a/arch/x86/power/cpu.c b/arch/x86/power/cpu.c +index 3aa3149df07f9..e00b8c36ab721 100644 +--- a/arch/x86/power/cpu.c ++++ b/arch/x86/power/cpu.c +@@ -41,7 +41,8 @@ static void msr_save_context(struct saved_context *ctxt) + struct saved_msr *end = msr + ctxt->saved_msrs.num; + + while (msr < end) { +- msr->valid = !rdmsrl_safe(msr->info.msr_no, &msr->info.reg.q); ++ if (msr->valid) ++ rdmsrl(msr->info.msr_no, msr->info.reg.q); + msr++; + } + } +@@ -426,8 +427,10 @@ static int msr_build_context(const u32 *msr_id, const int num) + } + + for (i = saved_msrs->num, j = 0; i < total_num; i++, j++) { ++ u64 dummy; ++ + msr_array[i].info.msr_no = msr_id[j]; +- msr_array[i].valid = false; ++ msr_array[i].valid = !rdmsrl_safe(msr_id[j], &dummy); + msr_array[i].info.reg.q = 0; + } + saved_msrs->num = total_num; +@@ -514,10 +517,24 @@ static int pm_cpu_check(const struct x86_cpu_id *c) + return ret; + } + ++static void pm_save_spec_msr(void) ++{ ++ u32 spec_msr_id[] = { ++ MSR_IA32_SPEC_CTRL, ++ MSR_IA32_TSX_CTRL, ++ MSR_TSX_FORCE_ABORT, ++ MSR_IA32_MCU_OPT_CTRL, ++ MSR_AMD64_LS_CFG, ++ }; ++ ++ msr_build_context(spec_msr_id, ARRAY_SIZE(spec_msr_id)); ++} ++ + static int pm_check_save_msr(void) + { + dmi_check_system(msr_save_dmi_table); + pm_cpu_check(msr_save_cpu_table); ++ pm_save_spec_msr(); + + return 0; + } +diff --git a/arch/x86/xen/pmu.c b/arch/x86/xen/pmu.c +index 95997e6c06960..9813298ba57d1 100644 +--- a/arch/x86/xen/pmu.c ++++ b/arch/x86/xen/pmu.c +@@ -505,10 +505,7 @@ irqreturn_t xen_pmu_irq_handler(int irq, void *dev_id) + return ret; + } + +-bool is_xen_pmu(int cpu) +-{ +- return (get_xenpmu_data() != NULL); +-} ++bool is_xen_pmu; + + void xen_pmu_init(int cpu) + { +@@ -519,7 +516,7 @@ void xen_pmu_init(int cpu) + + BUILD_BUG_ON(sizeof(struct xen_pmu_data) > PAGE_SIZE); + +- if (xen_hvm_domain()) ++ if (xen_hvm_domain() || (cpu != 0 && !is_xen_pmu)) + return; + + xenpmu_data = (struct xen_pmu_data *)get_zeroed_page(GFP_KERNEL); +@@ -540,7 +537,8 @@ void xen_pmu_init(int cpu) + per_cpu(xenpmu_shared, cpu).xenpmu_data = xenpmu_data; + per_cpu(xenpmu_shared, cpu).flags = 0; + +- if (cpu == 0) { ++ if (!is_xen_pmu) { ++ is_xen_pmu = true; + perf_register_guest_info_callbacks(&xen_guest_cbs); + xen_pmu_arch_init(); + } +diff --git a/arch/x86/xen/pmu.h b/arch/x86/xen/pmu.h +index 0e83a160589bc..65c58894fc79f 100644 +--- a/arch/x86/xen/pmu.h ++++ b/arch/x86/xen/pmu.h +@@ -4,6 +4,8 @@ + + #include + ++extern bool is_xen_pmu; ++ + irqreturn_t xen_pmu_irq_handler(int irq, void *dev_id); + #ifdef CONFIG_XEN_HAVE_VPMU + void xen_pmu_init(int cpu); +@@ -12,7 +14,6 @@ void xen_pmu_finish(int cpu); + static inline void xen_pmu_init(int cpu) {} + static inline void xen_pmu_finish(int cpu) {} + #endif +-bool is_xen_pmu(int cpu); + bool pmu_msr_read(unsigned int msr, uint64_t *val, int *err); + bool pmu_msr_write(unsigned int msr, uint32_t low, uint32_t high, int *err); + int pmu_apic_update(uint32_t reg); +diff --git a/arch/x86/xen/smp_hvm.c b/arch/x86/xen/smp_hvm.c +index f8d39440b2923..e5bd9eb421915 100644 +--- a/arch/x86/xen/smp_hvm.c ++++ b/arch/x86/xen/smp_hvm.c +@@ -18,6 +18,12 @@ static void __init xen_hvm_smp_prepare_boot_cpu(void) + */ + xen_vcpu_setup(0); + ++ /* ++ * Called again in case the kernel boots on vcpu >= MAX_VIRT_CPUS. ++ * Refer to comments in xen_hvm_init_time_ops(). ++ */ ++ xen_hvm_init_time_ops(); ++ + /* + * The alternative logic (which patches the unlock/lock) runs before + * the smp bootup up code is activated. Hence we need to set this up +diff --git a/arch/x86/xen/smp_pv.c b/arch/x86/xen/smp_pv.c +index 41fd4c123165a..e8248e8a04ca7 100644 +--- a/arch/x86/xen/smp_pv.c ++++ b/arch/x86/xen/smp_pv.c +@@ -126,7 +126,7 @@ int xen_smp_intr_init_pv(unsigned int cpu) + per_cpu(xen_irq_work, cpu).irq = rc; + per_cpu(xen_irq_work, cpu).name = callfunc_name; + +- if (is_xen_pmu(cpu)) { ++ if (is_xen_pmu) { + pmu_name = kasprintf(GFP_KERNEL, "pmu%d", cpu); + rc = bind_virq_to_irqhandler(VIRQ_XENPMU, cpu, + xen_pmu_irq_handler, +diff --git a/arch/x86/xen/time.c b/arch/x86/xen/time.c +index 01dcccf9185ff..9809de9f2310f 100644 +--- a/arch/x86/xen/time.c ++++ b/arch/x86/xen/time.c +@@ -547,6 +547,11 @@ static void xen_hvm_setup_cpu_clockevents(void) + + void __init xen_hvm_init_time_ops(void) + { ++ static bool hvm_time_initialized; ++ ++ if (hvm_time_initialized) ++ return; ++ + /* + * vector callback is needed otherwise we cannot receive interrupts + * on cpu > 0 and at this point we don't know how many cpus are +@@ -556,7 +561,22 @@ void __init xen_hvm_init_time_ops(void) + return; + + if (!xen_feature(XENFEAT_hvm_safe_pvclock)) { +- pr_info("Xen doesn't support pvclock on HVM, disable pv timer"); ++ pr_info_once("Xen doesn't support pvclock on HVM, disable pv timer"); ++ return; ++ } ++ ++ /* ++ * Only MAX_VIRT_CPUS 'vcpu_info' are embedded inside 'shared_info'. ++ * The __this_cpu_read(xen_vcpu) is still NULL when Xen HVM guest ++ * boots on vcpu >= MAX_VIRT_CPUS (e.g., kexec), To access ++ * __this_cpu_read(xen_vcpu) via xen_clocksource_read() will panic. ++ * ++ * The xen_hvm_init_time_ops() should be called again later after ++ * __this_cpu_read(xen_vcpu) is available. ++ */ ++ if (!__this_cpu_read(xen_vcpu)) { ++ pr_info("Delay xen_init_time_common() as kernel is running on vcpu=%d\n", ++ xen_vcpu_nr(0)); + return; + } + +@@ -568,5 +588,7 @@ void __init xen_hvm_init_time_ops(void) + x86_platform.calibrate_tsc = xen_tsc_khz; + x86_platform.get_wallclock = xen_get_wallclock; + x86_platform.set_wallclock = xen_set_wallclock; ++ ++ hvm_time_initialized = true; + } + #endif +diff --git a/arch/xtensa/boot/dts/xtfpga-flash-128m.dtsi b/arch/xtensa/boot/dts/xtfpga-flash-128m.dtsi +index 9bf8bad1dd18a..c33932568aa73 100644 +--- a/arch/xtensa/boot/dts/xtfpga-flash-128m.dtsi ++++ b/arch/xtensa/boot/dts/xtfpga-flash-128m.dtsi +@@ -8,19 +8,19 @@ + reg = <0x00000000 0x08000000>; + bank-width = <2>; + device-width = <2>; +- partition@0x0 { ++ partition@0 { + label = "data"; + reg = <0x00000000 0x06000000>; + }; +- partition@0x6000000 { ++ partition@6000000 { + label = "boot loader area"; + reg = <0x06000000 0x00800000>; + }; +- partition@0x6800000 { ++ partition@6800000 { + label = "kernel image"; + reg = <0x06800000 0x017e0000>; + }; +- partition@0x7fe0000 { ++ partition@7fe0000 { + label = "boot environment"; + reg = <0x07fe0000 0x00020000>; + }; +diff --git a/arch/xtensa/boot/dts/xtfpga-flash-16m.dtsi b/arch/xtensa/boot/dts/xtfpga-flash-16m.dtsi +index 40c2f81f7cb66..7bde2ab2d6fb5 100644 +--- a/arch/xtensa/boot/dts/xtfpga-flash-16m.dtsi ++++ b/arch/xtensa/boot/dts/xtfpga-flash-16m.dtsi +@@ -8,19 +8,19 @@ + reg = <0x08000000 0x01000000>; + bank-width = <2>; + device-width = <2>; +- partition@0x0 { ++ partition@0 { + label = "boot loader area"; + reg = <0x00000000 0x00400000>; + }; +- partition@0x400000 { ++ partition@400000 { + label = "kernel image"; + reg = <0x00400000 0x00600000>; + }; +- partition@0xa00000 { ++ partition@a00000 { + label = "data"; + reg = <0x00a00000 0x005e0000>; + }; +- partition@0xfe0000 { ++ partition@fe0000 { + label = "boot environment"; + reg = <0x00fe0000 0x00020000>; + }; +diff --git a/arch/xtensa/boot/dts/xtfpga-flash-4m.dtsi b/arch/xtensa/boot/dts/xtfpga-flash-4m.dtsi +index fb8d3a9f33c23..0655b868749a4 100644 +--- a/arch/xtensa/boot/dts/xtfpga-flash-4m.dtsi ++++ b/arch/xtensa/boot/dts/xtfpga-flash-4m.dtsi +@@ -8,11 +8,11 @@ + reg = <0x08000000 0x00400000>; + bank-width = <2>; + device-width = <2>; +- partition@0x0 { ++ partition@0 { + label = "boot loader area"; + reg = <0x00000000 0x003f0000>; + }; +- partition@0x3f0000 { ++ partition@3f0000 { + label = "boot environment"; + reg = <0x003f0000 0x00010000>; + }; +diff --git a/block/bfq-iosched.c b/block/bfq-iosched.c +index 11686e7684016..a9f42df92ea33 100644 +--- a/block/bfq-iosched.c ++++ b/block/bfq-iosched.c +@@ -2155,6 +2155,15 @@ bfq_setup_merge(struct bfq_queue *bfqq, struct bfq_queue *new_bfqq) + * are likely to increase the throughput. + */ + bfqq->new_bfqq = new_bfqq; ++ /* ++ * The above assignment schedules the following redirections: ++ * each time some I/O for bfqq arrives, the process that ++ * generated that I/O is disassociated from bfqq and ++ * associated with new_bfqq. Here we increases new_bfqq->ref ++ * in advance, adding the number of processes that are ++ * expected to be associated with new_bfqq as they happen to ++ * issue I/O. ++ */ + new_bfqq->ref += process_refs; + return new_bfqq; + } +@@ -2214,6 +2223,10 @@ bfq_setup_cooperator(struct bfq_data *bfqd, struct bfq_queue *bfqq, + { + struct bfq_queue *in_service_bfqq, *new_bfqq; + ++ /* if a merge has already been setup, then proceed with that first */ ++ if (bfqq->new_bfqq) ++ return bfqq->new_bfqq; ++ + /* + * Prevent bfqq from being merged if it has been created too + * long ago. The idea is that true cooperating processes, and +@@ -2228,9 +2241,6 @@ bfq_setup_cooperator(struct bfq_data *bfqd, struct bfq_queue *bfqq, + if (bfq_too_late_for_merging(bfqq)) + return NULL; + +- if (bfqq->new_bfqq) +- return bfqq->new_bfqq; +- + if (!io_struct || unlikely(bfqq == &bfqd->oom_bfqq)) + return NULL; + +@@ -4122,7 +4132,7 @@ static struct request *bfq_dispatch_request(struct blk_mq_hw_ctx *hctx) + struct bfq_data *bfqd = hctx->queue->elevator->elevator_data; + struct request *rq; + struct bfq_queue *in_serv_queue; +- bool waiting_rq, idle_timer_disabled; ++ bool waiting_rq, idle_timer_disabled = false; + + spin_lock_irq(&bfqd->lock); + +@@ -4130,14 +4140,15 @@ static struct request *bfq_dispatch_request(struct blk_mq_hw_ctx *hctx) + waiting_rq = in_serv_queue && bfq_bfqq_wait_request(in_serv_queue); + + rq = __bfq_dispatch_request(hctx); +- +- idle_timer_disabled = +- waiting_rq && !bfq_bfqq_wait_request(in_serv_queue); ++ if (in_serv_queue == bfqd->in_service_queue) { ++ idle_timer_disabled = ++ waiting_rq && !bfq_bfqq_wait_request(in_serv_queue); ++ } + + spin_unlock_irq(&bfqd->lock); +- +- bfq_update_dispatch_stats(hctx->queue, rq, in_serv_queue, +- idle_timer_disabled); ++ bfq_update_dispatch_stats(hctx->queue, rq, ++ idle_timer_disabled ? in_serv_queue : NULL, ++ idle_timer_disabled); + + return rq; + } +diff --git a/block/blk-merge.c b/block/blk-merge.c +index 7efa8c3e2b727..8054410536fd9 100644 +--- a/block/blk-merge.c ++++ b/block/blk-merge.c +@@ -7,6 +7,8 @@ + #include + #include + #include ++#include ++#include + + #include + +@@ -486,6 +488,9 @@ static inline int ll_new_hw_segment(struct request_queue *q, + if (req->nr_phys_segments + nr_phys_segs > queue_max_segments(q)) + goto no_merge; + ++ if (!blk_cgroup_mergeable(req, bio)) ++ goto no_merge; ++ + if (blk_integrity_merge_bio(q, req, bio) == false) + goto no_merge; + +@@ -609,6 +614,9 @@ static int ll_merge_requests_fn(struct request_queue *q, struct request *req, + if (total_phys_segments > queue_max_segments(q)) + return 0; + ++ if (!blk_cgroup_mergeable(req, next->bio)) ++ return 0; ++ + if (blk_integrity_merge_rq(q, req, next) == false) + return 0; + +@@ -843,6 +851,10 @@ bool blk_rq_merge_ok(struct request *rq, struct bio *bio) + if (rq->rq_disk != bio->bi_disk || req_no_special_merge(rq)) + return false; + ++ /* don't merge across cgroup boundaries */ ++ if (!blk_cgroup_mergeable(rq, bio)) ++ return false; ++ + /* only merge integrity protected bio into ditto rq */ + if (blk_integrity_merge_bio(rq->q, rq, bio) == false) + return false; +diff --git a/block/blk-sysfs.c b/block/blk-sysfs.c +index 07494deb1a26f..67836f212e2db 100644 +--- a/block/blk-sysfs.c ++++ b/block/blk-sysfs.c +@@ -1002,9 +1002,6 @@ void blk_unregister_queue(struct gendisk *disk) + */ + if (q->mq_ops) + blk_mq_unregister_dev(disk_to_dev(disk), q); +- +- kobject_uevent(&q->kobj, KOBJ_REMOVE); +- kobject_del(&q->kobj); + blk_trace_remove_sysfs(disk_to_dev(disk)); + + mutex_lock(&q->sysfs_lock); +@@ -1015,6 +1012,11 @@ void blk_unregister_queue(struct gendisk *disk) + if (q->request_fn || q->elevator) + elv_unregister_queue(q); + mutex_unlock(&q->sysfs_lock); ++ ++ /* Now that we've deleted all child objects, we can delete the queue. */ ++ kobject_uevent(&q->kobj, KOBJ_REMOVE); ++ kobject_del(&q->kobj); ++ + mutex_unlock(&q->sysfs_dir_lock); + + kobject_put(&disk_to_dev(disk)->kobj); +diff --git a/crypto/authenc.c b/crypto/authenc.c +index 3ee10fc25aff3..02d4d85174494 100644 +--- a/crypto/authenc.c ++++ b/crypto/authenc.c +@@ -268,7 +268,7 @@ static int crypto_authenc_decrypt_tail(struct aead_request *req, + dst = scatterwalk_ffwd(areq_ctx->dst, req->dst, req->assoclen); + + skcipher_request_set_tfm(skreq, ctx->enc); +- skcipher_request_set_callback(skreq, aead_request_flags(req), ++ skcipher_request_set_callback(skreq, flags, + req->base.complete, req->base.data); + skcipher_request_set_crypt(skreq, src, dst, + req->cryptlen - authsize, req->iv); +diff --git a/drivers/acpi/acpica/nswalk.c b/drivers/acpi/acpica/nswalk.c +index e9a061da9bb20..c325789a62bf0 100644 +--- a/drivers/acpi/acpica/nswalk.c ++++ b/drivers/acpi/acpica/nswalk.c +@@ -169,6 +169,9 @@ acpi_ns_walk_namespace(acpi_object_type type, + + if (start_node == ACPI_ROOT_OBJECT) { + start_node = acpi_gbl_root_node; ++ if (!start_node) { ++ return_ACPI_STATUS(AE_NO_NAMESPACE); ++ } + } + + /* Null child means "get first node" */ +diff --git a/drivers/acpi/apei/bert.c b/drivers/acpi/apei/bert.c +index 12771fcf0417d..d2212e092c503 100644 +--- a/drivers/acpi/apei/bert.c ++++ b/drivers/acpi/apei/bert.c +@@ -31,6 +31,7 @@ + + #undef pr_fmt + #define pr_fmt(fmt) "BERT: " fmt ++#define ACPI_BERT_PRINT_MAX_LEN 1024 + + static int bert_disable; + +@@ -59,8 +60,11 @@ static void __init bert_print_all(struct acpi_bert_region *region, + } + + pr_info_once("Error records from previous boot:\n"); +- +- cper_estatus_print(KERN_INFO HW_ERR, estatus); ++ if (region_len < ACPI_BERT_PRINT_MAX_LEN) ++ cper_estatus_print(KERN_INFO HW_ERR, estatus); ++ else ++ pr_info_once("Max print length exceeded, table data is available at:\n" ++ "/sys/firmware/acpi/tables/data/BERT"); + + /* + * Because the boot error source is "one-time polled" type, +@@ -82,7 +86,7 @@ static int __init setup_bert_disable(char *str) + { + bert_disable = 1; + +- return 0; ++ return 1; + } + __setup("bert_disable", setup_bert_disable); + +diff --git a/drivers/acpi/apei/erst.c b/drivers/acpi/apei/erst.c +index ab8faa6d6616f..445e85394db61 100644 +--- a/drivers/acpi/apei/erst.c ++++ b/drivers/acpi/apei/erst.c +@@ -899,7 +899,7 @@ EXPORT_SYMBOL_GPL(erst_clear); + static int __init setup_erst_disable(char *str) + { + erst_disable = 1; +- return 0; ++ return 1; + } + + __setup("erst_disable", setup_erst_disable); +diff --git a/drivers/acpi/apei/hest.c b/drivers/acpi/apei/hest.c +index b1e9f81ebeea2..d536e4d132eb4 100644 +--- a/drivers/acpi/apei/hest.c ++++ b/drivers/acpi/apei/hest.c +@@ -215,7 +215,7 @@ err: + static int __init setup_hest_disable(char *str) + { + hest_disable = HEST_DISABLED; +- return 0; ++ return 1; + } + + __setup("hest_disable", setup_hest_disable); +diff --git a/drivers/acpi/cppc_acpi.c b/drivers/acpi/cppc_acpi.c +index 1b43f8ebfabea..f68a4ffd3352e 100644 +--- a/drivers/acpi/cppc_acpi.c ++++ b/drivers/acpi/cppc_acpi.c +@@ -742,6 +742,11 @@ int acpi_cppc_processor_probe(struct acpi_processor *pr) + cpc_obj = &out_obj->package.elements[0]; + if (cpc_obj->type == ACPI_TYPE_INTEGER) { + num_ent = cpc_obj->integer.value; ++ if (num_ent <= 1) { ++ pr_debug("Unexpected _CPC NumEntries value (%d) for CPU:%d\n", ++ num_ent, pr->id); ++ goto out_free; ++ } + } else { + pr_debug("Unexpected entry type(%d) for NumEntries\n", + cpc_obj->type); +diff --git a/drivers/acpi/property.c b/drivers/acpi/property.c +index 27db1a968241b..c8018d73d5a79 100644 +--- a/drivers/acpi/property.c ++++ b/drivers/acpi/property.c +@@ -618,7 +618,7 @@ int __acpi_node_get_property_reference(const struct fwnode_handle *fwnode, + */ + if (obj->type == ACPI_TYPE_LOCAL_REFERENCE) { + if (index) +- return -EINVAL; ++ return -ENOENT; + + ret = acpi_bus_get_device(obj->reference.handle, &device); + if (ret) +diff --git a/drivers/ata/sata_dwc_460ex.c b/drivers/ata/sata_dwc_460ex.c +index 8487048c5ec9b..564f0826e0229 100644 +--- a/drivers/ata/sata_dwc_460ex.c ++++ b/drivers/ata/sata_dwc_460ex.c +@@ -149,7 +149,11 @@ struct sata_dwc_device { + #endif + }; + +-#define SATA_DWC_QCMD_MAX 32 ++/* ++ * Allow one extra special slot for commands and DMA management ++ * to account for libata internal commands. ++ */ ++#define SATA_DWC_QCMD_MAX (ATA_MAX_QUEUE + 1) + + struct sata_dwc_device_port { + struct sata_dwc_device *hsdev; +diff --git a/drivers/base/power/main.c b/drivers/base/power/main.c +index da413b95afabf..c0284c8db19b1 100644 +--- a/drivers/base/power/main.c ++++ b/drivers/base/power/main.c +@@ -2145,7 +2145,9 @@ static bool pm_ops_is_empty(const struct dev_pm_ops *ops) + + void device_pm_check_callbacks(struct device *dev) + { +- spin_lock_irq(&dev->power.lock); ++ unsigned long flags; ++ ++ spin_lock_irqsave(&dev->power.lock, flags); + dev->power.no_pm_callbacks = + (!dev->bus || (pm_ops_is_empty(dev->bus->pm) && + !dev->bus->suspend && !dev->bus->resume)) && +@@ -2154,7 +2156,7 @@ void device_pm_check_callbacks(struct device *dev) + (!dev->pm_domain || pm_ops_is_empty(&dev->pm_domain->ops)) && + (!dev->driver || (pm_ops_is_empty(dev->driver->pm) && + !dev->driver->suspend && !dev->driver->resume)); +- spin_unlock_irq(&dev->power.lock); ++ spin_unlock_irqrestore(&dev->power.lock, flags); + } + + bool dev_pm_smart_suspend_and_suspended(struct device *dev) +diff --git a/drivers/block/drbd/drbd_int.h b/drivers/block/drbd/drbd_int.h +index e35a234b0a8f2..4f66cf6879fdd 100644 +--- a/drivers/block/drbd/drbd_int.h ++++ b/drivers/block/drbd/drbd_int.h +@@ -1688,22 +1688,22 @@ struct sib_info { + }; + void drbd_bcast_event(struct drbd_device *device, const struct sib_info *sib); + +-extern void notify_resource_state(struct sk_buff *, ++extern int notify_resource_state(struct sk_buff *, + unsigned int, + struct drbd_resource *, + struct resource_info *, + enum drbd_notification_type); +-extern void notify_device_state(struct sk_buff *, ++extern int notify_device_state(struct sk_buff *, + unsigned int, + struct drbd_device *, + struct device_info *, + enum drbd_notification_type); +-extern void notify_connection_state(struct sk_buff *, ++extern int notify_connection_state(struct sk_buff *, + unsigned int, + struct drbd_connection *, + struct connection_info *, + enum drbd_notification_type); +-extern void notify_peer_device_state(struct sk_buff *, ++extern int notify_peer_device_state(struct sk_buff *, + unsigned int, + struct drbd_peer_device *, + struct peer_device_info *, +diff --git a/drivers/block/drbd/drbd_nl.c b/drivers/block/drbd/drbd_nl.c +index 5b15ffd0c7f57..5a80453be5535 100644 +--- a/drivers/block/drbd/drbd_nl.c ++++ b/drivers/block/drbd/drbd_nl.c +@@ -4598,7 +4598,7 @@ static int nla_put_notification_header(struct sk_buff *msg, + return drbd_notification_header_to_skb(msg, &nh, true); + } + +-void notify_resource_state(struct sk_buff *skb, ++int notify_resource_state(struct sk_buff *skb, + unsigned int seq, + struct drbd_resource *resource, + struct resource_info *resource_info, +@@ -4640,16 +4640,17 @@ void notify_resource_state(struct sk_buff *skb, + if (err && err != -ESRCH) + goto failed; + } +- return; ++ return 0; + + nla_put_failure: + nlmsg_free(skb); + failed: + drbd_err(resource, "Error %d while broadcasting event. Event seq:%u\n", + err, seq); ++ return err; + } + +-void notify_device_state(struct sk_buff *skb, ++int notify_device_state(struct sk_buff *skb, + unsigned int seq, + struct drbd_device *device, + struct device_info *device_info, +@@ -4689,16 +4690,17 @@ void notify_device_state(struct sk_buff *skb, + if (err && err != -ESRCH) + goto failed; + } +- return; ++ return 0; + + nla_put_failure: + nlmsg_free(skb); + failed: + drbd_err(device, "Error %d while broadcasting event. Event seq:%u\n", + err, seq); ++ return err; + } + +-void notify_connection_state(struct sk_buff *skb, ++int notify_connection_state(struct sk_buff *skb, + unsigned int seq, + struct drbd_connection *connection, + struct connection_info *connection_info, +@@ -4738,16 +4740,17 @@ void notify_connection_state(struct sk_buff *skb, + if (err && err != -ESRCH) + goto failed; + } +- return; ++ return 0; + + nla_put_failure: + nlmsg_free(skb); + failed: + drbd_err(connection, "Error %d while broadcasting event. Event seq:%u\n", + err, seq); ++ return err; + } + +-void notify_peer_device_state(struct sk_buff *skb, ++int notify_peer_device_state(struct sk_buff *skb, + unsigned int seq, + struct drbd_peer_device *peer_device, + struct peer_device_info *peer_device_info, +@@ -4788,13 +4791,14 @@ void notify_peer_device_state(struct sk_buff *skb, + if (err && err != -ESRCH) + goto failed; + } +- return; ++ return 0; + + nla_put_failure: + nlmsg_free(skb); + failed: + drbd_err(peer_device, "Error %d while broadcasting event. Event seq:%u\n", + err, seq); ++ return err; + } + + void notify_helper(enum drbd_notification_type type, +@@ -4845,7 +4849,7 @@ fail: + err, seq); + } + +-static void notify_initial_state_done(struct sk_buff *skb, unsigned int seq) ++static int notify_initial_state_done(struct sk_buff *skb, unsigned int seq) + { + struct drbd_genlmsghdr *dh; + int err; +@@ -4859,11 +4863,12 @@ static void notify_initial_state_done(struct sk_buff *skb, unsigned int seq) + if (nla_put_notification_header(skb, NOTIFY_EXISTS)) + goto nla_put_failure; + genlmsg_end(skb, dh); +- return; ++ return 0; + + nla_put_failure: + nlmsg_free(skb); + pr_err("Error %d sending event. Event seq:%u\n", err, seq); ++ return err; + } + + static void free_state_changes(struct list_head *list) +@@ -4890,6 +4895,7 @@ static int get_initial_state(struct sk_buff *skb, struct netlink_callback *cb) + unsigned int seq = cb->args[2]; + unsigned int n; + enum drbd_notification_type flags = 0; ++ int err = 0; + + /* There is no need for taking notification_mutex here: it doesn't + matter if the initial state events mix with later state chage +@@ -4898,32 +4904,32 @@ static int get_initial_state(struct sk_buff *skb, struct netlink_callback *cb) + + cb->args[5]--; + if (cb->args[5] == 1) { +- notify_initial_state_done(skb, seq); ++ err = notify_initial_state_done(skb, seq); + goto out; + } + n = cb->args[4]++; + if (cb->args[4] < cb->args[3]) + flags |= NOTIFY_CONTINUES; + if (n < 1) { +- notify_resource_state_change(skb, seq, state_change->resource, ++ err = notify_resource_state_change(skb, seq, state_change->resource, + NOTIFY_EXISTS | flags); + goto next; + } + n--; + if (n < state_change->n_connections) { +- notify_connection_state_change(skb, seq, &state_change->connections[n], ++ err = notify_connection_state_change(skb, seq, &state_change->connections[n], + NOTIFY_EXISTS | flags); + goto next; + } + n -= state_change->n_connections; + if (n < state_change->n_devices) { +- notify_device_state_change(skb, seq, &state_change->devices[n], ++ err = notify_device_state_change(skb, seq, &state_change->devices[n], + NOTIFY_EXISTS | flags); + goto next; + } + n -= state_change->n_devices; + if (n < state_change->n_devices * state_change->n_connections) { +- notify_peer_device_state_change(skb, seq, &state_change->peer_devices[n], ++ err = notify_peer_device_state_change(skb, seq, &state_change->peer_devices[n], + NOTIFY_EXISTS | flags); + goto next; + } +@@ -4938,7 +4944,10 @@ next: + cb->args[4] = 0; + } + out: +- return skb->len; ++ if (err) ++ return err; ++ else ++ return skb->len; + } + + int drbd_adm_get_initial_state(struct sk_buff *skb, struct netlink_callback *cb) +diff --git a/drivers/block/drbd/drbd_req.c b/drivers/block/drbd/drbd_req.c +index 19cac36e97371..86c953b7cbc2c 100644 +--- a/drivers/block/drbd/drbd_req.c ++++ b/drivers/block/drbd/drbd_req.c +@@ -207,7 +207,8 @@ void start_new_tl_epoch(struct drbd_connection *connection) + void complete_master_bio(struct drbd_device *device, + struct bio_and_error *m) + { +- m->bio->bi_status = errno_to_blk_status(m->error); ++ if (unlikely(m->error)) ++ m->bio->bi_status = errno_to_blk_status(m->error); + bio_endio(m->bio); + dec_ap_bio(device); + } +diff --git a/drivers/block/drbd/drbd_state.c b/drivers/block/drbd/drbd_state.c +index b452359b6aae8..1474250f94402 100644 +--- a/drivers/block/drbd/drbd_state.c ++++ b/drivers/block/drbd/drbd_state.c +@@ -1549,7 +1549,7 @@ int drbd_bitmap_io_from_worker(struct drbd_device *device, + return rv; + } + +-void notify_resource_state_change(struct sk_buff *skb, ++int notify_resource_state_change(struct sk_buff *skb, + unsigned int seq, + struct drbd_resource_state_change *resource_state_change, + enum drbd_notification_type type) +@@ -1562,10 +1562,10 @@ void notify_resource_state_change(struct sk_buff *skb, + .res_susp_fen = resource_state_change->susp_fen[NEW], + }; + +- notify_resource_state(skb, seq, resource, &resource_info, type); ++ return notify_resource_state(skb, seq, resource, &resource_info, type); + } + +-void notify_connection_state_change(struct sk_buff *skb, ++int notify_connection_state_change(struct sk_buff *skb, + unsigned int seq, + struct drbd_connection_state_change *connection_state_change, + enum drbd_notification_type type) +@@ -1576,10 +1576,10 @@ void notify_connection_state_change(struct sk_buff *skb, + .conn_role = connection_state_change->peer_role[NEW], + }; + +- notify_connection_state(skb, seq, connection, &connection_info, type); ++ return notify_connection_state(skb, seq, connection, &connection_info, type); + } + +-void notify_device_state_change(struct sk_buff *skb, ++int notify_device_state_change(struct sk_buff *skb, + unsigned int seq, + struct drbd_device_state_change *device_state_change, + enum drbd_notification_type type) +@@ -1589,10 +1589,10 @@ void notify_device_state_change(struct sk_buff *skb, + .dev_disk_state = device_state_change->disk_state[NEW], + }; + +- notify_device_state(skb, seq, device, &device_info, type); ++ return notify_device_state(skb, seq, device, &device_info, type); + } + +-void notify_peer_device_state_change(struct sk_buff *skb, ++int notify_peer_device_state_change(struct sk_buff *skb, + unsigned int seq, + struct drbd_peer_device_state_change *p, + enum drbd_notification_type type) +@@ -1606,7 +1606,7 @@ void notify_peer_device_state_change(struct sk_buff *skb, + .peer_resync_susp_dependency = p->resync_susp_dependency[NEW], + }; + +- notify_peer_device_state(skb, seq, peer_device, &peer_device_info, type); ++ return notify_peer_device_state(skb, seq, peer_device, &peer_device_info, type); + } + + static void broadcast_state_change(struct drbd_state_change *state_change) +@@ -1614,7 +1614,7 @@ static void broadcast_state_change(struct drbd_state_change *state_change) + struct drbd_resource_state_change *resource_state_change = &state_change->resource[0]; + bool resource_state_has_changed; + unsigned int n_device, n_connection, n_peer_device, n_peer_devices; +- void (*last_func)(struct sk_buff *, unsigned int, void *, ++ int (*last_func)(struct sk_buff *, unsigned int, void *, + enum drbd_notification_type) = NULL; + void *uninitialized_var(last_arg); + +diff --git a/drivers/block/drbd/drbd_state_change.h b/drivers/block/drbd/drbd_state_change.h +index ba80f612d6abb..d5b0479bc9a66 100644 +--- a/drivers/block/drbd/drbd_state_change.h ++++ b/drivers/block/drbd/drbd_state_change.h +@@ -44,19 +44,19 @@ extern struct drbd_state_change *remember_old_state(struct drbd_resource *, gfp_ + extern void copy_old_to_new_state_change(struct drbd_state_change *); + extern void forget_state_change(struct drbd_state_change *); + +-extern void notify_resource_state_change(struct sk_buff *, ++extern int notify_resource_state_change(struct sk_buff *, + unsigned int, + struct drbd_resource_state_change *, + enum drbd_notification_type type); +-extern void notify_connection_state_change(struct sk_buff *, ++extern int notify_connection_state_change(struct sk_buff *, + unsigned int, + struct drbd_connection_state_change *, + enum drbd_notification_type type); +-extern void notify_device_state_change(struct sk_buff *, ++extern int notify_device_state_change(struct sk_buff *, + unsigned int, + struct drbd_device_state_change *, + enum drbd_notification_type type); +-extern void notify_peer_device_state_change(struct sk_buff *, ++extern int notify_peer_device_state_change(struct sk_buff *, + unsigned int, + struct drbd_peer_device_state_change *, + enum drbd_notification_type type); +diff --git a/drivers/block/loop.c b/drivers/block/loop.c +index 19042b42a8baf..c31a76485c9cb 100644 +--- a/drivers/block/loop.c ++++ b/drivers/block/loop.c +@@ -795,33 +795,33 @@ static ssize_t loop_attr_backing_file_show(struct loop_device *lo, char *buf) + + static ssize_t loop_attr_offset_show(struct loop_device *lo, char *buf) + { +- return sprintf(buf, "%llu\n", (unsigned long long)lo->lo_offset); ++ return sysfs_emit(buf, "%llu\n", (unsigned long long)lo->lo_offset); + } + + static ssize_t loop_attr_sizelimit_show(struct loop_device *lo, char *buf) + { +- return sprintf(buf, "%llu\n", (unsigned long long)lo->lo_sizelimit); ++ return sysfs_emit(buf, "%llu\n", (unsigned long long)lo->lo_sizelimit); + } + + static ssize_t loop_attr_autoclear_show(struct loop_device *lo, char *buf) + { + int autoclear = (lo->lo_flags & LO_FLAGS_AUTOCLEAR); + +- return sprintf(buf, "%s\n", autoclear ? "1" : "0"); ++ return sysfs_emit(buf, "%s\n", autoclear ? "1" : "0"); + } + + static ssize_t loop_attr_partscan_show(struct loop_device *lo, char *buf) + { + int partscan = (lo->lo_flags & LO_FLAGS_PARTSCAN); + +- return sprintf(buf, "%s\n", partscan ? "1" : "0"); ++ return sysfs_emit(buf, "%s\n", partscan ? "1" : "0"); + } + + static ssize_t loop_attr_dio_show(struct loop_device *lo, char *buf) + { + int dio = (lo->lo_flags & LO_FLAGS_DIRECT_IO); + +- return sprintf(buf, "%s\n", dio ? "1" : "0"); ++ return sysfs_emit(buf, "%s\n", dio ? "1" : "0"); + } + + LOOP_ATTR_RO(backing_file); +diff --git a/drivers/block/virtio_blk.c b/drivers/block/virtio_blk.c +index dac1769146d7f..8b3bf11329ba0 100644 +--- a/drivers/block/virtio_blk.c ++++ b/drivers/block/virtio_blk.c +@@ -849,9 +849,17 @@ static int virtblk_probe(struct virtio_device *vdev) + err = virtio_cread_feature(vdev, VIRTIO_BLK_F_BLK_SIZE, + struct virtio_blk_config, blk_size, + &blk_size); +- if (!err) ++ if (!err) { ++ err = blk_validate_block_size(blk_size); ++ if (err) { ++ dev_err(&vdev->dev, ++ "virtio_blk: invalid block size: 0x%x\n", ++ blk_size); ++ goto out_free_tags; ++ } ++ + blk_queue_logical_block_size(q, blk_size); +- else ++ } else + blk_size = queue_logical_block_size(q); + + /* Use topology information if available */ +diff --git a/drivers/bluetooth/hci_serdev.c b/drivers/bluetooth/hci_serdev.c +index 7b3aade431e5e..9ebcf0d9e3957 100644 +--- a/drivers/bluetooth/hci_serdev.c ++++ b/drivers/bluetooth/hci_serdev.c +@@ -288,6 +288,8 @@ int hci_uart_register_device(struct hci_uart *hu, + if (err) + return err; + ++ percpu_init_rwsem(&hu->proto_lock); ++ + err = p->open(hu); + if (err) + goto err_open; +@@ -310,7 +312,6 @@ int hci_uart_register_device(struct hci_uart *hu, + + INIT_WORK(&hu->init_ready, hci_uart_init_work); + INIT_WORK(&hu->write_work, hci_uart_write_work); +- percpu_init_rwsem(&hu->proto_lock); + + /* Only when vendor specific setup callback is provided, consider + * the manufacturer information valid. This avoids filling in the +diff --git a/drivers/char/hw_random/atmel-rng.c b/drivers/char/hw_random/atmel-rng.c +index 433426242b875..40e6951ea0787 100644 +--- a/drivers/char/hw_random/atmel-rng.c ++++ b/drivers/char/hw_random/atmel-rng.c +@@ -96,6 +96,7 @@ static int atmel_trng_probe(struct platform_device *pdev) + + err_register: + clk_disable_unprepare(trng->clk); ++ atmel_trng_disable(trng); + return ret; + } + +diff --git a/drivers/char/tpm/tpm-chip.c b/drivers/char/tpm/tpm-chip.c +index f79f877942733..2d62a3649402f 100644 +--- a/drivers/char/tpm/tpm-chip.c ++++ b/drivers/char/tpm/tpm-chip.c +@@ -163,14 +163,6 @@ static void tpm_dev_release(struct device *dev) + kfree(chip); + } + +-static void tpm_devs_release(struct device *dev) +-{ +- struct tpm_chip *chip = container_of(dev, struct tpm_chip, devs); +- +- /* release the master device reference */ +- put_device(&chip->dev); +-} +- + /** + * tpm_class_shutdown() - prepare the TPM device for loss of power. + * @dev: device to which the chip is associated. +@@ -234,7 +226,6 @@ struct tpm_chip *tpm_chip_alloc(struct device *pdev, + chip->dev_num = rc; + + device_initialize(&chip->dev); +- device_initialize(&chip->devs); + + chip->dev.class = tpm_class; + chip->dev.class->shutdown_pre = tpm_class_shutdown; +@@ -242,29 +233,12 @@ struct tpm_chip *tpm_chip_alloc(struct device *pdev, + chip->dev.parent = pdev; + chip->dev.groups = chip->groups; + +- chip->devs.parent = pdev; +- chip->devs.class = tpmrm_class; +- chip->devs.release = tpm_devs_release; +- /* get extra reference on main device to hold on +- * behalf of devs. This holds the chip structure +- * while cdevs is in use. The corresponding put +- * is in the tpm_devs_release (TPM2 only) +- */ +- if (chip->flags & TPM_CHIP_FLAG_TPM2) +- get_device(&chip->dev); +- + if (chip->dev_num == 0) + chip->dev.devt = MKDEV(MISC_MAJOR, TPM_MINOR); + else + chip->dev.devt = MKDEV(MAJOR(tpm_devt), chip->dev_num); + +- chip->devs.devt = +- MKDEV(MAJOR(tpm_devt), chip->dev_num + TPM_NUM_DEVICES); +- + rc = dev_set_name(&chip->dev, "tpm%d", chip->dev_num); +- if (rc) +- goto out; +- rc = dev_set_name(&chip->devs, "tpmrm%d", chip->dev_num); + if (rc) + goto out; + +@@ -272,9 +246,7 @@ struct tpm_chip *tpm_chip_alloc(struct device *pdev, + chip->flags |= TPM_CHIP_FLAG_VIRTUAL; + + cdev_init(&chip->cdev, &tpm_fops); +- cdev_init(&chip->cdevs, &tpmrm_fops); + chip->cdev.owner = THIS_MODULE; +- chip->cdevs.owner = THIS_MODULE; + + rc = tpm2_init_space(&chip->work_space, TPM2_SPACE_BUFFER_SIZE); + if (rc) { +@@ -286,7 +258,6 @@ struct tpm_chip *tpm_chip_alloc(struct device *pdev, + return chip; + + out: +- put_device(&chip->devs); + put_device(&chip->dev); + return ERR_PTR(rc); + } +@@ -335,14 +306,9 @@ static int tpm_add_char_device(struct tpm_chip *chip) + } + + if (chip->flags & TPM_CHIP_FLAG_TPM2) { +- rc = cdev_device_add(&chip->cdevs, &chip->devs); +- if (rc) { +- dev_err(&chip->devs, +- "unable to cdev_device_add() %s, major %d, minor %d, err=%d\n", +- dev_name(&chip->devs), MAJOR(chip->devs.devt), +- MINOR(chip->devs.devt), rc); +- return rc; +- } ++ rc = tpm_devs_add(chip); ++ if (rc) ++ goto err_del_cdev; + } + + /* Make the chip available. */ +@@ -350,6 +316,10 @@ static int tpm_add_char_device(struct tpm_chip *chip) + idr_replace(&dev_nums_idr, chip, chip->dev_num); + mutex_unlock(&idr_lock); + ++ return 0; ++ ++err_del_cdev: ++ cdev_device_del(&chip->cdev, &chip->dev); + return rc; + } + +@@ -508,7 +478,7 @@ void tpm_chip_unregister(struct tpm_chip *chip) + hwrng_unregister(&chip->hwrng); + tpm_bios_log_teardown(chip); + if (chip->flags & TPM_CHIP_FLAG_TPM2) +- cdev_device_del(&chip->cdevs, &chip->devs); ++ tpm_devs_remove(chip); + tpm_del_char_device(chip); + } + EXPORT_SYMBOL_GPL(tpm_chip_unregister); +diff --git a/drivers/char/tpm/tpm.h b/drivers/char/tpm/tpm.h +index b9a30f0b88257..7b8e279c180b1 100644 +--- a/drivers/char/tpm/tpm.h ++++ b/drivers/char/tpm/tpm.h +@@ -605,6 +605,8 @@ int tpm2_prepare_space(struct tpm_chip *chip, struct tpm_space *space, u32 cc, + u8 *cmd); + int tpm2_commit_space(struct tpm_chip *chip, struct tpm_space *space, + u32 cc, u8 *buf, size_t *bufsiz); ++int tpm_devs_add(struct tpm_chip *chip); ++void tpm_devs_remove(struct tpm_chip *chip); + + void tpm_bios_log_setup(struct tpm_chip *chip); + void tpm_bios_log_teardown(struct tpm_chip *chip); +diff --git a/drivers/char/tpm/tpm2-space.c b/drivers/char/tpm/tpm2-space.c +index 205d930d7ea60..a54bb904b2816 100644 +--- a/drivers/char/tpm/tpm2-space.c ++++ b/drivers/char/tpm/tpm2-space.c +@@ -536,3 +536,68 @@ int tpm2_commit_space(struct tpm_chip *chip, struct tpm_space *space, + + return 0; + } ++ ++/* ++ * Put the reference to the main device. ++ */ ++static void tpm_devs_release(struct device *dev) ++{ ++ struct tpm_chip *chip = container_of(dev, struct tpm_chip, devs); ++ ++ /* release the master device reference */ ++ put_device(&chip->dev); ++} ++ ++/* ++ * Remove the device file for exposed TPM spaces and release the device ++ * reference. This may also release the reference to the master device. ++ */ ++void tpm_devs_remove(struct tpm_chip *chip) ++{ ++ cdev_device_del(&chip->cdevs, &chip->devs); ++ put_device(&chip->devs); ++} ++ ++/* ++ * Add a device file to expose TPM spaces. Also take a reference to the ++ * main device. ++ */ ++int tpm_devs_add(struct tpm_chip *chip) ++{ ++ int rc; ++ ++ device_initialize(&chip->devs); ++ chip->devs.parent = chip->dev.parent; ++ chip->devs.class = tpmrm_class; ++ ++ /* ++ * Get extra reference on main device to hold on behalf of devs. ++ * This holds the chip structure while cdevs is in use. The ++ * corresponding put is in the tpm_devs_release. ++ */ ++ get_device(&chip->dev); ++ chip->devs.release = tpm_devs_release; ++ chip->devs.devt = MKDEV(MAJOR(tpm_devt), chip->dev_num + TPM_NUM_DEVICES); ++ cdev_init(&chip->cdevs, &tpmrm_fops); ++ chip->cdevs.owner = THIS_MODULE; ++ ++ rc = dev_set_name(&chip->devs, "tpmrm%d", chip->dev_num); ++ if (rc) ++ goto err_put_devs; ++ ++ rc = cdev_device_add(&chip->cdevs, &chip->devs); ++ if (rc) { ++ dev_err(&chip->devs, ++ "unable to cdev_device_add() %s, major %d, minor %d, err=%d\n", ++ dev_name(&chip->devs), MAJOR(chip->devs.devt), ++ MINOR(chip->devs.devt), rc); ++ goto err_put_devs; ++ } ++ ++ return 0; ++ ++err_put_devs: ++ put_device(&chip->devs); ++ ++ return rc; ++} +diff --git a/drivers/char/virtio_console.c b/drivers/char/virtio_console.c +index cdf441942bae4..d3937d6904000 100644 +--- a/drivers/char/virtio_console.c ++++ b/drivers/char/virtio_console.c +@@ -1985,6 +1985,13 @@ static void virtcons_remove(struct virtio_device *vdev) + list_del(&portdev->list); + spin_unlock_irq(&pdrvdata_lock); + ++ /* Device is going away, exit any polling for buffers */ ++ virtio_break_device(vdev); ++ if (use_multiport(portdev)) ++ flush_work(&portdev->control_work); ++ else ++ flush_work(&portdev->config_work); ++ + /* Disable interrupts for vqs */ + vdev->config->reset(vdev); + /* Finish up work that's lined up */ +@@ -2258,7 +2265,7 @@ static struct virtio_driver virtio_rproc_serial = { + .remove = virtcons_remove, + }; + +-static int __init init(void) ++static int __init virtio_console_init(void) + { + int err; + +@@ -2295,7 +2302,7 @@ free: + return err; + } + +-static void __exit fini(void) ++static void __exit virtio_console_fini(void) + { + reclaim_dma_bufs(); + +@@ -2305,8 +2312,8 @@ static void __exit fini(void) + class_destroy(pdrvdata.class); + debugfs_remove_recursive(pdrvdata.debugfs_dir); + } +-module_init(init); +-module_exit(fini); ++module_init(virtio_console_init); ++module_exit(virtio_console_fini); + + MODULE_DESCRIPTION("Virtio console driver"); + MODULE_LICENSE("GPL"); +diff --git a/drivers/clk/actions/owl-s700.c b/drivers/clk/actions/owl-s700.c +index 5e9531392ee57..aa76b0c103735 100644 +--- a/drivers/clk/actions/owl-s700.c ++++ b/drivers/clk/actions/owl-s700.c +@@ -160,6 +160,7 @@ static struct clk_div_table hdmia_div_table[] = { + + static struct clk_div_table rmii_div_table[] = { + {0, 4}, {1, 10}, ++ {0, 0} + }; + + /* divider clocks */ +diff --git a/drivers/clk/actions/owl-s900.c b/drivers/clk/actions/owl-s900.c +index 7f60ed6afe639..460b33fc6c548 100644 +--- a/drivers/clk/actions/owl-s900.c ++++ b/drivers/clk/actions/owl-s900.c +@@ -138,7 +138,7 @@ static struct clk_div_table rmii_ref_div_table[] = { + + static struct clk_div_table usb3_mac_div_table[] = { + { 1, 2 }, { 2, 3 }, { 3, 4 }, +- { 0, 8 }, ++ { 0, 0 } + }; + + static struct clk_div_table i2s_div_table[] = { +diff --git a/drivers/clk/clk-clps711x.c b/drivers/clk/clk-clps711x.c +index 2c04396402ab4..50b42e91a1377 100644 +--- a/drivers/clk/clk-clps711x.c ++++ b/drivers/clk/clk-clps711x.c +@@ -32,11 +32,13 @@ static const struct clk_div_table spi_div_table[] = { + { .val = 1, .div = 8, }, + { .val = 2, .div = 2, }, + { .val = 3, .div = 1, }, ++ { /* sentinel */ } + }; + + static const struct clk_div_table timer_div_table[] = { + { .val = 0, .div = 256, }, + { .val = 1, .div = 1, }, ++ { /* sentinel */ } + }; + + struct clps711x_clk { +diff --git a/drivers/clk/clk.c b/drivers/clk/clk.c +index a9490c8e82a70..32606d1094fe4 100644 +--- a/drivers/clk/clk.c ++++ b/drivers/clk/clk.c +@@ -523,6 +523,24 @@ static void clk_core_get_boundaries(struct clk_core *core, + *max_rate = min(*max_rate, clk_user->max_rate); + } + ++static bool clk_core_check_boundaries(struct clk_core *core, ++ unsigned long min_rate, ++ unsigned long max_rate) ++{ ++ struct clk *user; ++ ++ lockdep_assert_held(&prepare_lock); ++ ++ if (min_rate > core->max_rate || max_rate < core->min_rate) ++ return false; ++ ++ hlist_for_each_entry(user, &core->clks, clks_node) ++ if (min_rate > user->max_rate || max_rate < user->min_rate) ++ return false; ++ ++ return true; ++} ++ + void clk_hw_set_rate_range(struct clk_hw *hw, unsigned long min_rate, + unsigned long max_rate) + { +@@ -2066,6 +2084,11 @@ int clk_set_rate_range(struct clk *clk, unsigned long min, unsigned long max) + clk->min_rate = min; + clk->max_rate = max; + ++ if (!clk_core_check_boundaries(clk->core, min, max)) { ++ ret = -EINVAL; ++ goto out; ++ } ++ + rate = clk_core_get_rate_nolock(clk->core); + if (rate < min || rate > max) { + /* +@@ -2094,6 +2117,7 @@ int clk_set_rate_range(struct clk *clk, unsigned long min, unsigned long max) + } + } + ++out: + if (clk->exclusive_count) + clk_core_rate_protect(clk->core); + +diff --git a/drivers/clk/loongson1/clk-loongson1c.c b/drivers/clk/loongson1/clk-loongson1c.c +index 3466f7320b40b..e3aa502761a31 100644 +--- a/drivers/clk/loongson1/clk-loongson1c.c ++++ b/drivers/clk/loongson1/clk-loongson1c.c +@@ -40,6 +40,7 @@ static const struct clk_div_table ahb_div_table[] = { + [1] = { .val = 1, .div = 4 }, + [2] = { .val = 2, .div = 3 }, + [3] = { .val = 3, .div = 3 }, ++ [4] = { /* sentinel */ } + }; + + void __init ls1x_clk_init(void) +diff --git a/drivers/clk/qcom/clk-rcg2.c b/drivers/clk/qcom/clk-rcg2.c +index f420f0c968775..04bd29d6aba13 100644 +--- a/drivers/clk/qcom/clk-rcg2.c ++++ b/drivers/clk/qcom/clk-rcg2.c +@@ -625,6 +625,7 @@ static const struct frac_entry frac_table_pixel[] = { + { 2, 9 }, + { 4, 9 }, + { 1, 1 }, ++ { 2, 3 }, + { } + }; + +diff --git a/drivers/clk/qcom/gcc-ipq8074.c b/drivers/clk/qcom/gcc-ipq8074.c +index 505c6263141d9..708c486a6e960 100644 +--- a/drivers/clk/qcom/gcc-ipq8074.c ++++ b/drivers/clk/qcom/gcc-ipq8074.c +@@ -1082,7 +1082,7 @@ static struct clk_rcg2 sdcc1_apps_clk_src = { + .name = "sdcc1_apps_clk_src", + .parent_names = gcc_xo_gpll0_gpll2_gpll0_out_main_div2, + .num_parents = 4, +- .ops = &clk_rcg2_ops, ++ .ops = &clk_rcg2_floor_ops, + }, + }; + +diff --git a/drivers/clk/qcom/gcc-msm8994.c b/drivers/clk/qcom/gcc-msm8994.c +index 53f0f369a33ed..4ec481efedc8f 100644 +--- a/drivers/clk/qcom/gcc-msm8994.c ++++ b/drivers/clk/qcom/gcc-msm8994.c +@@ -115,6 +115,7 @@ static struct clk_alpha_pll gpll4_early = { + + static struct clk_alpha_pll_postdiv gpll4 = { + .offset = 0x1dc0, ++ .width = 4, + .regs = clk_alpha_pll_regs[CLK_ALPHA_PLL_TYPE_DEFAULT], + .clkr.hw.init = &(struct clk_init_data) + { +diff --git a/drivers/clk/tegra/clk-emc.c b/drivers/clk/tegra/clk-emc.c +index 0621a3a82ea6c..7aeace88be6ea 100644 +--- a/drivers/clk/tegra/clk-emc.c ++++ b/drivers/clk/tegra/clk-emc.c +@@ -190,6 +190,7 @@ static struct tegra_emc *emc_ensure_emc_driver(struct tegra_clk_emc *tegra) + + tegra->emc = platform_get_drvdata(pdev); + if (!tegra->emc) { ++ put_device(&pdev->dev); + pr_err("%s: cannot find EMC driver\n", __func__); + return NULL; + } +diff --git a/drivers/clk/uniphier/clk-uniphier-fixed-rate.c b/drivers/clk/uniphier/clk-uniphier-fixed-rate.c +index 0ad0d46173c0e..225de2302cb76 100644 +--- a/drivers/clk/uniphier/clk-uniphier-fixed-rate.c ++++ b/drivers/clk/uniphier/clk-uniphier-fixed-rate.c +@@ -33,6 +33,7 @@ struct clk_hw *uniphier_clk_register_fixed_rate(struct device *dev, + + init.name = name; + init.ops = &clk_fixed_rate_ops; ++ init.flags = 0; + init.parent_names = NULL; + init.num_parents = 0; + +diff --git a/drivers/clocksource/acpi_pm.c b/drivers/clocksource/acpi_pm.c +index 1961e3539b576..05cc8d4e49adc 100644 +--- a/drivers/clocksource/acpi_pm.c ++++ b/drivers/clocksource/acpi_pm.c +@@ -230,8 +230,10 @@ static int __init parse_pmtmr(char *arg) + int ret; + + ret = kstrtouint(arg, 16, &base); +- if (ret) +- return ret; ++ if (ret) { ++ pr_warn("PMTMR: invalid 'pmtmr=' value: '%s'\n", arg); ++ return 1; ++ } + + pr_info("PMTMR IOPort override: 0x%04x -> 0x%04x\n", pmtmr_ioport, + base); +diff --git a/drivers/clocksource/timer-of.c b/drivers/clocksource/timer-of.c +index 6e2cb3693ed89..82bb0d39e8af0 100644 +--- a/drivers/clocksource/timer-of.c ++++ b/drivers/clocksource/timer-of.c +@@ -164,9 +164,9 @@ static __init int timer_of_base_init(struct device_node *np, + of_base->base = of_base->name ? + of_io_request_and_map(np, of_base->index, of_base->name) : + of_iomap(np, of_base->index); +- if (IS_ERR(of_base->base)) { +- pr_err("Failed to iomap (%s)\n", of_base->name); +- return PTR_ERR(of_base->base); ++ if (IS_ERR_OR_NULL(of_base->base)) { ++ pr_err("Failed to iomap (%s:%s)\n", np->name, of_base->name); ++ return of_base->base ? PTR_ERR(of_base->base) : -ENOMEM; + } + + return 0; +diff --git a/drivers/crypto/ccp/ccp-dmaengine.c b/drivers/crypto/ccp/ccp-dmaengine.c +index a83588d6ba72c..8209273eb85b5 100644 +--- a/drivers/crypto/ccp/ccp-dmaengine.c ++++ b/drivers/crypto/ccp/ccp-dmaengine.c +@@ -631,6 +631,20 @@ static int ccp_terminate_all(struct dma_chan *dma_chan) + return 0; + } + ++static void ccp_dma_release(struct ccp_device *ccp) ++{ ++ struct ccp_dma_chan *chan; ++ struct dma_chan *dma_chan; ++ unsigned int i; ++ ++ for (i = 0; i < ccp->cmd_q_count; i++) { ++ chan = ccp->ccp_dma_chan + i; ++ dma_chan = &chan->dma_chan; ++ tasklet_kill(&chan->cleanup_tasklet); ++ list_del_rcu(&dma_chan->device_node); ++ } ++} ++ + int ccp_dmaengine_register(struct ccp_device *ccp) + { + struct ccp_dma_chan *chan; +@@ -732,6 +746,7 @@ int ccp_dmaengine_register(struct ccp_device *ccp) + return 0; + + err_reg: ++ ccp_dma_release(ccp); + kmem_cache_destroy(ccp->dma_desc_cache); + + err_cache: +@@ -745,6 +760,7 @@ void ccp_dmaengine_unregister(struct ccp_device *ccp) + struct dma_device *dma_dev = &ccp->dma_dev; + + dma_async_device_unregister(dma_dev); ++ ccp_dma_release(ccp); + + kmem_cache_destroy(ccp->dma_desc_cache); + kmem_cache_destroy(ccp->dma_cmd_cache); +diff --git a/drivers/crypto/mxs-dcp.c b/drivers/crypto/mxs-dcp.c +index da834ae3586b6..2da6f38e2bcbc 100644 +--- a/drivers/crypto/mxs-dcp.c ++++ b/drivers/crypto/mxs-dcp.c +@@ -328,7 +328,7 @@ static int mxs_dcp_aes_block_crypt(struct crypto_async_request *arq) + memset(key + AES_KEYSIZE_128, 0, AES_KEYSIZE_128); + } + +- for_each_sg(req->src, src, sg_nents(src), i) { ++ for_each_sg(req->src, src, sg_nents(req->src), i) { + src_buf = sg_virt(src); + len = sg_dma_len(src); + tlen += len; +diff --git a/drivers/crypto/vmx/Kconfig b/drivers/crypto/vmx/Kconfig +index c3d524ea69987..f39eeca87932e 100644 +--- a/drivers/crypto/vmx/Kconfig ++++ b/drivers/crypto/vmx/Kconfig +@@ -1,7 +1,11 @@ + config CRYPTO_DEV_VMX_ENCRYPT + tristate "Encryption acceleration support on P8 CPU" + depends on CRYPTO_DEV_VMX ++ select CRYPTO_AES ++ select CRYPTO_CBC ++ select CRYPTO_CTR + select CRYPTO_GHASH ++ select CRYPTO_XTS + default m + help + Support for VMX cryptographic acceleration instructions on Power8 CPU. +diff --git a/drivers/dma/sh/shdma-base.c b/drivers/dma/sh/shdma-base.c +index 419c841aef34d..6b5626e299b22 100644 +--- a/drivers/dma/sh/shdma-base.c ++++ b/drivers/dma/sh/shdma-base.c +@@ -118,10 +118,8 @@ static dma_cookie_t shdma_tx_submit(struct dma_async_tx_descriptor *tx) + ret = pm_runtime_get(schan->dev); + + spin_unlock_irq(&schan->chan_lock); +- if (ret < 0) { ++ if (ret < 0) + dev_err(schan->dev, "%s(): GET = %d\n", __func__, ret); +- pm_runtime_put(schan->dev); +- } + + pm_runtime_barrier(schan->dev); + +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu.h b/drivers/gpu/drm/amd/amdgpu/amdgpu.h +index 447c4c7a36d68..acbd33fcb73d3 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu.h ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu.h +@@ -955,6 +955,8 @@ struct amdgpu_gfx { + DECLARE_BITMAP (pipe_reserve_bitmap, AMDGPU_MAX_COMPUTE_QUEUES); + }; + ++int amdgpu_file_to_fpriv(struct file *filp, struct amdgpu_fpriv **fpriv); ++ + int amdgpu_ib_get(struct amdgpu_device *adev, struct amdgpu_vm *vm, + unsigned size, struct amdgpu_ib *ib); + void amdgpu_ib_free(struct amdgpu_device *adev, struct amdgpu_ib *ib, +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gpuvm.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gpuvm.c +index f92597c292fe5..4488aad64643b 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gpuvm.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gpuvm.c +@@ -1044,11 +1044,15 @@ int amdgpu_amdkfd_gpuvm_acquire_process_vm(struct kgd_dev *kgd, + struct dma_fence **ef) + { + struct amdgpu_device *adev = get_amdgpu_device(kgd); +- struct drm_file *drm_priv = filp->private_data; +- struct amdgpu_fpriv *drv_priv = drm_priv->driver_priv; +- struct amdgpu_vm *avm = &drv_priv->vm; ++ struct amdgpu_fpriv *drv_priv; ++ struct amdgpu_vm *avm; + int ret; + ++ ret = amdgpu_file_to_fpriv(filp, &drv_priv); ++ if (ret) ++ return ret; ++ avm = &drv_priv->vm; ++ + /* Already a compute VM? */ + if (avm->process_info) + return -EINVAL; +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c +index 81001d8793221..023309296bfcd 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c +@@ -1469,6 +1469,7 @@ int amdgpu_cs_fence_to_handle_ioctl(struct drm_device *dev, void *data, + return 0; + + default: ++ dma_fence_put(fence); + return -EINVAL; + } + } +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c +index 63b1e325b45c5..b3b22a87b232b 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c +@@ -1132,6 +1132,22 @@ static const struct file_operations amdgpu_driver_kms_fops = { + #endif + }; + ++int amdgpu_file_to_fpriv(struct file *filp, struct amdgpu_fpriv **fpriv) ++{ ++ struct drm_file *file; ++ ++ if (!filp) ++ return -EINVAL; ++ ++ if (filp->f_op != &amdgpu_driver_kms_fops) { ++ return -EINVAL; ++ } ++ ++ file = filp->private_data; ++ *fpriv = file->driver_priv; ++ return 0; ++} ++ + static bool + amdgpu_get_crtc_scanout_position(struct drm_device *dev, unsigned int pipe, + bool in_vblank_irq, int *vpos, int *hpos, +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_gfx.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_gfx.c +index 239bf2a4b3c68..eeaa2e825858b 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_gfx.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_gfx.c +@@ -173,7 +173,7 @@ static int amdgpu_gfx_kiq_acquire(struct amdgpu_device *adev, + * adev->gfx.mec.num_pipe_per_mec + * adev->gfx.mec.num_queue_per_pipe; + +- while (queue_bit-- >= 0) { ++ while (--queue_bit >= 0) { + if (test_bit(queue_bit, adev->gfx.mec.queue_bitmap)) + continue; + +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_sched.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_sched.c +index 1cafe8d83a4db..0b70410488b66 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_sched.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_sched.c +@@ -54,16 +54,20 @@ static int amdgpu_sched_process_priority_override(struct amdgpu_device *adev, + enum drm_sched_priority priority) + { + struct file *filp = fget(fd); +- struct drm_file *file; + struct amdgpu_fpriv *fpriv; + struct amdgpu_ctx *ctx; + uint32_t id; ++ int r; + + if (!filp) + return -EINVAL; + +- file = filp->private_data; +- fpriv = file->driver_priv; ++ r = amdgpu_file_to_fpriv(filp, &fpriv); ++ if (r) { ++ fput(filp); ++ return r; ++ } ++ + idr_for_each_entry(&fpriv->ctx_mgr.ctx_handles, ctx, id) + amdgpu_ctx_priority_override(ctx, priority); + +diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_crat.c b/drivers/gpu/drm/amd/amdkfd/kfd_crat.c +index ee4996029a868..e2780643f4c32 100644 +--- a/drivers/gpu/drm/amd/amdkfd/kfd_crat.c ++++ b/drivers/gpu/drm/amd/amdkfd/kfd_crat.c +@@ -733,7 +733,7 @@ int kfd_create_crat_image_acpi(void **crat_image, size_t *size) + /* Fetch the CRAT table from ACPI */ + status = acpi_get_table(CRAT_SIGNATURE, 0, &crat_table); + if (status == AE_NOT_FOUND) { +- pr_warn("CRAT table not found\n"); ++ pr_info("CRAT table not found\n"); + return -ENODATA; + } else if (ACPI_FAILURE(status)) { + const char *err = acpi_format_exception(status); +diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c +index ed02bb6b2cd07..b2835cd41d3e2 100644 +--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c ++++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c +@@ -3593,6 +3593,9 @@ static void amdgpu_dm_connector_add_common_modes(struct drm_encoder *encoder, + mode = amdgpu_dm_create_common_mode(encoder, + common_modes[i].name, common_modes[i].w, + common_modes[i].h); ++ if (!mode) ++ continue; ++ + drm_mode_probed_add(connector, mode); + amdgpu_dm_connector->num_modes++; + } +diff --git a/drivers/gpu/drm/bridge/cdns-dsi.c b/drivers/gpu/drm/bridge/cdns-dsi.c +index ce9496d139869..0573c5250a414 100644 +--- a/drivers/gpu/drm/bridge/cdns-dsi.c ++++ b/drivers/gpu/drm/bridge/cdns-dsi.c +@@ -1604,6 +1604,7 @@ static const struct of_device_id cdns_dsi_of_match[] = { + { .compatible = "cdns,dsi" }, + { }, + }; ++MODULE_DEVICE_TABLE(of, cdns_dsi_of_match); + + static struct platform_driver cdns_dsi_platform_driver = { + .probe = cdns_dsi_drm_probe, +diff --git a/drivers/gpu/drm/bridge/sil-sii8620.c b/drivers/gpu/drm/bridge/sil-sii8620.c +index 1ea2a1b0fe375..ea433bb189ca2 100644 +--- a/drivers/gpu/drm/bridge/sil-sii8620.c ++++ b/drivers/gpu/drm/bridge/sil-sii8620.c +@@ -2122,7 +2122,7 @@ static void sii8620_init_rcp_input_dev(struct sii8620 *ctx) + if (ret) { + dev_err(ctx->dev, "Failed to register RC device\n"); + ctx->error = ret; +- rc_free_device(ctx->rc_dev); ++ rc_free_device(rc_dev); + return; + } + ctx->rc_dev = rc_dev; +diff --git a/drivers/gpu/drm/drm_edid.c b/drivers/gpu/drm/drm_edid.c +index 5c049483de23c..ef26095719c5e 100644 +--- a/drivers/gpu/drm/drm_edid.c ++++ b/drivers/gpu/drm/drm_edid.c +@@ -4323,7 +4323,8 @@ bool drm_detect_monitor_audio(struct edid *edid) + if (!edid_ext) + goto end; + +- has_audio = ((edid_ext[3] & EDID_BASIC_AUDIO) != 0); ++ has_audio = (edid_ext[0] == CEA_EXT && ++ (edid_ext[3] & EDID_BASIC_AUDIO) != 0); + + if (has_audio) { + DRM_DEBUG_KMS("Monitor has basic audio support\n"); +@@ -4501,16 +4502,8 @@ static void drm_parse_hdmi_deep_color_info(struct drm_connector *connector, + connector->name, dc_bpc); + info->bpc = dc_bpc; + +- /* +- * Deep color support mandates RGB444 support for all video +- * modes and forbids YCRCB422 support for all video modes per +- * HDMI 1.3 spec. +- */ +- info->color_formats = DRM_COLOR_FORMAT_RGB444; +- + /* YCRCB444 is optional according to spec. */ + if (hdmi[6] & DRM_EDID_HDMI_DC_Y444) { +- info->color_formats |= DRM_COLOR_FORMAT_YCRCB444; + DRM_DEBUG("%s: HDMI sink does YCRCB444 in deep color.\n", + connector->name); + } +diff --git a/drivers/gpu/drm/drm_panel_orientation_quirks.c b/drivers/gpu/drm/drm_panel_orientation_quirks.c +index 3b70a338e5b47..265df1e67eb3c 100644 +--- a/drivers/gpu/drm/drm_panel_orientation_quirks.c ++++ b/drivers/gpu/drm/drm_panel_orientation_quirks.c +@@ -133,6 +133,12 @@ static const struct dmi_system_id orientation_data[] = { + DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "MicroPC"), + }, + .driver_data = (void *)&lcd720x1280_rightside_up, ++ }, { /* GPD Win Max */ ++ .matches = { ++ DMI_EXACT_MATCH(DMI_SYS_VENDOR, "GPD"), ++ DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "G1619-01"), ++ }, ++ .driver_data = (void *)&lcd800x1280_rightside_up, + }, { /* + * GPD Pocket, note that the the DMI data is less generic then + * it seems, devices with a board-vendor of "AMI Corporation" +diff --git a/drivers/gpu/drm/imx/parallel-display.c b/drivers/gpu/drm/imx/parallel-display.c +index aefd04e18f935..e9dff31b377c4 100644 +--- a/drivers/gpu/drm/imx/parallel-display.c ++++ b/drivers/gpu/drm/imx/parallel-display.c +@@ -77,8 +77,10 @@ static int imx_pd_connector_get_modes(struct drm_connector *connector) + ret = of_get_drm_display_mode(np, &imxpd->mode, + &imxpd->bus_flags, + OF_USE_NATIVE_MODE); +- if (ret) ++ if (ret) { ++ drm_mode_destroy(connector->dev, mode); + return ret; ++ } + + drm_mode_copy(mode, &imxpd->mode); + mode->type |= DRM_MODE_TYPE_DRIVER | DRM_MODE_TYPE_PREFERRED, +diff --git a/drivers/gpu/drm/tegra/dsi.c b/drivers/gpu/drm/tegra/dsi.c +index ee6ca8fa1c655..e2903bf7821b1 100644 +--- a/drivers/gpu/drm/tegra/dsi.c ++++ b/drivers/gpu/drm/tegra/dsi.c +@@ -1456,8 +1456,10 @@ static int tegra_dsi_ganged_probe(struct tegra_dsi *dsi) + dsi->slave = platform_get_drvdata(gangster); + of_node_put(np); + +- if (!dsi->slave) ++ if (!dsi->slave) { ++ put_device(&gangster->dev); + return -EPROBE_DEFER; ++ } + + dsi->slave->master = dsi; + } +diff --git a/drivers/hid/i2c-hid/i2c-hid-core.c b/drivers/hid/i2c-hid/i2c-hid-core.c +index 19f4b807a5d1d..f5dc3122aff84 100644 +--- a/drivers/hid/i2c-hid/i2c-hid-core.c ++++ b/drivers/hid/i2c-hid/i2c-hid-core.c +@@ -632,6 +632,17 @@ static int i2c_hid_get_raw_report(struct hid_device *hid, + if (report_type == HID_OUTPUT_REPORT) + return -EINVAL; + ++ /* ++ * In case of unnumbered reports the response from the device will ++ * not have the report ID that the upper layers expect, so we need ++ * to stash it the buffer ourselves and adjust the data size. ++ */ ++ if (!report_number) { ++ buf[0] = 0; ++ buf++; ++ count--; ++ } ++ + /* +2 bytes to include the size of the reply in the query buffer */ + ask_count = min(count + 2, (size_t)ihid->bufsize); + +@@ -653,6 +664,9 @@ static int i2c_hid_get_raw_report(struct hid_device *hid, + count = min(count, ret_count - 2); + memcpy(buf, ihid->rawbuf + 2, count); + ++ if (!report_number) ++ count++; ++ + return count; + } + +@@ -669,17 +683,19 @@ static int i2c_hid_output_raw_report(struct hid_device *hid, __u8 *buf, + + mutex_lock(&ihid->reset_lock); + +- if (report_id) { +- buf++; +- count--; +- } +- ++ /* ++ * Note that both numbered and unnumbered reports passed here ++ * are supposed to have report ID stored in the 1st byte of the ++ * buffer, so we strip it off unconditionally before passing payload ++ * to i2c_hid_set_or_send_report which takes care of encoding ++ * everything properly. ++ */ + ret = i2c_hid_set_or_send_report(client, + report_type == HID_FEATURE_REPORT ? 0x03 : 0x02, +- report_id, buf, count, use_data); ++ report_id, buf + 1, count - 1, use_data); + +- if (report_id && ret >= 0) +- ret++; /* add report_id to the number of transfered bytes */ ++ if (ret >= 0) ++ ret++; /* add report_id to the number of transferred bytes */ + + mutex_unlock(&ihid->reset_lock); + +diff --git a/drivers/hv/hv_balloon.c b/drivers/hv/hv_balloon.c +index e5fc719a34e70..d442a8d2332eb 100644 +--- a/drivers/hv/hv_balloon.c ++++ b/drivers/hv/hv_balloon.c +@@ -1548,7 +1548,7 @@ static void balloon_onchannelcallback(void *context) + break; + + default: +- pr_warn("Unhandled message: type: %d\n", dm_hdr->type); ++ pr_warn_ratelimited("Unhandled message: type: %d\n", dm_hdr->type); + + } + } +diff --git a/drivers/hv/vmbus_drv.c b/drivers/hv/vmbus_drv.c +index 51fe219c91fc3..0c17743b4a65c 100644 +--- a/drivers/hv/vmbus_drv.c ++++ b/drivers/hv/vmbus_drv.c +@@ -2062,10 +2062,15 @@ static void __exit vmbus_exit(void) + if (ms_hyperv.misc_features & HV_FEATURE_GUEST_CRASH_MSR_AVAILABLE) { + kmsg_dump_unregister(&hv_kmsg_dumper); + unregister_die_notifier(&hyperv_die_block); +- atomic_notifier_chain_unregister(&panic_notifier_list, +- &hyperv_panic_block); + } + ++ /* ++ * The panic notifier is always registered, hence we should ++ * also unconditionally unregister it here as well. ++ */ ++ atomic_notifier_chain_unregister(&panic_notifier_list, ++ &hyperv_panic_block); ++ + free_page((unsigned long)hv_panic_page); + unregister_sysctl_table(hv_ctl_table_hdr); + hv_ctl_table_hdr = NULL; +diff --git a/drivers/hwmon/pmbus/pmbus.h b/drivers/hwmon/pmbus/pmbus.h +index 1d24397d36ecd..9d731de852c62 100644 +--- a/drivers/hwmon/pmbus/pmbus.h ++++ b/drivers/hwmon/pmbus/pmbus.h +@@ -291,6 +291,7 @@ enum pmbus_fan_mode { percent = 0, rpm }; + /* + * STATUS_VOUT, STATUS_INPUT + */ ++#define PB_VOLTAGE_VIN_OFF BIT(3) + #define PB_VOLTAGE_UV_FAULT BIT(4) + #define PB_VOLTAGE_UV_WARNING BIT(5) + #define PB_VOLTAGE_OV_WARNING BIT(6) +diff --git a/drivers/hwmon/pmbus/pmbus_core.c b/drivers/hwmon/pmbus/pmbus_core.c +index cd24b375df1ee..bef28e9559530 100644 +--- a/drivers/hwmon/pmbus/pmbus_core.c ++++ b/drivers/hwmon/pmbus/pmbus_core.c +@@ -1337,7 +1337,7 @@ static const struct pmbus_limit_attr vin_limit_attrs[] = { + .reg = PMBUS_VIN_UV_FAULT_LIMIT, + .attr = "lcrit", + .alarm = "lcrit_alarm", +- .sbit = PB_VOLTAGE_UV_FAULT, ++ .sbit = PB_VOLTAGE_UV_FAULT | PB_VOLTAGE_VIN_OFF, + }, { + .reg = PMBUS_VIN_OV_WARN_LIMIT, + .attr = "max", +@@ -2074,10 +2074,14 @@ static int pmbus_regulator_is_enabled(struct regulator_dev *rdev) + { + struct device *dev = rdev_get_dev(rdev); + struct i2c_client *client = to_i2c_client(dev->parent); ++ struct pmbus_data *data = i2c_get_clientdata(client); + u8 page = rdev_get_id(rdev); + int ret; + ++ mutex_lock(&data->update_lock); + ret = pmbus_read_byte_data(client, page, PMBUS_OPERATION); ++ mutex_unlock(&data->update_lock); ++ + if (ret < 0) + return ret; + +@@ -2088,11 +2092,17 @@ static int _pmbus_regulator_on_off(struct regulator_dev *rdev, bool enable) + { + struct device *dev = rdev_get_dev(rdev); + struct i2c_client *client = to_i2c_client(dev->parent); ++ struct pmbus_data *data = i2c_get_clientdata(client); + u8 page = rdev_get_id(rdev); ++ int ret; + +- return pmbus_update_byte_data(client, page, PMBUS_OPERATION, +- PB_OPERATION_CONTROL_ON, +- enable ? PB_OPERATION_CONTROL_ON : 0); ++ mutex_lock(&data->update_lock); ++ ret = pmbus_update_byte_data(client, page, PMBUS_OPERATION, ++ PB_OPERATION_CONTROL_ON, ++ enable ? PB_OPERATION_CONTROL_ON : 0); ++ mutex_unlock(&data->update_lock); ++ ++ return ret; + } + + static int pmbus_regulator_enable(struct regulator_dev *rdev) +diff --git a/drivers/hwmon/sch56xx-common.c b/drivers/hwmon/sch56xx-common.c +index bda3d52855861..e1c4e6937a645 100644 +--- a/drivers/hwmon/sch56xx-common.c ++++ b/drivers/hwmon/sch56xx-common.c +@@ -437,7 +437,7 @@ struct sch56xx_watchdog_data *sch56xx_watchdog_register(struct device *parent, + if (nowayout) + set_bit(WDOG_NO_WAY_OUT, &data->wddev.status); + if (output_enable & SCH56XX_WDOG_OUTPUT_ENABLE) +- set_bit(WDOG_ACTIVE, &data->wddev.status); ++ set_bit(WDOG_HW_RUNNING, &data->wddev.status); + + /* Since the watchdog uses a downcounter there is no register to read + the BIOS set timeout from (if any was set at all) -> +diff --git a/drivers/hwtracing/coresight/coresight-etm4x-sysfs.c b/drivers/hwtracing/coresight/coresight-etm4x-sysfs.c +index f5fb1e7a9c172..dc3d30ca1188c 100644 +--- a/drivers/hwtracing/coresight/coresight-etm4x-sysfs.c ++++ b/drivers/hwtracing/coresight/coresight-etm4x-sysfs.c +@@ -367,8 +367,12 @@ static ssize_t mode_store(struct device *dev, + mode = ETM_MODE_QELEM(config->mode); + /* start by clearing QE bits */ + config->cfg &= ~(BIT(13) | BIT(14)); +- /* if supported, Q elements with instruction counts are enabled */ +- if ((mode & BIT(0)) && (drvdata->q_support & BIT(0))) ++ /* ++ * if supported, Q elements with instruction counts are enabled. ++ * Always set the low bit for any requested mode. Valid combos are ++ * 0b00, 0b01 and 0b11. ++ */ ++ if (mode && drvdata->q_support) + config->cfg |= BIT(13); + /* + * if supported, Q elements with and without instruction +diff --git a/drivers/i2c/busses/i2c-xiic.c b/drivers/i2c/busses/i2c-xiic.c +index 8d6b6eeef71c4..52acb185a29cf 100644 +--- a/drivers/i2c/busses/i2c-xiic.c ++++ b/drivers/i2c/busses/i2c-xiic.c +@@ -724,7 +724,6 @@ static const struct i2c_adapter_quirks xiic_quirks = { + + static const struct i2c_adapter xiic_adapter = { + .owner = THIS_MODULE, +- .name = DRIVER_NAME, + .class = I2C_CLASS_DEPRECATED, + .algo = &xiic_algorithm, + .quirks = &xiic_quirks, +@@ -761,6 +760,8 @@ static int xiic_i2c_probe(struct platform_device *pdev) + i2c_set_adapdata(&i2c->adap, i2c); + i2c->adap.dev.parent = &pdev->dev; + i2c->adap.dev.of_node = pdev->dev.of_node; ++ snprintf(i2c->adap.name, sizeof(i2c->adap.name), ++ DRIVER_NAME " %s", pdev->name); + + mutex_init(&i2c->lock); + init_waitqueue_head(&i2c->wait); +diff --git a/drivers/i2c/muxes/i2c-demux-pinctrl.c b/drivers/i2c/muxes/i2c-demux-pinctrl.c +index 9ba9ce5696e12..1b99d0b928a0d 100644 +--- a/drivers/i2c/muxes/i2c-demux-pinctrl.c ++++ b/drivers/i2c/muxes/i2c-demux-pinctrl.c +@@ -262,7 +262,7 @@ static int i2c_demux_pinctrl_probe(struct platform_device *pdev) + + err = device_create_file(&pdev->dev, &dev_attr_available_masters); + if (err) +- goto err_rollback; ++ goto err_rollback_activation; + + err = device_create_file(&pdev->dev, &dev_attr_current_master); + if (err) +@@ -272,8 +272,9 @@ static int i2c_demux_pinctrl_probe(struct platform_device *pdev) + + err_rollback_available: + device_remove_file(&pdev->dev, &dev_attr_available_masters); +-err_rollback: ++err_rollback_activation: + i2c_demux_deactivate_master(priv); ++err_rollback: + for (j = 0; j < i; j++) { + of_node_put(priv->chan[j].parent_np); + of_changeset_destroy(&priv->chan[j].chgset); +diff --git a/drivers/iio/adc/twl6030-gpadc.c b/drivers/iio/adc/twl6030-gpadc.c +index e470510e76ea4..765aaee157e28 100644 +--- a/drivers/iio/adc/twl6030-gpadc.c ++++ b/drivers/iio/adc/twl6030-gpadc.c +@@ -927,6 +927,8 @@ static int twl6030_gpadc_probe(struct platform_device *pdev) + ret = devm_request_threaded_irq(dev, irq, NULL, + twl6030_gpadc_irq_handler, + IRQF_ONESHOT, "twl6030_gpadc", indio_dev); ++ if (ret) ++ return ret; + + ret = twl6030_gpadc_enable_irq(TWL6030_GPADC_RT_SW1_EOC_MASK); + if (ret < 0) { +diff --git a/drivers/iio/afe/iio-rescale.c b/drivers/iio/afe/iio-rescale.c +index e9ceee66d1e7c..d9c41db8155f9 100644 +--- a/drivers/iio/afe/iio-rescale.c ++++ b/drivers/iio/afe/iio-rescale.c +@@ -38,7 +38,7 @@ static int rescale_read_raw(struct iio_dev *indio_dev, + int *val, int *val2, long mask) + { + struct rescale *rescale = iio_priv(indio_dev); +- unsigned long long tmp; ++ s64 tmp; + int ret; + + switch (mask) { +@@ -59,10 +59,10 @@ static int rescale_read_raw(struct iio_dev *indio_dev, + *val2 = rescale->denominator; + return IIO_VAL_FRACTIONAL; + case IIO_VAL_FRACTIONAL_LOG2: +- tmp = *val * 1000000000LL; +- do_div(tmp, rescale->denominator); ++ tmp = (s64)*val * 1000000000LL; ++ tmp = div_s64(tmp, rescale->denominator); + tmp *= rescale->numerator; +- do_div(tmp, 1000000000LL); ++ tmp = div_s64(tmp, 1000000000LL); + *val = tmp; + return ret; + default: +diff --git a/drivers/iio/inkern.c b/drivers/iio/inkern.c +index 06ca3f7fcc445..a8ccc6e5a7735 100644 +--- a/drivers/iio/inkern.c ++++ b/drivers/iio/inkern.c +@@ -591,28 +591,50 @@ EXPORT_SYMBOL_GPL(iio_read_channel_average_raw); + static int iio_convert_raw_to_processed_unlocked(struct iio_channel *chan, + int raw, int *processed, unsigned int scale) + { +- int scale_type, scale_val, scale_val2, offset; ++ int scale_type, scale_val, scale_val2; ++ int offset_type, offset_val, offset_val2; + s64 raw64 = raw; +- int ret; + +- ret = iio_channel_read(chan, &offset, NULL, IIO_CHAN_INFO_OFFSET); +- if (ret >= 0) +- raw64 += offset; ++ offset_type = iio_channel_read(chan, &offset_val, &offset_val2, ++ IIO_CHAN_INFO_OFFSET); ++ if (offset_type >= 0) { ++ switch (offset_type) { ++ case IIO_VAL_INT: ++ break; ++ case IIO_VAL_INT_PLUS_MICRO: ++ case IIO_VAL_INT_PLUS_NANO: ++ /* ++ * Both IIO_VAL_INT_PLUS_MICRO and IIO_VAL_INT_PLUS_NANO ++ * implicitely truncate the offset to it's integer form. ++ */ ++ break; ++ case IIO_VAL_FRACTIONAL: ++ offset_val /= offset_val2; ++ break; ++ case IIO_VAL_FRACTIONAL_LOG2: ++ offset_val >>= offset_val2; ++ break; ++ default: ++ return -EINVAL; ++ } ++ ++ raw64 += offset_val; ++ } + + scale_type = iio_channel_read(chan, &scale_val, &scale_val2, + IIO_CHAN_INFO_SCALE); + if (scale_type < 0) { + /* +- * Just pass raw values as processed if no scaling is +- * available. ++ * If no channel scaling is available apply consumer scale to ++ * raw value and return. + */ +- *processed = raw; ++ *processed = raw * scale; + return 0; + } + + switch (scale_type) { + case IIO_VAL_INT: +- *processed = raw64 * scale_val; ++ *processed = raw64 * scale_val * scale; + break; + case IIO_VAL_INT_PLUS_MICRO: + if (scale_val2 < 0) +diff --git a/drivers/input/input.c b/drivers/input/input.c +index b031174c8d7f7..a0d90022fcf73 100644 +--- a/drivers/input/input.c ++++ b/drivers/input/input.c +@@ -2118,12 +2118,6 @@ int input_register_device(struct input_dev *dev) + /* KEY_RESERVED is not supposed to be transmitted to userspace. */ + __clear_bit(KEY_RESERVED, dev->keybit); + +- /* Buttonpads should not map BTN_RIGHT and/or BTN_MIDDLE. */ +- if (test_bit(INPUT_PROP_BUTTONPAD, dev->propbit)) { +- __clear_bit(BTN_RIGHT, dev->keybit); +- __clear_bit(BTN_MIDDLE, dev->keybit); +- } +- + /* Make sure that bitmasks not mentioned in dev->evbit are clean. */ + input_cleanse_bitmasks(dev); + +diff --git a/drivers/iommu/arm-smmu-v3.c b/drivers/iommu/arm-smmu-v3.c +index 6b7664052b5be..9f16f47e70219 100644 +--- a/drivers/iommu/arm-smmu-v3.c ++++ b/drivers/iommu/arm-smmu-v3.c +@@ -1250,6 +1250,7 @@ static irqreturn_t arm_smmu_evtq_thread(int irq, void *dev) + dev_info(smmu->dev, "\t0x%016llx\n", + (unsigned long long)evt[i]); + ++ cond_resched(); + } + + /* +diff --git a/drivers/irqchip/irq-gic-v3.c b/drivers/irqchip/irq-gic-v3.c +index ac888d7a0b00a..05b9a4cdc8fd5 100644 +--- a/drivers/irqchip/irq-gic-v3.c ++++ b/drivers/irqchip/irq-gic-v3.c +@@ -95,11 +95,11 @@ static inline void __iomem *gic_dist_base(struct irq_data *d) + return NULL; + } + +-static void gic_do_wait_for_rwp(void __iomem *base) ++static void gic_do_wait_for_rwp(void __iomem *base, u32 bit) + { + u32 count = 1000000; /* 1s! */ + +- while (readl_relaxed(base + GICD_CTLR) & GICD_CTLR_RWP) { ++ while (readl_relaxed(base + GICD_CTLR) & bit) { + count--; + if (!count) { + pr_err_ratelimited("RWP timeout, gone fishing\n"); +@@ -113,13 +113,13 @@ static void gic_do_wait_for_rwp(void __iomem *base) + /* Wait for completion of a distributor change */ + static void gic_dist_wait_for_rwp(void) + { +- gic_do_wait_for_rwp(gic_data.dist_base); ++ gic_do_wait_for_rwp(gic_data.dist_base, GICD_CTLR_RWP); + } + + /* Wait for completion of a redistributor change */ + static void gic_redist_wait_for_rwp(void) + { +- gic_do_wait_for_rwp(gic_data_rdist_rd_base()); ++ gic_do_wait_for_rwp(gic_data_rdist_rd_base(), GICR_CTLR_RWP); + } + + #ifdef CONFIG_ARM64 +diff --git a/drivers/irqchip/irq-nvic.c b/drivers/irqchip/irq-nvic.c +index 9694529b709de..330beb62d015c 100644 +--- a/drivers/irqchip/irq-nvic.c ++++ b/drivers/irqchip/irq-nvic.c +@@ -108,6 +108,7 @@ static int __init nvic_of_init(struct device_node *node, + + if (!nvic_irq_domain) { + pr_warn("Failed to allocate irq domain\n"); ++ iounmap(nvic_base); + return -ENOMEM; + } + +@@ -117,6 +118,7 @@ static int __init nvic_of_init(struct device_node *node, + if (ret) { + pr_warn("Failed to allocate irq chips\n"); + irq_domain_remove(nvic_irq_domain); ++ iounmap(nvic_base); + return ret; + } + +diff --git a/drivers/irqchip/qcom-pdc.c b/drivers/irqchip/qcom-pdc.c +index faa7d61b9d6c4..239a889df6080 100644 +--- a/drivers/irqchip/qcom-pdc.c ++++ b/drivers/irqchip/qcom-pdc.c +@@ -50,17 +50,18 @@ static u32 pdc_reg_read(int reg, u32 i) + static void pdc_enable_intr(struct irq_data *d, bool on) + { + int pin_out = d->hwirq; ++ unsigned long flags; + u32 index, mask; + u32 enable; + + index = pin_out / 32; + mask = pin_out % 32; + +- raw_spin_lock(&pdc_lock); ++ raw_spin_lock_irqsave(&pdc_lock, flags); + enable = pdc_reg_read(IRQ_ENABLE_BANK, index); + enable = on ? ENABLE_INTR(enable, mask) : CLEAR_INTR(enable, mask); + pdc_reg_write(IRQ_ENABLE_BANK, index, enable); +- raw_spin_unlock(&pdc_lock); ++ raw_spin_unlock_irqrestore(&pdc_lock, flags); + } + + static void qcom_pdc_gic_mask(struct irq_data *d) +diff --git a/drivers/md/dm-crypt.c b/drivers/md/dm-crypt.c +index a6a26f8e4d8e1..3441ad140b583 100644 +--- a/drivers/md/dm-crypt.c ++++ b/drivers/md/dm-crypt.c +@@ -2107,7 +2107,7 @@ static int crypt_set_keyring_key(struct crypt_config *cc, const char *key_string + + static int get_key_size(char **key_string) + { +- return (*key_string[0] == ':') ? -EINVAL : strlen(*key_string) >> 1; ++ return (*key_string[0] == ':') ? -EINVAL : (int)(strlen(*key_string) >> 1); + } + + #endif +diff --git a/drivers/md/dm-ioctl.c b/drivers/md/dm-ioctl.c +index 17cbad58834fc..0aae4a46db662 100644 +--- a/drivers/md/dm-ioctl.c ++++ b/drivers/md/dm-ioctl.c +@@ -17,6 +17,7 @@ + #include + #include + #include ++#include + + #include + +@@ -1670,6 +1671,7 @@ static ioctl_fn lookup_ioctl(unsigned int cmd, int *ioctl_flags) + if (unlikely(cmd >= ARRAY_SIZE(_ioctls))) + return NULL; + ++ cmd = array_index_nospec(cmd, ARRAY_SIZE(_ioctls)); + *ioctl_flags = _ioctls[cmd].flags; + return _ioctls[cmd].fn; + } +diff --git a/drivers/media/pci/cx88/cx88-mpeg.c b/drivers/media/pci/cx88/cx88-mpeg.c +index 52ff00ebd4bda..281eca5253406 100644 +--- a/drivers/media/pci/cx88/cx88-mpeg.c ++++ b/drivers/media/pci/cx88/cx88-mpeg.c +@@ -171,6 +171,9 @@ int cx8802_start_dma(struct cx8802_dev *dev, + cx_write(MO_TS_GPCNTRL, GP_COUNT_CONTROL_RESET); + q->count = 0; + ++ /* clear interrupt status register */ ++ cx_write(MO_TS_INTSTAT, 0x1f1111); ++ + /* enable irqs */ + dprintk(1, "setting the interrupt mask\n"); + cx_set(MO_PCI_INTMSK, core->pci_irqmask | PCI_INT_TSINT); +diff --git a/drivers/media/platform/coda/coda-common.c b/drivers/media/platform/coda/coda-common.c +index fccc771d23a51..5f8da544b98d5 100644 +--- a/drivers/media/platform/coda/coda-common.c ++++ b/drivers/media/platform/coda/coda-common.c +@@ -376,6 +376,7 @@ static struct vdoa_data *coda_get_vdoa_data(void) + if (!vdoa_data) + vdoa_data = ERR_PTR(-EPROBE_DEFER); + ++ put_device(&vdoa_pdev->dev); + out: + if (vdoa_node) + of_node_put(vdoa_node); +diff --git a/drivers/media/platform/davinci/vpif.c b/drivers/media/platform/davinci/vpif.c +index 16352e2263d2d..00ce9f276becd 100644 +--- a/drivers/media/platform/davinci/vpif.c ++++ b/drivers/media/platform/davinci/vpif.c +@@ -496,6 +496,7 @@ static int vpif_probe(struct platform_device *pdev) + + static int vpif_remove(struct platform_device *pdev) + { ++ pm_runtime_put(&pdev->dev); + pm_runtime_disable(&pdev->dev); + return 0; + } +diff --git a/drivers/media/usb/em28xx/em28xx-cards.c b/drivers/media/usb/em28xx/em28xx-cards.c +index 06da08f8efdb1..b14bff7b4ec88 100644 +--- a/drivers/media/usb/em28xx/em28xx-cards.c ++++ b/drivers/media/usb/em28xx/em28xx-cards.c +@@ -3822,6 +3822,8 @@ static int em28xx_usb_probe(struct usb_interface *intf, + goto err_free; + } + ++ kref_init(&dev->ref); ++ + dev->devno = nr; + dev->model = id->driver_info; + dev->alt = -1; +@@ -3922,6 +3924,8 @@ static int em28xx_usb_probe(struct usb_interface *intf, + } + + if (dev->board.has_dual_ts && em28xx_duplicate_dev(dev) == 0) { ++ kref_init(&dev->dev_next->ref); ++ + dev->dev_next->ts = SECONDARY_TS; + dev->dev_next->alt = -1; + dev->dev_next->is_audio_only = has_vendor_audio && +@@ -3976,12 +3980,8 @@ static int em28xx_usb_probe(struct usb_interface *intf, + em28xx_write_reg(dev, 0x0b, 0x82); + mdelay(100); + } +- +- kref_init(&dev->dev_next->ref); + } + +- kref_init(&dev->ref); +- + request_modules(dev); + + /* +@@ -4036,11 +4036,8 @@ static void em28xx_usb_disconnect(struct usb_interface *intf) + + em28xx_close_extension(dev); + +- if (dev->dev_next) { +- em28xx_close_extension(dev->dev_next); ++ if (dev->dev_next) + em28xx_release_resources(dev->dev_next); +- } +- + em28xx_release_resources(dev); + + if (dev->dev_next) { +diff --git a/drivers/media/usb/go7007/s2250-board.c b/drivers/media/usb/go7007/s2250-board.c +index 1466db150d82c..625e77f4dbd2e 100644 +--- a/drivers/media/usb/go7007/s2250-board.c ++++ b/drivers/media/usb/go7007/s2250-board.c +@@ -512,6 +512,7 @@ static int s2250_probe(struct i2c_client *client, + u8 *data; + struct go7007 *go = i2c_get_adapdata(adapter); + struct go7007_usb *usb = go->hpi_context; ++ int err = -EIO; + + audio = i2c_new_dummy(adapter, TLV320_ADDRESS >> 1); + if (audio == NULL) +@@ -540,11 +541,8 @@ static int s2250_probe(struct i2c_client *client, + V4L2_CID_HUE, -512, 511, 1, 0); + sd->ctrl_handler = &state->hdl; + if (state->hdl.error) { +- int err = state->hdl.error; +- +- v4l2_ctrl_handler_free(&state->hdl); +- kfree(state); +- return err; ++ err = state->hdl.error; ++ goto fail; + } + + state->std = V4L2_STD_NTSC; +@@ -608,7 +606,7 @@ fail: + i2c_unregister_device(audio); + v4l2_ctrl_handler_free(&state->hdl); + kfree(state); +- return -EIO; ++ return err; + } + + static int s2250_remove(struct i2c_client *client) +diff --git a/drivers/media/usb/hdpvr/hdpvr-video.c b/drivers/media/usb/hdpvr/hdpvr-video.c +index 0615996572e41..ce46f87214708 100644 +--- a/drivers/media/usb/hdpvr/hdpvr-video.c ++++ b/drivers/media/usb/hdpvr/hdpvr-video.c +@@ -312,7 +312,6 @@ static int hdpvr_start_streaming(struct hdpvr_device *dev) + + dev->status = STATUS_STREAMING; + +- INIT_WORK(&dev->worker, hdpvr_transmit_buffers); + schedule_work(&dev->worker); + + v4l2_dbg(MSG_BUFFER, hdpvr_debug, &dev->v4l2_dev, +@@ -1175,6 +1174,9 @@ int hdpvr_register_videodev(struct hdpvr_device *dev, struct device *parent, + bool ac3 = dev->flags & HDPVR_FLAG_AC3_CAP; + int res; + ++ // initialize dev->worker ++ INIT_WORK(&dev->worker, hdpvr_transmit_buffers); ++ + dev->cur_std = V4L2_STD_525_60; + dev->width = 720; + dev->height = 480; +diff --git a/drivers/media/usb/stk1160/stk1160-core.c b/drivers/media/usb/stk1160/stk1160-core.c +index bb0db4cdc6c75..271994bfe9c56 100644 +--- a/drivers/media/usb/stk1160/stk1160-core.c ++++ b/drivers/media/usb/stk1160/stk1160-core.c +@@ -413,7 +413,7 @@ static void stk1160_disconnect(struct usb_interface *interface) + /* Here is the only place where isoc get released */ + stk1160_uninit_isoc(dev); + +- stk1160_clear_queue(dev); ++ stk1160_clear_queue(dev, VB2_BUF_STATE_ERROR); + + video_unregister_device(&dev->vdev); + v4l2_device_disconnect(&dev->v4l2_dev); +diff --git a/drivers/media/usb/stk1160/stk1160-v4l.c b/drivers/media/usb/stk1160/stk1160-v4l.c +index 504e413edcd25..381f9f189bb73 100644 +--- a/drivers/media/usb/stk1160/stk1160-v4l.c ++++ b/drivers/media/usb/stk1160/stk1160-v4l.c +@@ -269,7 +269,7 @@ out_uninit: + stk1160_uninit_isoc(dev); + out_stop_hw: + usb_set_interface(dev->udev, 0, 0); +- stk1160_clear_queue(dev); ++ stk1160_clear_queue(dev, VB2_BUF_STATE_QUEUED); + + mutex_unlock(&dev->v4l_lock); + +@@ -317,7 +317,7 @@ static int stk1160_stop_streaming(struct stk1160 *dev) + + stk1160_stop_hw(dev); + +- stk1160_clear_queue(dev); ++ stk1160_clear_queue(dev, VB2_BUF_STATE_ERROR); + + stk1160_dbg("streaming stopped\n"); + +@@ -762,7 +762,7 @@ static const struct video_device v4l_template = { + /********************************************************************/ + + /* Must be called with both v4l_lock and vb_queue_lock hold */ +-void stk1160_clear_queue(struct stk1160 *dev) ++void stk1160_clear_queue(struct stk1160 *dev, enum vb2_buffer_state vb2_state) + { + struct stk1160_buffer *buf; + unsigned long flags; +@@ -773,7 +773,7 @@ void stk1160_clear_queue(struct stk1160 *dev) + buf = list_first_entry(&dev->avail_bufs, + struct stk1160_buffer, list); + list_del(&buf->list); +- vb2_buffer_done(&buf->vb.vb2_buf, VB2_BUF_STATE_ERROR); ++ vb2_buffer_done(&buf->vb.vb2_buf, vb2_state); + stk1160_dbg("buffer [%p/%d] aborted\n", + buf, buf->vb.vb2_buf.index); + } +@@ -783,7 +783,7 @@ void stk1160_clear_queue(struct stk1160 *dev) + buf = dev->isoc_ctl.buf; + dev->isoc_ctl.buf = NULL; + +- vb2_buffer_done(&buf->vb.vb2_buf, VB2_BUF_STATE_ERROR); ++ vb2_buffer_done(&buf->vb.vb2_buf, vb2_state); + stk1160_dbg("buffer [%p/%d] aborted\n", + buf, buf->vb.vb2_buf.index); + } +diff --git a/drivers/media/usb/stk1160/stk1160.h b/drivers/media/usb/stk1160/stk1160.h +index acd1c811db08a..54a046aacd331 100644 +--- a/drivers/media/usb/stk1160/stk1160.h ++++ b/drivers/media/usb/stk1160/stk1160.h +@@ -177,7 +177,7 @@ struct regval { + int stk1160_vb2_setup(struct stk1160 *dev); + int stk1160_video_register(struct stk1160 *dev); + void stk1160_video_unregister(struct stk1160 *dev); +-void stk1160_clear_queue(struct stk1160 *dev); ++void stk1160_clear_queue(struct stk1160 *dev, enum vb2_buffer_state vb2_state); + + /* Provided by stk1160-video.c */ + int stk1160_alloc_isoc(struct stk1160 *dev); +diff --git a/drivers/memory/emif.c b/drivers/memory/emif.c +index 1c6b2cc6269ad..45f78b38b0da5 100644 +--- a/drivers/memory/emif.c ++++ b/drivers/memory/emif.c +@@ -1425,7 +1425,7 @@ static struct emif_data *__init_or_module get_device_details( + temp = devm_kzalloc(dev, sizeof(*pd), GFP_KERNEL); + dev_info = devm_kzalloc(dev, sizeof(*dev_info), GFP_KERNEL); + +- if (!emif || !pd || !dev_info) { ++ if (!emif || !temp || !dev_info) { + dev_err(dev, "%s:%d: allocation error\n", __func__, __LINE__); + goto error; + } +@@ -1517,7 +1517,7 @@ static int __init_or_module emif_probe(struct platform_device *pdev) + { + struct emif_data *emif; + struct resource *res; +- int irq; ++ int irq, ret; + + if (pdev->dev.of_node) + emif = of_get_memory_device_details(pdev->dev.of_node, &pdev->dev); +@@ -1551,7 +1551,9 @@ static int __init_or_module emif_probe(struct platform_device *pdev) + emif_onetime_settings(emif); + emif_debugfs_init(emif); + disable_and_clear_all_interrupts(emif); +- setup_interrupts(emif, irq); ++ ret = setup_interrupts(emif, irq); ++ if (ret) ++ goto error; + + /* One-time actions taken on probing the first device */ + if (!emif1) { +diff --git a/drivers/mfd/asic3.c b/drivers/mfd/asic3.c +index 1531302a50ec3..75584cee0da5c 100644 +--- a/drivers/mfd/asic3.c ++++ b/drivers/mfd/asic3.c +@@ -918,14 +918,14 @@ static int __init asic3_mfd_probe(struct platform_device *pdev, + ret = mfd_add_devices(&pdev->dev, pdev->id, + &asic3_cell_ds1wm, 1, mem, asic->irq_base, NULL); + if (ret < 0) +- goto out; ++ goto out_unmap; + } + + if (mem_sdio && (irq >= 0)) { + ret = mfd_add_devices(&pdev->dev, pdev->id, + &asic3_cell_mmc, 1, mem_sdio, irq, NULL); + if (ret < 0) +- goto out; ++ goto out_unmap; + } + + ret = 0; +@@ -939,8 +939,12 @@ static int __init asic3_mfd_probe(struct platform_device *pdev, + ret = mfd_add_devices(&pdev->dev, 0, + asic3_cell_leds, ASIC3_NUM_LEDS, NULL, 0, NULL); + } ++ return ret; + +- out: ++out_unmap: ++ if (asic->tmio_cnf) ++ iounmap(asic->tmio_cnf); ++out: + return ret; + } + +diff --git a/drivers/mfd/mc13xxx-core.c b/drivers/mfd/mc13xxx-core.c +index d0bf50e3568d7..dcbb969af5f4f 100644 +--- a/drivers/mfd/mc13xxx-core.c ++++ b/drivers/mfd/mc13xxx-core.c +@@ -326,8 +326,10 @@ int mc13xxx_adc_do_conversion(struct mc13xxx *mc13xxx, unsigned int mode, + adc1 |= MC13783_ADC1_ATOX; + + dev_dbg(mc13xxx->dev, "%s: request irq\n", __func__); +- mc13xxx_irq_request(mc13xxx, MC13XXX_IRQ_ADCDONE, ++ ret = mc13xxx_irq_request(mc13xxx, MC13XXX_IRQ_ADCDONE, + mc13xxx_handler_adcdone, __func__, &adcdone_data); ++ if (ret) ++ goto out; + + mc13xxx_reg_write(mc13xxx, MC13XXX_ADC0, adc0); + mc13xxx_reg_write(mc13xxx, MC13XXX_ADC1, adc1); +diff --git a/drivers/misc/kgdbts.c b/drivers/misc/kgdbts.c +index 49e08b6133f50..bc4dc92af1f60 100644 +--- a/drivers/misc/kgdbts.c ++++ b/drivers/misc/kgdbts.c +@@ -1072,10 +1072,10 @@ static int kgdbts_option_setup(char *opt) + { + if (strlen(opt) >= MAX_CONFIG_LEN) { + printk(KERN_ERR "kgdbts: config string too long\n"); +- return -ENOSPC; ++ return 1; + } + strcpy(config, opt); +- return 0; ++ return 1; + } + + __setup("kgdbts=", kgdbts_option_setup); +diff --git a/drivers/mmc/core/host.c b/drivers/mmc/core/host.c +index dd1c14d8f6863..9de8a3553d424 100644 +--- a/drivers/mmc/core/host.c ++++ b/drivers/mmc/core/host.c +@@ -413,6 +413,16 @@ struct mmc_host *mmc_alloc_host(int extra, struct device *dev) + + EXPORT_SYMBOL(mmc_alloc_host); + ++static int mmc_validate_host_caps(struct mmc_host *host) ++{ ++ if (host->caps & MMC_CAP_SDIO_IRQ && !host->ops->enable_sdio_irq) { ++ dev_warn(host->parent, "missing ->enable_sdio_irq() ops\n"); ++ return -EINVAL; ++ } ++ ++ return 0; ++} ++ + /** + * mmc_add_host - initialise host hardware + * @host: mmc host +@@ -425,8 +435,9 @@ int mmc_add_host(struct mmc_host *host) + { + int err; + +- WARN_ON((host->caps & MMC_CAP_SDIO_IRQ) && +- !host->ops->enable_sdio_irq); ++ err = mmc_validate_host_caps(host); ++ if (err) ++ return err; + + err = device_add(&host->class_dev); + if (err) +diff --git a/drivers/mmc/host/davinci_mmc.c b/drivers/mmc/host/davinci_mmc.c +index e6f14257a7d06..70d04962f53ac 100644 +--- a/drivers/mmc/host/davinci_mmc.c ++++ b/drivers/mmc/host/davinci_mmc.c +@@ -1389,8 +1389,12 @@ static int davinci_mmcsd_suspend(struct device *dev) + static int davinci_mmcsd_resume(struct device *dev) + { + struct mmc_davinci_host *host = dev_get_drvdata(dev); ++ int ret; ++ ++ ret = clk_enable(host->clk); ++ if (ret) ++ return ret; + +- clk_enable(host->clk); + mmc_davinci_reset_ctrl(host, 0); + + return 0; +diff --git a/drivers/mmc/host/renesas_sdhi_core.c b/drivers/mmc/host/renesas_sdhi_core.c +index e8ab582551f8e..eabfcb5bbafff 100644 +--- a/drivers/mmc/host/renesas_sdhi_core.c ++++ b/drivers/mmc/host/renesas_sdhi_core.c +@@ -302,10 +302,10 @@ static void renesas_sdhi_hs400_complete(struct tmio_mmc_host *host) + SH_MOBILE_SDHI_SCC_TMPPORT2_HS400OSEL) | + sd_scc_read32(host, priv, SH_MOBILE_SDHI_SCC_TMPPORT2)); + +- /* Set the sampling clock selection range of HS400 mode */ + sd_scc_write32(host, priv, SH_MOBILE_SDHI_SCC_DTCNTL, + SH_MOBILE_SDHI_SCC_DTCNTL_TAPEN | +- 0x4 << SH_MOBILE_SDHI_SCC_DTCNTL_TAPNUM_SHIFT); ++ sd_scc_read32(host, priv, ++ SH_MOBILE_SDHI_SCC_DTCNTL)); + + + if (host->pdata->flags & TMIO_MMC_HAVE_4TAP_HS400) +diff --git a/drivers/mmc/host/sdhci-xenon.c b/drivers/mmc/host/sdhci-xenon.c +index ca34fa424634f..bd7d159368367 100644 +--- a/drivers/mmc/host/sdhci-xenon.c ++++ b/drivers/mmc/host/sdhci-xenon.c +@@ -243,16 +243,6 @@ static void xenon_voltage_switch(struct sdhci_host *host) + { + /* Wait for 5ms after set 1.8V signal enable bit */ + usleep_range(5000, 5500); +- +- /* +- * For some reason the controller's Host Control2 register reports +- * the bit representing 1.8V signaling as 0 when read after it was +- * written as 1. Subsequent read reports 1. +- * +- * Since this may cause some issues, do an empty read of the Host +- * Control2 register here to circumvent this. +- */ +- sdhci_readw(host, SDHCI_HOST_CONTROL2); + } + + static const struct sdhci_ops sdhci_xenon_ops = { +diff --git a/drivers/mtd/nand/onenand/generic.c b/drivers/mtd/nand/onenand/generic.c +index acad17ec6581a..bfb5cee1b4722 100644 +--- a/drivers/mtd/nand/onenand/generic.c ++++ b/drivers/mtd/nand/onenand/generic.c +@@ -56,7 +56,12 @@ static int generic_onenand_probe(struct platform_device *pdev) + } + + info->onenand.mmcontrol = pdata ? pdata->mmcontrol : NULL; +- info->onenand.irq = platform_get_irq(pdev, 0); ++ ++ err = platform_get_irq(pdev, 0); ++ if (err < 0) ++ goto out_iounmap; ++ ++ info->onenand.irq = err; + + info->mtd.dev.parent = &pdev->dev; + info->mtd.priv = &info->onenand; +diff --git a/drivers/mtd/nand/raw/atmel/nand-controller.c b/drivers/mtd/nand/raw/atmel/nand-controller.c +index 7887629304872..b2ffd22fec31d 100644 +--- a/drivers/mtd/nand/raw/atmel/nand-controller.c ++++ b/drivers/mtd/nand/raw/atmel/nand-controller.c +@@ -1984,13 +1984,15 @@ static int atmel_nand_controller_init(struct atmel_nand_controller *nc, + nc->mck = of_clk_get(dev->parent->of_node, 0); + if (IS_ERR(nc->mck)) { + dev_err(dev, "Failed to retrieve MCK clk\n"); +- return PTR_ERR(nc->mck); ++ ret = PTR_ERR(nc->mck); ++ goto out_release_dma; + } + + np = of_parse_phandle(dev->parent->of_node, "atmel,smc", 0); + if (!np) { + dev_err(dev, "Missing or invalid atmel,smc property\n"); +- return -EINVAL; ++ ret = -EINVAL; ++ goto out_release_dma; + } + + nc->smc = syscon_node_to_regmap(np); +@@ -1998,10 +2000,16 @@ static int atmel_nand_controller_init(struct atmel_nand_controller *nc, + if (IS_ERR(nc->smc)) { + ret = PTR_ERR(nc->smc); + dev_err(dev, "Could not get SMC regmap (err = %d)\n", ret); +- return ret; ++ goto out_release_dma; + } + + return 0; ++ ++out_release_dma: ++ if (nc->dmac) ++ dma_release_channel(nc->dmac); ++ ++ return ret; + } + + static int +diff --git a/drivers/mtd/ubi/build.c b/drivers/mtd/ubi/build.c +index c120c8761fcd2..1ea3a4977c618 100644 +--- a/drivers/mtd/ubi/build.c ++++ b/drivers/mtd/ubi/build.c +@@ -363,9 +363,6 @@ static ssize_t dev_attribute_show(struct device *dev, + * we still can use 'ubi->ubi_num'. + */ + ubi = container_of(dev, struct ubi_device, dev); +- ubi = ubi_get_device(ubi->ubi_num); +- if (!ubi) +- return -ENODEV; + + if (attr == &dev_eraseblock_size) + ret = sprintf(buf, "%d\n", ubi->leb_size); +@@ -394,7 +391,6 @@ static ssize_t dev_attribute_show(struct device *dev, + else + ret = -EINVAL; + +- ubi_put_device(ubi); + return ret; + } + +@@ -969,9 +965,6 @@ int ubi_attach_mtd_dev(struct mtd_info *mtd, int ubi_num, + goto out_detach; + } + +- /* Make device "available" before it becomes accessible via sysfs */ +- ubi_devices[ubi_num] = ubi; +- + err = uif_init(ubi); + if (err) + goto out_detach; +@@ -1016,6 +1009,7 @@ int ubi_attach_mtd_dev(struct mtd_info *mtd, int ubi_num, + wake_up_process(ubi->bgt_thread); + spin_unlock(&ubi->wl_lock); + ++ ubi_devices[ubi_num] = ubi; + ubi_notify_all(ubi, UBI_VOLUME_ADDED, NULL); + return ubi_num; + +@@ -1024,7 +1018,6 @@ out_debugfs: + out_uif: + uif_close(ubi); + out_detach: +- ubi_devices[ubi_num] = NULL; + ubi_wl_close(ubi); + ubi_free_internal_volumes(ubi); + vfree(ubi->vtbl); +diff --git a/drivers/mtd/ubi/fastmap.c b/drivers/mtd/ubi/fastmap.c +index b88ef875236cc..d45c1d6587d18 100644 +--- a/drivers/mtd/ubi/fastmap.c ++++ b/drivers/mtd/ubi/fastmap.c +@@ -477,7 +477,9 @@ static int scan_pool(struct ubi_device *ubi, struct ubi_attach_info *ai, + if (err == UBI_IO_FF_BITFLIPS) + scrub = 1; + +- add_aeb(ai, free, pnum, ec, scrub); ++ ret = add_aeb(ai, free, pnum, ec, scrub); ++ if (ret) ++ goto out; + continue; + } else if (err == 0 || err == UBI_IO_BITFLIPS) { + dbg_bld("Found non empty PEB:%i in pool", pnum); +@@ -647,8 +649,10 @@ static int ubi_attach_fastmap(struct ubi_device *ubi, + if (fm_pos >= fm_size) + goto fail_bad; + +- add_aeb(ai, &ai->free, be32_to_cpu(fmec->pnum), +- be32_to_cpu(fmec->ec), 0); ++ ret = add_aeb(ai, &ai->free, be32_to_cpu(fmec->pnum), ++ be32_to_cpu(fmec->ec), 0); ++ if (ret) ++ goto fail; + } + + /* read EC values from used list */ +@@ -658,8 +662,10 @@ static int ubi_attach_fastmap(struct ubi_device *ubi, + if (fm_pos >= fm_size) + goto fail_bad; + +- add_aeb(ai, &used, be32_to_cpu(fmec->pnum), +- be32_to_cpu(fmec->ec), 0); ++ ret = add_aeb(ai, &used, be32_to_cpu(fmec->pnum), ++ be32_to_cpu(fmec->ec), 0); ++ if (ret) ++ goto fail; + } + + /* read EC values from scrub list */ +@@ -669,8 +675,10 @@ static int ubi_attach_fastmap(struct ubi_device *ubi, + if (fm_pos >= fm_size) + goto fail_bad; + +- add_aeb(ai, &used, be32_to_cpu(fmec->pnum), +- be32_to_cpu(fmec->ec), 1); ++ ret = add_aeb(ai, &used, be32_to_cpu(fmec->pnum), ++ be32_to_cpu(fmec->ec), 1); ++ if (ret) ++ goto fail; + } + + /* read EC values from erase list */ +@@ -680,8 +688,10 @@ static int ubi_attach_fastmap(struct ubi_device *ubi, + if (fm_pos >= fm_size) + goto fail_bad; + +- add_aeb(ai, &ai->erase, be32_to_cpu(fmec->pnum), +- be32_to_cpu(fmec->ec), 1); ++ ret = add_aeb(ai, &ai->erase, be32_to_cpu(fmec->pnum), ++ be32_to_cpu(fmec->ec), 1); ++ if (ret) ++ goto fail; + } + + ai->mean_ec = div_u64(ai->ec_sum, ai->ec_count); +diff --git a/drivers/mtd/ubi/vmt.c b/drivers/mtd/ubi/vmt.c +index 729588b94e41e..d0c6b66b74509 100644 +--- a/drivers/mtd/ubi/vmt.c ++++ b/drivers/mtd/ubi/vmt.c +@@ -69,16 +69,11 @@ static ssize_t vol_attribute_show(struct device *dev, + { + int ret; + struct ubi_volume *vol = container_of(dev, struct ubi_volume, dev); +- struct ubi_device *ubi; +- +- ubi = ubi_get_device(vol->ubi->ubi_num); +- if (!ubi) +- return -ENODEV; ++ struct ubi_device *ubi = vol->ubi; + + spin_lock(&ubi->volumes_lock); + if (!ubi->volumes[vol->vol_id]) { + spin_unlock(&ubi->volumes_lock); +- ubi_put_device(ubi); + return -ENODEV; + } + /* Take a reference to prevent volume removal */ +@@ -116,7 +111,6 @@ static ssize_t vol_attribute_show(struct device *dev, + vol->ref_count -= 1; + ubi_assert(vol->ref_count >= 0); + spin_unlock(&ubi->volumes_lock); +- ubi_put_device(ubi); + return ret; + } + +diff --git a/drivers/net/can/usb/ems_usb.c b/drivers/net/can/usb/ems_usb.c +index 3957b746107f1..31a070226353a 100644 +--- a/drivers/net/can/usb/ems_usb.c ++++ b/drivers/net/can/usb/ems_usb.c +@@ -835,7 +835,6 @@ static netdev_tx_t ems_usb_start_xmit(struct sk_buff *skb, struct net_device *ne + + usb_unanchor_urb(urb); + usb_free_coherent(dev->udev, size, buf, urb->transfer_dma); +- dev_kfree_skb(skb); + + atomic_dec(&dev->active_tx_urbs); + +diff --git a/drivers/net/can/usb/mcba_usb.c b/drivers/net/can/usb/mcba_usb.c +index 097d4a673b059..ea1de06009d6d 100644 +--- a/drivers/net/can/usb/mcba_usb.c ++++ b/drivers/net/can/usb/mcba_usb.c +@@ -44,10 +44,6 @@ + #define MCBA_USB_RX_BUFF_SIZE 64 + #define MCBA_USB_TX_BUFF_SIZE (sizeof(struct mcba_usb_msg)) + +-/* MCBA endpoint numbers */ +-#define MCBA_USB_EP_IN 1 +-#define MCBA_USB_EP_OUT 1 +- + /* Microchip command id */ + #define MBCA_CMD_RECEIVE_MESSAGE 0xE3 + #define MBCA_CMD_I_AM_ALIVE_FROM_CAN 0xF5 +@@ -95,6 +91,8 @@ struct mcba_priv { + atomic_t free_ctx_cnt; + void *rxbuf[MCBA_MAX_RX_URBS]; + dma_addr_t rxbuf_dma[MCBA_MAX_RX_URBS]; ++ int rx_pipe; ++ int tx_pipe; + }; + + /* CAN frame */ +@@ -283,10 +281,8 @@ static netdev_tx_t mcba_usb_xmit(struct mcba_priv *priv, + + memcpy(buf, usb_msg, MCBA_USB_TX_BUFF_SIZE); + +- usb_fill_bulk_urb(urb, priv->udev, +- usb_sndbulkpipe(priv->udev, MCBA_USB_EP_OUT), buf, +- MCBA_USB_TX_BUFF_SIZE, mcba_usb_write_bulk_callback, +- ctx); ++ usb_fill_bulk_urb(urb, priv->udev, priv->tx_pipe, buf, MCBA_USB_TX_BUFF_SIZE, ++ mcba_usb_write_bulk_callback, ctx); + + urb->transfer_flags |= URB_NO_TRANSFER_DMA_MAP; + usb_anchor_urb(urb, &priv->tx_submitted); +@@ -379,7 +375,6 @@ static netdev_tx_t mcba_usb_start_xmit(struct sk_buff *skb, + xmit_failed: + can_free_echo_skb(priv->netdev, ctx->ndx); + mcba_usb_free_ctx(ctx); +- dev_kfree_skb(skb); + stats->tx_dropped++; + + return NETDEV_TX_OK; +@@ -622,7 +617,7 @@ static void mcba_usb_read_bulk_callback(struct urb *urb) + resubmit_urb: + + usb_fill_bulk_urb(urb, priv->udev, +- usb_rcvbulkpipe(priv->udev, MCBA_USB_EP_OUT), ++ priv->rx_pipe, + urb->transfer_buffer, MCBA_USB_RX_BUFF_SIZE, + mcba_usb_read_bulk_callback, priv); + +@@ -667,7 +662,7 @@ static int mcba_usb_start(struct mcba_priv *priv) + urb->transfer_dma = buf_dma; + + usb_fill_bulk_urb(urb, priv->udev, +- usb_rcvbulkpipe(priv->udev, MCBA_USB_EP_IN), ++ priv->rx_pipe, + buf, MCBA_USB_RX_BUFF_SIZE, + mcba_usb_read_bulk_callback, priv); + urb->transfer_flags |= URB_NO_TRANSFER_DMA_MAP; +@@ -821,6 +816,13 @@ static int mcba_usb_probe(struct usb_interface *intf, + struct mcba_priv *priv; + int err = -ENOMEM; + struct usb_device *usbdev = interface_to_usbdev(intf); ++ struct usb_endpoint_descriptor *in, *out; ++ ++ err = usb_find_common_endpoints(intf->cur_altsetting, &in, &out, NULL, NULL); ++ if (err) { ++ dev_err(&intf->dev, "Can't find endpoints\n"); ++ return err; ++ } + + netdev = alloc_candev(sizeof(struct mcba_priv), MCBA_MAX_TX_URBS); + if (!netdev) { +@@ -866,6 +868,9 @@ static int mcba_usb_probe(struct usb_interface *intf, + goto cleanup_free_candev; + } + ++ priv->rx_pipe = usb_rcvbulkpipe(priv->udev, in->bEndpointAddress); ++ priv->tx_pipe = usb_sndbulkpipe(priv->udev, out->bEndpointAddress); ++ + devm_can_led_init(netdev); + + /* Start USB dev only if we have successfully registered CAN device */ +diff --git a/drivers/net/can/vxcan.c b/drivers/net/can/vxcan.c +index ccd758ba3fb09..8197f04aa8b6c 100644 +--- a/drivers/net/can/vxcan.c ++++ b/drivers/net/can/vxcan.c +@@ -156,7 +156,7 @@ static void vxcan_setup(struct net_device *dev) + dev->hard_header_len = 0; + dev->addr_len = 0; + dev->tx_queue_len = 0; +- dev->flags = (IFF_NOARP|IFF_ECHO); ++ dev->flags = IFF_NOARP; + dev->netdev_ops = &vxcan_netdev_ops; + dev->needs_free_netdev = true; + } +diff --git a/drivers/net/ethernet/8390/mcf8390.c b/drivers/net/ethernet/8390/mcf8390.c +index 4ad8031ab6695..065fdbe66c425 100644 +--- a/drivers/net/ethernet/8390/mcf8390.c ++++ b/drivers/net/ethernet/8390/mcf8390.c +@@ -406,12 +406,12 @@ static int mcf8390_init(struct net_device *dev) + static int mcf8390_probe(struct platform_device *pdev) + { + struct net_device *dev; +- struct resource *mem, *irq; ++ struct resource *mem; + resource_size_t msize; +- int ret; ++ int ret, irq; + +- irq = platform_get_resource(pdev, IORESOURCE_IRQ, 0); +- if (irq == NULL) { ++ irq = platform_get_irq(pdev, 0); ++ if (irq < 0) { + dev_err(&pdev->dev, "no IRQ specified?\n"); + return -ENXIO; + } +@@ -434,7 +434,7 @@ static int mcf8390_probe(struct platform_device *pdev) + SET_NETDEV_DEV(dev, &pdev->dev); + platform_set_drvdata(pdev, dev); + +- dev->irq = irq->start; ++ dev->irq = irq; + dev->base_addr = mem->start; + + ret = mcf8390_init(dev); +diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c b/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c +index e75a47a9f5119..deba77670b1c7 100644 +--- a/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c ++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c +@@ -1377,9 +1377,7 @@ static int bnxt_set_pauseparam(struct net_device *dev, + } + + link_info->autoneg |= BNXT_AUTONEG_FLOW_CTRL; +- if (bp->hwrm_spec_code >= 0x10201) +- link_info->req_flow_ctrl = +- PORT_PHY_CFG_REQ_AUTO_PAUSE_AUTONEG_PAUSE; ++ link_info->req_flow_ctrl = 0; + } else { + /* when transition from auto pause to force pause, + * force a link change +diff --git a/drivers/net/ethernet/qlogic/qed/qed_sriov.c b/drivers/net/ethernet/qlogic/qed/qed_sriov.c +index 285231bc318bb..402c1c3d84ce2 100644 +--- a/drivers/net/ethernet/qlogic/qed/qed_sriov.c ++++ b/drivers/net/ethernet/qlogic/qed/qed_sriov.c +@@ -3002,12 +3002,16 @@ static int qed_iov_pre_update_vport(struct qed_hwfn *hwfn, + u8 mask = QED_ACCEPT_UCAST_UNMATCHED | QED_ACCEPT_MCAST_UNMATCHED; + struct qed_filter_accept_flags *flags = ¶ms->accept_flags; + struct qed_public_vf_info *vf_info; ++ u16 tlv_mask; ++ ++ tlv_mask = BIT(QED_IOV_VP_UPDATE_ACCEPT_PARAM) | ++ BIT(QED_IOV_VP_UPDATE_ACCEPT_ANY_VLAN); + + /* Untrusted VFs can't even be trusted to know that fact. + * Simply indicate everything is configured fine, and trace + * configuration 'behind their back'. + */ +- if (!(*tlvs & BIT(QED_IOV_VP_UPDATE_ACCEPT_PARAM))) ++ if (!(*tlvs & tlv_mask)) + return 0; + + vf_info = qed_iov_get_public_vf_info(hwfn, vfid, true); +@@ -3024,6 +3028,13 @@ static int qed_iov_pre_update_vport(struct qed_hwfn *hwfn, + flags->tx_accept_filter &= ~mask; + } + ++ if (params->update_accept_any_vlan_flg) { ++ vf_info->accept_any_vlan = params->accept_any_vlan; ++ ++ if (vf_info->forced_vlan && !vf_info->is_trusted_configured) ++ params->accept_any_vlan = false; ++ } ++ + return 0; + } + +@@ -4709,6 +4720,7 @@ static int qed_get_vf_config(struct qed_dev *cdev, + tx_rate = vf_info->tx_rate; + ivi->max_tx_rate = tx_rate ? tx_rate : link.speed; + ivi->min_tx_rate = qed_iov_get_vf_min_rate(hwfn, vf_id); ++ ivi->trusted = vf_info->is_trusted_request; + + return 0; + } +@@ -5139,6 +5151,12 @@ static void qed_iov_handle_trust_change(struct qed_hwfn *hwfn) + + params.update_ctl_frame_check = 1; + params.mac_chk_en = !vf_info->is_trusted_configured; ++ params.update_accept_any_vlan_flg = 0; ++ ++ if (vf_info->accept_any_vlan && vf_info->forced_vlan) { ++ params.update_accept_any_vlan_flg = 1; ++ params.accept_any_vlan = vf_info->accept_any_vlan; ++ } + + if (vf_info->rx_accept_mode & mask) { + flags->update_rx_mode_config = 1; +@@ -5154,13 +5172,20 @@ static void qed_iov_handle_trust_change(struct qed_hwfn *hwfn) + if (!vf_info->is_trusted_configured) { + flags->rx_accept_filter &= ~mask; + flags->tx_accept_filter &= ~mask; ++ params.accept_any_vlan = false; + } + + if (flags->update_rx_mode_config || + flags->update_tx_mode_config || +- params.update_ctl_frame_check) ++ params.update_ctl_frame_check || ++ params.update_accept_any_vlan_flg) { ++ DP_VERBOSE(hwfn, QED_MSG_IOV, ++ "vport update config for %s VF[abs 0x%x rel 0x%x]\n", ++ vf_info->is_trusted_configured ? "trusted" : "untrusted", ++ vf->abs_vf_id, vf->relative_vf_id); + qed_sp_vport_update(hwfn, ¶ms, + QED_SPQ_MODE_EBLOCK, NULL); ++ } + } + } + +diff --git a/drivers/net/ethernet/qlogic/qed/qed_sriov.h b/drivers/net/ethernet/qlogic/qed/qed_sriov.h +index 9a8fd79611f24..853be06bccdf6 100644 +--- a/drivers/net/ethernet/qlogic/qed/qed_sriov.h ++++ b/drivers/net/ethernet/qlogic/qed/qed_sriov.h +@@ -88,6 +88,7 @@ struct qed_public_vf_info { + bool is_trusted_request; + u8 rx_accept_mode; + u8 tx_accept_mode; ++ bool accept_any_vlan; + }; + + struct qed_iov_vf_init_params { +diff --git a/drivers/net/ethernet/qlogic/qede/qede_fp.c b/drivers/net/ethernet/qlogic/qede/qede_fp.c +index 9d5c2e31dfe9b..6a1a7d37dfd71 100644 +--- a/drivers/net/ethernet/qlogic/qede/qede_fp.c ++++ b/drivers/net/ethernet/qlogic/qede/qede_fp.c +@@ -731,6 +731,9 @@ qede_build_skb(struct qede_rx_queue *rxq, + buf = page_address(bd->data) + bd->page_offset; + skb = build_skb(buf, rxq->rx_buf_seg_size); + ++ if (unlikely(!skb)) ++ return NULL; ++ + skb_reserve(skb, pad); + skb_put(skb, len); + +diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_dcb.h b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_dcb.h +index f4aa6331b367b..0a9d24e86715d 100644 +--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_dcb.h ++++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_dcb.h +@@ -52,7 +52,7 @@ static inline int qlcnic_dcb_get_hw_capability(struct qlcnic_dcb *dcb) + if (dcb && dcb->ops->get_hw_capability) + return dcb->ops->get_hw_capability(dcb); + +- return 0; ++ return -EOPNOTSUPP; + } + + static inline void qlcnic_dcb_free(struct qlcnic_dcb *dcb) +@@ -66,7 +66,7 @@ static inline int qlcnic_dcb_attach(struct qlcnic_dcb *dcb) + if (dcb && dcb->ops->attach) + return dcb->ops->attach(dcb); + +- return 0; ++ return -EOPNOTSUPP; + } + + static inline int +@@ -75,7 +75,7 @@ qlcnic_dcb_query_hw_capability(struct qlcnic_dcb *dcb, char *buf) + if (dcb && dcb->ops->query_hw_capability) + return dcb->ops->query_hw_capability(dcb, buf); + +- return 0; ++ return -EOPNOTSUPP; + } + + static inline void qlcnic_dcb_get_info(struct qlcnic_dcb *dcb) +@@ -90,7 +90,7 @@ qlcnic_dcb_query_cee_param(struct qlcnic_dcb *dcb, char *buf, u8 type) + if (dcb && dcb->ops->query_cee_param) + return dcb->ops->query_cee_param(dcb, buf, type); + +- return 0; ++ return -EOPNOTSUPP; + } + + static inline int qlcnic_dcb_get_cee_cfg(struct qlcnic_dcb *dcb) +@@ -98,7 +98,7 @@ static inline int qlcnic_dcb_get_cee_cfg(struct qlcnic_dcb *dcb) + if (dcb && dcb->ops->get_cee_cfg) + return dcb->ops->get_cee_cfg(dcb); + +- return 0; ++ return -EOPNOTSUPP; + } + + static inline void qlcnic_dcb_aen_handler(struct qlcnic_dcb *dcb, void *msg) +diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c +index 05f5084158bf5..9762e687fc73a 100644 +--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c ++++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c +@@ -398,8 +398,7 @@ stmmac_probe_config_dt(struct platform_device *pdev, const char **mac) + plat->interface = of_get_phy_mode(np); + + /* Get max speed of operation from device tree */ +- if (of_property_read_u32(np, "max-speed", &plat->max_speed)) +- plat->max_speed = -1; ++ of_property_read_u32(np, "max-speed", &plat->max_speed); + + plat->bus_id = of_alias_get_id(np, "ethernet"); + if (plat->bus_id < 0) +diff --git a/drivers/net/ethernet/sun/sunhme.c b/drivers/net/ethernet/sun/sunhme.c +index 06da2f59fcbff..882908e74cc99 100644 +--- a/drivers/net/ethernet/sun/sunhme.c ++++ b/drivers/net/ethernet/sun/sunhme.c +@@ -3164,7 +3164,7 @@ static int happy_meal_pci_probe(struct pci_dev *pdev, + if (err) { + printk(KERN_ERR "happymeal(PCI): Cannot register net device, " + "aborting.\n"); +- goto err_out_iounmap; ++ goto err_out_free_coherent; + } + + pci_set_drvdata(pdev, hp); +@@ -3197,6 +3197,10 @@ static int happy_meal_pci_probe(struct pci_dev *pdev, + + return 0; + ++err_out_free_coherent: ++ dma_free_coherent(hp->dma_dev, PAGE_SIZE, ++ hp->happy_block, hp->hblock_dvma); ++ + err_out_iounmap: + iounmap(hp->gregs); + +diff --git a/drivers/net/hamradio/6pack.c b/drivers/net/hamradio/6pack.c +index af776d7be7806..29431e3eebee3 100644 +--- a/drivers/net/hamradio/6pack.c ++++ b/drivers/net/hamradio/6pack.c +@@ -674,14 +674,14 @@ static void sixpack_close(struct tty_struct *tty) + */ + netif_stop_queue(sp->dev); + ++ unregister_netdev(sp->dev); ++ + del_timer_sync(&sp->tx_t); + del_timer_sync(&sp->resync_t); + + /* Free all 6pack frame buffers. */ + kfree(sp->rbuff); + kfree(sp->xbuff); +- +- unregister_netdev(sp->dev); + } + + /* Perform I/O control on an active 6pack channel. */ +diff --git a/drivers/net/macvtap.c b/drivers/net/macvtap.c +index 9a10029caf83f..085f1648a8a67 100644 +--- a/drivers/net/macvtap.c ++++ b/drivers/net/macvtap.c +@@ -132,11 +132,17 @@ static void macvtap_setup(struct net_device *dev) + dev->tx_queue_len = TUN_READQ_SIZE; + } + ++static struct net *macvtap_link_net(const struct net_device *dev) ++{ ++ return dev_net(macvlan_dev_real_dev(dev)); ++} ++ + static struct rtnl_link_ops macvtap_link_ops __read_mostly = { + .kind = "macvtap", + .setup = macvtap_setup, + .newlink = macvtap_newlink, + .dellink = macvtap_dellink, ++ .get_link_net = macvtap_link_net, + .priv_size = sizeof(struct macvtap_dev), + }; + +diff --git a/drivers/net/phy/broadcom.c b/drivers/net/phy/broadcom.c +index e86ea105c8022..94622d119abce 100644 +--- a/drivers/net/phy/broadcom.c ++++ b/drivers/net/phy/broadcom.c +@@ -15,6 +15,7 @@ + */ + + #include "bcm-phy-lib.h" ++#include + #include + #include + #include +@@ -462,6 +463,26 @@ static int brcm_fet_config_init(struct phy_device *phydev) + if (err < 0) + return err; + ++ /* The datasheet indicates the PHY needs up to 1us to complete a reset, ++ * build some slack here. ++ */ ++ usleep_range(1000, 2000); ++ ++ /* The PHY requires 65 MDC clock cycles to complete a write operation ++ * and turnaround the line properly. ++ * ++ * We ignore -EIO here as the MDIO controller (e.g.: mdio-bcm-unimac) ++ * may flag the lack of turn-around as a read failure. This is ++ * particularly true with this combination since the MDIO controller ++ * only used 64 MDC cycles. This is not a critical failure in this ++ * specific case and it has no functional impact otherwise, so we let ++ * that one go through. If there is a genuine bus error, the next read ++ * of MII_BRCM_FET_INTREG will error out. ++ */ ++ err = phy_read(phydev, MII_BMCR); ++ if (err < 0 && err != -EIO) ++ return err; ++ + reg = phy_read(phydev, MII_BRCM_FET_INTREG); + if (reg < 0) + return reg; +diff --git a/drivers/net/wireless/ath/ath10k/wow.c b/drivers/net/wireless/ath/ath10k/wow.c +index a6b179f88d363..1d44227d107d4 100644 +--- a/drivers/net/wireless/ath/ath10k/wow.c ++++ b/drivers/net/wireless/ath/ath10k/wow.c +@@ -235,14 +235,15 @@ static int ath10k_vif_wow_set_wakeups(struct ath10k_vif *arvif, + if (patterns[i].mask[j / 8] & BIT(j % 8)) + bitmask[j] = 0xff; + old_pattern.mask = bitmask; +- new_pattern = old_pattern; + + if (ar->wmi.rx_decap_mode == ATH10K_HW_TXRX_NATIVE_WIFI) { +- if (patterns[i].pkt_offset < ETH_HLEN) ++ if (patterns[i].pkt_offset < ETH_HLEN) { + ath10k_wow_convert_8023_to_80211(&new_pattern, + &old_pattern); +- else ++ } else { ++ new_pattern = old_pattern; + new_pattern.pkt_offset += WOW_HDR_LEN - ETH_HLEN; ++ } + } + + if (WARN_ON(new_pattern.pattern_len > WOW_MAX_PATTERN_SIZE)) +diff --git a/drivers/net/wireless/ath/ath5k/eeprom.c b/drivers/net/wireless/ath/ath5k/eeprom.c +index 94d34ee02265d..01163b3339451 100644 +--- a/drivers/net/wireless/ath/ath5k/eeprom.c ++++ b/drivers/net/wireless/ath/ath5k/eeprom.c +@@ -746,6 +746,9 @@ ath5k_eeprom_convert_pcal_info_5111(struct ath5k_hw *ah, int mode, + } + } + ++ if (idx == AR5K_EEPROM_N_PD_CURVES) ++ goto err_out; ++ + ee->ee_pd_gains[mode] = 1; + + pd = &chinfo[pier].pd_curves[idx]; +diff --git a/drivers/net/wireless/ath/ath9k/htc_hst.c b/drivers/net/wireless/ath/ath9k/htc_hst.c +index 05fca38b38ed4..e37de14bc502f 100644 +--- a/drivers/net/wireless/ath/ath9k/htc_hst.c ++++ b/drivers/net/wireless/ath/ath9k/htc_hst.c +@@ -30,6 +30,7 @@ static int htc_issue_send(struct htc_target *target, struct sk_buff* skb, + hdr->endpoint_id = epid; + hdr->flags = flags; + hdr->payload_len = cpu_to_be16(len); ++ memset(hdr->control, 0, sizeof(hdr->control)); + + status = target->hif->send(target->hif_dev, endpoint->ul_pipeid, skb); + +@@ -274,6 +275,10 @@ int htc_connect_service(struct htc_target *target, + conn_msg->dl_pipeid = endpoint->dl_pipeid; + conn_msg->ul_pipeid = endpoint->ul_pipeid; + ++ /* To prevent infoleak */ ++ conn_msg->svc_meta_len = 0; ++ conn_msg->pad = 0; ++ + ret = htc_issue_send(target, skb, skb->len, 0, ENDPOINT0); + if (ret) + goto err; +diff --git a/drivers/net/wireless/ath/carl9170/main.c b/drivers/net/wireless/ath/carl9170/main.c +index 7064e6fc5dbbb..ab78707467f49 100644 +--- a/drivers/net/wireless/ath/carl9170/main.c ++++ b/drivers/net/wireless/ath/carl9170/main.c +@@ -1922,7 +1922,7 @@ static int carl9170_parse_eeprom(struct ar9170 *ar) + WARN_ON(!(tx_streams >= 1 && tx_streams <= + IEEE80211_HT_MCS_TX_MAX_STREAMS)); + +- tx_params = (tx_streams - 1) << ++ tx_params |= (tx_streams - 1) << + IEEE80211_HT_MCS_TX_MAX_STREAMS_SHIFT; + + carl9170_band_2GHz.ht_cap.mcs.tx_params |= tx_params; +diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/firmware.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/firmware.c +index 9927079a9ace4..4e5a6c311d1ad 100644 +--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/firmware.c ++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/firmware.c +@@ -217,6 +217,8 @@ static int brcmf_init_nvram_parser(struct nvram_parser *nvp, + size = BRCMF_FW_MAX_NVRAM_SIZE; + else + size = data_len; ++ /* Add space for properties we may add */ ++ size += strlen(BRCMF_FW_DEFAULT_BOARDREV) + 1; + /* Alloc for extra 0 byte + roundup by 4 + length field */ + size += 1 + 3 + sizeof(u32); + nvp->nvram = kzalloc(size, GFP_KERNEL); +diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c +index 4fffa6988087b..a21529d2ccabc 100644 +--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c ++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c +@@ -22,6 +22,7 @@ + #include + #include + #include ++#include + #include + + #include +@@ -441,47 +442,6 @@ brcmf_pcie_write_ram32(struct brcmf_pciedev_info *devinfo, u32 mem_offset, + } + + +-static void +-brcmf_pcie_copy_mem_todev(struct brcmf_pciedev_info *devinfo, u32 mem_offset, +- void *srcaddr, u32 len) +-{ +- void __iomem *address = devinfo->tcm + mem_offset; +- __le32 *src32; +- __le16 *src16; +- u8 *src8; +- +- if (((ulong)address & 4) || ((ulong)srcaddr & 4) || (len & 4)) { +- if (((ulong)address & 2) || ((ulong)srcaddr & 2) || (len & 2)) { +- src8 = (u8 *)srcaddr; +- while (len) { +- iowrite8(*src8, address); +- address++; +- src8++; +- len--; +- } +- } else { +- len = len / 2; +- src16 = (__le16 *)srcaddr; +- while (len) { +- iowrite16(le16_to_cpu(*src16), address); +- address += 2; +- src16++; +- len--; +- } +- } +- } else { +- len = len / 4; +- src32 = (__le32 *)srcaddr; +- while (len) { +- iowrite32(le32_to_cpu(*src32), address); +- address += 4; +- src32++; +- len--; +- } +- } +-} +- +- + static void + brcmf_pcie_copy_dev_tomem(struct brcmf_pciedev_info *devinfo, u32 mem_offset, + void *dstaddr, u32 len) +@@ -1503,8 +1463,8 @@ static int brcmf_pcie_download_fw_nvram(struct brcmf_pciedev_info *devinfo, + return err; + + brcmf_dbg(PCIE, "Download FW %s\n", devinfo->fw_name); +- brcmf_pcie_copy_mem_todev(devinfo, devinfo->ci->rambase, +- (void *)fw->data, fw->size); ++ memcpy_toio(devinfo->tcm + devinfo->ci->rambase, ++ (void *)fw->data, fw->size); + + resetintr = get_unaligned_le32(fw->data); + release_firmware(fw); +@@ -1518,7 +1478,7 @@ static int brcmf_pcie_download_fw_nvram(struct brcmf_pciedev_info *devinfo, + brcmf_dbg(PCIE, "Download NVRAM %s\n", devinfo->nvram_name); + address = devinfo->ci->rambase + devinfo->ci->ramsize - + nvram_len; +- brcmf_pcie_copy_mem_todev(devinfo, address, nvram, nvram_len); ++ memcpy_toio(devinfo->tcm + address, nvram, nvram_len); + brcmf_fw_nvram_free(nvram); + } else { + brcmf_dbg(PCIE, "No matching NVRAM file found %s\n", +diff --git a/drivers/net/wireless/intel/iwlwifi/dvm/mac80211.c b/drivers/net/wireless/intel/iwlwifi/dvm/mac80211.c +index 82caae02dd094..f2e0cfa2f4a23 100644 +--- a/drivers/net/wireless/intel/iwlwifi/dvm/mac80211.c ++++ b/drivers/net/wireless/intel/iwlwifi/dvm/mac80211.c +@@ -317,7 +317,7 @@ static int iwlagn_mac_start(struct ieee80211_hw *hw) + + priv->is_open = 1; + IWL_DEBUG_MAC80211(priv, "leave\n"); +- return 0; ++ return ret; + } + + static void iwlagn_mac_stop(struct ieee80211_hw *hw) +diff --git a/drivers/net/wireless/ray_cs.c b/drivers/net/wireless/ray_cs.c +index 08c607c031bc0..8704bae39e1bf 100644 +--- a/drivers/net/wireless/ray_cs.c ++++ b/drivers/net/wireless/ray_cs.c +@@ -394,6 +394,8 @@ static int ray_config(struct pcmcia_device *link) + goto failed; + local->sram = ioremap(link->resource[2]->start, + resource_size(link->resource[2])); ++ if (!local->sram) ++ goto failed; + + /*** Set up 16k window for shared memory (receive buffer) ***************/ + link->resource[3]->flags |= +@@ -408,6 +410,8 @@ static int ray_config(struct pcmcia_device *link) + goto failed; + local->rmem = ioremap(link->resource[3]->start, + resource_size(link->resource[3])); ++ if (!local->rmem) ++ goto failed; + + /*** Set up window for attribute memory ***********************************/ + link->resource[4]->flags |= +@@ -422,6 +426,8 @@ static int ray_config(struct pcmcia_device *link) + goto failed; + local->amem = ioremap(link->resource[4]->start, + resource_size(link->resource[4])); ++ if (!local->amem) ++ goto failed; + + dev_dbg(&link->dev, "ray_config sram=%p\n", local->sram); + dev_dbg(&link->dev, "ray_config rmem=%p\n", local->rmem); +diff --git a/drivers/parisc/dino.c b/drivers/parisc/dino.c +index 2b60535a9c7bf..25f36e5197d48 100644 +--- a/drivers/parisc/dino.c ++++ b/drivers/parisc/dino.c +@@ -144,9 +144,8 @@ struct dino_device + { + struct pci_hba_data hba; /* 'C' inheritance - must be first */ + spinlock_t dinosaur_pen; +- unsigned long txn_addr; /* EIR addr to generate interrupt */ +- u32 txn_data; /* EIR data assign to each dino */ + u32 imr; /* IRQ's which are enabled */ ++ struct gsc_irq gsc_irq; + int global_irq[DINO_LOCAL_IRQS]; /* map IMR bit to global irq */ + #ifdef DINO_DEBUG + unsigned int dino_irr0; /* save most recent IRQ line stat */ +@@ -343,14 +342,43 @@ static void dino_unmask_irq(struct irq_data *d) + if (tmp & DINO_MASK_IRQ(local_irq)) { + DBG(KERN_WARNING "%s(): IRQ asserted! (ILR 0x%x)\n", + __func__, tmp); +- gsc_writel(dino_dev->txn_data, dino_dev->txn_addr); ++ gsc_writel(dino_dev->gsc_irq.txn_data, dino_dev->gsc_irq.txn_addr); + } + } + ++#ifdef CONFIG_SMP ++static int dino_set_affinity_irq(struct irq_data *d, const struct cpumask *dest, ++ bool force) ++{ ++ struct dino_device *dino_dev = irq_data_get_irq_chip_data(d); ++ struct cpumask tmask; ++ int cpu_irq; ++ u32 eim; ++ ++ if (!cpumask_and(&tmask, dest, cpu_online_mask)) ++ return -EINVAL; ++ ++ cpu_irq = cpu_check_affinity(d, &tmask); ++ if (cpu_irq < 0) ++ return cpu_irq; ++ ++ dino_dev->gsc_irq.txn_addr = txn_affinity_addr(d->irq, cpu_irq); ++ eim = ((u32) dino_dev->gsc_irq.txn_addr) | dino_dev->gsc_irq.txn_data; ++ __raw_writel(eim, dino_dev->hba.base_addr+DINO_IAR0); ++ ++ irq_data_update_effective_affinity(d, &tmask); ++ ++ return IRQ_SET_MASK_OK; ++} ++#endif ++ + static struct irq_chip dino_interrupt_type = { + .name = "GSC-PCI", + .irq_unmask = dino_unmask_irq, + .irq_mask = dino_mask_irq, ++#ifdef CONFIG_SMP ++ .irq_set_affinity = dino_set_affinity_irq, ++#endif + }; + + +@@ -811,7 +839,6 @@ static int __init dino_common_init(struct parisc_device *dev, + { + int status; + u32 eim; +- struct gsc_irq gsc_irq; + struct resource *res; + + pcibios_register_hba(&dino_dev->hba); +@@ -826,10 +853,8 @@ static int __init dino_common_init(struct parisc_device *dev, + ** still only has 11 IRQ input lines - just map some of them + ** to a different processor. + */ +- dev->irq = gsc_alloc_irq(&gsc_irq); +- dino_dev->txn_addr = gsc_irq.txn_addr; +- dino_dev->txn_data = gsc_irq.txn_data; +- eim = ((u32) gsc_irq.txn_addr) | gsc_irq.txn_data; ++ dev->irq = gsc_alloc_irq(&dino_dev->gsc_irq); ++ eim = ((u32) dino_dev->gsc_irq.txn_addr) | dino_dev->gsc_irq.txn_data; + + /* + ** Dino needs a PA "IRQ" to get a processor's attention. +diff --git a/drivers/parisc/gsc.c b/drivers/parisc/gsc.c +index 1bab5a2cd359f..a0cae6194591d 100644 +--- a/drivers/parisc/gsc.c ++++ b/drivers/parisc/gsc.c +@@ -139,10 +139,41 @@ static void gsc_asic_unmask_irq(struct irq_data *d) + */ + } + ++#ifdef CONFIG_SMP ++static int gsc_set_affinity_irq(struct irq_data *d, const struct cpumask *dest, ++ bool force) ++{ ++ struct gsc_asic *gsc_dev = irq_data_get_irq_chip_data(d); ++ struct cpumask tmask; ++ int cpu_irq; ++ ++ if (!cpumask_and(&tmask, dest, cpu_online_mask)) ++ return -EINVAL; ++ ++ cpu_irq = cpu_check_affinity(d, &tmask); ++ if (cpu_irq < 0) ++ return cpu_irq; ++ ++ gsc_dev->gsc_irq.txn_addr = txn_affinity_addr(d->irq, cpu_irq); ++ gsc_dev->eim = ((u32) gsc_dev->gsc_irq.txn_addr) | gsc_dev->gsc_irq.txn_data; ++ ++ /* switch IRQ's for devices below LASI/WAX to other CPU */ ++ gsc_writel(gsc_dev->eim, gsc_dev->hpa + OFFSET_IAR); ++ ++ irq_data_update_effective_affinity(d, &tmask); ++ ++ return IRQ_SET_MASK_OK; ++} ++#endif ++ ++ + static struct irq_chip gsc_asic_interrupt_type = { + .name = "GSC-ASIC", + .irq_unmask = gsc_asic_unmask_irq, + .irq_mask = gsc_asic_mask_irq, ++#ifdef CONFIG_SMP ++ .irq_set_affinity = gsc_set_affinity_irq, ++#endif + }; + + int gsc_assign_irq(struct irq_chip *type, void *data) +diff --git a/drivers/parisc/gsc.h b/drivers/parisc/gsc.h +index b9d7bfb68e24d..9a364a4d09a51 100644 +--- a/drivers/parisc/gsc.h ++++ b/drivers/parisc/gsc.h +@@ -32,6 +32,7 @@ struct gsc_asic { + int version; + int type; + int eim; ++ struct gsc_irq gsc_irq; + int global_irq[32]; + }; + +diff --git a/drivers/parisc/lasi.c b/drivers/parisc/lasi.c +index 4c92254315004..07ac0b8ee4fe3 100644 +--- a/drivers/parisc/lasi.c ++++ b/drivers/parisc/lasi.c +@@ -167,7 +167,6 @@ static int __init lasi_init_chip(struct parisc_device *dev) + { + extern void (*chassis_power_off)(void); + struct gsc_asic *lasi; +- struct gsc_irq gsc_irq; + int ret; + + lasi = kzalloc(sizeof(*lasi), GFP_KERNEL); +@@ -189,7 +188,7 @@ static int __init lasi_init_chip(struct parisc_device *dev) + lasi_init_irq(lasi); + + /* the IRQ lasi should use */ +- dev->irq = gsc_alloc_irq(&gsc_irq); ++ dev->irq = gsc_alloc_irq(&lasi->gsc_irq); + if (dev->irq < 0) { + printk(KERN_ERR "%s(): cannot get GSC irq\n", + __func__); +@@ -197,9 +196,9 @@ static int __init lasi_init_chip(struct parisc_device *dev) + return -EBUSY; + } + +- lasi->eim = ((u32) gsc_irq.txn_addr) | gsc_irq.txn_data; ++ lasi->eim = ((u32) lasi->gsc_irq.txn_addr) | lasi->gsc_irq.txn_data; + +- ret = request_irq(gsc_irq.irq, gsc_asic_intr, 0, "lasi", lasi); ++ ret = request_irq(lasi->gsc_irq.irq, gsc_asic_intr, 0, "lasi", lasi); + if (ret < 0) { + kfree(lasi); + return ret; +diff --git a/drivers/parisc/wax.c b/drivers/parisc/wax.c +index 6a3e40702b3bf..5c42bfa83398d 100644 +--- a/drivers/parisc/wax.c ++++ b/drivers/parisc/wax.c +@@ -72,7 +72,6 @@ static int __init wax_init_chip(struct parisc_device *dev) + { + struct gsc_asic *wax; + struct parisc_device *parent; +- struct gsc_irq gsc_irq; + int ret; + + wax = kzalloc(sizeof(*wax), GFP_KERNEL); +@@ -89,7 +88,7 @@ static int __init wax_init_chip(struct parisc_device *dev) + wax_init_irq(wax); + + /* the IRQ wax should use */ +- dev->irq = gsc_claim_irq(&gsc_irq, WAX_GSC_IRQ); ++ dev->irq = gsc_claim_irq(&wax->gsc_irq, WAX_GSC_IRQ); + if (dev->irq < 0) { + printk(KERN_ERR "%s(): cannot get GSC irq\n", + __func__); +@@ -97,9 +96,9 @@ static int __init wax_init_chip(struct parisc_device *dev) + return -EBUSY; + } + +- wax->eim = ((u32) gsc_irq.txn_addr) | gsc_irq.txn_data; ++ wax->eim = ((u32) wax->gsc_irq.txn_addr) | wax->gsc_irq.txn_data; + +- ret = request_irq(gsc_irq.irq, gsc_asic_intr, 0, "wax", wax); ++ ret = request_irq(wax->gsc_irq.irq, gsc_asic_intr, 0, "wax", wax); + if (ret < 0) { + kfree(wax); + return ret; +diff --git a/drivers/pci/access.c b/drivers/pci/access.c +index 3c8ffd62dc006..98ee5f05fc0fb 100644 +--- a/drivers/pci/access.c ++++ b/drivers/pci/access.c +@@ -160,9 +160,12 @@ int pci_generic_config_write32(struct pci_bus *bus, unsigned int devfn, + * write happen to have any RW1C (write-one-to-clear) bits set, we + * just inadvertently cleared something we shouldn't have. + */ +- dev_warn_ratelimited(&bus->dev, "%d-byte config write to %04x:%02x:%02x.%d offset %#x may corrupt adjacent RW1C bits\n", +- size, pci_domain_nr(bus), bus->number, +- PCI_SLOT(devfn), PCI_FUNC(devfn), where); ++ if (!bus->unsafe_warn) { ++ dev_warn(&bus->dev, "%d-byte config write to %04x:%02x:%02x.%d offset %#x may corrupt adjacent RW1C bits\n", ++ size, pci_domain_nr(bus), bus->number, ++ PCI_SLOT(devfn), PCI_FUNC(devfn), where); ++ bus->unsafe_warn = 1; ++ } + + mask = ~(((1 << (size * 8)) - 1) << ((where & 0x3) * 8)); + tmp = readl(addr) & mask; +diff --git a/drivers/pci/controller/pci-aardvark.c b/drivers/pci/controller/pci-aardvark.c +index e6d60fa2217da..db778a25bae36 100644 +--- a/drivers/pci/controller/pci-aardvark.c ++++ b/drivers/pci/controller/pci-aardvark.c +@@ -833,7 +833,7 @@ static void advk_msi_irq_compose_msi_msg(struct irq_data *data, + + msg->address_lo = lower_32_bits(msi_msg); + msg->address_hi = upper_32_bits(msi_msg); +- msg->data = data->irq; ++ msg->data = data->hwirq; + } + + static int advk_msi_set_affinity(struct irq_data *irq_data, +@@ -850,15 +850,11 @@ static int advk_msi_irq_domain_alloc(struct irq_domain *domain, + int hwirq, i; + + mutex_lock(&pcie->msi_used_lock); +- hwirq = bitmap_find_next_zero_area(pcie->msi_used, MSI_IRQ_NUM, +- 0, nr_irqs, 0); +- if (hwirq >= MSI_IRQ_NUM) { +- mutex_unlock(&pcie->msi_used_lock); +- return -ENOSPC; +- } +- +- bitmap_set(pcie->msi_used, hwirq, nr_irqs); ++ hwirq = bitmap_find_free_region(pcie->msi_used, MSI_IRQ_NUM, ++ order_base_2(nr_irqs)); + mutex_unlock(&pcie->msi_used_lock); ++ if (hwirq < 0) ++ return -ENOSPC; + + for (i = 0; i < nr_irqs; i++) + irq_domain_set_info(domain, virq + i, hwirq + i, +@@ -876,7 +872,7 @@ static void advk_msi_irq_domain_free(struct irq_domain *domain, + struct advk_pcie *pcie = domain->host_data; + + mutex_lock(&pcie->msi_used_lock); +- bitmap_clear(pcie->msi_used, d->hwirq, nr_irqs); ++ bitmap_release_region(pcie->msi_used, d->hwirq, order_base_2(nr_irqs)); + mutex_unlock(&pcie->msi_used_lock); + } + +diff --git a/drivers/pci/hotplug/pciehp_hpc.c b/drivers/pci/hotplug/pciehp_hpc.c +index 53227232243f1..2795445233b3b 100644 +--- a/drivers/pci/hotplug/pciehp_hpc.c ++++ b/drivers/pci/hotplug/pciehp_hpc.c +@@ -80,6 +80,8 @@ static int pcie_poll_cmd(struct controller *ctrl, int timeout) + if (slot_status & PCI_EXP_SLTSTA_CC) { + pcie_capability_write_word(pdev, PCI_EXP_SLTSTA, + PCI_EXP_SLTSTA_CC); ++ ctrl->cmd_busy = 0; ++ smp_mb(); + return 1; + } + if (timeout < 0) +@@ -969,6 +971,8 @@ static void quirk_cmd_compl(struct pci_dev *pdev) + } + DECLARE_PCI_FIXUP_CLASS_EARLY(PCI_VENDOR_ID_INTEL, PCI_ANY_ID, + PCI_CLASS_BRIDGE_PCI, 8, quirk_cmd_compl); ++DECLARE_PCI_FIXUP_CLASS_EARLY(PCI_VENDOR_ID_QCOM, 0x0110, ++ PCI_CLASS_BRIDGE_PCI, 8, quirk_cmd_compl); + DECLARE_PCI_FIXUP_CLASS_EARLY(PCI_VENDOR_ID_QCOM, 0x0400, + PCI_CLASS_BRIDGE_PCI, 8, quirk_cmd_compl); + DECLARE_PCI_FIXUP_CLASS_EARLY(PCI_VENDOR_ID_QCOM, 0x0401, +diff --git a/drivers/perf/qcom_l2_pmu.c b/drivers/perf/qcom_l2_pmu.c +index 842135cf35a3a..be6ac55e99af0 100644 +--- a/drivers/perf/qcom_l2_pmu.c ++++ b/drivers/perf/qcom_l2_pmu.c +@@ -797,7 +797,7 @@ static struct cluster_pmu *l2_cache_associate_cpu_with_cluster( + { + u64 mpidr; + int cpu_cluster_id; +- struct cluster_pmu *cluster = NULL; ++ struct cluster_pmu *cluster; + + /* + * This assumes that the cluster_id is in MPIDR[aff1] for +@@ -819,10 +819,10 @@ static struct cluster_pmu *l2_cache_associate_cpu_with_cluster( + cluster->cluster_id); + cpumask_set_cpu(cpu, &cluster->cluster_cpus); + *per_cpu_ptr(l2cache_pmu->pmu_cluster, cpu) = cluster; +- break; ++ return cluster; + } + +- return cluster; ++ return NULL; + } + + static int l2cache_pmu_online_cpu(unsigned int cpu, struct hlist_node *node) +diff --git a/drivers/pinctrl/mediatek/pinctrl-mtk-common.c b/drivers/pinctrl/mediatek/pinctrl-mtk-common.c +index 16ff56f935017..64fa544ac8501 100644 +--- a/drivers/pinctrl/mediatek/pinctrl-mtk-common.c ++++ b/drivers/pinctrl/mediatek/pinctrl-mtk-common.c +@@ -1046,6 +1046,7 @@ int mtk_pctrl_init(struct platform_device *pdev, + node = of_parse_phandle(np, "mediatek,pctl-regmap", 0); + if (node) { + pctl->regmap1 = syscon_node_to_regmap(node); ++ of_node_put(node); + if (IS_ERR(pctl->regmap1)) + return PTR_ERR(pctl->regmap1); + } else if (regmap) { +@@ -1059,6 +1060,7 @@ int mtk_pctrl_init(struct platform_device *pdev, + node = of_parse_phandle(np, "mediatek,pctl-regmap", 1); + if (node) { + pctl->regmap2 = syscon_node_to_regmap(node); ++ of_node_put(node); + if (IS_ERR(pctl->regmap2)) + return PTR_ERR(pctl->regmap2); + } +diff --git a/drivers/pinctrl/nomadik/pinctrl-nomadik.c b/drivers/pinctrl/nomadik/pinctrl-nomadik.c +index f0e7a8c114b22..415e913609945 100644 +--- a/drivers/pinctrl/nomadik/pinctrl-nomadik.c ++++ b/drivers/pinctrl/nomadik/pinctrl-nomadik.c +@@ -1916,8 +1916,10 @@ static int nmk_pinctrl_probe(struct platform_device *pdev) + } + + prcm_np = of_parse_phandle(np, "prcm", 0); +- if (prcm_np) ++ if (prcm_np) { + npct->prcm_base = of_iomap(prcm_np, 0); ++ of_node_put(prcm_np); ++ } + if (!npct->prcm_base) { + if (version == PINCTRL_NMK_STN8815) { + dev_info(&pdev->dev, +diff --git a/drivers/pinctrl/pinconf-generic.c b/drivers/pinctrl/pinconf-generic.c +index b4f7f8a458eaf..55b56440a5a89 100644 +--- a/drivers/pinctrl/pinconf-generic.c ++++ b/drivers/pinctrl/pinconf-generic.c +@@ -31,10 +31,10 @@ static const struct pin_config_item conf_items[] = { + PCONFDUMP(PIN_CONFIG_BIAS_BUS_HOLD, "input bias bus hold", NULL, false), + PCONFDUMP(PIN_CONFIG_BIAS_DISABLE, "input bias disabled", NULL, false), + PCONFDUMP(PIN_CONFIG_BIAS_HIGH_IMPEDANCE, "input bias high impedance", NULL, false), +- PCONFDUMP(PIN_CONFIG_BIAS_PULL_DOWN, "input bias pull down", NULL, false), ++ PCONFDUMP(PIN_CONFIG_BIAS_PULL_DOWN, "input bias pull down", "ohms", true), + PCONFDUMP(PIN_CONFIG_BIAS_PULL_PIN_DEFAULT, +- "input bias pull to pin specific state", NULL, false), +- PCONFDUMP(PIN_CONFIG_BIAS_PULL_UP, "input bias pull up", NULL, false), ++ "input bias pull to pin specific state", "ohms", true), ++ PCONFDUMP(PIN_CONFIG_BIAS_PULL_UP, "input bias pull up", "ohms", true), + PCONFDUMP(PIN_CONFIG_DRIVE_OPEN_DRAIN, "output drive open drain", NULL, false), + PCONFDUMP(PIN_CONFIG_DRIVE_OPEN_SOURCE, "output drive open source", NULL, false), + PCONFDUMP(PIN_CONFIG_DRIVE_PUSH_PULL, "output drive push pull", NULL, false), +diff --git a/drivers/pinctrl/pinctrl-rockchip.c b/drivers/pinctrl/pinctrl-rockchip.c +index d0d5b8bdbc105..dc405d7aa1b78 100644 +--- a/drivers/pinctrl/pinctrl-rockchip.c ++++ b/drivers/pinctrl/pinctrl-rockchip.c +@@ -3400,6 +3400,7 @@ static int rockchip_pinctrl_probe(struct platform_device *pdev) + node = of_parse_phandle(np, "rockchip,grf", 0); + if (node) { + info->regmap_base = syscon_node_to_regmap(node); ++ of_node_put(node); + if (IS_ERR(info->regmap_base)) + return PTR_ERR(info->regmap_base); + } else { +@@ -3436,6 +3437,7 @@ static int rockchip_pinctrl_probe(struct platform_device *pdev) + node = of_parse_phandle(np, "rockchip,pmu", 0); + if (node) { + info->regmap_pmu = syscon_node_to_regmap(node); ++ of_node_put(node); + if (IS_ERR(info->regmap_pmu)) + return PTR_ERR(info->regmap_pmu); + } +diff --git a/drivers/pinctrl/samsung/pinctrl-samsung.c b/drivers/pinctrl/samsung/pinctrl-samsung.c +index 82407e4a16427..41f953661dd62 100644 +--- a/drivers/pinctrl/samsung/pinctrl-samsung.c ++++ b/drivers/pinctrl/samsung/pinctrl-samsung.c +@@ -1002,6 +1002,16 @@ samsung_pinctrl_get_soc_data_for_of_alias(struct platform_device *pdev) + return &(of_data->ctrl[id]); + } + ++static void samsung_banks_of_node_put(struct samsung_pinctrl_drv_data *d) ++{ ++ struct samsung_pin_bank *bank; ++ unsigned int i; ++ ++ bank = d->pin_banks; ++ for (i = 0; i < d->nr_banks; ++i, ++bank) ++ of_node_put(bank->of_node); ++} ++ + /* retrieve the soc specific data */ + static const struct samsung_pin_ctrl * + samsung_pinctrl_get_soc_data(struct samsung_pinctrl_drv_data *d, +@@ -1116,19 +1126,19 @@ static int samsung_pinctrl_probe(struct platform_device *pdev) + if (ctrl->retention_data) { + drvdata->retention_ctrl = ctrl->retention_data->init(drvdata, + ctrl->retention_data); +- if (IS_ERR(drvdata->retention_ctrl)) +- return PTR_ERR(drvdata->retention_ctrl); ++ if (IS_ERR(drvdata->retention_ctrl)) { ++ ret = PTR_ERR(drvdata->retention_ctrl); ++ goto err_put_banks; ++ } + } + + ret = samsung_pinctrl_register(pdev, drvdata); + if (ret) +- return ret; ++ goto err_put_banks; + + ret = samsung_gpiolib_register(pdev, drvdata); +- if (ret) { +- samsung_pinctrl_unregister(pdev, drvdata); +- return ret; +- } ++ if (ret) ++ goto err_unregister; + + if (ctrl->eint_gpio_init) + ctrl->eint_gpio_init(drvdata); +@@ -1138,6 +1148,12 @@ static int samsung_pinctrl_probe(struct platform_device *pdev) + platform_set_drvdata(pdev, drvdata); + + return 0; ++ ++err_unregister: ++ samsung_pinctrl_unregister(pdev, drvdata); ++err_put_banks: ++ samsung_banks_of_node_put(drvdata); ++ return ret; + } + + /** +diff --git a/drivers/power/reset/gemini-poweroff.c b/drivers/power/reset/gemini-poweroff.c +index 90e35c07240ae..b7f7a8225f22e 100644 +--- a/drivers/power/reset/gemini-poweroff.c ++++ b/drivers/power/reset/gemini-poweroff.c +@@ -107,8 +107,8 @@ static int gemini_poweroff_probe(struct platform_device *pdev) + return PTR_ERR(gpw->base); + + irq = platform_get_irq(pdev, 0); +- if (!irq) +- return -EINVAL; ++ if (irq < 0) ++ return irq; + + gpw->dev = dev; + +diff --git a/drivers/power/supply/ab8500_fg.c b/drivers/power/supply/ab8500_fg.c +index b0e77324b0167..675f9d0e8471e 100644 +--- a/drivers/power/supply/ab8500_fg.c ++++ b/drivers/power/supply/ab8500_fg.c +@@ -2541,8 +2541,10 @@ static int ab8500_fg_sysfs_init(struct ab8500_fg *di) + ret = kobject_init_and_add(&di->fg_kobject, + &ab8500_fg_ktype, + NULL, "battery"); +- if (ret < 0) ++ if (ret < 0) { ++ kobject_put(&di->fg_kobject); + dev_err(di->dev, "failed to create sysfs entry\n"); ++ } + + return ret; + } +diff --git a/drivers/power/supply/axp20x_battery.c b/drivers/power/supply/axp20x_battery.c +index e84b6e4da14a8..9fda98b950bab 100644 +--- a/drivers/power/supply/axp20x_battery.c ++++ b/drivers/power/supply/axp20x_battery.c +@@ -185,7 +185,6 @@ static int axp20x_battery_get_prop(struct power_supply *psy, + union power_supply_propval *val) + { + struct axp20x_batt_ps *axp20x_batt = power_supply_get_drvdata(psy); +- struct iio_channel *chan; + int ret = 0, reg, val1; + + switch (psp) { +@@ -265,12 +264,12 @@ static int axp20x_battery_get_prop(struct power_supply *psy, + if (ret) + return ret; + +- if (reg & AXP20X_PWR_STATUS_BAT_CHARGING) +- chan = axp20x_batt->batt_chrg_i; +- else +- chan = axp20x_batt->batt_dischrg_i; +- +- ret = iio_read_channel_processed(chan, &val->intval); ++ if (reg & AXP20X_PWR_STATUS_BAT_CHARGING) { ++ ret = iio_read_channel_processed(axp20x_batt->batt_chrg_i, &val->intval); ++ } else { ++ ret = iio_read_channel_processed(axp20x_batt->batt_dischrg_i, &val1); ++ val->intval = -val1; ++ } + if (ret) + return ret; + +diff --git a/drivers/power/supply/bq24190_charger.c b/drivers/power/supply/bq24190_charger.c +index 863208928cf0b..c830343be61e5 100644 +--- a/drivers/power/supply/bq24190_charger.c ++++ b/drivers/power/supply/bq24190_charger.c +@@ -43,6 +43,7 @@ + #define BQ24190_REG_POC_CHG_CONFIG_DISABLE 0x0 + #define BQ24190_REG_POC_CHG_CONFIG_CHARGE 0x1 + #define BQ24190_REG_POC_CHG_CONFIG_OTG 0x2 ++#define BQ24190_REG_POC_CHG_CONFIG_OTG_ALT 0x3 + #define BQ24190_REG_POC_SYS_MIN_MASK (BIT(3) | BIT(2) | BIT(1)) + #define BQ24190_REG_POC_SYS_MIN_SHIFT 1 + #define BQ24190_REG_POC_SYS_MIN_MIN 3000 +@@ -568,7 +569,11 @@ static int bq24190_vbus_is_enabled(struct regulator_dev *dev) + pm_runtime_mark_last_busy(bdi->dev); + pm_runtime_put_autosuspend(bdi->dev); + +- return ret ? ret : val == BQ24190_REG_POC_CHG_CONFIG_OTG; ++ if (ret) ++ return ret; ++ ++ return (val == BQ24190_REG_POC_CHG_CONFIG_OTG || ++ val == BQ24190_REG_POC_CHG_CONFIG_OTG_ALT); + } + + static const struct regulator_ops bq24190_vbus_ops = { +diff --git a/drivers/power/supply/wm8350_power.c b/drivers/power/supply/wm8350_power.c +index 15c0ca15e2aa9..4fa42d4a8a40a 100644 +--- a/drivers/power/supply/wm8350_power.c ++++ b/drivers/power/supply/wm8350_power.c +@@ -411,44 +411,112 @@ static const struct power_supply_desc wm8350_usb_desc = { + * Initialisation + *********************************************************************/ + +-static void wm8350_init_charger(struct wm8350 *wm8350) ++static int wm8350_init_charger(struct wm8350 *wm8350) + { ++ int ret; ++ + /* register our interest in charger events */ +- wm8350_register_irq(wm8350, WM8350_IRQ_CHG_BAT_HOT, ++ ret = wm8350_register_irq(wm8350, WM8350_IRQ_CHG_BAT_HOT, + wm8350_charger_handler, 0, "Battery hot", wm8350); +- wm8350_register_irq(wm8350, WM8350_IRQ_CHG_BAT_COLD, ++ if (ret) ++ goto err; ++ ++ ret = wm8350_register_irq(wm8350, WM8350_IRQ_CHG_BAT_COLD, + wm8350_charger_handler, 0, "Battery cold", wm8350); +- wm8350_register_irq(wm8350, WM8350_IRQ_CHG_BAT_FAIL, ++ if (ret) ++ goto free_chg_bat_hot; ++ ++ ret = wm8350_register_irq(wm8350, WM8350_IRQ_CHG_BAT_FAIL, + wm8350_charger_handler, 0, "Battery fail", wm8350); +- wm8350_register_irq(wm8350, WM8350_IRQ_CHG_TO, ++ if (ret) ++ goto free_chg_bat_cold; ++ ++ ret = wm8350_register_irq(wm8350, WM8350_IRQ_CHG_TO, + wm8350_charger_handler, 0, + "Charger timeout", wm8350); +- wm8350_register_irq(wm8350, WM8350_IRQ_CHG_END, ++ if (ret) ++ goto free_chg_bat_fail; ++ ++ ret = wm8350_register_irq(wm8350, WM8350_IRQ_CHG_END, + wm8350_charger_handler, 0, + "Charge end", wm8350); +- wm8350_register_irq(wm8350, WM8350_IRQ_CHG_START, ++ if (ret) ++ goto free_chg_to; ++ ++ ret = wm8350_register_irq(wm8350, WM8350_IRQ_CHG_START, + wm8350_charger_handler, 0, + "Charge start", wm8350); +- wm8350_register_irq(wm8350, WM8350_IRQ_CHG_FAST_RDY, ++ if (ret) ++ goto free_chg_end; ++ ++ ret = wm8350_register_irq(wm8350, WM8350_IRQ_CHG_FAST_RDY, + wm8350_charger_handler, 0, + "Fast charge ready", wm8350); +- wm8350_register_irq(wm8350, WM8350_IRQ_CHG_VBATT_LT_3P9, ++ if (ret) ++ goto free_chg_start; ++ ++ ret = wm8350_register_irq(wm8350, WM8350_IRQ_CHG_VBATT_LT_3P9, + wm8350_charger_handler, 0, + "Battery <3.9V", wm8350); +- wm8350_register_irq(wm8350, WM8350_IRQ_CHG_VBATT_LT_3P1, ++ if (ret) ++ goto free_chg_fast_rdy; ++ ++ ret = wm8350_register_irq(wm8350, WM8350_IRQ_CHG_VBATT_LT_3P1, + wm8350_charger_handler, 0, + "Battery <3.1V", wm8350); +- wm8350_register_irq(wm8350, WM8350_IRQ_CHG_VBATT_LT_2P85, ++ if (ret) ++ goto free_chg_vbatt_lt_3p9; ++ ++ ret = wm8350_register_irq(wm8350, WM8350_IRQ_CHG_VBATT_LT_2P85, + wm8350_charger_handler, 0, + "Battery <2.85V", wm8350); ++ if (ret) ++ goto free_chg_vbatt_lt_3p1; + + /* and supply change events */ +- wm8350_register_irq(wm8350, WM8350_IRQ_EXT_USB_FB, ++ ret = wm8350_register_irq(wm8350, WM8350_IRQ_EXT_USB_FB, + wm8350_charger_handler, 0, "USB", wm8350); +- wm8350_register_irq(wm8350, WM8350_IRQ_EXT_WALL_FB, ++ if (ret) ++ goto free_chg_vbatt_lt_2p85; ++ ++ ret = wm8350_register_irq(wm8350, WM8350_IRQ_EXT_WALL_FB, + wm8350_charger_handler, 0, "Wall", wm8350); +- wm8350_register_irq(wm8350, WM8350_IRQ_EXT_BAT_FB, ++ if (ret) ++ goto free_ext_usb_fb; ++ ++ ret = wm8350_register_irq(wm8350, WM8350_IRQ_EXT_BAT_FB, + wm8350_charger_handler, 0, "Battery", wm8350); ++ if (ret) ++ goto free_ext_wall_fb; ++ ++ return 0; ++ ++free_ext_wall_fb: ++ wm8350_free_irq(wm8350, WM8350_IRQ_EXT_WALL_FB, wm8350); ++free_ext_usb_fb: ++ wm8350_free_irq(wm8350, WM8350_IRQ_EXT_USB_FB, wm8350); ++free_chg_vbatt_lt_2p85: ++ wm8350_free_irq(wm8350, WM8350_IRQ_CHG_VBATT_LT_2P85, wm8350); ++free_chg_vbatt_lt_3p1: ++ wm8350_free_irq(wm8350, WM8350_IRQ_CHG_VBATT_LT_3P1, wm8350); ++free_chg_vbatt_lt_3p9: ++ wm8350_free_irq(wm8350, WM8350_IRQ_CHG_VBATT_LT_3P9, wm8350); ++free_chg_fast_rdy: ++ wm8350_free_irq(wm8350, WM8350_IRQ_CHG_FAST_RDY, wm8350); ++free_chg_start: ++ wm8350_free_irq(wm8350, WM8350_IRQ_CHG_START, wm8350); ++free_chg_end: ++ wm8350_free_irq(wm8350, WM8350_IRQ_CHG_END, wm8350); ++free_chg_to: ++ wm8350_free_irq(wm8350, WM8350_IRQ_CHG_TO, wm8350); ++free_chg_bat_fail: ++ wm8350_free_irq(wm8350, WM8350_IRQ_CHG_BAT_FAIL, wm8350); ++free_chg_bat_cold: ++ wm8350_free_irq(wm8350, WM8350_IRQ_CHG_BAT_COLD, wm8350); ++free_chg_bat_hot: ++ wm8350_free_irq(wm8350, WM8350_IRQ_CHG_BAT_HOT, wm8350); ++err: ++ return ret; + } + + static void free_charger_irq(struct wm8350 *wm8350) +@@ -459,6 +527,7 @@ static void free_charger_irq(struct wm8350 *wm8350) + wm8350_free_irq(wm8350, WM8350_IRQ_CHG_TO, wm8350); + wm8350_free_irq(wm8350, WM8350_IRQ_CHG_END, wm8350); + wm8350_free_irq(wm8350, WM8350_IRQ_CHG_START, wm8350); ++ wm8350_free_irq(wm8350, WM8350_IRQ_CHG_FAST_RDY, wm8350); + wm8350_free_irq(wm8350, WM8350_IRQ_CHG_VBATT_LT_3P9, wm8350); + wm8350_free_irq(wm8350, WM8350_IRQ_CHG_VBATT_LT_3P1, wm8350); + wm8350_free_irq(wm8350, WM8350_IRQ_CHG_VBATT_LT_2P85, wm8350); +diff --git a/drivers/ptp/ptp_sysfs.c b/drivers/ptp/ptp_sysfs.c +index 48401dfcd999a..f97a5eefa2e23 100644 +--- a/drivers/ptp/ptp_sysfs.c ++++ b/drivers/ptp/ptp_sysfs.c +@@ -26,7 +26,7 @@ static ssize_t clock_name_show(struct device *dev, + struct device_attribute *attr, char *page) + { + struct ptp_clock *ptp = dev_get_drvdata(dev); +- return snprintf(page, PAGE_SIZE-1, "%s\n", ptp->info->name); ++ return sysfs_emit(page, "%s\n", ptp->info->name); + } + static DEVICE_ATTR_RO(clock_name); + +@@ -240,7 +240,7 @@ static ssize_t ptp_pin_show(struct device *dev, struct device_attribute *attr, + + mutex_unlock(&ptp->pincfg_mux); + +- return snprintf(page, PAGE_SIZE, "%u %u\n", func, chan); ++ return sysfs_emit(page, "%u %u\n", func, chan); + } + + static ssize_t ptp_pin_store(struct device *dev, struct device_attribute *attr, +diff --git a/drivers/pwm/pwm-lpc18xx-sct.c b/drivers/pwm/pwm-lpc18xx-sct.c +index d7f5f7de030dd..8b3aad06e2360 100644 +--- a/drivers/pwm/pwm-lpc18xx-sct.c ++++ b/drivers/pwm/pwm-lpc18xx-sct.c +@@ -406,12 +406,6 @@ static int lpc18xx_pwm_probe(struct platform_device *pdev) + lpc18xx_pwm_writel(lpc18xx_pwm, LPC18XX_PWM_LIMIT, + BIT(lpc18xx_pwm->period_event)); + +- ret = pwmchip_add(&lpc18xx_pwm->chip); +- if (ret < 0) { +- dev_err(&pdev->dev, "pwmchip_add failed: %d\n", ret); +- goto disable_pwmclk; +- } +- + for (i = 0; i < lpc18xx_pwm->chip.npwm; i++) { + struct lpc18xx_pwm_data *data; + +@@ -421,14 +415,12 @@ static int lpc18xx_pwm_probe(struct platform_device *pdev) + GFP_KERNEL); + if (!data) { + ret = -ENOMEM; +- goto remove_pwmchip; ++ goto disable_pwmclk; + } + + pwm_set_chip_data(pwm, data); + } + +- platform_set_drvdata(pdev, lpc18xx_pwm); +- + val = lpc18xx_pwm_readl(lpc18xx_pwm, LPC18XX_PWM_CTRL); + val &= ~LPC18XX_PWM_BIDIR; + val &= ~LPC18XX_PWM_CTRL_HALT; +@@ -436,10 +428,16 @@ static int lpc18xx_pwm_probe(struct platform_device *pdev) + val |= LPC18XX_PWM_PRE(0); + lpc18xx_pwm_writel(lpc18xx_pwm, LPC18XX_PWM_CTRL, val); + ++ ret = pwmchip_add(&lpc18xx_pwm->chip); ++ if (ret < 0) { ++ dev_err(&pdev->dev, "pwmchip_add failed: %d\n", ret); ++ goto disable_pwmclk; ++ } ++ ++ platform_set_drvdata(pdev, lpc18xx_pwm); ++ + return 0; + +-remove_pwmchip: +- pwmchip_remove(&lpc18xx_pwm->chip); + disable_pwmclk: + clk_disable_unprepare(lpc18xx_pwm->pwm_clk); + return ret; +diff --git a/drivers/regulator/qcom_smd-regulator.c b/drivers/regulator/qcom_smd-regulator.c +index 8d920a3ad40b8..3c6d6afd419e3 100644 +--- a/drivers/regulator/qcom_smd-regulator.c ++++ b/drivers/regulator/qcom_smd-regulator.c +@@ -751,8 +751,10 @@ static int rpm_reg_probe(struct platform_device *pdev) + + for_each_available_child_of_node(dev->of_node, node) { + vreg = devm_kzalloc(&pdev->dev, sizeof(*vreg), GFP_KERNEL); +- if (!vreg) ++ if (!vreg) { ++ of_node_put(node); + return -ENOMEM; ++ } + + ret = rpm_regulator_init_vreg(vreg, dev, node, rpm, vreg_data); + +diff --git a/drivers/remoteproc/qcom_wcnss.c b/drivers/remoteproc/qcom_wcnss.c +index b0e07e9f42d56..6cc0f9a5533e0 100644 +--- a/drivers/remoteproc/qcom_wcnss.c ++++ b/drivers/remoteproc/qcom_wcnss.c +@@ -448,6 +448,7 @@ static int wcnss_alloc_memory_region(struct qcom_wcnss *wcnss) + } + + ret = of_address_to_resource(node, 0, &r); ++ of_node_put(node); + if (ret) + return ret; + +diff --git a/drivers/rtc/rtc-wm8350.c b/drivers/rtc/rtc-wm8350.c +index 483c7993516bb..ed874e5c5fc88 100644 +--- a/drivers/rtc/rtc-wm8350.c ++++ b/drivers/rtc/rtc-wm8350.c +@@ -441,14 +441,21 @@ static int wm8350_rtc_probe(struct platform_device *pdev) + return ret; + } + +- wm8350_register_irq(wm8350, WM8350_IRQ_RTC_SEC, ++ ret = wm8350_register_irq(wm8350, WM8350_IRQ_RTC_SEC, + wm8350_rtc_update_handler, 0, + "RTC Seconds", wm8350); ++ if (ret) ++ return ret; ++ + wm8350_mask_irq(wm8350, WM8350_IRQ_RTC_SEC); + +- wm8350_register_irq(wm8350, WM8350_IRQ_RTC_ALM, ++ ret = wm8350_register_irq(wm8350, WM8350_IRQ_RTC_ALM, + wm8350_rtc_alarm_handler, 0, + "RTC Alarm", wm8350); ++ if (ret) { ++ wm8350_free_irq(wm8350, WM8350_IRQ_RTC_SEC, wm8350); ++ return ret; ++ } + + return 0; + } +diff --git a/drivers/scsi/aha152x.c b/drivers/scsi/aha152x.c +index 4d7b0e0adbf70..2690098d44117 100644 +--- a/drivers/scsi/aha152x.c ++++ b/drivers/scsi/aha152x.c +@@ -3379,13 +3379,11 @@ static int __init aha152x_setup(char *str) + setup[setup_count].synchronous = ints[0] >= 6 ? ints[6] : 1; + setup[setup_count].delay = ints[0] >= 7 ? ints[7] : DELAY_DEFAULT; + setup[setup_count].ext_trans = ints[0] >= 8 ? ints[8] : 0; +- if (ints[0] > 8) { /*}*/ ++ if (ints[0] > 8) + printk(KERN_NOTICE "aha152x: usage: aha152x=[,[," + "[,[,[,[,[,]]]]]]]\n"); +- } else { ++ else + setup_count++; +- return 0; +- } + + return 1; + } +diff --git a/drivers/scsi/bfa/bfad_attr.c b/drivers/scsi/bfa/bfad_attr.c +index 3b84290cf0a7e..eaab423a5fd09 100644 +--- a/drivers/scsi/bfa/bfad_attr.c ++++ b/drivers/scsi/bfa/bfad_attr.c +@@ -719,7 +719,7 @@ bfad_im_serial_num_show(struct device *dev, struct device_attribute *attr, + char serial_num[BFA_ADAPTER_SERIAL_NUM_LEN]; + + bfa_get_adapter_serial_num(&bfad->bfa, serial_num); +- return snprintf(buf, PAGE_SIZE, "%s\n", serial_num); ++ return sysfs_emit(buf, "%s\n", serial_num); + } + + static ssize_t +@@ -733,7 +733,7 @@ bfad_im_model_show(struct device *dev, struct device_attribute *attr, + char model[BFA_ADAPTER_MODEL_NAME_LEN]; + + bfa_get_adapter_model(&bfad->bfa, model); +- return snprintf(buf, PAGE_SIZE, "%s\n", model); ++ return sysfs_emit(buf, "%s\n", model); + } + + static ssize_t +@@ -813,7 +813,7 @@ bfad_im_model_desc_show(struct device *dev, struct device_attribute *attr, + snprintf(model_descr, BFA_ADAPTER_MODEL_DESCR_LEN, + "Invalid Model"); + +- return snprintf(buf, PAGE_SIZE, "%s\n", model_descr); ++ return sysfs_emit(buf, "%s\n", model_descr); + } + + static ssize_t +@@ -827,7 +827,7 @@ bfad_im_node_name_show(struct device *dev, struct device_attribute *attr, + u64 nwwn; + + nwwn = bfa_fcs_lport_get_nwwn(port->fcs_port); +- return snprintf(buf, PAGE_SIZE, "0x%llx\n", cpu_to_be64(nwwn)); ++ return sysfs_emit(buf, "0x%llx\n", cpu_to_be64(nwwn)); + } + + static ssize_t +@@ -844,7 +844,7 @@ bfad_im_symbolic_name_show(struct device *dev, struct device_attribute *attr, + bfa_fcs_lport_get_attr(&bfad->bfa_fcs.fabric.bport, &port_attr); + strlcpy(symname, port_attr.port_cfg.sym_name.symname, + BFA_SYMNAME_MAXLEN); +- return snprintf(buf, PAGE_SIZE, "%s\n", symname); ++ return sysfs_emit(buf, "%s\n", symname); + } + + static ssize_t +@@ -858,14 +858,14 @@ bfad_im_hw_version_show(struct device *dev, struct device_attribute *attr, + char hw_ver[BFA_VERSION_LEN]; + + bfa_get_pci_chip_rev(&bfad->bfa, hw_ver); +- return snprintf(buf, PAGE_SIZE, "%s\n", hw_ver); ++ return sysfs_emit(buf, "%s\n", hw_ver); + } + + static ssize_t + bfad_im_drv_version_show(struct device *dev, struct device_attribute *attr, + char *buf) + { +- return snprintf(buf, PAGE_SIZE, "%s\n", BFAD_DRIVER_VERSION); ++ return sysfs_emit(buf, "%s\n", BFAD_DRIVER_VERSION); + } + + static ssize_t +@@ -879,7 +879,7 @@ bfad_im_optionrom_version_show(struct device *dev, + char optrom_ver[BFA_VERSION_LEN]; + + bfa_get_adapter_optrom_ver(&bfad->bfa, optrom_ver); +- return snprintf(buf, PAGE_SIZE, "%s\n", optrom_ver); ++ return sysfs_emit(buf, "%s\n", optrom_ver); + } + + static ssize_t +@@ -893,7 +893,7 @@ bfad_im_fw_version_show(struct device *dev, struct device_attribute *attr, + char fw_ver[BFA_VERSION_LEN]; + + bfa_get_adapter_fw_ver(&bfad->bfa, fw_ver); +- return snprintf(buf, PAGE_SIZE, "%s\n", fw_ver); ++ return sysfs_emit(buf, "%s\n", fw_ver); + } + + static ssize_t +@@ -905,7 +905,7 @@ bfad_im_num_of_ports_show(struct device *dev, struct device_attribute *attr, + (struct bfad_im_port_s *) shost->hostdata[0]; + struct bfad_s *bfad = im_port->bfad; + +- return snprintf(buf, PAGE_SIZE, "%d\n", ++ return sysfs_emit(buf, "%d\n", + bfa_get_nports(&bfad->bfa)); + } + +@@ -913,7 +913,7 @@ static ssize_t + bfad_im_drv_name_show(struct device *dev, struct device_attribute *attr, + char *buf) + { +- return snprintf(buf, PAGE_SIZE, "%s\n", BFAD_DRIVER_NAME); ++ return sysfs_emit(buf, "%s\n", BFAD_DRIVER_NAME); + } + + static ssize_t +@@ -932,14 +932,14 @@ bfad_im_num_of_discovered_ports_show(struct device *dev, + rports = kcalloc(nrports, sizeof(struct bfa_rport_qualifier_s), + GFP_ATOMIC); + if (rports == NULL) +- return snprintf(buf, PAGE_SIZE, "Failed\n"); ++ return sysfs_emit(buf, "Failed\n"); + + spin_lock_irqsave(&bfad->bfad_lock, flags); + bfa_fcs_lport_get_rport_quals(port->fcs_port, rports, &nrports); + spin_unlock_irqrestore(&bfad->bfad_lock, flags); + kfree(rports); + +- return snprintf(buf, PAGE_SIZE, "%d\n", nrports); ++ return sysfs_emit(buf, "%d\n", nrports); + } + + static DEVICE_ATTR(serial_number, S_IRUGO, +diff --git a/drivers/scsi/libfc/fc_exch.c b/drivers/scsi/libfc/fc_exch.c +index 384458d1f73c3..9fa0aa235cb4c 100644 +--- a/drivers/scsi/libfc/fc_exch.c ++++ b/drivers/scsi/libfc/fc_exch.c +@@ -1709,6 +1709,7 @@ static void fc_exch_abts_resp(struct fc_exch *ep, struct fc_frame *fp) + if (cancel_delayed_work_sync(&ep->timeout_work)) { + FC_EXCH_DBG(ep, "Exchange timer canceled due to ABTS response\n"); + fc_exch_release(ep); /* release from pending timer hold */ ++ return; + } + + spin_lock_bh(&ep->ex_lock); +diff --git a/drivers/scsi/libsas/sas_ata.c b/drivers/scsi/libsas/sas_ata.c +index e032af6547334..685d7a16bcd4c 100644 +--- a/drivers/scsi/libsas/sas_ata.c ++++ b/drivers/scsi/libsas/sas_ata.c +@@ -216,7 +216,7 @@ static unsigned int sas_ata_qc_issue(struct ata_queued_cmd *qc) + task->total_xfer_len = qc->nbytes; + task->num_scatter = qc->n_elem; + task->data_dir = qc->dma_dir; +- } else if (qc->tf.protocol == ATA_PROT_NODATA) { ++ } else if (!ata_is_data(qc->tf.protocol)) { + task->data_dir = DMA_NONE; + } else { + for_each_sg(qc->sg, sg, qc->n_elem, si) +diff --git a/drivers/scsi/mvsas/mv_init.c b/drivers/scsi/mvsas/mv_init.c +index 98d6608068abd..9c48394ac68ab 100644 +--- a/drivers/scsi/mvsas/mv_init.c ++++ b/drivers/scsi/mvsas/mv_init.c +@@ -729,7 +729,7 @@ static ssize_t + mvs_show_driver_version(struct device *cdev, + struct device_attribute *attr, char *buffer) + { +- return snprintf(buffer, PAGE_SIZE, "%s\n", DRV_VERSION); ++ return sysfs_emit(buffer, "%s\n", DRV_VERSION); + } + + static DEVICE_ATTR(driver_version, +@@ -781,7 +781,7 @@ mvs_store_interrupt_coalescing(struct device *cdev, + static ssize_t mvs_show_interrupt_coalescing(struct device *cdev, + struct device_attribute *attr, char *buffer) + { +- return snprintf(buffer, PAGE_SIZE, "%d\n", interrupt_coalescing); ++ return sysfs_emit(buffer, "%d\n", interrupt_coalescing); + } + + static DEVICE_ATTR(interrupt_coalescing, +diff --git a/drivers/scsi/pm8001/pm8001_hwi.c b/drivers/scsi/pm8001/pm8001_hwi.c +index 3e814c0469fbd..d532230c62f3e 100644 +--- a/drivers/scsi/pm8001/pm8001_hwi.c ++++ b/drivers/scsi/pm8001/pm8001_hwi.c +@@ -1748,6 +1748,7 @@ static void pm8001_send_abort_all(struct pm8001_hba_info *pm8001_ha, + ccb->device = pm8001_ha_dev; + ccb->ccb_tag = ccb_tag; + ccb->task = task; ++ ccb->n_elem = 0; + + circularQ = &pm8001_ha->inbnd_q_tbl[0]; + +@@ -1810,6 +1811,7 @@ static void pm8001_send_read_log(struct pm8001_hba_info *pm8001_ha, + ccb->device = pm8001_ha_dev; + ccb->ccb_tag = ccb_tag; + ccb->task = task; ++ ccb->n_elem = 0; + pm8001_ha_dev->id |= NCQ_READ_LOG_FLAG; + pm8001_ha_dev->id |= NCQ_2ND_RLE_FLAG; + +@@ -1826,7 +1828,7 @@ static void pm8001_send_read_log(struct pm8001_hba_info *pm8001_ha, + + sata_cmd.tag = cpu_to_le32(ccb_tag); + sata_cmd.device_id = cpu_to_le32(pm8001_ha_dev->device_id); +- sata_cmd.ncqtag_atap_dir_m |= ((0x1 << 7) | (0x5 << 9)); ++ sata_cmd.ncqtag_atap_dir_m = cpu_to_le32((0x1 << 7) | (0x5 << 9)); + memcpy(&sata_cmd.sata_fis, &fis, sizeof(struct host_to_dev_fis)); + + res = pm8001_mpi_build_cmd(pm8001_ha, circularQ, opc, &sata_cmd, 0); +@@ -3775,12 +3777,11 @@ int pm8001_mpi_task_abort_resp(struct pm8001_hba_info *pm8001_ha, void *piomb) + mb(); + + if (pm8001_dev->id & NCQ_ABORT_ALL_FLAG) { +- pm8001_tag_free(pm8001_ha, tag); + sas_free_task(t); +- /* clear the flag */ +- pm8001_dev->id &= 0xBFFFFFFF; +- } else ++ pm8001_dev->id &= ~NCQ_ABORT_ALL_FLAG; ++ } else { + t->task_done(t); ++ } + + return 0; + } +@@ -4727,7 +4728,7 @@ int pm8001_chip_ssp_tm_req(struct pm8001_hba_info *pm8001_ha, + memcpy(sspTMCmd.lun, task->ssp_task.LUN, 8); + sspTMCmd.tag = cpu_to_le32(ccb->ccb_tag); + if (pm8001_ha->chip_id != chip_8001) +- sspTMCmd.ds_ads_m = 0x08; ++ sspTMCmd.ds_ads_m = cpu_to_le32(0x08); + circularQ = &pm8001_ha->inbnd_q_tbl[0]; + ret = pm8001_mpi_build_cmd(pm8001_ha, circularQ, opc, &sspTMCmd, 0); + return ret; +diff --git a/drivers/scsi/pm8001/pm80xx_hwi.c b/drivers/scsi/pm8001/pm80xx_hwi.c +index c63b5db435c59..d655f72db51d5 100644 +--- a/drivers/scsi/pm8001/pm80xx_hwi.c ++++ b/drivers/scsi/pm8001/pm80xx_hwi.c +@@ -881,9 +881,11 @@ pm80xx_set_thermal_config(struct pm8001_hba_info *pm8001_ha) + else + page_code = THERMAL_PAGE_CODE_8H; + +- payload.cfg_pg[0] = (THERMAL_LOG_ENABLE << 9) | +- (THERMAL_ENABLE << 8) | page_code; +- payload.cfg_pg[1] = (LTEMPHIL << 24) | (RTEMPHIL << 8); ++ payload.cfg_pg[0] = ++ cpu_to_le32((THERMAL_LOG_ENABLE << 9) | ++ (THERMAL_ENABLE << 8) | page_code); ++ payload.cfg_pg[1] = ++ cpu_to_le32((LTEMPHIL << 24) | (RTEMPHIL << 8)); + + rc = pm8001_mpi_build_cmd(pm8001_ha, circularQ, opc, &payload, 0); + if (rc) +@@ -1435,6 +1437,7 @@ static void pm80xx_send_abort_all(struct pm8001_hba_info *pm8001_ha, + ccb->device = pm8001_ha_dev; + ccb->ccb_tag = ccb_tag; + ccb->task = task; ++ ccb->n_elem = 0; + + circularQ = &pm8001_ha->inbnd_q_tbl[0]; + +@@ -1516,7 +1519,7 @@ static void pm80xx_send_read_log(struct pm8001_hba_info *pm8001_ha, + + sata_cmd.tag = cpu_to_le32(ccb_tag); + sata_cmd.device_id = cpu_to_le32(pm8001_ha_dev->device_id); +- sata_cmd.ncqtag_atap_dir_m_dad |= ((0x1 << 7) | (0x5 << 9)); ++ sata_cmd.ncqtag_atap_dir_m_dad = cpu_to_le32(((0x1 << 7) | (0x5 << 9))); + memcpy(&sata_cmd.sata_fis, &fis, sizeof(struct host_to_dev_fis)); + + res = pm8001_mpi_build_cmd(pm8001_ha, circularQ, opc, &sata_cmd, 0); +diff --git a/drivers/scsi/qla2xxx/qla_def.h b/drivers/scsi/qla2xxx/qla_def.h +index 47835d26a9730..300ef2e2ae5a9 100644 +--- a/drivers/scsi/qla2xxx/qla_def.h ++++ b/drivers/scsi/qla2xxx/qla_def.h +@@ -4655,4 +4655,8 @@ struct sff_8247_a0 { + #include "qla_gbl.h" + #include "qla_dbg.h" + #include "qla_inline.h" ++ ++#define IS_SESSION_DELETED(_fcport) (_fcport->disc_state == DSC_DELETE_PEND || \ ++ _fcport->disc_state == DSC_DELETED) ++ + #endif +diff --git a/drivers/scsi/qla2xxx/qla_gs.c b/drivers/scsi/qla2xxx/qla_gs.c +index c3195d4c25e5c..ba695d6482090 100644 +--- a/drivers/scsi/qla2xxx/qla_gs.c ++++ b/drivers/scsi/qla2xxx/qla_gs.c +@@ -691,8 +691,7 @@ qla2x00_rff_id(scsi_qla_host_t *vha, u8 type) + return (QLA_SUCCESS); + } + +- return qla_async_rffid(vha, &vha->d_id, qlt_rff_id(vha), +- FC4_TYPE_FCP_SCSI); ++ return qla_async_rffid(vha, &vha->d_id, qlt_rff_id(vha), type); + } + + static int qla_async_rffid(scsi_qla_host_t *vha, port_id_t *d_id, +@@ -744,7 +743,7 @@ static int qla_async_rffid(scsi_qla_host_t *vha, port_id_t *d_id, + ct_req->req.rff_id.port_id[1] = d_id->b.area; + ct_req->req.rff_id.port_id[2] = d_id->b.al_pa; + ct_req->req.rff_id.fc4_feature = fc4feature; +- ct_req->req.rff_id.fc4_type = fc4type; /* SCSI - FCP */ ++ ct_req->req.rff_id.fc4_type = fc4type; /* SCSI-FCP or FC-NVMe */ + + sp->u.iocb_cmd.u.ctarg.req_size = RFF_ID_REQ_SIZE; + sp->u.iocb_cmd.u.ctarg.rsp_size = RFF_ID_RSP_SIZE; +diff --git a/drivers/scsi/qla2xxx/qla_init.c b/drivers/scsi/qla2xxx/qla_init.c +index 613e5467b4bc2..1e3169e3ccbf7 100644 +--- a/drivers/scsi/qla2xxx/qla_init.c ++++ b/drivers/scsi/qla2xxx/qla_init.c +@@ -219,9 +219,9 @@ qla2x00_async_login(struct scsi_qla_host *vha, fc_port_t *fcport, + if (!vha->flags.online || (fcport->flags & FCF_ASYNC_SENT) || + fcport->loop_id == FC_NO_LOOP_ID) { + ql_log(ql_log_warn, vha, 0xffff, +- "%s: %8phC - not sending command.\n", +- __func__, fcport->port_name); +- return rval; ++ "%s: %8phC online %d flags %x - not sending command.\n", ++ __func__, fcport->port_name, vha->flags.online, fcport->flags); ++ goto done; + } + + sp = qla2x00_get_sp(vha, fcport, GFP_KERNEL); +@@ -891,6 +891,14 @@ int qla24xx_async_gnl(struct scsi_qla_host *vha, fc_port_t *fcport) + unsigned long flags; + u16 *mb; + ++ if (IS_SESSION_DELETED(fcport)) { ++ ql_log(ql_log_warn, vha, 0xffff, ++ "%s: %8phC is being delete - not sending command.\n", ++ __func__, fcport->port_name); ++ fcport->flags &= ~FCF_ASYNC_ACTIVE; ++ return rval; ++ } ++ + if (!vha->flags.online || (fcport->flags & FCF_ASYNC_SENT)) + return rval; + +@@ -1121,8 +1129,15 @@ int qla24xx_async_gpdb(struct scsi_qla_host *vha, fc_port_t *fcport, u8 opt) + struct port_database_24xx *pd; + struct qla_hw_data *ha = vha->hw; + +- if (!vha->flags.online || (fcport->flags & FCF_ASYNC_SENT) || +- fcport->loop_id == FC_NO_LOOP_ID) { ++ if (IS_SESSION_DELETED(fcport)) { ++ ql_log(ql_log_warn, vha, 0xffff, ++ "%s: %8phC is being delete - not sending command.\n", ++ __func__, fcport->port_name); ++ fcport->flags &= ~FCF_ASYNC_ACTIVE; ++ return rval; ++ } ++ ++ if (!vha->flags.online || fcport->flags & FCF_ASYNC_SENT) { + ql_log(ql_log_warn, vha, 0xffff, + "%s: %8phC - not sending command.\n", + __func__, fcport->port_name); +@@ -1331,7 +1346,8 @@ int qla24xx_fcport_handle_login(struct scsi_qla_host *vha, fc_port_t *fcport) + fcport->login_gen, fcport->login_retry, + fcport->loop_id, fcport->scan_state); + +- if (fcport->scan_state != QLA_FCPORT_FOUND) ++ if (fcport->scan_state != QLA_FCPORT_FOUND || ++ fcport->disc_state == DSC_DELETE_PEND) + return 0; + + if ((fcport->loop_id != FC_NO_LOOP_ID) && +@@ -1350,7 +1366,7 @@ int qla24xx_fcport_handle_login(struct scsi_qla_host *vha, fc_port_t *fcport) + if (vha->host->active_mode == MODE_TARGET) + return 0; + +- if (fcport->flags & FCF_ASYNC_SENT) { ++ if (fcport->flags & (FCF_ASYNC_SENT | FCF_ASYNC_ACTIVE)) { + set_bit(RELOGIN_NEEDED, &vha->dpc_flags); + return 0; + } +@@ -3151,6 +3167,14 @@ qla2x00_alloc_fw_dump(scsi_qla_host_t *vha) + struct rsp_que *rsp = ha->rsp_q_map[0]; + struct qla2xxx_fw_dump *fw_dump; + ++ if (ha->fw_dump) { ++ ql_dbg(ql_dbg_init, vha, 0x00bd, ++ "Firmware dump already allocated.\n"); ++ return; ++ } ++ ++ ha->fw_dumped = 0; ++ ha->fw_dump_cap_flags = 0; + dump_size = fixed_size = mem_size = eft_size = fce_size = mq_size = 0; + req_q_size = rsp_q_size = 0; + +@@ -8709,7 +8733,7 @@ struct qla_qpair *qla2xxx_create_qpair(struct scsi_qla_host *vha, int qos, + qpair->rsp->req = qpair->req; + qpair->rsp->qpair = qpair; + /* init qpair to this cpu. Will adjust at run time. */ +- qla_cpu_update(qpair, smp_processor_id()); ++ qla_cpu_update(qpair, raw_smp_processor_id()); + + if (IS_T10_PI_CAPABLE(ha) && ql2xenabledif) { + if (ha->fw_attributes & BIT_4) +diff --git a/drivers/scsi/qla2xxx/qla_isr.c b/drivers/scsi/qla2xxx/qla_isr.c +index f9b3151f4b10d..9c7af5e1dfb07 100644 +--- a/drivers/scsi/qla2xxx/qla_isr.c ++++ b/drivers/scsi/qla2xxx/qla_isr.c +@@ -1819,6 +1819,7 @@ qla24xx_tm_iocb_entry(scsi_qla_host_t *vha, struct req_que *req, void *tsk) + iocb->u.tmf.data = QLA_FUNCTION_FAILED; + } else if ((le16_to_cpu(sts->scsi_status) & + SS_RESPONSE_INFO_LEN_VALID)) { ++ host_to_fcp_swap(sts->data, sizeof(sts->data)); + if (le32_to_cpu(sts->rsp_data_len) < 4) { + ql_log(ql_log_warn, fcport->vha, 0x503b, + "Async-%s error - hdl=%x not enough response(%d).\n", +diff --git a/drivers/scsi/qla2xxx/qla_target.c b/drivers/scsi/qla2xxx/qla_target.c +index 5fbac85d7adfb..09c52ef66887a 100644 +--- a/drivers/scsi/qla2xxx/qla_target.c ++++ b/drivers/scsi/qla2xxx/qla_target.c +@@ -3216,6 +3216,7 @@ int qlt_xmit_response(struct qla_tgt_cmd *cmd, int xmit_type, + "RESET-RSP online/active/old-count/new-count = %d/%d/%d/%d.\n", + vha->flags.online, qla2x00_reset_active(vha), + cmd->reset_count, qpair->chip_reset); ++ res = 0; + goto out_unmap_unlock; + } + +diff --git a/drivers/scsi/zorro7xx.c b/drivers/scsi/zorro7xx.c +index aff31991aea98..ee6d974738532 100644 +--- a/drivers/scsi/zorro7xx.c ++++ b/drivers/scsi/zorro7xx.c +@@ -158,6 +158,8 @@ static void zorro7xx_remove_one(struct zorro_dev *z) + scsi_remove_host(host); + + NCR_700_release(host); ++ if (host->base > 0x01000000) ++ iounmap(hostdata->base); + kfree(hostdata); + free_irq(host->irq, host); + zorro_release_device(z); +diff --git a/drivers/soc/ti/wkup_m3_ipc.c b/drivers/soc/ti/wkup_m3_ipc.c +index c1fda6acb670a..8358b97505db2 100644 +--- a/drivers/soc/ti/wkup_m3_ipc.c ++++ b/drivers/soc/ti/wkup_m3_ipc.c +@@ -454,9 +454,9 @@ static int wkup_m3_ipc_probe(struct platform_device *pdev) + } + + irq = platform_get_irq(pdev, 0); +- if (!irq) { ++ if (irq < 0) { + dev_err(&pdev->dev, "no irq resource\n"); +- return -ENXIO; ++ return irq; + } + + ret = devm_request_irq(dev, irq, wkup_m3_txev_handler, +diff --git a/drivers/spi/spi-bcm-qspi.c b/drivers/spi/spi-bcm-qspi.c +index 82c24c85f45bc..3f291db7b39a0 100644 +--- a/drivers/spi/spi-bcm-qspi.c ++++ b/drivers/spi/spi-bcm-qspi.c +@@ -970,7 +970,7 @@ static int bcm_qspi_exec_mem_op(struct spi_mem *mem, + addr = op->addr.val; + len = op->data.nbytes; + +- if (bcm_qspi_bspi_ver_three(qspi) == true) { ++ if (has_bspi(qspi) && bcm_qspi_bspi_ver_three(qspi) == true) { + /* + * The address coming into this function is a raw flash offset. + * But for BSPI <= V3, we need to convert it to a remapped BSPI +@@ -989,7 +989,7 @@ static int bcm_qspi_exec_mem_op(struct spi_mem *mem, + len < 4) + mspi_read = true; + +- if (mspi_read) ++ if (!has_bspi(qspi) || mspi_read) + return bcm_qspi_mspi_exec_mem_op(spi, op); + + ret = bcm_qspi_bspi_set_mode(qspi, op, 0); +diff --git a/drivers/spi/spi-pxa2xx-pci.c b/drivers/spi/spi-pxa2xx-pci.c +index 1736a48bbccec..54e316eb08913 100644 +--- a/drivers/spi/spi-pxa2xx-pci.c ++++ b/drivers/spi/spi-pxa2xx-pci.c +@@ -72,14 +72,23 @@ static bool lpss_dma_filter(struct dma_chan *chan, void *param) + return true; + } + ++static void lpss_dma_put_device(void *dma_dev) ++{ ++ pci_dev_put(dma_dev); ++} ++ + static int lpss_spi_setup(struct pci_dev *dev, struct pxa_spi_info *c) + { + struct pci_dev *dma_dev; ++ int ret; + + c->num_chipselect = 1; + c->max_clk_rate = 50000000; + + dma_dev = pci_get_slot(dev->bus, PCI_DEVFN(PCI_SLOT(dev->devfn), 0)); ++ ret = devm_add_action_or_reset(&dev->dev, lpss_dma_put_device, dma_dev); ++ if (ret) ++ return ret; + + if (c->tx_param) { + struct dw_dma_slave *slave = c->tx_param; +@@ -103,8 +112,9 @@ static int lpss_spi_setup(struct pci_dev *dev, struct pxa_spi_info *c) + + static int mrfld_spi_setup(struct pci_dev *dev, struct pxa_spi_info *c) + { +- struct pci_dev *dma_dev = pci_get_slot(dev->bus, PCI_DEVFN(21, 0)); + struct dw_dma_slave *tx, *rx; ++ struct pci_dev *dma_dev; ++ int ret; + + switch (PCI_FUNC(dev->devfn)) { + case 0: +@@ -129,6 +139,11 @@ static int mrfld_spi_setup(struct pci_dev *dev, struct pxa_spi_info *c) + return -ENODEV; + } + ++ dma_dev = pci_get_slot(dev->bus, PCI_DEVFN(21, 0)); ++ ret = devm_add_action_or_reset(&dev->dev, lpss_dma_put_device, dma_dev); ++ if (ret) ++ return ret; ++ + tx = c->tx_param; + tx->dma_dev = &dma_dev->dev; + +diff --git a/drivers/spi/spi-tegra114.c b/drivers/spi/spi-tegra114.c +index c510b53e5e3f5..a8264f880b761 100644 +--- a/drivers/spi/spi-tegra114.c ++++ b/drivers/spi/spi-tegra114.c +@@ -1136,6 +1136,10 @@ static int tegra_spi_probe(struct platform_device *pdev) + tspi->phys = r->start; + + spi_irq = platform_get_irq(pdev, 0); ++ if (spi_irq < 0) { ++ ret = spi_irq; ++ goto exit_free_master; ++ } + tspi->irq = spi_irq; + + tspi->clk = devm_clk_get(&pdev->dev, "spi"); +diff --git a/drivers/spi/spi-tegra20-slink.c b/drivers/spi/spi-tegra20-slink.c +index bc3097e5cc261..436d559503db1 100644 +--- a/drivers/spi/spi-tegra20-slink.c ++++ b/drivers/spi/spi-tegra20-slink.c +@@ -1016,14 +1016,8 @@ static int tegra_slink_probe(struct platform_device *pdev) + struct resource *r; + int ret, spi_irq; + const struct tegra_slink_chip_data *cdata = NULL; +- const struct of_device_id *match; + +- match = of_match_device(tegra_slink_of_match, &pdev->dev); +- if (!match) { +- dev_err(&pdev->dev, "Error: No device match found\n"); +- return -ENODEV; +- } +- cdata = match->data; ++ cdata = of_device_get_match_data(&pdev->dev); + + master = spi_alloc_master(&pdev->dev, sizeof(*tspi)); + if (!master) { +diff --git a/drivers/spi/spi.c b/drivers/spi/spi.c +index 49f592e433a8d..3bcd6f178f73b 100644 +--- a/drivers/spi/spi.c ++++ b/drivers/spi/spi.c +@@ -779,10 +779,10 @@ int spi_map_buf(struct spi_controller *ctlr, struct device *dev, + int i, ret; + + if (vmalloced_buf || kmap_buf) { +- desc_len = min_t(int, max_seg_size, PAGE_SIZE); ++ desc_len = min_t(unsigned long, max_seg_size, PAGE_SIZE); + sgs = DIV_ROUND_UP(len + offset_in_page(buf), desc_len); + } else if (virt_addr_valid(buf)) { +- desc_len = min_t(int, max_seg_size, ctlr->max_dma_len); ++ desc_len = min_t(size_t, max_seg_size, ctlr->max_dma_len); + sgs = DIV_ROUND_UP(len, desc_len); + } else { + return -EINVAL; +diff --git a/drivers/staging/iio/adc/ad7280a.c b/drivers/staging/iio/adc/ad7280a.c +index 6a48ad067a8bd..15422d82f8120 100644 +--- a/drivers/staging/iio/adc/ad7280a.c ++++ b/drivers/staging/iio/adc/ad7280a.c +@@ -102,9 +102,9 @@ + static unsigned int ad7280a_devaddr(unsigned int addr) + { + return ((addr & 0x1) << 4) | +- ((addr & 0x2) << 3) | ++ ((addr & 0x2) << 2) | + (addr & 0x4) | +- ((addr & 0x8) >> 3) | ++ ((addr & 0x8) >> 2) | + ((addr & 0x10) >> 4); + } + +diff --git a/drivers/thermal/int340x_thermal/int3400_thermal.c b/drivers/thermal/int340x_thermal/int3400_thermal.c +index 77967da5d4061..68393c3c103ad 100644 +--- a/drivers/thermal/int340x_thermal/int3400_thermal.c ++++ b/drivers/thermal/int340x_thermal/int3400_thermal.c +@@ -53,7 +53,7 @@ struct int3400_thermal_priv { + struct art *arts; + int trt_count; + struct trt *trts; +- u8 uuid_bitmap; ++ u32 uuid_bitmap; + int rel_misc_dev_res; + int current_uuid_index; + }; +diff --git a/drivers/tty/hvc/hvc_iucv.c b/drivers/tty/hvc/hvc_iucv.c +index 2af1e5751bd63..796fbff623f6e 100644 +--- a/drivers/tty/hvc/hvc_iucv.c ++++ b/drivers/tty/hvc/hvc_iucv.c +@@ -1470,7 +1470,9 @@ out_error: + */ + static int __init hvc_iucv_config(char *val) + { +- return kstrtoul(val, 10, &hvc_iucv_devices); ++ if (kstrtoul(val, 10, &hvc_iucv_devices)) ++ pr_warn("hvc_iucv= invalid parameter value '%s'\n", val); ++ return 1; + } + + +diff --git a/drivers/tty/mxser.c b/drivers/tty/mxser.c +index 8bc15cb67a58b..88eb90361a89c 100644 +--- a/drivers/tty/mxser.c ++++ b/drivers/tty/mxser.c +@@ -861,6 +861,7 @@ static int mxser_activate(struct tty_port *port, struct tty_struct *tty) + struct mxser_port *info = container_of(port, struct mxser_port, port); + unsigned long page; + unsigned long flags; ++ int ret; + + page = __get_free_page(GFP_KERNEL); + if (!page) +@@ -870,9 +871,9 @@ static int mxser_activate(struct tty_port *port, struct tty_struct *tty) + + if (!info->ioaddr || !info->type) { + set_bit(TTY_IO_ERROR, &tty->flags); +- free_page(page); + spin_unlock_irqrestore(&info->slock, flags); +- return 0; ++ ret = 0; ++ goto err_free_xmit; + } + info->port.xmit_buf = (unsigned char *) page; + +@@ -898,8 +899,10 @@ static int mxser_activate(struct tty_port *port, struct tty_struct *tty) + if (capable(CAP_SYS_ADMIN)) { + set_bit(TTY_IO_ERROR, &tty->flags); + return 0; +- } else +- return -ENODEV; ++ } ++ ++ ret = -ENODEV; ++ goto err_free_xmit; + } + + /* +@@ -944,6 +947,10 @@ static int mxser_activate(struct tty_port *port, struct tty_struct *tty) + spin_unlock_irqrestore(&info->slock, flags); + + return 0; ++err_free_xmit: ++ free_page(page); ++ info->port.xmit_buf = NULL; ++ return ret; + } + + /* +diff --git a/drivers/tty/serial/8250/8250_mid.c b/drivers/tty/serial/8250/8250_mid.c +index efa0515139f8e..e6c1791609ddf 100644 +--- a/drivers/tty/serial/8250/8250_mid.c ++++ b/drivers/tty/serial/8250/8250_mid.c +@@ -73,6 +73,11 @@ static int pnw_setup(struct mid8250 *mid, struct uart_port *p) + return 0; + } + ++static void pnw_exit(struct mid8250 *mid) ++{ ++ pci_dev_put(mid->dma_dev); ++} ++ + static int tng_handle_irq(struct uart_port *p) + { + struct mid8250 *mid = p->private_data; +@@ -124,6 +129,11 @@ static int tng_setup(struct mid8250 *mid, struct uart_port *p) + return 0; + } + ++static void tng_exit(struct mid8250 *mid) ++{ ++ pci_dev_put(mid->dma_dev); ++} ++ + static int dnv_handle_irq(struct uart_port *p) + { + struct mid8250 *mid = p->private_data; +@@ -330,9 +340,9 @@ static int mid8250_probe(struct pci_dev *pdev, const struct pci_device_id *id) + + pci_set_drvdata(pdev, mid); + return 0; ++ + err: +- if (mid->board->exit) +- mid->board->exit(mid); ++ mid->board->exit(mid); + return ret; + } + +@@ -342,8 +352,7 @@ static void mid8250_remove(struct pci_dev *pdev) + + serial8250_unregister_port(mid->line); + +- if (mid->board->exit) +- mid->board->exit(mid); ++ mid->board->exit(mid); + } + + static const struct mid8250_board pnw_board = { +@@ -351,6 +360,7 @@ static const struct mid8250_board pnw_board = { + .freq = 50000000, + .base_baud = 115200, + .setup = pnw_setup, ++ .exit = pnw_exit, + }; + + static const struct mid8250_board tng_board = { +@@ -358,6 +368,7 @@ static const struct mid8250_board tng_board = { + .freq = 38400000, + .base_baud = 1843200, + .setup = tng_setup, ++ .exit = tng_exit, + }; + + static const struct mid8250_board dnv_board = { +diff --git a/drivers/tty/serial/8250/8250_port.c b/drivers/tty/serial/8250/8250_port.c +index 39e821d6e5376..5ec50ccfbec95 100644 +--- a/drivers/tty/serial/8250/8250_port.c ++++ b/drivers/tty/serial/8250/8250_port.c +@@ -1594,6 +1594,18 @@ static inline void start_tx_rs485(struct uart_port *port) + if (!(up->port.rs485.flags & SER_RS485_RX_DURING_TX)) + serial8250_stop_rx(&up->port); + ++ /* ++ * While serial8250_em485_handle_stop_tx() is a noop if ++ * em485->active_timer != &em485->stop_tx_timer, it might happen that ++ * the timer is still armed and triggers only after the current bunch of ++ * chars is send and em485->active_timer == &em485->stop_tx_timer again. ++ * So cancel the timer. There is still a theoretical race condition if ++ * the timer is already running and only comes around to check for ++ * em485->active_timer when &em485->stop_tx_timer is armed again. ++ */ ++ if (em485->active_timer == &em485->stop_tx_timer) ++ hrtimer_try_to_cancel(&em485->stop_tx_timer); ++ + em485->active_timer = NULL; + + mcr = serial8250_in_MCR(up); +diff --git a/drivers/tty/serial/kgdboc.c b/drivers/tty/serial/kgdboc.c +index b0aa864f84a97..6e81d782d8a00 100644 +--- a/drivers/tty/serial/kgdboc.c ++++ b/drivers/tty/serial/kgdboc.c +@@ -302,16 +302,16 @@ static int kgdboc_option_setup(char *opt) + { + if (!opt) { + pr_err("config string not provided\n"); +- return -EINVAL; ++ return 1; + } + + if (strlen(opt) >= MAX_CONFIG_LEN) { + pr_err("config string too long\n"); +- return -ENOSPC; ++ return 1; + } + strcpy(config, opt); + +- return 0; ++ return 1; + } + + __setup("kgdboc=", kgdboc_option_setup); +diff --git a/drivers/tty/serial/samsung.c b/drivers/tty/serial/samsung.c +index 1528a7ba2bf4d..49661cef54693 100644 +--- a/drivers/tty/serial/samsung.c ++++ b/drivers/tty/serial/samsung.c +@@ -761,11 +761,8 @@ static irqreturn_t s3c24xx_serial_tx_chars(int irq, void *id) + goto out; + } + +- if (uart_circ_chars_pending(xmit) < WAKEUP_CHARS) { +- spin_unlock(&port->lock); ++ if (uart_circ_chars_pending(xmit) < WAKEUP_CHARS) + uart_write_wakeup(port); +- spin_lock(&port->lock); +- } + + if (uart_circ_empty(xmit)) + s3c24xx_serial_stop_tx(port); +diff --git a/drivers/usb/dwc3/dwc3-omap.c b/drivers/usb/dwc3/dwc3-omap.c +index 0dfb710f48b5e..0b800bc6150d4 100644 +--- a/drivers/usb/dwc3/dwc3-omap.c ++++ b/drivers/usb/dwc3/dwc3-omap.c +@@ -237,7 +237,7 @@ static void dwc3_omap_set_mailbox(struct dwc3_omap *omap, + break; + + case OMAP_DWC3_ID_FLOAT: +- if (omap->vbus_reg) ++ if (omap->vbus_reg && regulator_is_enabled(omap->vbus_reg)) + regulator_disable(omap->vbus_reg); + val = dwc3_omap_read_utmi_ctrl(omap); + val |= USBOTGSS_UTMI_OTG_CTRL_IDDIG; +diff --git a/drivers/usb/host/ehci-pci.c b/drivers/usb/host/ehci-pci.c +index 56e6fd0f04829..42ace9f92ce92 100644 +--- a/drivers/usb/host/ehci-pci.c ++++ b/drivers/usb/host/ehci-pci.c +@@ -21,6 +21,9 @@ static const char hcd_name[] = "ehci-pci"; + /* defined here to avoid adding to pci_ids.h for single instance use */ + #define PCI_DEVICE_ID_INTEL_CE4100_USB 0x2e70 + ++#define PCI_VENDOR_ID_ASPEED 0x1a03 ++#define PCI_DEVICE_ID_ASPEED_EHCI 0x2603 ++ + /*-------------------------------------------------------------------------*/ + #define PCI_DEVICE_ID_INTEL_QUARK_X1000_SOC 0x0939 + static inline bool is_intel_quark_x1000(struct pci_dev *pdev) +@@ -223,6 +226,12 @@ static int ehci_pci_setup(struct usb_hcd *hcd) + ehci->has_synopsys_hc_bug = 1; + } + break; ++ case PCI_VENDOR_ID_ASPEED: ++ if (pdev->device == PCI_DEVICE_ID_ASPEED_EHCI) { ++ ehci_info(ehci, "applying Aspeed HC workaround\n"); ++ ehci->is_aspeed = 1; ++ } ++ break; + } + + /* optional debug port, normally in the first BAR */ +diff --git a/drivers/usb/host/xhci-hub.c b/drivers/usb/host/xhci-hub.c +index cf5af8592f3d8..1bb48e53449e6 100644 +--- a/drivers/usb/host/xhci-hub.c ++++ b/drivers/usb/host/xhci-hub.c +@@ -670,7 +670,7 @@ static int xhci_exit_test_mode(struct xhci_hcd *xhci) + } + pm_runtime_allow(xhci_to_hcd(xhci)->self.controller); + xhci->test_mode = 0; +- return xhci_reset(xhci); ++ return xhci_reset(xhci, XHCI_RESET_SHORT_USEC); + } + + void xhci_set_link_state(struct xhci_hcd *xhci, struct xhci_port *port, +diff --git a/drivers/usb/host/xhci-mem.c b/drivers/usb/host/xhci-mem.c +index fb47caf929de5..798823ce2b34f 100644 +--- a/drivers/usb/host/xhci-mem.c ++++ b/drivers/usb/host/xhci-mem.c +@@ -2595,7 +2595,7 @@ int xhci_mem_init(struct xhci_hcd *xhci, gfp_t flags) + + fail: + xhci_halt(xhci); +- xhci_reset(xhci); ++ xhci_reset(xhci, XHCI_RESET_SHORT_USEC); + xhci_mem_cleanup(xhci); + return -ENOMEM; + } +diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c +index 353a57f515223..ab255144e5a70 100644 +--- a/drivers/usb/host/xhci.c ++++ b/drivers/usb/host/xhci.c +@@ -66,7 +66,7 @@ static bool td_on_ring(struct xhci_td *td, struct xhci_ring *ring) + * handshake done). There are two failure modes: "usec" have passed (major + * hardware flakeout), or the register reads as all-ones (hardware removed). + */ +-int xhci_handshake(void __iomem *ptr, u32 mask, u32 done, int usec) ++int xhci_handshake(void __iomem *ptr, u32 mask, u32 done, u64 timeout_us) + { + u32 result; + int ret; +@@ -74,7 +74,7 @@ int xhci_handshake(void __iomem *ptr, u32 mask, u32 done, int usec) + ret = readl_poll_timeout_atomic(ptr, result, + (result & mask) == done || + result == U32_MAX, +- 1, usec); ++ 1, timeout_us); + if (result == U32_MAX) /* card removed */ + return -ENODEV; + +@@ -163,7 +163,7 @@ int xhci_start(struct xhci_hcd *xhci) + * Transactions will be terminated immediately, and operational registers + * will be set to their defaults. + */ +-int xhci_reset(struct xhci_hcd *xhci) ++int xhci_reset(struct xhci_hcd *xhci, u64 timeout_us) + { + u32 command; + u32 state; +@@ -196,8 +196,7 @@ int xhci_reset(struct xhci_hcd *xhci) + if (xhci->quirks & XHCI_INTEL_HOST) + udelay(1000); + +- ret = xhci_handshake(&xhci->op_regs->command, +- CMD_RESET, 0, 10 * 1000 * 1000); ++ ret = xhci_handshake(&xhci->op_regs->command, CMD_RESET, 0, timeout_us); + if (ret) + return ret; + +@@ -210,8 +209,7 @@ int xhci_reset(struct xhci_hcd *xhci) + * xHCI cannot write to any doorbells or operational registers other + * than status until the "Controller Not Ready" flag is cleared. + */ +- ret = xhci_handshake(&xhci->op_regs->status, +- STS_CNR, 0, 10 * 1000 * 1000); ++ ret = xhci_handshake(&xhci->op_regs->status, STS_CNR, 0, timeout_us); + + for (i = 0; i < 2; i++) { + xhci->bus_state[i].port_c_suspend = 0; +@@ -731,7 +729,7 @@ static void xhci_stop(struct usb_hcd *hcd) + xhci->xhc_state |= XHCI_STATE_HALTED; + xhci->cmd_ring_state = CMD_RING_STATE_STOPPED; + xhci_halt(xhci); +- xhci_reset(xhci); ++ xhci_reset(xhci, XHCI_RESET_SHORT_USEC); + spin_unlock_irq(&xhci->lock); + + xhci_cleanup_msix(xhci); +@@ -784,7 +782,7 @@ void xhci_shutdown(struct usb_hcd *hcd) + xhci_halt(xhci); + /* Workaround for spurious wakeups at shutdown with HSW */ + if (xhci->quirks & XHCI_SPURIOUS_WAKEUP) +- xhci_reset(xhci); ++ xhci_reset(xhci, XHCI_RESET_SHORT_USEC); + spin_unlock_irq(&xhci->lock); + + xhci_cleanup_msix(xhci); +@@ -1162,7 +1160,7 @@ int xhci_resume(struct xhci_hcd *xhci, bool hibernated) + xhci_dbg(xhci, "Stop HCD\n"); + xhci_halt(xhci); + xhci_zero_64b_regs(xhci); +- retval = xhci_reset(xhci); ++ retval = xhci_reset(xhci, XHCI_RESET_LONG_USEC); + spin_unlock_irq(&xhci->lock); + if (retval) + return retval; +@@ -5190,7 +5188,7 @@ int xhci_gen_setup(struct usb_hcd *hcd, xhci_get_quirks_t get_quirks) + + xhci_dbg(xhci, "Resetting HCD\n"); + /* Reset the internal HC memory state and registers. */ +- retval = xhci_reset(xhci); ++ retval = xhci_reset(xhci, XHCI_RESET_LONG_USEC); + if (retval) + return retval; + xhci_dbg(xhci, "Reset complete\n"); +diff --git a/drivers/usb/host/xhci.h b/drivers/usb/host/xhci.h +index dfc914713704f..3e6cb257fde5a 100644 +--- a/drivers/usb/host/xhci.h ++++ b/drivers/usb/host/xhci.h +@@ -226,6 +226,9 @@ struct xhci_op_regs { + #define CMD_ETE (1 << 14) + /* bits 15:31 are reserved (and should be preserved on writes). */ + ++#define XHCI_RESET_LONG_USEC (10 * 1000 * 1000) ++#define XHCI_RESET_SHORT_USEC (250 * 1000) ++ + /* IMAN - Interrupt Management Register */ + #define IMAN_IE (1 << 1) + #define IMAN_IP (1 << 0) +@@ -2057,11 +2060,11 @@ void xhci_free_container_ctx(struct xhci_hcd *xhci, + + /* xHCI host controller glue */ + typedef void (*xhci_get_quirks_t)(struct device *, struct xhci_hcd *); +-int xhci_handshake(void __iomem *ptr, u32 mask, u32 done, int usec); ++int xhci_handshake(void __iomem *ptr, u32 mask, u32 done, u64 timeout_us); + void xhci_quiesce(struct xhci_hcd *xhci); + int xhci_halt(struct xhci_hcd *xhci); + int xhci_start(struct xhci_hcd *xhci); +-int xhci_reset(struct xhci_hcd *xhci); ++int xhci_reset(struct xhci_hcd *xhci, u64 timeout_us); + int xhci_run(struct usb_hcd *hcd); + int xhci_gen_setup(struct usb_hcd *hcd, xhci_get_quirks_t get_quirks); + void xhci_shutdown(struct usb_hcd *hcd); +diff --git a/drivers/usb/serial/Kconfig b/drivers/usb/serial/Kconfig +index 533f127c30ad8..22fe96d5d1493 100644 +--- a/drivers/usb/serial/Kconfig ++++ b/drivers/usb/serial/Kconfig +@@ -65,6 +65,7 @@ config USB_SERIAL_SIMPLE + - Libtransistor USB console + - a number of Motorola phones + - Motorola Tetra devices ++ - Nokia mobile phones + - Novatel Wireless GPS receivers + - Siemens USB/MPI adapter. + - ViVOtech ViVOpay USB device. +diff --git a/drivers/usb/serial/pl2303.c b/drivers/usb/serial/pl2303.c +index 7df0fbede21bc..2e8cb6d8ba41f 100644 +--- a/drivers/usb/serial/pl2303.c ++++ b/drivers/usb/serial/pl2303.c +@@ -110,6 +110,7 @@ static const struct usb_device_id id_table[] = { + { USB_DEVICE(ADLINK_VENDOR_ID, ADLINK_ND6530GC_PRODUCT_ID) }, + { USB_DEVICE(SMART_VENDOR_ID, SMART_PRODUCT_ID) }, + { USB_DEVICE(AT_VENDOR_ID, AT_VTKIT3_PRODUCT_ID) }, ++ { USB_DEVICE(IBM_VENDOR_ID, IBM_PRODUCT_ID) }, + { } /* Terminating entry */ + }; + +diff --git a/drivers/usb/serial/pl2303.h b/drivers/usb/serial/pl2303.h +index 3e5442573fe4e..15f746e977a71 100644 +--- a/drivers/usb/serial/pl2303.h ++++ b/drivers/usb/serial/pl2303.h +@@ -29,6 +29,9 @@ + #define ATEN_PRODUCT_UC232B 0x2022 + #define ATEN_PRODUCT_ID2 0x2118 + ++#define IBM_VENDOR_ID 0x04b3 ++#define IBM_PRODUCT_ID 0x4016 ++ + #define IODATA_VENDOR_ID 0x04bb + #define IODATA_PRODUCT_ID 0x0a03 + #define IODATA_PRODUCT_ID_RSAQ5 0x0a0e +diff --git a/drivers/usb/serial/usb-serial-simple.c b/drivers/usb/serial/usb-serial-simple.c +index bd23a7cb1be2b..4c6747889a194 100644 +--- a/drivers/usb/serial/usb-serial-simple.c ++++ b/drivers/usb/serial/usb-serial-simple.c +@@ -91,6 +91,11 @@ DEVICE(moto_modem, MOTO_IDS); + { USB_DEVICE(0x0cad, 0x9016) } /* TPG2200 */ + DEVICE(motorola_tetra, MOTOROLA_TETRA_IDS); + ++/* Nokia mobile phone driver */ ++#define NOKIA_IDS() \ ++ { USB_DEVICE(0x0421, 0x069a) } /* Nokia 130 (RM-1035) */ ++DEVICE(nokia, NOKIA_IDS); ++ + /* Novatel Wireless GPS driver */ + #define NOVATEL_IDS() \ + { USB_DEVICE(0x09d7, 0x0100) } /* NovAtel FlexPack GPS */ +@@ -123,6 +128,7 @@ static struct usb_serial_driver * const serial_drivers[] = { + &vivopay_device, + &moto_modem_device, + &motorola_tetra_device, ++ &nokia_device, + &novatel_gps_device, + &hp4x_device, + &suunto_device, +@@ -140,6 +146,7 @@ static const struct usb_device_id id_table[] = { + VIVOPAY_IDS(), + MOTO_IDS(), + MOTOROLA_TETRA_IDS(), ++ NOKIA_IDS(), + NOVATEL_IDS(), + HP4X_IDS(), + SUUNTO_IDS(), +diff --git a/drivers/usb/storage/ene_ub6250.c b/drivers/usb/storage/ene_ub6250.c +index 4d261e4de9ad3..54679679c825d 100644 +--- a/drivers/usb/storage/ene_ub6250.c ++++ b/drivers/usb/storage/ene_ub6250.c +@@ -236,36 +236,33 @@ static struct us_unusual_dev ene_ub6250_unusual_dev_list[] = { + #define memstick_logaddr(logadr1, logadr0) ((((u16)(logadr1)) << 8) | (logadr0)) + + +-struct SD_STATUS { +- u8 Insert:1; +- u8 Ready:1; +- u8 MediaChange:1; +- u8 IsMMC:1; +- u8 HiCapacity:1; +- u8 HiSpeed:1; +- u8 WtP:1; +- u8 Reserved:1; +-}; +- +-struct MS_STATUS { +- u8 Insert:1; +- u8 Ready:1; +- u8 MediaChange:1; +- u8 IsMSPro:1; +- u8 IsMSPHG:1; +- u8 Reserved1:1; +- u8 WtP:1; +- u8 Reserved2:1; +-}; +- +-struct SM_STATUS { +- u8 Insert:1; +- u8 Ready:1; +- u8 MediaChange:1; +- u8 Reserved:3; +- u8 WtP:1; +- u8 IsMS:1; +-}; ++/* SD_STATUS bits */ ++#define SD_Insert BIT(0) ++#define SD_Ready BIT(1) ++#define SD_MediaChange BIT(2) ++#define SD_IsMMC BIT(3) ++#define SD_HiCapacity BIT(4) ++#define SD_HiSpeed BIT(5) ++#define SD_WtP BIT(6) ++ /* Bit 7 reserved */ ++ ++/* MS_STATUS bits */ ++#define MS_Insert BIT(0) ++#define MS_Ready BIT(1) ++#define MS_MediaChange BIT(2) ++#define MS_IsMSPro BIT(3) ++#define MS_IsMSPHG BIT(4) ++ /* Bit 5 reserved */ ++#define MS_WtP BIT(6) ++ /* Bit 7 reserved */ ++ ++/* SM_STATUS bits */ ++#define SM_Insert BIT(0) ++#define SM_Ready BIT(1) ++#define SM_MediaChange BIT(2) ++ /* Bits 3-5 reserved */ ++#define SM_WtP BIT(6) ++#define SM_IsMS BIT(7) + + struct ms_bootblock_cis { + u8 bCistplDEVICE[6]; /* 0 */ +@@ -436,9 +433,9 @@ struct ene_ub6250_info { + u8 *bbuf; + + /* for 6250 code */ +- struct SD_STATUS SD_Status; +- struct MS_STATUS MS_Status; +- struct SM_STATUS SM_Status; ++ u8 SD_Status; ++ u8 MS_Status; ++ u8 SM_Status; + + /* ----- SD Control Data ---------------- */ + /*SD_REGISTER SD_Regs; */ +@@ -601,7 +598,7 @@ static int sd_scsi_test_unit_ready(struct us_data *us, struct scsi_cmnd *srb) + { + struct ene_ub6250_info *info = (struct ene_ub6250_info *) us->extra; + +- if (info->SD_Status.Insert && info->SD_Status.Ready) ++ if ((info->SD_Status & SD_Insert) && (info->SD_Status & SD_Ready)) + return USB_STOR_TRANSPORT_GOOD; + else { + ene_sd_init(us); +@@ -621,7 +618,7 @@ static int sd_scsi_mode_sense(struct us_data *us, struct scsi_cmnd *srb) + 0x0b, 0x00, 0x80, 0x08, 0x00, 0x00, + 0x71, 0xc0, 0x00, 0x00, 0x02, 0x00 }; + +- if (info->SD_Status.WtP) ++ if (info->SD_Status & SD_WtP) + usb_stor_set_xfer_buf(mediaWP, 12, srb); + else + usb_stor_set_xfer_buf(mediaNoWP, 12, srb); +@@ -640,9 +637,9 @@ static int sd_scsi_read_capacity(struct us_data *us, struct scsi_cmnd *srb) + struct ene_ub6250_info *info = (struct ene_ub6250_info *) us->extra; + + usb_stor_dbg(us, "sd_scsi_read_capacity\n"); +- if (info->SD_Status.HiCapacity) { ++ if (info->SD_Status & SD_HiCapacity) { + bl_len = 0x200; +- if (info->SD_Status.IsMMC) ++ if (info->SD_Status & SD_IsMMC) + bl_num = info->HC_C_SIZE-1; + else + bl_num = (info->HC_C_SIZE + 1) * 1024 - 1; +@@ -692,7 +689,7 @@ static int sd_scsi_read(struct us_data *us, struct scsi_cmnd *srb) + return USB_STOR_TRANSPORT_ERROR; + } + +- if (info->SD_Status.HiCapacity) ++ if (info->SD_Status & SD_HiCapacity) + bnByte = bn; + + /* set up the command wrapper */ +@@ -732,7 +729,7 @@ static int sd_scsi_write(struct us_data *us, struct scsi_cmnd *srb) + return USB_STOR_TRANSPORT_ERROR; + } + +- if (info->SD_Status.HiCapacity) ++ if (info->SD_Status & SD_HiCapacity) + bnByte = bn; + + /* set up the command wrapper */ +@@ -1454,7 +1451,7 @@ static int ms_scsi_test_unit_ready(struct us_data *us, struct scsi_cmnd *srb) + struct ene_ub6250_info *info = (struct ene_ub6250_info *)(us->extra); + + /* pr_info("MS_SCSI_Test_Unit_Ready\n"); */ +- if (info->MS_Status.Insert && info->MS_Status.Ready) { ++ if ((info->MS_Status & MS_Insert) && (info->MS_Status & MS_Ready)) { + return USB_STOR_TRANSPORT_GOOD; + } else { + ene_ms_init(us); +@@ -1474,7 +1471,7 @@ static int ms_scsi_mode_sense(struct us_data *us, struct scsi_cmnd *srb) + 0x0b, 0x00, 0x80, 0x08, 0x00, 0x00, + 0x71, 0xc0, 0x00, 0x00, 0x02, 0x00 }; + +- if (info->MS_Status.WtP) ++ if (info->MS_Status & MS_WtP) + usb_stor_set_xfer_buf(mediaWP, 12, srb); + else + usb_stor_set_xfer_buf(mediaNoWP, 12, srb); +@@ -1493,7 +1490,7 @@ static int ms_scsi_read_capacity(struct us_data *us, struct scsi_cmnd *srb) + + usb_stor_dbg(us, "ms_scsi_read_capacity\n"); + bl_len = 0x200; +- if (info->MS_Status.IsMSPro) ++ if (info->MS_Status & MS_IsMSPro) + bl_num = info->MSP_TotalBlock - 1; + else + bl_num = info->MS_Lib.NumberOfLogBlock * info->MS_Lib.blockSize * 2 - 1; +@@ -1648,7 +1645,7 @@ static int ms_scsi_read(struct us_data *us, struct scsi_cmnd *srb) + if (bn > info->bl_num) + return USB_STOR_TRANSPORT_ERROR; + +- if (info->MS_Status.IsMSPro) { ++ if (info->MS_Status & MS_IsMSPro) { + result = ene_load_bincode(us, MSP_RW_PATTERN); + if (result != USB_STOR_XFER_GOOD) { + usb_stor_dbg(us, "Load MPS RW pattern Fail !!\n"); +@@ -1749,7 +1746,7 @@ static int ms_scsi_write(struct us_data *us, struct scsi_cmnd *srb) + if (bn > info->bl_num) + return USB_STOR_TRANSPORT_ERROR; + +- if (info->MS_Status.IsMSPro) { ++ if (info->MS_Status & MS_IsMSPro) { + result = ene_load_bincode(us, MSP_RW_PATTERN); + if (result != USB_STOR_XFER_GOOD) { + pr_info("Load MSP RW pattern Fail !!\n"); +@@ -1857,12 +1854,12 @@ static int ene_get_card_status(struct us_data *us, u8 *buf) + + tmpreg = (u16) reg4b; + reg4b = *(u32 *)(&buf[0x14]); +- if (info->SD_Status.HiCapacity && !info->SD_Status.IsMMC) ++ if ((info->SD_Status & SD_HiCapacity) && !(info->SD_Status & SD_IsMMC)) + info->HC_C_SIZE = (reg4b >> 8) & 0x3fffff; + + info->SD_C_SIZE = ((tmpreg & 0x03) << 10) | (u16)(reg4b >> 22); + info->SD_C_SIZE_MULT = (u8)(reg4b >> 7) & 0x07; +- if (info->SD_Status.HiCapacity && info->SD_Status.IsMMC) ++ if ((info->SD_Status & SD_HiCapacity) && (info->SD_Status & SD_IsMMC)) + info->HC_C_SIZE = *(u32 *)(&buf[0x100]); + + if (info->SD_READ_BL_LEN > SD_BLOCK_LEN) { +@@ -2074,6 +2071,7 @@ static int ene_ms_init(struct us_data *us) + u16 MSP_BlockSize, MSP_UserAreaBlocks; + struct ene_ub6250_info *info = (struct ene_ub6250_info *) us->extra; + u8 *bbuf = info->bbuf; ++ unsigned int s; + + printk(KERN_INFO "transport --- ENE_MSInit\n"); + +@@ -2098,15 +2096,16 @@ static int ene_ms_init(struct us_data *us) + return USB_STOR_TRANSPORT_ERROR; + } + /* the same part to test ENE */ +- info->MS_Status = *(struct MS_STATUS *) bbuf; +- +- if (info->MS_Status.Insert && info->MS_Status.Ready) { +- printk(KERN_INFO "Insert = %x\n", info->MS_Status.Insert); +- printk(KERN_INFO "Ready = %x\n", info->MS_Status.Ready); +- printk(KERN_INFO "IsMSPro = %x\n", info->MS_Status.IsMSPro); +- printk(KERN_INFO "IsMSPHG = %x\n", info->MS_Status.IsMSPHG); +- printk(KERN_INFO "WtP= %x\n", info->MS_Status.WtP); +- if (info->MS_Status.IsMSPro) { ++ info->MS_Status = bbuf[0]; ++ ++ s = info->MS_Status; ++ if ((s & MS_Insert) && (s & MS_Ready)) { ++ printk(KERN_INFO "Insert = %x\n", !!(s & MS_Insert)); ++ printk(KERN_INFO "Ready = %x\n", !!(s & MS_Ready)); ++ printk(KERN_INFO "IsMSPro = %x\n", !!(s & MS_IsMSPro)); ++ printk(KERN_INFO "IsMSPHG = %x\n", !!(s & MS_IsMSPHG)); ++ printk(KERN_INFO "WtP= %x\n", !!(s & MS_WtP)); ++ if (s & MS_IsMSPro) { + MSP_BlockSize = (bbuf[6] << 8) | bbuf[7]; + MSP_UserAreaBlocks = (bbuf[10] << 8) | bbuf[11]; + info->MSP_TotalBlock = MSP_BlockSize * MSP_UserAreaBlocks; +@@ -2167,17 +2166,17 @@ static int ene_sd_init(struct us_data *us) + return USB_STOR_TRANSPORT_ERROR; + } + +- info->SD_Status = *(struct SD_STATUS *) bbuf; +- if (info->SD_Status.Insert && info->SD_Status.Ready) { +- struct SD_STATUS *s = &info->SD_Status; ++ info->SD_Status = bbuf[0]; ++ if ((info->SD_Status & SD_Insert) && (info->SD_Status & SD_Ready)) { ++ unsigned int s = info->SD_Status; + + ene_get_card_status(us, bbuf); +- usb_stor_dbg(us, "Insert = %x\n", s->Insert); +- usb_stor_dbg(us, "Ready = %x\n", s->Ready); +- usb_stor_dbg(us, "IsMMC = %x\n", s->IsMMC); +- usb_stor_dbg(us, "HiCapacity = %x\n", s->HiCapacity); +- usb_stor_dbg(us, "HiSpeed = %x\n", s->HiSpeed); +- usb_stor_dbg(us, "WtP = %x\n", s->WtP); ++ usb_stor_dbg(us, "Insert = %x\n", !!(s & SD_Insert)); ++ usb_stor_dbg(us, "Ready = %x\n", !!(s & SD_Ready)); ++ usb_stor_dbg(us, "IsMMC = %x\n", !!(s & SD_IsMMC)); ++ usb_stor_dbg(us, "HiCapacity = %x\n", !!(s & SD_HiCapacity)); ++ usb_stor_dbg(us, "HiSpeed = %x\n", !!(s & SD_HiSpeed)); ++ usb_stor_dbg(us, "WtP = %x\n", !!(s & SD_WtP)); + } else { + usb_stor_dbg(us, "SD Card Not Ready --- %x\n", bbuf[0]); + return USB_STOR_TRANSPORT_ERROR; +@@ -2199,14 +2198,14 @@ static int ene_init(struct us_data *us) + + misc_reg03 = bbuf[0]; + if (misc_reg03 & 0x01) { +- if (!info->SD_Status.Ready) { ++ if (!(info->SD_Status & SD_Ready)) { + result = ene_sd_init(us); + if (result != USB_STOR_XFER_GOOD) + return USB_STOR_TRANSPORT_ERROR; + } + } + if (misc_reg03 & 0x02) { +- if (!info->MS_Status.Ready) { ++ if (!(info->MS_Status & MS_Ready)) { + result = ene_ms_init(us); + if (result != USB_STOR_XFER_GOOD) + return USB_STOR_TRANSPORT_ERROR; +@@ -2305,14 +2304,14 @@ static int ene_transport(struct scsi_cmnd *srb, struct us_data *us) + + /*US_DEBUG(usb_stor_show_command(us, srb)); */ + scsi_set_resid(srb, 0); +- if (unlikely(!(info->SD_Status.Ready || info->MS_Status.Ready))) ++ if (unlikely(!(info->SD_Status & SD_Ready) || (info->MS_Status & MS_Ready))) + result = ene_init(us); + if (result == USB_STOR_XFER_GOOD) { + result = USB_STOR_TRANSPORT_ERROR; +- if (info->SD_Status.Ready) ++ if (info->SD_Status & SD_Ready) + result = sd_scsi_irp(us, srb); + +- if (info->MS_Status.Ready) ++ if (info->MS_Status & MS_Ready) + result = ms_scsi_irp(us, srb); + } + return result; +@@ -2376,7 +2375,6 @@ static int ene_ub6250_probe(struct usb_interface *intf, + + static int ene_ub6250_resume(struct usb_interface *iface) + { +- u8 tmp = 0; + struct us_data *us = usb_get_intfdata(iface); + struct ene_ub6250_info *info = (struct ene_ub6250_info *)(us->extra); + +@@ -2388,17 +2386,16 @@ static int ene_ub6250_resume(struct usb_interface *iface) + mutex_unlock(&us->dev_mutex); + + info->Power_IsResum = true; +- /*info->SD_Status.Ready = 0; */ +- info->SD_Status = *(struct SD_STATUS *)&tmp; +- info->MS_Status = *(struct MS_STATUS *)&tmp; +- info->SM_Status = *(struct SM_STATUS *)&tmp; ++ /* info->SD_Status &= ~SD_Ready; */ ++ info->SD_Status = 0; ++ info->MS_Status = 0; ++ info->SM_Status = 0; + + return 0; + } + + static int ene_ub6250_reset_resume(struct usb_interface *iface) + { +- u8 tmp = 0; + struct us_data *us = usb_get_intfdata(iface); + struct ene_ub6250_info *info = (struct ene_ub6250_info *)(us->extra); + +@@ -2410,10 +2407,10 @@ static int ene_ub6250_reset_resume(struct usb_interface *iface) + * the device + */ + info->Power_IsResum = true; +- /*info->SD_Status.Ready = 0; */ +- info->SD_Status = *(struct SD_STATUS *)&tmp; +- info->MS_Status = *(struct MS_STATUS *)&tmp; +- info->SM_Status = *(struct SM_STATUS *)&tmp; ++ /* info->SD_Status &= ~SD_Ready; */ ++ info->SD_Status = 0; ++ info->MS_Status = 0; ++ info->SM_Status = 0; + + return 0; + } +diff --git a/drivers/usb/storage/realtek_cr.c b/drivers/usb/storage/realtek_cr.c +index 1d9ce9cbc831d..9c2a1eda3f4f0 100644 +--- a/drivers/usb/storage/realtek_cr.c ++++ b/drivers/usb/storage/realtek_cr.c +@@ -364,7 +364,7 @@ static int rts51x_read_mem(struct us_data *us, u16 addr, u8 *data, u16 len) + + buf = kmalloc(len, GFP_NOIO); + if (buf == NULL) +- return USB_STOR_TRANSPORT_ERROR; ++ return -ENOMEM; + + usb_stor_dbg(us, "addr = 0x%x, len = %d\n", addr, len); + +diff --git a/drivers/video/fbdev/atafb.c b/drivers/video/fbdev/atafb.c +index fcd2dd670a658..770f77055682b 100644 +--- a/drivers/video/fbdev/atafb.c ++++ b/drivers/video/fbdev/atafb.c +@@ -1713,9 +1713,9 @@ static int falcon_setcolreg(unsigned int regno, unsigned int red, + ((blue & 0xfc00) >> 8)); + if (regno < 16) { + shifter_tt.color_reg[regno] = +- (((red & 0xe000) >> 13) | ((red & 0x1000) >> 12) << 8) | +- (((green & 0xe000) >> 13) | ((green & 0x1000) >> 12) << 4) | +- ((blue & 0xe000) >> 13) | ((blue & 0x1000) >> 12); ++ ((((red & 0xe000) >> 13) | ((red & 0x1000) >> 12)) << 8) | ++ ((((green & 0xe000) >> 13) | ((green & 0x1000) >> 12)) << 4) | ++ ((blue & 0xe000) >> 13) | ((blue & 0x1000) >> 12); + ((u32 *)info->pseudo_palette)[regno] = ((red & 0xf800) | + ((green & 0xfc00) >> 5) | + ((blue & 0xf800) >> 11)); +@@ -2001,9 +2001,9 @@ static int stste_setcolreg(unsigned int regno, unsigned int red, + green >>= 12; + if (ATARIHW_PRESENT(EXTD_SHIFTER)) + shifter_tt.color_reg[regno] = +- (((red & 0xe) >> 1) | ((red & 1) << 3) << 8) | +- (((green & 0xe) >> 1) | ((green & 1) << 3) << 4) | +- ((blue & 0xe) >> 1) | ((blue & 1) << 3); ++ ((((red & 0xe) >> 1) | ((red & 1) << 3)) << 8) | ++ ((((green & 0xe) >> 1) | ((green & 1) << 3)) << 4) | ++ ((blue & 0xe) >> 1) | ((blue & 1) << 3); + else + shifter_tt.color_reg[regno] = + ((red & 0xe) << 7) | +diff --git a/drivers/video/fbdev/cirrusfb.c b/drivers/video/fbdev/cirrusfb.c +index b3be06dd29088..72358d187023e 100644 +--- a/drivers/video/fbdev/cirrusfb.c ++++ b/drivers/video/fbdev/cirrusfb.c +@@ -470,7 +470,7 @@ static int cirrusfb_check_mclk(struct fb_info *info, long freq) + return 0; + } + +-static int cirrusfb_check_pixclock(const struct fb_var_screeninfo *var, ++static int cirrusfb_check_pixclock(struct fb_var_screeninfo *var, + struct fb_info *info) + { + long freq; +@@ -479,9 +479,7 @@ static int cirrusfb_check_pixclock(const struct fb_var_screeninfo *var, + unsigned maxclockidx = var->bits_per_pixel >> 3; + + /* convert from ps to kHz */ +- freq = PICOS2KHZ(var->pixclock); +- +- dev_dbg(info->device, "desired pixclock: %ld kHz\n", freq); ++ freq = PICOS2KHZ(var->pixclock ? : 1); + + maxclock = cirrusfb_board_info[cinfo->btype].maxclock[maxclockidx]; + cinfo->multiplexing = 0; +@@ -489,11 +487,13 @@ static int cirrusfb_check_pixclock(const struct fb_var_screeninfo *var, + /* If the frequency is greater than we can support, we might be able + * to use multiplexing for the video mode */ + if (freq > maxclock) { +- dev_err(info->device, +- "Frequency greater than maxclock (%ld kHz)\n", +- maxclock); +- return -EINVAL; ++ var->pixclock = KHZ2PICOS(maxclock); ++ ++ while ((freq = PICOS2KHZ(var->pixclock)) > maxclock) ++ var->pixclock++; + } ++ dev_dbg(info->device, "desired pixclock: %ld kHz\n", freq); ++ + /* + * Additional constraint: 8bpp uses DAC clock doubling to allow maximum + * pixel clock +diff --git a/drivers/video/fbdev/core/fbcvt.c b/drivers/video/fbdev/core/fbcvt.c +index 55d2bd0ce5c02..64843464c6613 100644 +--- a/drivers/video/fbdev/core/fbcvt.c ++++ b/drivers/video/fbdev/core/fbcvt.c +@@ -214,9 +214,11 @@ static u32 fb_cvt_aspect_ratio(struct fb_cvt_data *cvt) + static void fb_cvt_print_name(struct fb_cvt_data *cvt) + { + u32 pixcount, pixcount_mod; +- int cnt = 255, offset = 0, read = 0; +- u8 *buf = kzalloc(256, GFP_KERNEL); ++ int size = 256; ++ int off = 0; ++ u8 *buf; + ++ buf = kzalloc(size, GFP_KERNEL); + if (!buf) + return; + +@@ -224,43 +226,30 @@ static void fb_cvt_print_name(struct fb_cvt_data *cvt) + pixcount_mod = (cvt->xres * (cvt->yres/cvt->interlace)) % 1000000; + pixcount_mod /= 1000; + +- read = snprintf(buf+offset, cnt, "fbcvt: %dx%d@%d: CVT Name - ", +- cvt->xres, cvt->yres, cvt->refresh); +- offset += read; +- cnt -= read; ++ off += scnprintf(buf + off, size - off, "fbcvt: %dx%d@%d: CVT Name - ", ++ cvt->xres, cvt->yres, cvt->refresh); + +- if (cvt->status) +- snprintf(buf+offset, cnt, "Not a CVT standard - %d.%03d Mega " +- "Pixel Image\n", pixcount, pixcount_mod); +- else { +- if (pixcount) { +- read = snprintf(buf+offset, cnt, "%d", pixcount); +- cnt -= read; +- offset += read; +- } ++ if (cvt->status) { ++ off += scnprintf(buf + off, size - off, ++ "Not a CVT standard - %d.%03d Mega Pixel Image\n", ++ pixcount, pixcount_mod); ++ } else { ++ if (pixcount) ++ off += scnprintf(buf + off, size - off, "%d", pixcount); + +- read = snprintf(buf+offset, cnt, ".%03dM", pixcount_mod); +- cnt -= read; +- offset += read; ++ off += scnprintf(buf + off, size - off, ".%03dM", pixcount_mod); + + if (cvt->aspect_ratio == 0) +- read = snprintf(buf+offset, cnt, "3"); ++ off += scnprintf(buf + off, size - off, "3"); + else if (cvt->aspect_ratio == 3) +- read = snprintf(buf+offset, cnt, "4"); ++ off += scnprintf(buf + off, size - off, "4"); + else if (cvt->aspect_ratio == 1 || cvt->aspect_ratio == 4) +- read = snprintf(buf+offset, cnt, "9"); ++ off += scnprintf(buf + off, size - off, "9"); + else if (cvt->aspect_ratio == 2) +- read = snprintf(buf+offset, cnt, "A"); +- else +- read = 0; +- cnt -= read; +- offset += read; +- +- if (cvt->flags & FB_CVT_FLAG_REDUCED_BLANK) { +- read = snprintf(buf+offset, cnt, "-R"); +- cnt -= read; +- offset += read; +- } ++ off += scnprintf(buf + off, size - off, "A"); ++ ++ if (cvt->flags & FB_CVT_FLAG_REDUCED_BLANK) ++ off += scnprintf(buf + off, size - off, "-R"); + } + + printk(KERN_INFO "%s\n", buf); +diff --git a/drivers/video/fbdev/nvidia/nv_i2c.c b/drivers/video/fbdev/nvidia/nv_i2c.c +index d7994a1732459..0b48965a6420c 100644 +--- a/drivers/video/fbdev/nvidia/nv_i2c.c ++++ b/drivers/video/fbdev/nvidia/nv_i2c.c +@@ -86,7 +86,7 @@ static int nvidia_setup_i2c_bus(struct nvidia_i2c_chan *chan, const char *name, + { + int rc; + +- strcpy(chan->adapter.name, name); ++ strscpy(chan->adapter.name, name, sizeof(chan->adapter.name)); + chan->adapter.owner = THIS_MODULE; + chan->adapter.class = i2c_class; + chan->adapter.algo_data = &chan->algo; +diff --git a/drivers/video/fbdev/omap2/omapfb/displays/connector-dvi.c b/drivers/video/fbdev/omap2/omapfb/displays/connector-dvi.c +index 06e1db34541e2..41b0db0cc0471 100644 +--- a/drivers/video/fbdev/omap2/omapfb/displays/connector-dvi.c ++++ b/drivers/video/fbdev/omap2/omapfb/displays/connector-dvi.c +@@ -254,6 +254,7 @@ static int dvic_probe_of(struct platform_device *pdev) + adapter_node = of_parse_phandle(node, "ddc-i2c-bus", 0); + if (adapter_node) { + adapter = of_get_i2c_adapter_by_node(adapter_node); ++ of_node_put(adapter_node); + if (adapter == NULL) { + dev_err(&pdev->dev, "failed to parse ddc-i2c-bus\n"); + omap_dss_put_device(ddata->in); +diff --git a/drivers/video/fbdev/omap2/omapfb/displays/panel-dsi-cm.c b/drivers/video/fbdev/omap2/omapfb/displays/panel-dsi-cm.c +index 87497a00241fd..1c57ddaeff1b8 100644 +--- a/drivers/video/fbdev/omap2/omapfb/displays/panel-dsi-cm.c ++++ b/drivers/video/fbdev/omap2/omapfb/displays/panel-dsi-cm.c +@@ -412,7 +412,7 @@ static ssize_t dsicm_num_errors_show(struct device *dev, + if (r) + return r; + +- return snprintf(buf, PAGE_SIZE, "%d\n", errors); ++ return sysfs_emit(buf, "%d\n", errors); + } + + static ssize_t dsicm_hw_revision_show(struct device *dev, +@@ -442,7 +442,7 @@ static ssize_t dsicm_hw_revision_show(struct device *dev, + if (r) + return r; + +- return snprintf(buf, PAGE_SIZE, "%02x.%02x.%02x\n", id1, id2, id3); ++ return sysfs_emit(buf, "%02x.%02x.%02x\n", id1, id2, id3); + } + + static ssize_t dsicm_store_ulps(struct device *dev, +@@ -490,7 +490,7 @@ static ssize_t dsicm_show_ulps(struct device *dev, + t = ddata->ulps_enabled; + mutex_unlock(&ddata->lock); + +- return snprintf(buf, PAGE_SIZE, "%u\n", t); ++ return sysfs_emit(buf, "%u\n", t); + } + + static ssize_t dsicm_store_ulps_timeout(struct device *dev, +@@ -535,7 +535,7 @@ static ssize_t dsicm_show_ulps_timeout(struct device *dev, + t = ddata->ulps_timeout; + mutex_unlock(&ddata->lock); + +- return snprintf(buf, PAGE_SIZE, "%u\n", t); ++ return sysfs_emit(buf, "%u\n", t); + } + + static DEVICE_ATTR(num_dsi_errors, S_IRUGO, dsicm_num_errors_show, NULL); +diff --git a/drivers/video/fbdev/omap2/omapfb/displays/panel-sony-acx565akm.c b/drivers/video/fbdev/omap2/omapfb/displays/panel-sony-acx565akm.c +index f2c2fef3db744..87c4f420a9d92 100644 +--- a/drivers/video/fbdev/omap2/omapfb/displays/panel-sony-acx565akm.c ++++ b/drivers/video/fbdev/omap2/omapfb/displays/panel-sony-acx565akm.c +@@ -487,7 +487,7 @@ static ssize_t show_cabc_available_modes(struct device *dev, + int i; + + if (!ddata->has_cabc) +- return snprintf(buf, PAGE_SIZE, "%s\n", cabc_modes[0]); ++ return sysfs_emit(buf, "%s\n", cabc_modes[0]); + + for (i = 0, len = 0; + len < PAGE_SIZE && i < ARRAY_SIZE(cabc_modes); i++) +diff --git a/drivers/video/fbdev/omap2/omapfb/displays/panel-tpo-td043mtea1.c b/drivers/video/fbdev/omap2/omapfb/displays/panel-tpo-td043mtea1.c +index ea8c79a42b41a..3f1389bfba6f0 100644 +--- a/drivers/video/fbdev/omap2/omapfb/displays/panel-tpo-td043mtea1.c ++++ b/drivers/video/fbdev/omap2/omapfb/displays/panel-tpo-td043mtea1.c +@@ -173,7 +173,7 @@ static ssize_t tpo_td043_vmirror_show(struct device *dev, + { + struct panel_drv_data *ddata = dev_get_drvdata(dev); + +- return snprintf(buf, PAGE_SIZE, "%d\n", ddata->vmirror); ++ return sysfs_emit(buf, "%d\n", ddata->vmirror); + } + + static ssize_t tpo_td043_vmirror_store(struct device *dev, +@@ -203,7 +203,7 @@ static ssize_t tpo_td043_mode_show(struct device *dev, + { + struct panel_drv_data *ddata = dev_get_drvdata(dev); + +- return snprintf(buf, PAGE_SIZE, "%d\n", ddata->mode); ++ return sysfs_emit(buf, "%d\n", ddata->mode); + } + + static ssize_t tpo_td043_mode_store(struct device *dev, +diff --git a/drivers/video/fbdev/sm712fb.c b/drivers/video/fbdev/sm712fb.c +index 1781ca697f66b..f4396d1389e42 100644 +--- a/drivers/video/fbdev/sm712fb.c ++++ b/drivers/video/fbdev/sm712fb.c +@@ -1047,7 +1047,7 @@ static ssize_t smtcfb_read(struct fb_info *info, char __user *buf, + if (count + p > total_size) + count = total_size - p; + +- buffer = kmalloc((count > PAGE_SIZE) ? PAGE_SIZE : count, GFP_KERNEL); ++ buffer = kmalloc(PAGE_SIZE, GFP_KERNEL); + if (!buffer) + return -ENOMEM; + +@@ -1059,25 +1059,14 @@ static ssize_t smtcfb_read(struct fb_info *info, char __user *buf, + while (count) { + c = (count > PAGE_SIZE) ? PAGE_SIZE : count; + dst = buffer; +- for (i = c >> 2; i--;) { +- *dst = fb_readl(src++); +- *dst = big_swap(*dst); ++ for (i = (c + 3) >> 2; i--;) { ++ u32 val; ++ ++ val = fb_readl(src); ++ *dst = big_swap(val); ++ src++; + dst++; + } +- if (c & 3) { +- u8 *dst8 = (u8 *)dst; +- u8 __iomem *src8 = (u8 __iomem *)src; +- +- for (i = c & 3; i--;) { +- if (i & 1) { +- *dst8++ = fb_readb(++src8); +- } else { +- *dst8++ = fb_readb(--src8); +- src8 += 2; +- } +- } +- src = (u32 __iomem *)src8; +- } + + if (copy_to_user(buf, buffer, c)) { + err = -EFAULT; +@@ -1130,7 +1119,7 @@ static ssize_t smtcfb_write(struct fb_info *info, const char __user *buf, + count = total_size - p; + } + +- buffer = kmalloc((count > PAGE_SIZE) ? PAGE_SIZE : count, GFP_KERNEL); ++ buffer = kmalloc(PAGE_SIZE, GFP_KERNEL); + if (!buffer) + return -ENOMEM; + +@@ -1148,24 +1137,11 @@ static ssize_t smtcfb_write(struct fb_info *info, const char __user *buf, + break; + } + +- for (i = c >> 2; i--;) { +- fb_writel(big_swap(*src), dst++); ++ for (i = (c + 3) >> 2; i--;) { ++ fb_writel(big_swap(*src), dst); ++ dst++; + src++; + } +- if (c & 3) { +- u8 *src8 = (u8 *)src; +- u8 __iomem *dst8 = (u8 __iomem *)dst; +- +- for (i = c & 3; i--;) { +- if (i & 1) { +- fb_writeb(*src8++, ++dst8); +- } else { +- fb_writeb(*src8++, --dst8); +- dst8 += 2; +- } +- } +- dst = (u32 __iomem *)dst8; +- } + + *ppos += c; + buf += c; +diff --git a/drivers/video/fbdev/smscufx.c b/drivers/video/fbdev/smscufx.c +index 22b606af0a875..da54a84d2e62e 100644 +--- a/drivers/video/fbdev/smscufx.c ++++ b/drivers/video/fbdev/smscufx.c +@@ -1662,6 +1662,7 @@ static int ufx_usb_probe(struct usb_interface *interface, + info->par = dev; + info->pseudo_palette = dev->pseudo_palette; + info->fbops = &ufx_ops; ++ INIT_LIST_HEAD(&info->modelist); + + retval = fb_alloc_cmap(&info->cmap, 256, 0); + if (retval < 0) { +@@ -1672,8 +1673,6 @@ static int ufx_usb_probe(struct usb_interface *interface, + INIT_DELAYED_WORK(&dev->free_framebuffer_work, + ufx_free_framebuffer_work); + +- INIT_LIST_HEAD(&info->modelist); +- + retval = ufx_reg_read(dev, 0x3000, &id_rev); + check_warn_goto_error(retval, "error %d reading 0x3000 register from device", retval); + dev_dbg(dev->gdev, "ID_REV register value 0x%08x", id_rev); +diff --git a/drivers/video/fbdev/udlfb.c b/drivers/video/fbdev/udlfb.c +index f7823aa99340d..08a694e9383f0 100644 +--- a/drivers/video/fbdev/udlfb.c ++++ b/drivers/video/fbdev/udlfb.c +@@ -1430,7 +1430,7 @@ static ssize_t metrics_bytes_rendered_show(struct device *fbdev, + struct device_attribute *a, char *buf) { + struct fb_info *fb_info = dev_get_drvdata(fbdev); + struct dlfb_data *dlfb = fb_info->par; +- return snprintf(buf, PAGE_SIZE, "%u\n", ++ return sysfs_emit(buf, "%u\n", + atomic_read(&dlfb->bytes_rendered)); + } + +@@ -1438,7 +1438,7 @@ static ssize_t metrics_bytes_identical_show(struct device *fbdev, + struct device_attribute *a, char *buf) { + struct fb_info *fb_info = dev_get_drvdata(fbdev); + struct dlfb_data *dlfb = fb_info->par; +- return snprintf(buf, PAGE_SIZE, "%u\n", ++ return sysfs_emit(buf, "%u\n", + atomic_read(&dlfb->bytes_identical)); + } + +@@ -1446,7 +1446,7 @@ static ssize_t metrics_bytes_sent_show(struct device *fbdev, + struct device_attribute *a, char *buf) { + struct fb_info *fb_info = dev_get_drvdata(fbdev); + struct dlfb_data *dlfb = fb_info->par; +- return snprintf(buf, PAGE_SIZE, "%u\n", ++ return sysfs_emit(buf, "%u\n", + atomic_read(&dlfb->bytes_sent)); + } + +@@ -1454,7 +1454,7 @@ static ssize_t metrics_cpu_kcycles_used_show(struct device *fbdev, + struct device_attribute *a, char *buf) { + struct fb_info *fb_info = dev_get_drvdata(fbdev); + struct dlfb_data *dlfb = fb_info->par; +- return snprintf(buf, PAGE_SIZE, "%u\n", ++ return sysfs_emit(buf, "%u\n", + atomic_read(&dlfb->cpu_kcycles_used)); + } + +diff --git a/drivers/video/fbdev/w100fb.c b/drivers/video/fbdev/w100fb.c +index 967030176d87d..307066113c358 100644 +--- a/drivers/video/fbdev/w100fb.c ++++ b/drivers/video/fbdev/w100fb.c +@@ -773,12 +773,18 @@ out: + fb_dealloc_cmap(&info->cmap); + kfree(info->pseudo_palette); + } +- if (remapped_fbuf != NULL) ++ if (remapped_fbuf != NULL) { + iounmap(remapped_fbuf); +- if (remapped_regs != NULL) ++ remapped_fbuf = NULL; ++ } ++ if (remapped_regs != NULL) { + iounmap(remapped_regs); +- if (remapped_base != NULL) ++ remapped_regs = NULL; ++ } ++ if (remapped_base != NULL) { + iounmap(remapped_base); ++ remapped_base = NULL; ++ } + if (info) + framebuffer_release(info); + return err; +@@ -803,8 +809,11 @@ static int w100fb_remove(struct platform_device *pdev) + fb_dealloc_cmap(&info->cmap); + + iounmap(remapped_base); ++ remapped_base = NULL; + iounmap(remapped_regs); ++ remapped_regs = NULL; + iounmap(remapped_fbuf); ++ remapped_fbuf = NULL; + + framebuffer_release(info); + +diff --git a/drivers/w1/slaves/w1_therm.c b/drivers/w1/slaves/w1_therm.c +index 3c350dfbcd0be..aba727294bc8a 100644 +--- a/drivers/w1/slaves/w1_therm.c ++++ b/drivers/w1/slaves/w1_therm.c +@@ -693,16 +693,20 @@ static ssize_t w1_seq_show(struct device *device, + if (sl->reg_num.id == reg_num->id) + seq = i; + ++ if (w1_reset_bus(sl->master)) ++ goto error; ++ ++ /* Put the device into chain DONE state */ ++ w1_write_8(sl->master, W1_MATCH_ROM); ++ w1_write_block(sl->master, (u8 *)&rn, 8); + w1_write_8(sl->master, W1_42_CHAIN); + w1_write_8(sl->master, W1_42_CHAIN_DONE); + w1_write_8(sl->master, W1_42_CHAIN_DONE_INV); +- w1_read_block(sl->master, &ack, sizeof(ack)); + + /* check for acknowledgment */ + ack = w1_read_8(sl->master); + if (ack != W1_42_SUCCESS_CONFIRM_BYTE) + goto error; +- + } + + /* Exit from CHAIN state */ +diff --git a/fs/btrfs/extent_io.h b/fs/btrfs/extent_io.h +index d5089cadd7c49..35a21a602e3ac 100644 +--- a/fs/btrfs/extent_io.h ++++ b/fs/btrfs/extent_io.h +@@ -197,7 +197,7 @@ struct extent_buffer { + */ + struct extent_changeset { + /* How many bytes are set/cleared in this operation */ +- unsigned int bytes_changed; ++ u64 bytes_changed; + + /* Changed ranges */ + struct ulist range_changed; +diff --git a/fs/ext2/super.c b/fs/ext2/super.c +index 80a3038e0e464..ad9fd08f66bab 100644 +--- a/fs/ext2/super.c ++++ b/fs/ext2/super.c +@@ -780,8 +780,12 @@ static loff_t ext2_max_size(int bits) + res += 1LL << (bits-2); + res += 1LL << (2*(bits-2)); + res += 1LL << (3*(bits-2)); ++ /* Compute how many metadata blocks are needed */ ++ meta_blocks = 1; ++ meta_blocks += 1 + ppb; ++ meta_blocks += 1 + ppb + ppb * ppb; + /* Does block tree limit file size? */ +- if (res < upper_limit) ++ if (res + meta_blocks <= upper_limit) + goto check_lfs; + + res = upper_limit; +diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c +index 7959aae4857e1..96cf0f57ca950 100644 +--- a/fs/ext4/inode.c ++++ b/fs/ext4/inode.c +@@ -2148,6 +2148,15 @@ static int ext4_writepage(struct page *page, + else + len = PAGE_SIZE; + ++ /* Should never happen but for bugs in other kernel subsystems */ ++ if (!page_has_buffers(page)) { ++ ext4_warning_inode(inode, ++ "page %lu does not have buffers attached", page->index); ++ ClearPageDirty(page); ++ unlock_page(page); ++ return 0; ++ } ++ + page_bufs = page_buffers(page); + /* + * We cannot do block allocation or other extent handling in this +@@ -2697,6 +2706,22 @@ static int mpage_prepare_extent_to_map(struct mpage_da_data *mpd) + wait_on_page_writeback(page); + BUG_ON(PageWriteback(page)); + ++ /* ++ * Should never happen but for buggy code in ++ * other subsystems that call ++ * set_page_dirty() without properly warning ++ * the file system first. See [1] for more ++ * information. ++ * ++ * [1] https://lore.kernel.org/linux-mm/20180103100430.GE4911@quack2.suse.cz ++ */ ++ if (!page_has_buffers(page)) { ++ ext4_warning_inode(mpd->inode, "page %lu does not have buffers attached", page->index); ++ ClearPageDirty(page); ++ unlock_page(page); ++ continue; ++ } ++ + if (mpd->map.m_len == 0) + mpd->first_page = page->index; + mpd->next_page = page->index + 1; +diff --git a/fs/f2fs/gc.c b/fs/f2fs/gc.c +index bd377ff0b403f..ff447bbb5248b 100644 +--- a/fs/f2fs/gc.c ++++ b/fs/f2fs/gc.c +@@ -589,8 +589,10 @@ static bool is_alive(struct f2fs_sb_info *sbi, struct f2fs_summary *sum, + set_sbi_flag(sbi, SBI_NEED_FSCK); + } + +- if (f2fs_check_nid_range(sbi, dni->ino)) ++ if (f2fs_check_nid_range(sbi, dni->ino)) { ++ f2fs_put_page(node_page, 1); + return false; ++ } + + *nofs = ofs_of_node(node_page); + source_blkaddr = datablock_addr(NULL, node_page, ofs_in_node); +diff --git a/fs/fuse/dev.c b/fs/fuse/dev.c +index d1dc545302528..a5144ecd5babd 100644 +--- a/fs/fuse/dev.c ++++ b/fs/fuse/dev.c +@@ -999,7 +999,17 @@ static int fuse_copy_page(struct fuse_copy_state *cs, struct page **pagep, + + while (count) { + if (cs->write && cs->pipebufs && page) { +- return fuse_ref_page(cs, page, offset, count); ++ /* ++ * Can't control lifetime of pipe buffers, so always ++ * copy user pages. ++ */ ++ if (cs->req->user_pages) { ++ err = fuse_copy_fill(cs); ++ if (err) ++ return err; ++ } else { ++ return fuse_ref_page(cs, page, offset, count); ++ } + } else if (!cs->len) { + if (cs->move_pages && page && + offset == 0 && count == PAGE_SIZE) { +diff --git a/fs/fuse/file.c b/fs/fuse/file.c +index ed9b3ebc0cca4..599a6eeed02e0 100644 +--- a/fs/fuse/file.c ++++ b/fs/fuse/file.c +@@ -1329,6 +1329,7 @@ static int fuse_get_user_pages(struct fuse_req *req, struct iov_iter *ii, + (PAGE_SIZE - ret) & (PAGE_SIZE - 1); + } + ++ req->user_pages = true; + if (write) + req->in.argpages = 1; + else +diff --git a/fs/fuse/fuse_i.h b/fs/fuse/fuse_i.h +index 853d37ec81e0c..1c754a02fb06b 100644 +--- a/fs/fuse/fuse_i.h ++++ b/fs/fuse/fuse_i.h +@@ -313,6 +313,8 @@ struct fuse_req { + /** refcount */ + refcount_t count; + ++ bool user_pages; ++ + /** Unique ID for the interrupt request */ + u64 intr_unique; + +diff --git a/fs/gfs2/rgrp.c b/fs/gfs2/rgrp.c +index 054fdfd4fb8b3..29dcf0973b73f 100644 +--- a/fs/gfs2/rgrp.c ++++ b/fs/gfs2/rgrp.c +@@ -1406,7 +1406,8 @@ int gfs2_fitrim(struct file *filp, void __user *argp) + + start = r.start >> bs_shift; + end = start + (r.len >> bs_shift); +- minlen = max_t(u64, r.minlen, ++ minlen = max_t(u64, r.minlen, sdp->sd_sb.sb_bsize); ++ minlen = max_t(u64, minlen, + q->limits.discard_granularity) >> bs_shift; + + if (end <= start || minlen > sdp->sd_max_rg_data) +diff --git a/fs/jffs2/build.c b/fs/jffs2/build.c +index b288c8ae1236b..837cd55fd4c5e 100644 +--- a/fs/jffs2/build.c ++++ b/fs/jffs2/build.c +@@ -415,13 +415,15 @@ int jffs2_do_mount_fs(struct jffs2_sb_info *c) + jffs2_free_ino_caches(c); + jffs2_free_raw_node_refs(c); + ret = -EIO; +- goto out_free; ++ goto out_sum_exit; + } + + jffs2_calc_trigger_levels(c); + + return 0; + ++ out_sum_exit: ++ jffs2_sum_exit(c); + out_free: + kvfree(c->blocks); + +diff --git a/fs/jffs2/fs.c b/fs/jffs2/fs.c +index eab04eca95a3f..81f7a6efe168b 100644 +--- a/fs/jffs2/fs.c ++++ b/fs/jffs2/fs.c +@@ -597,8 +597,8 @@ out_root: + jffs2_free_ino_caches(c); + jffs2_free_raw_node_refs(c); + kvfree(c->blocks); +- out_inohash: + jffs2_clear_xattr_subsystem(c); ++ out_inohash: + kfree(c->inocache_list); + out_wbuf: + jffs2_flash_cleanup(c); +diff --git a/fs/jffs2/scan.c b/fs/jffs2/scan.c +index 08813789fcf06..664384dac6e58 100644 +--- a/fs/jffs2/scan.c ++++ b/fs/jffs2/scan.c +@@ -136,7 +136,7 @@ int jffs2_scan_medium(struct jffs2_sb_info *c) + if (!s) { + JFFS2_WARNING("Can't allocate memory for summary\n"); + ret = -ENOMEM; +- goto out; ++ goto out_buf; + } + } + +@@ -274,13 +274,15 @@ int jffs2_scan_medium(struct jffs2_sb_info *c) + } + ret = 0; + out: ++ jffs2_sum_reset_collected(s); ++ kfree(s); ++ out_buf: + if (buf_size) + kfree(flashbuf); + #ifndef __ECOS + else + mtd_unpoint(c->mtd, 0, c->mtd->size); + #endif +- kfree(s); + return ret; + } + +diff --git a/fs/jfs/inode.c b/fs/jfs/inode.c +index 87b41edc800d0..68779cc3609a6 100644 +--- a/fs/jfs/inode.c ++++ b/fs/jfs/inode.c +@@ -156,12 +156,13 @@ void jfs_evict_inode(struct inode *inode) + dquot_initialize(inode); + + if (JFS_IP(inode)->fileset == FILESYSTEM_I) { ++ struct inode *ipimap = JFS_SBI(inode->i_sb)->ipimap; + truncate_inode_pages_final(&inode->i_data); + + if (test_cflag(COMMIT_Freewmap, inode)) + jfs_free_zero_link(inode); + +- if (JFS_SBI(inode->i_sb)->ipimap) ++ if (ipimap && JFS_IP(ipimap)->i_imap) + diFree(inode); + + /* +diff --git a/fs/jfs/jfs_dmap.c b/fs/jfs/jfs_dmap.c +index 687b07b9b4f62..f05805a10a50b 100644 +--- a/fs/jfs/jfs_dmap.c ++++ b/fs/jfs/jfs_dmap.c +@@ -161,6 +161,7 @@ static const s8 budtab[256] = { + * 0 - success + * -ENOMEM - insufficient memory + * -EIO - i/o error ++ * -EINVAL - wrong bmap data + */ + int dbMount(struct inode *ipbmap) + { +@@ -192,6 +193,12 @@ int dbMount(struct inode *ipbmap) + bmp->db_nfree = le64_to_cpu(dbmp_le->dn_nfree); + bmp->db_l2nbperpage = le32_to_cpu(dbmp_le->dn_l2nbperpage); + bmp->db_numag = le32_to_cpu(dbmp_le->dn_numag); ++ if (!bmp->db_numag) { ++ release_metapage(mp); ++ kfree(bmp); ++ return -EINVAL; ++ } ++ + bmp->db_maxlevel = le32_to_cpu(dbmp_le->dn_maxlevel); + bmp->db_maxag = le32_to_cpu(dbmp_le->dn_maxag); + bmp->db_agpref = le32_to_cpu(dbmp_le->dn_agpref); +diff --git a/fs/minix/inode.c b/fs/minix/inode.c +index 03fe8bac36cf4..3ce91ad1ee1b3 100644 +--- a/fs/minix/inode.c ++++ b/fs/minix/inode.c +@@ -450,7 +450,8 @@ static const struct address_space_operations minix_aops = { + .writepage = minix_writepage, + .write_begin = minix_write_begin, + .write_end = generic_write_end, +- .bmap = minix_bmap ++ .bmap = minix_bmap, ++ .direct_IO = noop_direct_IO + }; + + static const struct inode_operations minix_symlink_inode_operations = { +diff --git a/fs/nfs/callback_proc.c b/fs/nfs/callback_proc.c +index 868d66ed8bcf6..f2a854805f0ea 100644 +--- a/fs/nfs/callback_proc.c ++++ b/fs/nfs/callback_proc.c +@@ -364,12 +364,11 @@ __be32 nfs4_callback_devicenotify(void *argp, void *resp, + struct cb_process_state *cps) + { + struct cb_devicenotifyargs *args = argp; ++ const struct pnfs_layoutdriver_type *ld = NULL; + uint32_t i; + __be32 res = 0; +- struct nfs_client *clp = cps->clp; +- struct nfs_server *server = NULL; + +- if (!clp) { ++ if (!cps->clp) { + res = cpu_to_be32(NFS4ERR_OP_NOT_IN_SESSION); + goto out; + } +@@ -377,23 +376,15 @@ __be32 nfs4_callback_devicenotify(void *argp, void *resp, + for (i = 0; i < args->ndevs; i++) { + struct cb_devicenotifyitem *dev = &args->devs[i]; + +- if (!server || +- server->pnfs_curr_ld->id != dev->cbd_layout_type) { +- rcu_read_lock(); +- list_for_each_entry_rcu(server, &clp->cl_superblocks, client_link) +- if (server->pnfs_curr_ld && +- server->pnfs_curr_ld->id == dev->cbd_layout_type) { +- rcu_read_unlock(); +- goto found; +- } +- rcu_read_unlock(); +- continue; ++ if (!ld || ld->id != dev->cbd_layout_type) { ++ pnfs_put_layoutdriver(ld); ++ ld = pnfs_find_layoutdriver(dev->cbd_layout_type); ++ if (!ld) ++ continue; + } +- +- found: +- nfs4_delete_deviceid(server->pnfs_curr_ld, clp, &dev->cbd_dev_id); ++ nfs4_delete_deviceid(ld, cps->clp, &dev->cbd_dev_id); + } +- ++ pnfs_put_layoutdriver(ld); + out: + kfree(args->devs); + return res; +diff --git a/fs/nfs/callback_xdr.c b/fs/nfs/callback_xdr.c +index 76aa1b456c524..2f84c612838c4 100644 +--- a/fs/nfs/callback_xdr.c ++++ b/fs/nfs/callback_xdr.c +@@ -281,10 +281,6 @@ __be32 decode_devicenotify_args(struct svc_rqst *rqstp, + n = ntohl(*p++); + if (n == 0) + goto out; +- if (n > ULONG_MAX / sizeof(*args->devs)) { +- status = htonl(NFS4ERR_BADXDR); +- goto out; +- } + + args->devs = kmalloc_array(n, sizeof(*args->devs), GFP_KERNEL); + if (!args->devs) { +diff --git a/fs/nfs/direct.c b/fs/nfs/direct.c +index e5da9d7fb69e9..6a4083d550c6c 100644 +--- a/fs/nfs/direct.c ++++ b/fs/nfs/direct.c +@@ -288,8 +288,8 @@ ssize_t nfs_direct_IO(struct kiocb *iocb, struct iov_iter *iter) + VM_BUG_ON(iov_iter_count(iter) != PAGE_SIZE); + + if (iov_iter_rw(iter) == READ) +- return nfs_file_direct_read(iocb, iter); +- return nfs_file_direct_write(iocb, iter); ++ return nfs_file_direct_read(iocb, iter, true); ++ return nfs_file_direct_write(iocb, iter, true); + } + + static void nfs_direct_release_pages(struct page **pages, unsigned int npages) +@@ -553,6 +553,7 @@ static ssize_t nfs_direct_read_schedule_iovec(struct nfs_direct_req *dreq, + * nfs_file_direct_read - file direct read operation for NFS files + * @iocb: target I/O control block + * @iter: vector of user buffers into which to read data ++ * @swap: flag indicating this is swap IO, not O_DIRECT IO + * + * We use this function for direct reads instead of calling + * generic_file_aio_read() in order to avoid gfar's check to see if +@@ -568,7 +569,8 @@ static ssize_t nfs_direct_read_schedule_iovec(struct nfs_direct_req *dreq, + * client must read the updated atime from the server back into its + * cache. + */ +-ssize_t nfs_file_direct_read(struct kiocb *iocb, struct iov_iter *iter) ++ssize_t nfs_file_direct_read(struct kiocb *iocb, struct iov_iter *iter, ++ bool swap) + { + struct file *file = iocb->ki_filp; + struct address_space *mapping = file->f_mapping; +@@ -610,12 +612,14 @@ ssize_t nfs_file_direct_read(struct kiocb *iocb, struct iov_iter *iter) + if (iter_is_iovec(iter)) + dreq->flags = NFS_ODIRECT_SHOULD_DIRTY; + +- nfs_start_io_direct(inode); ++ if (!swap) ++ nfs_start_io_direct(inode); + + NFS_I(inode)->read_io += count; + requested = nfs_direct_read_schedule_iovec(dreq, iter, iocb->ki_pos); + +- nfs_end_io_direct(inode); ++ if (!swap) ++ nfs_end_io_direct(inode); + + if (requested > 0) { + result = nfs_direct_wait(dreq); +@@ -884,7 +888,7 @@ static const struct nfs_pgio_completion_ops nfs_direct_write_completion_ops = { + */ + static ssize_t nfs_direct_write_schedule_iovec(struct nfs_direct_req *dreq, + struct iov_iter *iter, +- loff_t pos) ++ loff_t pos, int ioflags) + { + struct nfs_pageio_descriptor desc; + struct inode *inode = dreq->inode; +@@ -892,7 +896,7 @@ static ssize_t nfs_direct_write_schedule_iovec(struct nfs_direct_req *dreq, + size_t requested_bytes = 0; + size_t wsize = max_t(size_t, NFS_SERVER(inode)->wsize, PAGE_SIZE); + +- nfs_pageio_init_write(&desc, inode, FLUSH_COND_STABLE, false, ++ nfs_pageio_init_write(&desc, inode, ioflags, false, + &nfs_direct_write_completion_ops); + desc.pg_dreq = dreq; + get_dreq(dreq); +@@ -971,6 +975,7 @@ static ssize_t nfs_direct_write_schedule_iovec(struct nfs_direct_req *dreq, + * nfs_file_direct_write - file direct write operation for NFS files + * @iocb: target I/O control block + * @iter: vector of user buffers from which to write data ++ * @swap: flag indicating this is swap IO, not O_DIRECT IO + * + * We use this function for direct writes instead of calling + * generic_file_aio_write() in order to avoid taking the inode +@@ -987,7 +992,8 @@ static ssize_t nfs_direct_write_schedule_iovec(struct nfs_direct_req *dreq, + * Note that O_APPEND is not supported for NFS direct writes, as there + * is no atomic O_APPEND write facility in the NFS protocol. + */ +-ssize_t nfs_file_direct_write(struct kiocb *iocb, struct iov_iter *iter) ++ssize_t nfs_file_direct_write(struct kiocb *iocb, struct iov_iter *iter, ++ bool swap) + { + ssize_t result = -EINVAL, requested; + size_t count; +@@ -1001,7 +1007,11 @@ ssize_t nfs_file_direct_write(struct kiocb *iocb, struct iov_iter *iter) + dfprintk(FILE, "NFS: direct write(%pD2, %zd@%Ld)\n", + file, iov_iter_count(iter), (long long) iocb->ki_pos); + +- result = generic_write_checks(iocb, iter); ++ if (swap) ++ /* bypass generic checks */ ++ result = iov_iter_count(iter); ++ else ++ result = generic_write_checks(iocb, iter); + if (result <= 0) + return result; + count = result; +@@ -1031,16 +1041,22 @@ ssize_t nfs_file_direct_write(struct kiocb *iocb, struct iov_iter *iter) + if (!is_sync_kiocb(iocb)) + dreq->iocb = iocb; + +- nfs_start_io_direct(inode); ++ if (swap) { ++ requested = nfs_direct_write_schedule_iovec(dreq, iter, pos, ++ FLUSH_STABLE); ++ } else { ++ nfs_start_io_direct(inode); + +- requested = nfs_direct_write_schedule_iovec(dreq, iter, pos); ++ requested = nfs_direct_write_schedule_iovec(dreq, iter, pos, ++ FLUSH_COND_STABLE); + +- if (mapping->nrpages) { +- invalidate_inode_pages2_range(mapping, +- pos >> PAGE_SHIFT, end); +- } ++ if (mapping->nrpages) { ++ invalidate_inode_pages2_range(mapping, ++ pos >> PAGE_SHIFT, end); ++ } + +- nfs_end_io_direct(inode); ++ nfs_end_io_direct(inode); ++ } + + if (requested > 0) { + result = nfs_direct_wait(dreq); +diff --git a/fs/nfs/file.c b/fs/nfs/file.c +index 29553fdba8af7..62a86c4143913 100644 +--- a/fs/nfs/file.c ++++ b/fs/nfs/file.c +@@ -157,7 +157,7 @@ nfs_file_read(struct kiocb *iocb, struct iov_iter *to) + ssize_t result; + + if (iocb->ki_flags & IOCB_DIRECT) +- return nfs_file_direct_read(iocb, to); ++ return nfs_file_direct_read(iocb, to, false); + + dprintk("NFS: read(%pD2, %zu@%lu)\n", + iocb->ki_filp, +@@ -606,7 +606,7 @@ ssize_t nfs_file_write(struct kiocb *iocb, struct iov_iter *from) + return result; + + if (iocb->ki_flags & IOCB_DIRECT) +- return nfs_file_direct_write(iocb, from); ++ return nfs_file_direct_write(iocb, from, false); + + dprintk("NFS: write(%pD2, %zu@%Ld)\n", + file, iov_iter_count(from), (long long) iocb->ki_pos); +diff --git a/fs/nfs/nfs4state.c b/fs/nfs/nfs4state.c +index 9c98547fcefcc..30576a10a1f4c 100644 +--- a/fs/nfs/nfs4state.c ++++ b/fs/nfs/nfs4state.c +@@ -49,6 +49,7 @@ + #include + #include + #include ++#include + + #include + +@@ -2505,9 +2506,17 @@ static int nfs4_bind_conn_to_session(struct nfs_client *clp) + + static void nfs4_state_manager(struct nfs_client *clp) + { ++ unsigned int memflags; + int status = 0; + const char *section = "", *section_sep = ""; + ++ /* ++ * State recovery can deadlock if the direct reclaim code tries ++ * start NFS writeback. So ensure memory allocations are all ++ * GFP_NOFS. ++ */ ++ memflags = memalloc_nofs_save(); ++ + /* Ensure exclusive access to NFSv4 state */ + do { + clear_bit(NFS4CLNT_RUN_MANAGER, &clp->cl_state); +@@ -2600,6 +2609,7 @@ static void nfs4_state_manager(struct nfs_client *clp) + goto out_error; + } + ++ memalloc_nofs_restore(memflags); + nfs4_end_drain_session(clp); + nfs4_clear_state_manager_bit(clp); + +@@ -2616,6 +2626,7 @@ static void nfs4_state_manager(struct nfs_client *clp) + return; + if (test_and_set_bit(NFS4CLNT_MANAGER_RUNNING, &clp->cl_state) != 0) + return; ++ memflags = memalloc_nofs_save(); + } while (refcount_read(&clp->cl_count) > 1 && !signalled()); + goto out_drain; + +@@ -2627,6 +2638,7 @@ out_error: + clp->cl_hostname, -status); + ssleep(1); + out_drain: ++ memalloc_nofs_restore(memflags); + nfs4_end_drain_session(clp); + nfs4_clear_state_manager_bit(clp); + } +diff --git a/fs/nfs/pnfs.c b/fs/nfs/pnfs.c +index c900cb2119bae..0f1c158594188 100644 +--- a/fs/nfs/pnfs.c ++++ b/fs/nfs/pnfs.c +@@ -92,6 +92,17 @@ find_pnfs_driver(u32 id) + return local; + } + ++const struct pnfs_layoutdriver_type *pnfs_find_layoutdriver(u32 id) ++{ ++ return find_pnfs_driver(id); ++} ++ ++void pnfs_put_layoutdriver(const struct pnfs_layoutdriver_type *ld) ++{ ++ if (ld) ++ module_put(ld->owner); ++} ++ + void + unset_pnfs_layoutdriver(struct nfs_server *nfss) + { +diff --git a/fs/nfs/pnfs.h b/fs/nfs/pnfs.h +index 80fafa29e567a..d5d818b1ac9d9 100644 +--- a/fs/nfs/pnfs.h ++++ b/fs/nfs/pnfs.h +@@ -225,6 +225,8 @@ struct pnfs_devicelist { + + extern int pnfs_register_layoutdriver(struct pnfs_layoutdriver_type *); + extern void pnfs_unregister_layoutdriver(struct pnfs_layoutdriver_type *); ++extern const struct pnfs_layoutdriver_type *pnfs_find_layoutdriver(u32 id); ++extern void pnfs_put_layoutdriver(const struct pnfs_layoutdriver_type *ld); + + /* nfs4proc.c */ + extern size_t max_response_pages(struct nfs_server *server); +diff --git a/fs/nfsd/nfsproc.c b/fs/nfsd/nfsproc.c +index 01f7ce1ae1275..bce1cc686eb5b 100644 +--- a/fs/nfsd/nfsproc.c ++++ b/fs/nfsd/nfsproc.c +@@ -228,7 +228,7 @@ nfsd_proc_write(struct svc_rqst *rqstp) + unsigned long cnt = argp->len; + unsigned int nvecs; + +- dprintk("nfsd: WRITE %s %d bytes at %d\n", ++ dprintk("nfsd: WRITE %s %u bytes at %d\n", + SVCFH_fmt(&argp->fh), + argp->len, argp->offset); + +diff --git a/fs/nfsd/xdr.h b/fs/nfsd/xdr.h +index ea7cca3a64b76..6251d8754c82b 100644 +--- a/fs/nfsd/xdr.h ++++ b/fs/nfsd/xdr.h +@@ -33,7 +33,7 @@ struct nfsd_readargs { + struct nfsd_writeargs { + svc_fh fh; + __u32 offset; +- int len; ++ __u32 len; + struct kvec first; + }; + +diff --git a/fs/ntfs/inode.c b/fs/ntfs/inode.c +index e844b43f2eacf..0acd1f02b1467 100644 +--- a/fs/ntfs/inode.c ++++ b/fs/ntfs/inode.c +@@ -1906,6 +1906,10 @@ int ntfs_read_inode_mount(struct inode *vi) + } + /* Now allocate memory for the attribute list. */ + ni->attr_list_size = (u32)ntfs_attr_size(a); ++ if (!ni->attr_list_size) { ++ ntfs_error(sb, "Attr_list_size is zero"); ++ goto put_err_out; ++ } + ni->attr_list = ntfs_malloc_nofs(ni->attr_list_size); + if (!ni->attr_list) { + ntfs_error(sb, "Not enough memory to allocate buffer " +diff --git a/fs/ubifs/dir.c b/fs/ubifs/dir.c +index dbdf6a4230fbd..111905ddbfc2e 100644 +--- a/fs/ubifs/dir.c ++++ b/fs/ubifs/dir.c +@@ -373,15 +373,18 @@ static int do_tmpfile(struct inode *dir, struct dentry *dentry, + { + struct inode *inode; + struct ubifs_info *c = dir->i_sb->s_fs_info; +- struct ubifs_budget_req req = { .new_ino = 1, .new_dent = 1}; ++ struct ubifs_budget_req req = { .new_ino = 1, .new_dent = 1, ++ .dirtied_ino = 1}; + struct ubifs_budget_req ino_req = { .dirtied_ino = 1 }; + struct ubifs_inode *ui, *dir_ui = ubifs_inode(dir); + int err, instantiated = 0; + struct fscrypt_name nm; + + /* +- * Budget request settings: new dirty inode, new direntry, +- * budget for dirtied inode will be released via writeback. ++ * Budget request settings: new inode, new direntry, changing the ++ * parent directory inode. ++ * Allocate budget separately for new dirtied inode, the budget will ++ * be released via writeback. + */ + + dbg_gen("dent '%pd', mode %#hx in dir ino %lu", +@@ -451,6 +454,8 @@ out_inode: + make_bad_inode(inode); + if (!instantiated) + iput(inode); ++ else if (whiteout) ++ iput(*whiteout); + out_budg: + ubifs_release_budget(c, &req); + if (!instantiated) +@@ -971,7 +976,8 @@ static int ubifs_mkdir(struct inode *dir, struct dentry *dentry, umode_t mode) + struct ubifs_inode *dir_ui = ubifs_inode(dir); + struct ubifs_info *c = dir->i_sb->s_fs_info; + int err, sz_change; +- struct ubifs_budget_req req = { .new_ino = 1, .new_dent = 1 }; ++ struct ubifs_budget_req req = { .new_ino = 1, .new_dent = 1, ++ .dirtied_ino = 1}; + struct fscrypt_name nm; + + /* +@@ -1341,6 +1347,7 @@ static int do_rename(struct inode *old_dir, struct dentry *old_dentry, + + if (flags & RENAME_WHITEOUT) { + union ubifs_dev_desc *dev = NULL; ++ struct ubifs_budget_req wht_req; + + dev = kmalloc(sizeof(union ubifs_dev_desc), GFP_NOFS); + if (!dev) { +@@ -1362,6 +1369,23 @@ static int do_rename(struct inode *old_dir, struct dentry *old_dentry, + whiteout_ui->data = dev; + whiteout_ui->data_len = ubifs_encode_dev(dev, MKDEV(0, 0)); + ubifs_assert(c, !whiteout_ui->dirty); ++ ++ memset(&wht_req, 0, sizeof(struct ubifs_budget_req)); ++ wht_req.dirtied_ino = 1; ++ wht_req.dirtied_ino_d = ALIGN(whiteout_ui->data_len, 8); ++ /* ++ * To avoid deadlock between space budget (holds ui_mutex and ++ * waits wb work) and writeback work(waits ui_mutex), do space ++ * budget before ubifs inodes locked. ++ */ ++ err = ubifs_budget_space(c, &wht_req); ++ if (err) { ++ iput(whiteout); ++ goto out_release; ++ } ++ ++ /* Add the old_dentry size to the old_dir size. */ ++ old_sz -= CALC_DENT_SIZE(fname_len(&old_nm)); + } + + lock_4_inodes(old_dir, new_dir, new_inode, whiteout); +@@ -1436,18 +1460,6 @@ static int do_rename(struct inode *old_dir, struct dentry *old_dentry, + } + + if (whiteout) { +- struct ubifs_budget_req wht_req = { .dirtied_ino = 1, +- .dirtied_ino_d = \ +- ALIGN(ubifs_inode(whiteout)->data_len, 8) }; +- +- err = ubifs_budget_space(c, &wht_req); +- if (err) { +- kfree(whiteout_ui->data); +- whiteout_ui->data_len = 0; +- iput(whiteout); +- goto out_release; +- } +- + inc_nlink(whiteout); + mark_inode_dirty(whiteout); + +diff --git a/fs/ubifs/io.c b/fs/ubifs/io.c +index 9542ebf643a5e..0ad819c904dfd 100644 +--- a/fs/ubifs/io.c ++++ b/fs/ubifs/io.c +@@ -810,16 +810,42 @@ int ubifs_wbuf_write_nolock(struct ubifs_wbuf *wbuf, void *buf, int len) + */ + n = aligned_len >> c->max_write_shift; + if (n) { +- n <<= c->max_write_shift; ++ int m = n - 1; ++ + dbg_io("write %d bytes to LEB %d:%d", n, wbuf->lnum, + wbuf->offs); +- err = ubifs_leb_write(c, wbuf->lnum, buf + written, +- wbuf->offs, n); ++ ++ if (m) { ++ /* '(n-1)<max_write_shift < len' is always true. */ ++ m <<= c->max_write_shift; ++ err = ubifs_leb_write(c, wbuf->lnum, buf + written, ++ wbuf->offs, m); ++ if (err) ++ goto out; ++ wbuf->offs += m; ++ aligned_len -= m; ++ len -= m; ++ written += m; ++ } ++ ++ /* ++ * The non-written len of buf may be less than 'n' because ++ * parameter 'len' is not 8 bytes aligned, so here we read ++ * min(len, n) bytes from buf. ++ */ ++ n = 1 << c->max_write_shift; ++ memcpy(wbuf->buf, buf + written, min(len, n)); ++ if (n > len) { ++ ubifs_assert(c, n - len < 8); ++ ubifs_pad(c, wbuf->buf + len, n - len); ++ } ++ ++ err = ubifs_leb_write(c, wbuf->lnum, wbuf->buf, wbuf->offs, n); + if (err) + goto out; + wbuf->offs += n; + aligned_len -= n; +- len -= n; ++ len -= min(len, n); + written += n; + } + +diff --git a/fs/ubifs/ioctl.c b/fs/ubifs/ioctl.c +index e666459f63c70..3fca4f7414126 100644 +--- a/fs/ubifs/ioctl.c ++++ b/fs/ubifs/ioctl.c +@@ -113,7 +113,7 @@ static int setflags(struct inode *inode, int flags) + struct ubifs_inode *ui = ubifs_inode(inode); + struct ubifs_info *c = inode->i_sb->s_fs_info; + struct ubifs_budget_req req = { .dirtied_ino = 1, +- .dirtied_ino_d = ui->data_len }; ++ .dirtied_ino_d = ALIGN(ui->data_len, 8) }; + + err = ubifs_budget_space(c, &req); + if (err) +diff --git a/include/linux/blk-cgroup.h b/include/linux/blk-cgroup.h +index 6d766a19f2bbb..8f1be8b493910 100644 +--- a/include/linux/blk-cgroup.h ++++ b/include/linux/blk-cgroup.h +@@ -21,6 +21,7 @@ + #include + #include + #include ++#include + + /* percpu_counter batch for blkg_[rw]stats, per-cpu drift doesn't matter */ + #define BLKG_STAT_CPU_BATCH (INT_MAX / 2) +@@ -844,6 +845,21 @@ static inline void blkcg_use_delay(struct blkcg_gq *blkg) + atomic_inc(&blkg->blkcg->css.cgroup->congestion_count); + } + ++/** ++ * blk_cgroup_mergeable - Determine whether to allow or disallow merges ++ * @rq: request to merge into ++ * @bio: bio to merge ++ * ++ * @bio and @rq should belong to the same cgroup and their issue_as_root should ++ * match. The latter is necessary as we don't want to throttle e.g. a metadata ++ * update because it happens to be next to a regular IO. ++ */ ++static inline bool blk_cgroup_mergeable(struct request *rq, struct bio *bio) ++{ ++ return rq->bio->bi_blkg == bio->bi_blkg && ++ bio_issue_as_root_blkg(rq->bio) == bio_issue_as_root_blkg(bio); ++} ++ + static inline int blkcg_unuse_delay(struct blkcg_gq *blkg) + { + int old = atomic_read(&blkg->use_delay); +@@ -947,6 +963,7 @@ static inline struct request_list *blk_rq_rl(struct request *rq) { return &rq->q + + static inline bool blkcg_bio_issue_check(struct request_queue *q, + struct bio *bio) { return true; } ++static inline bool blk_cgroup_mergeable(struct request *rq, struct bio *bio) { return true; } + + #define blk_queue_for_each_rl(rl, q) \ + for ((rl) = &(q)->root_rl; (rl); (rl) = NULL) +diff --git a/include/linux/blkdev.h b/include/linux/blkdev.h +index 209ba8e7bd317..56fe682d9beb4 100644 +--- a/include/linux/blkdev.h ++++ b/include/linux/blkdev.h +@@ -56,6 +56,14 @@ struct blk_stat_callback; + */ + #define BLKCG_MAX_POLS 5 + ++static inline int blk_validate_block_size(unsigned int bsize) ++{ ++ if (bsize < 512 || bsize > PAGE_SIZE || !is_power_of_2(bsize)) ++ return -EINVAL; ++ ++ return 0; ++} ++ + typedef void (rq_end_io_fn)(struct request *, blk_status_t); + + #define BLK_RL_SYNCFULL (1U << 0) +diff --git a/include/linux/mmzone.h b/include/linux/mmzone.h +index fa02014eba8ea..b4084b6ed5418 100644 +--- a/include/linux/mmzone.h ++++ b/include/linux/mmzone.h +@@ -1155,13 +1155,16 @@ extern struct mem_section mem_section[NR_SECTION_ROOTS][SECTIONS_PER_ROOT]; + + static inline struct mem_section *__nr_to_section(unsigned long nr) + { ++ unsigned long root = SECTION_NR_TO_ROOT(nr); ++ ++ if (unlikely(root >= NR_SECTION_ROOTS)) ++ return NULL; ++ + #ifdef CONFIG_SPARSEMEM_EXTREME +- if (!mem_section) ++ if (!mem_section || !mem_section[root]) + return NULL; + #endif +- if (!mem_section[SECTION_NR_TO_ROOT(nr)]) +- return NULL; +- return &mem_section[SECTION_NR_TO_ROOT(nr)][nr & SECTION_ROOT_MASK]; ++ return &mem_section[root][nr & SECTION_ROOT_MASK]; + } + extern int __section_nr(struct mem_section* ms); + extern unsigned long usemap_size(void); +diff --git a/include/linux/netdevice.h b/include/linux/netdevice.h +index 58ee9d2d6a3ca..8d48b352ee74f 100644 +--- a/include/linux/netdevice.h ++++ b/include/linux/netdevice.h +@@ -3674,7 +3674,8 @@ void netdev_run_todo(void); + */ + static inline void dev_put(struct net_device *dev) + { +- this_cpu_dec(*dev->pcpu_refcnt); ++ if (dev) ++ this_cpu_dec(*dev->pcpu_refcnt); + } + + /** +@@ -3685,7 +3686,8 @@ static inline void dev_put(struct net_device *dev) + */ + static inline void dev_hold(struct net_device *dev) + { +- this_cpu_inc(*dev->pcpu_refcnt); ++ if (dev) ++ this_cpu_inc(*dev->pcpu_refcnt); + } + + /* Carrier loss detection, dial on demand. The functions netif_carrier_on +diff --git a/include/linux/nfs_fs.h b/include/linux/nfs_fs.h +index 0ff7dd2bf8a4f..8ea7ceed82851 100644 +--- a/include/linux/nfs_fs.h ++++ b/include/linux/nfs_fs.h +@@ -475,10 +475,10 @@ static inline struct rpc_cred *nfs_file_cred(struct file *file) + * linux/fs/nfs/direct.c + */ + extern ssize_t nfs_direct_IO(struct kiocb *, struct iov_iter *); +-extern ssize_t nfs_file_direct_read(struct kiocb *iocb, +- struct iov_iter *iter); +-extern ssize_t nfs_file_direct_write(struct kiocb *iocb, +- struct iov_iter *iter); ++ssize_t nfs_file_direct_read(struct kiocb *iocb, ++ struct iov_iter *iter, bool swap); ++ssize_t nfs_file_direct_write(struct kiocb *iocb, ++ struct iov_iter *iter, bool swap); + + /* + * linux/fs/nfs/dir.c +diff --git a/include/linux/pci.h b/include/linux/pci.h +index a4bbce871e08e..3e06e9790c255 100644 +--- a/include/linux/pci.h ++++ b/include/linux/pci.h +@@ -581,6 +581,7 @@ struct pci_bus { + struct bin_attribute *legacy_io; /* Legacy I/O for this bus */ + struct bin_attribute *legacy_mem; /* Legacy mem */ + unsigned int is_added:1; ++ unsigned int unsafe_warn:1; /* warned about RW1C config write */ + }; + + #define to_pci_bus(n) container_of(n, struct pci_bus, dev) +diff --git a/include/linux/sunrpc/xdr.h b/include/linux/sunrpc/xdr.h +index 33580cc72a43d..8e3d35189bf89 100644 +--- a/include/linux/sunrpc/xdr.h ++++ b/include/linux/sunrpc/xdr.h +@@ -509,6 +509,8 @@ xdr_stream_decode_uint32_array(struct xdr_stream *xdr, + + if (unlikely(xdr_stream_decode_u32(xdr, &len) < 0)) + return -EBADMSG; ++ if (len > SIZE_MAX / sizeof(*p)) ++ return -EBADMSG; + p = xdr_inline_decode(xdr, len * sizeof(*p)); + if (unlikely(!p)) + return -EBADMSG; +diff --git a/include/net/arp.h b/include/net/arp.h +index c8f580a0e6b1f..dc6e9dd3e1e62 100644 +--- a/include/net/arp.h ++++ b/include/net/arp.h +@@ -71,6 +71,7 @@ void arp_send(int type, int ptype, __be32 dest_ip, + const unsigned char *src_hw, const unsigned char *th); + int arp_mc_map(__be32 addr, u8 *haddr, struct net_device *dev, int dir); + void arp_ifdown(struct net_device *dev); ++int arp_invalidate(struct net_device *dev, __be32 ip, bool force); + + struct sk_buff *arp_create(int type, int ptype, __be32 dest_ip, + struct net_device *dev, __be32 src_ip, +diff --git a/include/net/sock.h b/include/net/sock.h +index 2bf8dcf863f2c..7d3a4c2eea95b 100644 +--- a/include/net/sock.h ++++ b/include/net/sock.h +@@ -2400,22 +2400,39 @@ static inline void sock_recv_ts_and_drops(struct msghdr *msg, struct sock *sk, + void __sock_tx_timestamp(__u16 tsflags, __u8 *tx_flags); + + /** +- * sock_tx_timestamp - checks whether the outgoing packet is to be time stamped ++ * _sock_tx_timestamp - checks whether the outgoing packet is to be time stamped + * @sk: socket sending this packet + * @tsflags: timestamping flags to use + * @tx_flags: completed with instructions for time stamping ++ * @tskey: filled in with next sk_tskey (not for TCP, which uses seqno) + * + * Note: callers should take care of initial ``*tx_flags`` value (usually 0) + */ +-static inline void sock_tx_timestamp(const struct sock *sk, __u16 tsflags, +- __u8 *tx_flags) ++static inline void _sock_tx_timestamp(struct sock *sk, __u16 tsflags, ++ __u8 *tx_flags, __u32 *tskey) + { +- if (unlikely(tsflags)) ++ if (unlikely(tsflags)) { + __sock_tx_timestamp(tsflags, tx_flags); ++ if (tsflags & SOF_TIMESTAMPING_OPT_ID && tskey && ++ tsflags & SOF_TIMESTAMPING_TX_RECORD_MASK) ++ *tskey = sk->sk_tskey++; ++ } + if (unlikely(sock_flag(sk, SOCK_WIFI_STATUS))) + *tx_flags |= SKBTX_WIFI_STATUS; + } + ++static inline void sock_tx_timestamp(struct sock *sk, __u16 tsflags, ++ __u8 *tx_flags) ++{ ++ _sock_tx_timestamp(sk, tsflags, tx_flags, NULL); ++} ++ ++static inline void skb_setup_tx_timestamp(struct sk_buff *skb, __u16 tsflags) ++{ ++ _sock_tx_timestamp(skb->sk, tsflags, &skb_shinfo(skb)->tx_flags, ++ &skb_shinfo(skb)->tskey); ++} ++ + /** + * sk_eat_skb - Release a skb if it is no longer needed + * @sk: socket to eat this skb from +diff --git a/include/net/xfrm.h b/include/net/xfrm.h +index a8aa2bb74ad61..6b18cd0e511a5 100644 +--- a/include/net/xfrm.h ++++ b/include/net/xfrm.h +@@ -1739,13 +1739,16 @@ int xfrm_policy_walk(struct net *net, struct xfrm_policy_walk *walk, + void *); + void xfrm_policy_walk_done(struct xfrm_policy_walk *walk, struct net *net); + int xfrm_policy_insert(int dir, struct xfrm_policy *policy, int excl); +-struct xfrm_policy *xfrm_policy_bysel_ctx(struct net *net, u32 mark, u32 if_id, +- u8 type, int dir, ++struct xfrm_policy *xfrm_policy_bysel_ctx(struct net *net, ++ const struct xfrm_mark *mark, ++ u32 if_id, u8 type, int dir, + struct xfrm_selector *sel, + struct xfrm_sec_ctx *ctx, int delete, + int *err); +-struct xfrm_policy *xfrm_policy_byid(struct net *net, u32 mark, u32 if_id, u8, +- int dir, u32 id, int delete, int *err); ++struct xfrm_policy *xfrm_policy_byid(struct net *net, ++ const struct xfrm_mark *mark, u32 if_id, ++ u8 type, int dir, u32 id, int delete, ++ int *err); + int xfrm_policy_flush(struct net *net, u8 type, bool task_valid); + void xfrm_policy_hash_rebuild(struct net *net); + u32 xfrm_get_acqseq(void); +diff --git a/include/uapi/linux/bpf.h b/include/uapi/linux/bpf.h +index 8481fc7676c0b..6334aede67fc2 100644 +--- a/include/uapi/linux/bpf.h ++++ b/include/uapi/linux/bpf.h +@@ -1207,8 +1207,8 @@ union bpf_attr { + * Return + * The return value depends on the result of the test, and can be: + * +- * * 0, if current task belongs to the cgroup2. +- * * 1, if current task does not belong to the cgroup2. ++ * * 1, if current task belongs to the cgroup2. ++ * * 0, if current task does not belong to the cgroup2. + * * A negative error code, if an error occurred. + * + * int bpf_skb_change_tail(struct sk_buff *skb, u32 len, u64 flags) +diff --git a/init/main.c b/init/main.c +index 7baad67c2e937..272ec131211c0 100644 +--- a/init/main.c ++++ b/init/main.c +@@ -774,7 +774,7 @@ static int __init initcall_blacklist(char *str) + } + } while (str_entry); + +- return 0; ++ return 1; + } + + static bool __init_or_module initcall_blacklisted(initcall_t fn) +@@ -1027,7 +1027,9 @@ static noinline void __init kernel_init_freeable(void); + bool rodata_enabled __ro_after_init = true; + static int __init set_debug_rodata(char *str) + { +- return strtobool(str, &rodata_enabled); ++ if (strtobool(str, &rodata_enabled)) ++ pr_warn("Invalid option string for rodata: '%s'\n", str); ++ return 1; + } + __setup("rodata=", set_debug_rodata); + #endif +diff --git a/kernel/cgroup/cgroup-internal.h b/kernel/cgroup/cgroup-internal.h +index 75568fcf2180d..8f7729b0a6383 100644 +--- a/kernel/cgroup/cgroup-internal.h ++++ b/kernel/cgroup/cgroup-internal.h +@@ -34,6 +34,25 @@ extern char trace_cgroup_path[TRACE_CGROUP_PATH_LEN]; + } \ + } while (0) + ++struct cgroup_pidlist; ++ ++struct cgroup_file_ctx { ++ struct cgroup_namespace *ns; ++ ++ struct { ++ void *trigger; ++ } psi; ++ ++ struct { ++ bool started; ++ struct css_task_iter iter; ++ } procs; ++ ++ struct { ++ struct cgroup_pidlist *pidlist; ++ } procs1; ++}; ++ + /* + * A cgroup can be associated with multiple css_sets as different tasks may + * belong to different cgroups on different hierarchies. In the other +diff --git a/kernel/cgroup/cgroup-v1.c b/kernel/cgroup/cgroup-v1.c +index ced2b3f3547c6..61644976225a9 100644 +--- a/kernel/cgroup/cgroup-v1.c ++++ b/kernel/cgroup/cgroup-v1.c +@@ -426,6 +426,7 @@ static void *cgroup_pidlist_start(struct seq_file *s, loff_t *pos) + * next pid to display, if any + */ + struct kernfs_open_file *of = s->private; ++ struct cgroup_file_ctx *ctx = of->priv; + struct cgroup *cgrp = seq_css(s)->cgroup; + struct cgroup_pidlist *l; + enum cgroup_filetype type = seq_cft(s)->private; +@@ -435,25 +436,24 @@ static void *cgroup_pidlist_start(struct seq_file *s, loff_t *pos) + mutex_lock(&cgrp->pidlist_mutex); + + /* +- * !NULL @of->priv indicates that this isn't the first start() +- * after open. If the matching pidlist is around, we can use that. +- * Look for it. Note that @of->priv can't be used directly. It +- * could already have been destroyed. ++ * !NULL @ctx->procs1.pidlist indicates that this isn't the first ++ * start() after open. If the matching pidlist is around, we can use ++ * that. Look for it. Note that @ctx->procs1.pidlist can't be used ++ * directly. It could already have been destroyed. + */ +- if (of->priv) +- of->priv = cgroup_pidlist_find(cgrp, type); ++ if (ctx->procs1.pidlist) ++ ctx->procs1.pidlist = cgroup_pidlist_find(cgrp, type); + + /* + * Either this is the first start() after open or the matching + * pidlist has been destroyed inbetween. Create a new one. + */ +- if (!of->priv) { +- ret = pidlist_array_load(cgrp, type, +- (struct cgroup_pidlist **)&of->priv); ++ if (!ctx->procs1.pidlist) { ++ ret = pidlist_array_load(cgrp, type, &ctx->procs1.pidlist); + if (ret) + return ERR_PTR(ret); + } +- l = of->priv; ++ l = ctx->procs1.pidlist; + + if (pid) { + int end = l->length; +@@ -481,7 +481,8 @@ static void *cgroup_pidlist_start(struct seq_file *s, loff_t *pos) + static void cgroup_pidlist_stop(struct seq_file *s, void *v) + { + struct kernfs_open_file *of = s->private; +- struct cgroup_pidlist *l = of->priv; ++ struct cgroup_file_ctx *ctx = of->priv; ++ struct cgroup_pidlist *l = ctx->procs1.pidlist; + + if (l) + mod_delayed_work(cgroup_pidlist_destroy_wq, &l->destroy_dwork, +@@ -492,7 +493,8 @@ static void cgroup_pidlist_stop(struct seq_file *s, void *v) + static void *cgroup_pidlist_next(struct seq_file *s, void *v, loff_t *pos) + { + struct kernfs_open_file *of = s->private; +- struct cgroup_pidlist *l = of->priv; ++ struct cgroup_file_ctx *ctx = of->priv; ++ struct cgroup_pidlist *l = ctx->procs1.pidlist; + pid_t *p = v; + pid_t *end = l->list + l->length; + /* +@@ -535,10 +537,11 @@ static ssize_t __cgroup1_procs_write(struct kernfs_open_file *of, + goto out_unlock; + + /* +- * Even if we're attaching all tasks in the thread group, we only +- * need to check permissions on one of them. ++ * Even if we're attaching all tasks in the thread group, we only need ++ * to check permissions on one of them. Check permissions using the ++ * credentials from file open to protect against inherited fd attacks. + */ +- cred = current_cred(); ++ cred = of->file->f_cred; + tcred = get_task_cred(task); + if (!uid_eq(cred->euid, GLOBAL_ROOT_UID) && + !uid_eq(cred->euid, tcred->uid) && +diff --git a/kernel/cgroup/cgroup.c b/kernel/cgroup/cgroup.c +index 63eff85f251f3..4e8284d8cacc0 100644 +--- a/kernel/cgroup/cgroup.c ++++ b/kernel/cgroup/cgroup.c +@@ -3451,24 +3451,43 @@ static int cpu_stat_show(struct seq_file *seq, void *v) + static int cgroup_file_open(struct kernfs_open_file *of) + { + struct cftype *cft = of->kn->priv; ++ struct cgroup_file_ctx *ctx; ++ int ret; + +- if (cft->open) +- return cft->open(of); +- return 0; ++ ctx = kzalloc(sizeof(*ctx), GFP_KERNEL); ++ if (!ctx) ++ return -ENOMEM; ++ ++ ctx->ns = current->nsproxy->cgroup_ns; ++ get_cgroup_ns(ctx->ns); ++ of->priv = ctx; ++ ++ if (!cft->open) ++ return 0; ++ ++ ret = cft->open(of); ++ if (ret) { ++ put_cgroup_ns(ctx->ns); ++ kfree(ctx); ++ } ++ return ret; + } + + static void cgroup_file_release(struct kernfs_open_file *of) + { + struct cftype *cft = of->kn->priv; ++ struct cgroup_file_ctx *ctx = of->priv; + + if (cft->release) + cft->release(of); ++ put_cgroup_ns(ctx->ns); ++ kfree(ctx); + } + + static ssize_t cgroup_file_write(struct kernfs_open_file *of, char *buf, + size_t nbytes, loff_t off) + { +- struct cgroup_namespace *ns = current->nsproxy->cgroup_ns; ++ struct cgroup_file_ctx *ctx = of->priv; + struct cgroup *cgrp = of->kn->parent->priv; + struct cftype *cft = of->kn->priv; + struct cgroup_subsys_state *css; +@@ -3482,7 +3501,7 @@ static ssize_t cgroup_file_write(struct kernfs_open_file *of, char *buf, + */ + if ((cgrp->root->flags & CGRP_ROOT_NS_DELEGATE) && + !(cft->flags & CFTYPE_NS_DELEGATABLE) && +- ns != &init_cgroup_ns && ns->root_cset->dfl_cgrp == cgrp) ++ ctx->ns != &init_cgroup_ns && ctx->ns->root_cset->dfl_cgrp == cgrp) + return -EPERM; + + if (cft->write) +@@ -4376,21 +4395,21 @@ void css_task_iter_end(struct css_task_iter *it) + + static void cgroup_procs_release(struct kernfs_open_file *of) + { +- if (of->priv) { +- css_task_iter_end(of->priv); +- kfree(of->priv); +- } ++ struct cgroup_file_ctx *ctx = of->priv; ++ ++ if (ctx->procs.started) ++ css_task_iter_end(&ctx->procs.iter); + } + + static void *cgroup_procs_next(struct seq_file *s, void *v, loff_t *pos) + { + struct kernfs_open_file *of = s->private; +- struct css_task_iter *it = of->priv; ++ struct cgroup_file_ctx *ctx = of->priv; + + if (pos) + (*pos)++; + +- return css_task_iter_next(it); ++ return css_task_iter_next(&ctx->procs.iter); + } + + static void *__cgroup_procs_start(struct seq_file *s, loff_t *pos, +@@ -4398,21 +4417,18 @@ static void *__cgroup_procs_start(struct seq_file *s, loff_t *pos, + { + struct kernfs_open_file *of = s->private; + struct cgroup *cgrp = seq_css(s)->cgroup; +- struct css_task_iter *it = of->priv; ++ struct cgroup_file_ctx *ctx = of->priv; ++ struct css_task_iter *it = &ctx->procs.iter; + + /* + * When a seq_file is seeked, it's always traversed sequentially + * from position 0, so we can simply keep iterating on !0 *pos. + */ +- if (!it) { ++ if (!ctx->procs.started) { + if (WARN_ON_ONCE((*pos))) + return ERR_PTR(-EINVAL); +- +- it = kzalloc(sizeof(*it), GFP_KERNEL); +- if (!it) +- return ERR_PTR(-ENOMEM); +- of->priv = it; + css_task_iter_start(&cgrp->self, iter_flags, it); ++ ctx->procs.started = true; + } else if (!(*pos)) { + css_task_iter_end(it); + css_task_iter_start(&cgrp->self, iter_flags, it); +@@ -4447,9 +4463,9 @@ static int cgroup_procs_show(struct seq_file *s, void *v) + + static int cgroup_procs_write_permission(struct cgroup *src_cgrp, + struct cgroup *dst_cgrp, +- struct super_block *sb) ++ struct super_block *sb, ++ struct cgroup_namespace *ns) + { +- struct cgroup_namespace *ns = current->nsproxy->cgroup_ns; + struct cgroup *com_cgrp = src_cgrp; + struct inode *inode; + int ret; +@@ -4485,8 +4501,10 @@ static int cgroup_procs_write_permission(struct cgroup *src_cgrp, + static ssize_t cgroup_procs_write(struct kernfs_open_file *of, + char *buf, size_t nbytes, loff_t off) + { ++ struct cgroup_file_ctx *ctx = of->priv; + struct cgroup *src_cgrp, *dst_cgrp; + struct task_struct *task; ++ const struct cred *saved_cred; + ssize_t ret; + + dst_cgrp = cgroup_kn_lock_live(of->kn, false); +@@ -4503,8 +4521,16 @@ static ssize_t cgroup_procs_write(struct kernfs_open_file *of, + src_cgrp = task_cgroup_from_root(task, &cgrp_dfl_root); + spin_unlock_irq(&css_set_lock); + ++ /* ++ * Process and thread migrations follow same delegation rule. Check ++ * permissions using the credentials from file open to protect against ++ * inherited fd attacks. ++ */ ++ saved_cred = override_creds(of->file->f_cred); + ret = cgroup_procs_write_permission(src_cgrp, dst_cgrp, +- of->file->f_path.dentry->d_sb); ++ of->file->f_path.dentry->d_sb, ++ ctx->ns); ++ revert_creds(saved_cred); + if (ret) + goto out_finish; + +@@ -4526,8 +4552,10 @@ static void *cgroup_threads_start(struct seq_file *s, loff_t *pos) + static ssize_t cgroup_threads_write(struct kernfs_open_file *of, + char *buf, size_t nbytes, loff_t off) + { ++ struct cgroup_file_ctx *ctx = of->priv; + struct cgroup *src_cgrp, *dst_cgrp; + struct task_struct *task; ++ const struct cred *saved_cred; + ssize_t ret; + + buf = strstrip(buf); +@@ -4546,9 +4574,16 @@ static ssize_t cgroup_threads_write(struct kernfs_open_file *of, + src_cgrp = task_cgroup_from_root(task, &cgrp_dfl_root); + spin_unlock_irq(&css_set_lock); + +- /* thread migrations follow the cgroup.procs delegation rule */ ++ /* ++ * Process and thread migrations follow same delegation rule. Check ++ * permissions using the credentials from file open to protect against ++ * inherited fd attacks. ++ */ ++ saved_cred = override_creds(of->file->f_cred); + ret = cgroup_procs_write_permission(src_cgrp, dst_cgrp, +- of->file->f_path.dentry->d_sb); ++ of->file->f_path.dentry->d_sb, ++ ctx->ns); ++ revert_creds(saved_cred); + if (ret) + goto out_finish; + +diff --git a/kernel/dma/debug.c b/kernel/dma/debug.c +index 1c82b0d25498f..9c9a5b12f92ff 100644 +--- a/kernel/dma/debug.c ++++ b/kernel/dma/debug.c +@@ -1056,7 +1056,7 @@ static __init int dma_debug_cmdline(char *str) + global_disable = true; + } + +- return 0; ++ return 1; + } + + static __init int dma_debug_entries_cmdline(char *str) +@@ -1065,7 +1065,7 @@ static __init int dma_debug_entries_cmdline(char *str) + return -EINVAL; + if (!get_option(&str, &nr_prealloc_entries)) + nr_prealloc_entries = PREALLOC_DMA_DEBUG_ENTRIES; +- return 0; ++ return 1; + } + + __setup("dma_debug=", dma_debug_cmdline); +diff --git a/kernel/events/core.c b/kernel/events/core.c +index 2adde229d1af4..ec2f9e433208a 100644 +--- a/kernel/events/core.c ++++ b/kernel/events/core.c +@@ -9137,8 +9137,11 @@ perf_event_parse_addr_filter(struct perf_event *event, char *fstr, + } + + /* ready to consume more filters */ ++ kfree(filename); ++ filename = NULL; + state = IF_STATE_ACTION; + filter = NULL; ++ kernel = 0; + } + } + +diff --git a/kernel/power/hibernate.c b/kernel/power/hibernate.c +index 6670a44ec5d45..6abdfdf571ee7 100644 +--- a/kernel/power/hibernate.c ++++ b/kernel/power/hibernate.c +@@ -1219,7 +1219,7 @@ static int __init resumedelay_setup(char *str) + int rc = kstrtouint(str, 0, &resume_delay); + + if (rc) +- return rc; ++ pr_warn("resumedelay: bad option string '%s'\n", str); + return 1; + } + +diff --git a/kernel/power/suspend_test.c b/kernel/power/suspend_test.c +index 6a897e8b2a888..3f6345d60256f 100644 +--- a/kernel/power/suspend_test.c ++++ b/kernel/power/suspend_test.c +@@ -158,22 +158,22 @@ static int __init setup_test_suspend(char *value) + value++; + suspend_type = strsep(&value, ","); + if (!suspend_type) +- return 0; ++ return 1; + + repeat = strsep(&value, ","); + if (repeat) { + if (kstrtou32(repeat, 0, &test_repeat_count_max)) +- return 0; ++ return 1; + } + + for (i = PM_SUSPEND_MIN; i < PM_SUSPEND_MAX; i++) + if (!strcmp(pm_labels[i], suspend_type)) { + test_state_label = pm_labels[i]; +- return 0; ++ return 1; + } + + printk(warn_bad_state, suspend_type); +- return 0; ++ return 1; + } + __setup("test_suspend", setup_test_suspend); + +diff --git a/kernel/printk/printk.c b/kernel/printk/printk.c +index 57742e193214e..2ba16c426ba5d 100644 +--- a/kernel/printk/printk.c ++++ b/kernel/printk/printk.c +@@ -127,8 +127,10 @@ static int __control_devkmsg(char *str) + + static int __init control_devkmsg(char *str) + { +- if (__control_devkmsg(str) < 0) ++ if (__control_devkmsg(str) < 0) { ++ pr_warn("printk.devkmsg: bad option string '%s'\n", str); + return 1; ++ } + + /* + * Set sysctl string accordingly: +@@ -147,7 +149,7 @@ static int __init control_devkmsg(char *str) + */ + devkmsg_log |= DEVKMSG_LOG_MASK_LOCK; + +- return 0; ++ return 1; + } + __setup("printk.devkmsg=", control_devkmsg); + +diff --git a/kernel/ptrace.c b/kernel/ptrace.c +index af74e843221b3..8a98e3e78c704 100644 +--- a/kernel/ptrace.c ++++ b/kernel/ptrace.c +@@ -364,6 +364,26 @@ bool ptrace_may_access(struct task_struct *task, unsigned int mode) + return !err; + } + ++static int check_ptrace_options(unsigned long data) ++{ ++ if (data & ~(unsigned long)PTRACE_O_MASK) ++ return -EINVAL; ++ ++ if (unlikely(data & PTRACE_O_SUSPEND_SECCOMP)) { ++ if (!IS_ENABLED(CONFIG_CHECKPOINT_RESTORE) || ++ !IS_ENABLED(CONFIG_SECCOMP)) ++ return -EINVAL; ++ ++ if (!capable(CAP_SYS_ADMIN)) ++ return -EPERM; ++ ++ if (seccomp_mode(¤t->seccomp) != SECCOMP_MODE_DISABLED || ++ current->ptrace & PT_SUSPEND_SECCOMP) ++ return -EPERM; ++ } ++ return 0; ++} ++ + static int ptrace_attach(struct task_struct *task, long request, + unsigned long addr, + unsigned long flags) +@@ -375,8 +395,16 @@ static int ptrace_attach(struct task_struct *task, long request, + if (seize) { + if (addr != 0) + goto out; ++ /* ++ * This duplicates the check in check_ptrace_options() because ++ * ptrace_attach() and ptrace_setoptions() have historically ++ * used different error codes for unknown ptrace options. ++ */ + if (flags & ~(unsigned long)PTRACE_O_MASK) + goto out; ++ retval = check_ptrace_options(flags); ++ if (retval) ++ return retval; + flags = PT_PTRACED | PT_SEIZED | (flags << PT_OPT_FLAG_SHIFT); + } else { + flags = PT_PTRACED; +@@ -649,22 +677,11 @@ int ptrace_writedata(struct task_struct *tsk, char __user *src, unsigned long ds + static int ptrace_setoptions(struct task_struct *child, unsigned long data) + { + unsigned flags; ++ int ret; + +- if (data & ~(unsigned long)PTRACE_O_MASK) +- return -EINVAL; +- +- if (unlikely(data & PTRACE_O_SUSPEND_SECCOMP)) { +- if (!IS_ENABLED(CONFIG_CHECKPOINT_RESTORE) || +- !IS_ENABLED(CONFIG_SECCOMP)) +- return -EINVAL; +- +- if (!capable(CAP_SYS_ADMIN)) +- return -EPERM; +- +- if (seccomp_mode(¤t->seccomp) != SECCOMP_MODE_DISABLED || +- current->ptrace & PT_SUSPEND_SECCOMP) +- return -EPERM; +- } ++ ret = check_ptrace_options(data); ++ if (ret) ++ return ret; + + /* Avoid intermediate state when all opts are cleared */ + flags = child->ptrace; +diff --git a/kernel/sched/debug.c b/kernel/sched/debug.c +index 9518606fa1e58..b1ef4f2e7edcb 100644 +--- a/kernel/sched/debug.c ++++ b/kernel/sched/debug.c +@@ -871,25 +871,15 @@ void print_numa_stats(struct seq_file *m, int node, unsigned long tsf, + static void sched_show_numa(struct task_struct *p, struct seq_file *m) + { + #ifdef CONFIG_NUMA_BALANCING +- struct mempolicy *pol; +- + if (p->mm) + P(mm->numa_scan_seq); + +- task_lock(p); +- pol = p->mempolicy; +- if (pol && !(pol->flags & MPOL_F_MORON)) +- pol = NULL; +- mpol_get(pol); +- task_unlock(p); +- + P(numa_pages_migrated); + P(numa_preferred_nid); + P(total_numa_faults); + SEQ_printf(m, "current_node=%d, numa_group_id=%d\n", + task_node(p), task_numa_group_id(p)); + show_numa_stats(p, m); +- mpol_put(pol); + #endif + } + +diff --git a/lib/raid6/test/Makefile b/lib/raid6/test/Makefile +index 79777645cac9c..e7b54ec8ca709 100644 +--- a/lib/raid6/test/Makefile ++++ b/lib/raid6/test/Makefile +@@ -4,6 +4,8 @@ + # from userspace. + # + ++pound := \# ++ + CC = gcc + OPTFLAGS = -O2 # Adjust as desired + CFLAGS = -I.. -I ../../../include -g $(OPTFLAGS) +@@ -44,7 +46,7 @@ else ifeq ($(HAS_NEON),yes) + OBJS += neon.o neon1.o neon2.o neon4.o neon8.o recov_neon.o recov_neon_inner.o + CFLAGS += -DCONFIG_KERNEL_MODE_NEON=1 + else +- HAS_ALTIVEC := $(shell printf '\#include \nvector int a;\n' |\ ++ HAS_ALTIVEC := $(shell printf '$(pound)include \nvector int a;\n' |\ + gcc -c -x c - >/dev/null && rm ./-.o && echo yes) + ifeq ($(HAS_ALTIVEC),yes) + CFLAGS += -I../../../arch/powerpc/include +diff --git a/lib/raid6/test/test.c b/lib/raid6/test/test.c +index b07f4d8e6b033..a7e9372482996 100644 +--- a/lib/raid6/test/test.c ++++ b/lib/raid6/test/test.c +@@ -22,7 +22,6 @@ + #define NDISKS 16 /* Including P and Q */ + + const char raid6_empty_zero_page[PAGE_SIZE] __attribute__((aligned(PAGE_SIZE))); +-struct raid6_calls raid6_call; + + char *dataptrs[NDISKS]; + char data[NDISKS][PAGE_SIZE] __attribute__((aligned(PAGE_SIZE))); +diff --git a/lib/test_kmod.c b/lib/test_kmod.c +index 87a0cc750ea23..6813b183aa348 100644 +--- a/lib/test_kmod.c ++++ b/lib/test_kmod.c +@@ -1155,6 +1155,7 @@ static struct kmod_test_device *register_test_dev_kmod(void) + if (ret) { + pr_err("could not register misc device: %d\n", ret); + free_test_dev_kmod(test_dev); ++ test_dev = NULL; + goto out; + } + +diff --git a/mm/memcontrol.c b/mm/memcontrol.c +index 87cd5bf1b4874..f3aa6e6214d5e 100644 +--- a/mm/memcontrol.c ++++ b/mm/memcontrol.c +@@ -6404,7 +6404,7 @@ static int __init cgroup_memory(char *s) + if (!strcmp(token, "nokmem")) + cgroup_memory_nokmem = true; + } +- return 0; ++ return 1; + } + __setup("cgroup.memory=", cgroup_memory); + +diff --git a/mm/memory.c b/mm/memory.c +index 1d03085fde02b..8cd80ba56474a 100644 +--- a/mm/memory.c ++++ b/mm/memory.c +@@ -1302,6 +1302,17 @@ int copy_page_range(struct mm_struct *dst_mm, struct mm_struct *src_mm, + return ret; + } + ++/* Whether we should zap all COWed (private) pages too */ ++static inline bool should_zap_cows(struct zap_details *details) ++{ ++ /* By default, zap all pages */ ++ if (!details) ++ return true; ++ ++ /* Or, we zap COWed pages only if the caller wants to */ ++ return !details->check_mapping; ++} ++ + static unsigned long zap_pte_range(struct mmu_gather *tlb, + struct vm_area_struct *vma, pmd_t *pmd, + unsigned long addr, unsigned long end, +@@ -1390,17 +1401,19 @@ again: + continue; + } + +- /* If details->check_mapping, we leave swap entries. */ +- if (unlikely(details)) +- continue; +- + entry = pte_to_swp_entry(ptent); +- if (!non_swap_entry(entry)) ++ if (!non_swap_entry(entry)) { ++ /* Genuine swap entry, hence a private anon page */ ++ if (!should_zap_cows(details)) ++ continue; + rss[MM_SWAPENTS]--; +- else if (is_migration_entry(entry)) { ++ } else if (is_migration_entry(entry)) { + struct page *page; + + page = migration_entry_to_page(entry); ++ if (details && details->check_mapping && ++ details->check_mapping != page_rmapping(page)) ++ continue; + rss[mm_counter(page)]--; + } + if (unlikely(!free_swap_and_cache(entry))) +@@ -3416,11 +3429,20 @@ static vm_fault_t __do_fault(struct vm_fault *vmf) + return ret; + + if (unlikely(PageHWPoison(vmf->page))) { +- if (ret & VM_FAULT_LOCKED) +- unlock_page(vmf->page); +- put_page(vmf->page); ++ struct page *page = vmf->page; ++ vm_fault_t poisonret = VM_FAULT_HWPOISON; ++ if (ret & VM_FAULT_LOCKED) { ++ if (page_mapped(page)) ++ unmap_mapping_pages(page_mapping(page), ++ page->index, 1, false); ++ /* Retry if a clean page was removed from the cache. */ ++ if (invalidate_inode_page(page)) ++ poisonret = VM_FAULT_NOPAGE; ++ unlock_page(page); ++ } ++ put_page(page); + vmf->page = NULL; +- return VM_FAULT_HWPOISON; ++ return poisonret; + } + + if (unlikely(!(ret & VM_FAULT_LOCKED))) +diff --git a/mm/mempolicy.c b/mm/mempolicy.c +index 3cd27c1c729f6..5ada8897ef0ef 100644 +--- a/mm/mempolicy.c ++++ b/mm/mempolicy.c +@@ -732,7 +732,6 @@ static int vma_replace_policy(struct vm_area_struct *vma, + static int mbind_range(struct mm_struct *mm, unsigned long start, + unsigned long end, struct mempolicy *new_pol) + { +- struct vm_area_struct *next; + struct vm_area_struct *prev; + struct vm_area_struct *vma; + int err = 0; +@@ -748,8 +747,7 @@ static int mbind_range(struct mm_struct *mm, unsigned long start, + if (start > vma->vm_start) + prev = vma; + +- for (; vma && vma->vm_start < end; prev = vma, vma = next) { +- next = vma->vm_next; ++ for (; vma && vma->vm_start < end; prev = vma, vma = vma->vm_next) { + vmstart = max(start, vma->vm_start); + vmend = min(end, vma->vm_end); + +@@ -763,10 +761,6 @@ static int mbind_range(struct mm_struct *mm, unsigned long start, + new_pol, vma->vm_userfaultfd_ctx); + if (prev) { + vma = prev; +- next = vma->vm_next; +- if (mpol_equal(vma_policy(vma), new_pol)) +- continue; +- /* vma_merge() joined vma && vma->next, case 8 */ + goto replace; + } + if (vma->vm_start != vmstart) { +@@ -2569,6 +2563,7 @@ alloc_new: + mpol_new = kmem_cache_alloc(policy_cache, GFP_KERNEL); + if (!mpol_new) + goto err_out; ++ atomic_set(&mpol_new->refcnt, 1); + goto restart; + } + +diff --git a/mm/mmap.c b/mm/mmap.c +index f875386e7acd4..bb8ba32589459 100644 +--- a/mm/mmap.c ++++ b/mm/mmap.c +@@ -2469,7 +2469,7 @@ static int __init cmdline_parse_stack_guard_gap(char *p) + if (!*endptr) + stack_guard_gap = val << PAGE_SHIFT; + +- return 0; ++ return 1; + } + __setup("stack_guard_gap=", cmdline_parse_stack_guard_gap); + +diff --git a/mm/mremap.c b/mm/mremap.c +index 33d8bbe24dddd..3cf9d77b33341 100644 +--- a/mm/mremap.c ++++ b/mm/mremap.c +@@ -201,6 +201,9 @@ unsigned long move_page_tables(struct vm_area_struct *vma, + unsigned long mmun_start; /* For mmu_notifiers */ + unsigned long mmun_end; /* For mmu_notifiers */ + ++ if (!len) ++ return 0; ++ + old_end = old_addr + len; + flush_cache_range(vma, old_addr, old_end); + +diff --git a/mm/page_alloc.c b/mm/page_alloc.c +index afcaa657a0229..1a39fd6a73b88 100644 +--- a/mm/page_alloc.c ++++ b/mm/page_alloc.c +@@ -6855,10 +6855,17 @@ restart: + + out2: + /* Align start of ZONE_MOVABLE on all nids to MAX_ORDER_NR_PAGES */ +- for (nid = 0; nid < MAX_NUMNODES; nid++) ++ for (nid = 0; nid < MAX_NUMNODES; nid++) { ++ unsigned long start_pfn, end_pfn; ++ + zone_movable_pfn[nid] = + roundup(zone_movable_pfn[nid], MAX_ORDER_NR_PAGES); + ++ get_pfn_range_for_nid(nid, &start_pfn, &end_pfn); ++ if (zone_movable_pfn[nid] >= end_pfn) ++ zone_movable_pfn[nid] = 0; ++ } ++ + out: + /* restore the node_state */ + node_states[N_MEMORY] = saved_node_state; +diff --git a/mm/rmap.c b/mm/rmap.c +index 699f445e3e78c..e578eb942317b 100644 +--- a/mm/rmap.c ++++ b/mm/rmap.c +@@ -1594,7 +1594,30 @@ static bool try_to_unmap_one(struct page *page, struct vm_area_struct *vma, + + /* MADV_FREE page check */ + if (!PageSwapBacked(page)) { +- if (!PageDirty(page)) { ++ int ref_count, map_count; ++ ++ /* ++ * Synchronize with gup_pte_range(): ++ * - clear PTE; barrier; read refcount ++ * - inc refcount; barrier; read PTE ++ */ ++ smp_mb(); ++ ++ ref_count = page_ref_count(page); ++ map_count = page_mapcount(page); ++ ++ /* ++ * Order reads for page refcount and dirty flag ++ * (see comments in __remove_mapping()). ++ */ ++ smp_rmb(); ++ ++ /* ++ * The only page refs must be one from isolation ++ * plus the rmap(s) (dropped by discard:). ++ */ ++ if (ref_count == 1 + map_count && ++ !PageDirty(page)) { + /* Invalidate as we cleared the pte */ + mmu_notifier_invalidate_range(mm, + address, address + PAGE_SIZE); +diff --git a/mm/usercopy.c b/mm/usercopy.c +index e81d11715d95b..a65fbc6282157 100644 +--- a/mm/usercopy.c ++++ b/mm/usercopy.c +@@ -298,7 +298,10 @@ static bool enable_checks __initdata = true; + + static int __init parse_hardened_usercopy(char *str) + { +- return strtobool(str, &enable_checks); ++ if (strtobool(str, &enable_checks)) ++ pr_warn("Invalid option string for hardened_usercopy: '%s'\n", ++ str); ++ return 1; + } + + __setup("hardened_usercopy=", parse_hardened_usercopy); +diff --git a/net/bluetooth/hci_event.c b/net/bluetooth/hci_event.c +index 196d0d8320070..dd7bf437d88e0 100644 +--- a/net/bluetooth/hci_event.c ++++ b/net/bluetooth/hci_event.c +@@ -4792,8 +4792,9 @@ static void hci_disconn_phylink_complete_evt(struct hci_dev *hdev, + hci_dev_lock(hdev); + + hcon = hci_conn_hash_lookup_handle(hdev, ev->phy_handle); +- if (hcon) { ++ if (hcon && hcon->type == AMP_LINK) { + hcon->state = BT_CLOSED; ++ hci_disconn_cfm(hcon, ev->reason); + hci_conn_del(hcon); + } + +diff --git a/net/can/raw.c b/net/can/raw.c +index d0fb5a57c66d5..2a6db8752b61d 100644 +--- a/net/can/raw.c ++++ b/net/can/raw.c +@@ -814,7 +814,7 @@ static int raw_sendmsg(struct socket *sock, struct msghdr *msg, size_t size) + if (err < 0) + goto free_skb; + +- sock_tx_timestamp(sk, sk->sk_tsflags, &skb_shinfo(skb)->tx_flags); ++ skb_setup_tx_timestamp(skb, sk->sk_tsflags); + + skb->dev = dev; + skb->sk = sk; +diff --git a/net/ipv4/arp.c b/net/ipv4/arp.c +index e90c89ef8c08a..b18b2a3c54ade 100644 +--- a/net/ipv4/arp.c ++++ b/net/ipv4/arp.c +@@ -1114,13 +1114,18 @@ static int arp_req_get(struct arpreq *r, struct net_device *dev) + return err; + } + +-static int arp_invalidate(struct net_device *dev, __be32 ip) ++int arp_invalidate(struct net_device *dev, __be32 ip, bool force) + { + struct neighbour *neigh = neigh_lookup(&arp_tbl, &ip, dev); + int err = -ENXIO; + struct neigh_table *tbl = &arp_tbl; + + if (neigh) { ++ if ((neigh->nud_state & NUD_VALID) && !force) { ++ neigh_release(neigh); ++ return 0; ++ } ++ + if (neigh->nud_state & ~NUD_NOARP) + err = neigh_update(neigh, NULL, NUD_FAILED, + NEIGH_UPDATE_F_OVERRIDE| +@@ -1167,7 +1172,7 @@ static int arp_req_delete(struct net *net, struct arpreq *r, + if (!dev) + return -EINVAL; + } +- return arp_invalidate(dev, ip); ++ return arp_invalidate(dev, ip, true); + } + + /* +diff --git a/net/ipv4/fib_frontend.c b/net/ipv4/fib_frontend.c +index 70e5e9e5d8351..1885a2fbad862 100644 +--- a/net/ipv4/fib_frontend.c ++++ b/net/ipv4/fib_frontend.c +@@ -917,9 +917,11 @@ void fib_add_ifaddr(struct in_ifaddr *ifa) + return; + + /* Add broadcast address, if it is explicitly assigned. */ +- if (ifa->ifa_broadcast && ifa->ifa_broadcast != htonl(0xFFFFFFFF)) ++ if (ifa->ifa_broadcast && ifa->ifa_broadcast != htonl(0xFFFFFFFF)) { + fib_magic(RTM_NEWROUTE, RTN_BROADCAST, ifa->ifa_broadcast, 32, + prim, 0); ++ arp_invalidate(dev, ifa->ifa_broadcast, false); ++ } + + if (!ipv4_is_zeronet(prefix) && !(ifa->ifa_flags & IFA_F_SECONDARY) && + (prefix != addr || ifa->ifa_prefixlen < 32)) { +@@ -935,6 +937,7 @@ void fib_add_ifaddr(struct in_ifaddr *ifa) + prim, 0); + fib_magic(RTM_NEWROUTE, RTN_BROADCAST, prefix | ~mask, + 32, prim, 0); ++ arp_invalidate(dev, prefix | ~mask, false); + } + } + } +diff --git a/net/ipv4/raw.c b/net/ipv4/raw.c +index 8cae691c3c9f4..654f586fc0d73 100644 +--- a/net/ipv4/raw.c ++++ b/net/ipv4/raw.c +@@ -391,7 +391,7 @@ static int raw_send_hdrinc(struct sock *sk, struct flowi4 *fl4, + + skb->ip_summed = CHECKSUM_NONE; + +- sock_tx_timestamp(sk, sockc->tsflags, &skb_shinfo(skb)->tx_flags); ++ skb_setup_tx_timestamp(skb, sockc->tsflags); + + if (flags & MSG_CONFIRM) + skb_set_dst_pending_confirm(skb, 1); +diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c +index c97c027a8d773..97c3b616d594b 100644 +--- a/net/ipv4/tcp_output.c ++++ b/net/ipv4/tcp_output.c +@@ -3425,6 +3425,7 @@ static void tcp_connect_queue_skb(struct sock *sk, struct sk_buff *skb) + */ + static int tcp_send_syn_data(struct sock *sk, struct sk_buff *syn) + { ++ struct inet_connection_sock *icsk = inet_csk(sk); + struct tcp_sock *tp = tcp_sk(sk); + struct tcp_fastopen_request *fo = tp->fastopen_req; + int space, err = 0; +@@ -3439,8 +3440,10 @@ static int tcp_send_syn_data(struct sock *sk, struct sk_buff *syn) + * private TCP options. The cost is reduced data space in SYN :( + */ + tp->rx_opt.mss_clamp = tcp_mss_clamp(tp, tp->rx_opt.mss_clamp); ++ /* Sync mss_cache after updating the mss_clamp */ ++ tcp_sync_mss(sk, icsk->icsk_pmtu_cookie); + +- space = __tcp_mtu_to_mss(sk, inet_csk(sk)->icsk_pmtu_cookie) - ++ space = __tcp_mtu_to_mss(sk, icsk->icsk_pmtu_cookie) - + MAX_TCP_OPTION_SPACE; + + space = min_t(size_t, space, fo->size); +diff --git a/net/ipv6/raw.c b/net/ipv6/raw.c +index 98c8f98a7660e..ad7bd40b6d533 100644 +--- a/net/ipv6/raw.c ++++ b/net/ipv6/raw.c +@@ -660,7 +660,7 @@ static int rawv6_send_hdrinc(struct sock *sk, struct msghdr *msg, int length, + + skb->ip_summed = CHECKSUM_NONE; + +- sock_tx_timestamp(sk, sockc->tsflags, &skb_shinfo(skb)->tx_flags); ++ skb_setup_tx_timestamp(skb, sockc->tsflags); + + if (flags & MSG_CONFIRM) + skb_set_dst_pending_confirm(skb, 1); +diff --git a/net/ipv6/xfrm6_output.c b/net/ipv6/xfrm6_output.c +index b5941c9475f36..fbcec48270712 100644 +--- a/net/ipv6/xfrm6_output.c ++++ b/net/ipv6/xfrm6_output.c +@@ -142,6 +142,19 @@ static int __xfrm6_output_finish(struct net *net, struct sock *sk, struct sk_buf + return x->outer_mode->afinfo->output_finish(sk, skb); + } + ++static int xfrm6_noneed_fragment(struct sk_buff *skb) ++{ ++ struct frag_hdr *fh; ++ u8 prevhdr = ipv6_hdr(skb)->nexthdr; ++ ++ if (prevhdr != NEXTHDR_FRAGMENT) ++ return 0; ++ fh = (struct frag_hdr *)(skb->data + sizeof(struct ipv6hdr)); ++ if (fh->nexthdr == NEXTHDR_ESP || fh->nexthdr == NEXTHDR_AUTH) ++ return 1; ++ return 0; ++} ++ + static int __xfrm6_output(struct net *net, struct sock *sk, struct sk_buff *skb) + { + struct dst_entry *dst = skb_dst(skb); +@@ -170,6 +183,9 @@ static int __xfrm6_output(struct net *net, struct sock *sk, struct sk_buff *skb) + xfrm6_local_rxpmtu(skb, mtu); + kfree_skb(skb); + return -EMSGSIZE; ++ } else if (toobig && xfrm6_noneed_fragment(skb)) { ++ skb->ignore_df = 1; ++ goto skip_frag; + } else if (!skb->ignore_df && toobig && skb->sk) { + xfrm_local_error(skb, mtu); + kfree_skb(skb); +diff --git a/net/key/af_key.c b/net/key/af_key.c +index 388910cf09781..a416c0f900567 100644 +--- a/net/key/af_key.c ++++ b/net/key/af_key.c +@@ -1709,7 +1709,7 @@ static int pfkey_register(struct sock *sk, struct sk_buff *skb, const struct sad + + xfrm_probe_algs(); + +- supp_skb = compose_sadb_supported(hdr, GFP_KERNEL); ++ supp_skb = compose_sadb_supported(hdr, GFP_KERNEL | __GFP_ZERO); + if (!supp_skb) { + if (hdr->sadb_msg_satype != SADB_SATYPE_UNSPEC) + pfk->registered &= ~(1<sadb_msg_satype); +@@ -2413,7 +2413,7 @@ static int pfkey_spddelete(struct sock *sk, struct sk_buff *skb, const struct sa + return err; + } + +- xp = xfrm_policy_bysel_ctx(net, DUMMY_MARK, 0, XFRM_POLICY_TYPE_MAIN, ++ xp = xfrm_policy_bysel_ctx(net, &dummy_mark, 0, XFRM_POLICY_TYPE_MAIN, + pol->sadb_x_policy_dir - 1, &sel, pol_ctx, + 1, &err); + security_xfrm_policy_free(pol_ctx); +@@ -2664,7 +2664,7 @@ static int pfkey_spdget(struct sock *sk, struct sk_buff *skb, const struct sadb_ + return -EINVAL; + + delete = (hdr->sadb_msg_type == SADB_X_SPDDELETE2); +- xp = xfrm_policy_byid(net, DUMMY_MARK, 0, XFRM_POLICY_TYPE_MAIN, ++ xp = xfrm_policy_byid(net, &dummy_mark, 0, XFRM_POLICY_TYPE_MAIN, + dir, pol->sadb_x_policy_id, delete, &err); + if (xp == NULL) + return -ENOENT; +diff --git a/net/netfilter/nf_conntrack_proto_tcp.c b/net/netfilter/nf_conntrack_proto_tcp.c +index 40f8a1252394b..66cda5e2d6b9e 100644 +--- a/net/netfilter/nf_conntrack_proto_tcp.c ++++ b/net/netfilter/nf_conntrack_proto_tcp.c +@@ -362,8 +362,8 @@ static void tcp_options(const struct sk_buff *skb, + length, buff); + BUG_ON(ptr == NULL); + +- state->td_scale = +- state->flags = 0; ++ state->td_scale = 0; ++ state->flags &= IP_CT_TCP_FLAG_BE_LIBERAL; + + while (length > 0) { + int opcode=*ptr++; +@@ -784,6 +784,16 @@ static bool nf_conntrack_tcp_established(const struct nf_conn *ct) + test_bit(IPS_ASSURED_BIT, &ct->status); + } + ++static void nf_ct_tcp_state_reset(struct ip_ct_tcp_state *state) ++{ ++ state->td_end = 0; ++ state->td_maxend = 0; ++ state->td_maxwin = 0; ++ state->td_maxack = 0; ++ state->td_scale = 0; ++ state->flags &= IP_CT_TCP_FLAG_BE_LIBERAL; ++} ++ + /* Returns verdict for packet, or -1 for invalid. */ + static int tcp_packet(struct nf_conn *ct, + const struct sk_buff *skb, +@@ -882,8 +892,7 @@ static int tcp_packet(struct nf_conn *ct, + ct->proto.tcp.last_flags &= ~IP_CT_EXP_CHALLENGE_ACK; + ct->proto.tcp.seen[ct->proto.tcp.last_dir].flags = + ct->proto.tcp.last_flags; +- memset(&ct->proto.tcp.seen[dir], 0, +- sizeof(struct ip_ct_tcp_state)); ++ nf_ct_tcp_state_reset(&ct->proto.tcp.seen[dir]); + break; + } + ct->proto.tcp.last_index = index; +diff --git a/net/netlink/af_netlink.c b/net/netlink/af_netlink.c +index a7497361e4d78..5c6241964637f 100644 +--- a/net/netlink/af_netlink.c ++++ b/net/netlink/af_netlink.c +@@ -152,6 +152,8 @@ static const struct rhashtable_params netlink_rhashtable_params; + + static inline u32 netlink_group_mask(u32 group) + { ++ if (group > 32) ++ return 0; + return group ? 1 << (group - 1) : 0; + } + +diff --git a/net/openvswitch/actions.c b/net/openvswitch/actions.c +index 100cc09c100d9..8b75afe412842 100644 +--- a/net/openvswitch/actions.c ++++ b/net/openvswitch/actions.c +@@ -1098,7 +1098,7 @@ static int clone(struct datapath *dp, struct sk_buff *skb, + int rem = nla_len(attr); + bool dont_clone_flow_key; + +- /* The first action is always 'OVS_CLONE_ATTR_ARG'. */ ++ /* The first action is always 'OVS_CLONE_ATTR_EXEC'. */ + clone_arg = nla_data(attr); + dont_clone_flow_key = nla_get_u32(clone_arg); + actions = nla_next(clone_arg, &rem); +diff --git a/net/openvswitch/flow_netlink.c b/net/openvswitch/flow_netlink.c +index eab5e8eaddaaf..4413ffdc1e030 100644 +--- a/net/openvswitch/flow_netlink.c ++++ b/net/openvswitch/flow_netlink.c +@@ -2166,8 +2166,8 @@ static int __ovs_nla_put_key(const struct sw_flow_key *swkey, + icmpv6_key->icmpv6_type = ntohs(output->tp.src); + icmpv6_key->icmpv6_code = ntohs(output->tp.dst); + +- if (icmpv6_key->icmpv6_type == NDISC_NEIGHBOUR_SOLICITATION || +- icmpv6_key->icmpv6_type == NDISC_NEIGHBOUR_ADVERTISEMENT) { ++ if (swkey->tp.src == htons(NDISC_NEIGHBOUR_SOLICITATION) || ++ swkey->tp.src == htons(NDISC_NEIGHBOUR_ADVERTISEMENT)) { + struct ovs_key_nd *nd_key; + + nla = nla_reserve(skb, OVS_KEY_ATTR_ND, sizeof(*nd_key)); +@@ -3173,7 +3173,9 @@ static int clone_action_to_attr(const struct nlattr *attr, + if (!start) + return -EMSGSIZE; + +- err = ovs_nla_put_actions(nla_data(attr), rem, skb); ++ /* Skipping the OVS_CLONE_ATTR_EXEC that is always the first attribute. */ ++ attr = nla_next(nla_data(attr), &rem); ++ err = ovs_nla_put_actions(attr, rem, skb); + + if (err) + nla_nest_cancel(skb, start); +diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c +index d65051959f852..b951f411ddedc 100644 +--- a/net/packet/af_packet.c ++++ b/net/packet/af_packet.c +@@ -1978,7 +1978,7 @@ retry: + skb->mark = sk->sk_mark; + skb->tstamp = sockc.transmit_time; + +- sock_tx_timestamp(sk, sockc.tsflags, &skb_shinfo(skb)->tx_flags); ++ skb_setup_tx_timestamp(skb, sockc.tsflags); + + if (unlikely(extra_len == 4)) + skb->no_fcs = 1; +@@ -2501,7 +2501,7 @@ static int tpacket_fill_skb(struct packet_sock *po, struct sk_buff *skb, + skb->priority = po->sk.sk_priority; + skb->mark = po->sk.sk_mark; + skb->tstamp = sockc->transmit_time; +- sock_tx_timestamp(&po->sk, sockc->tsflags, &skb_shinfo(skb)->tx_flags); ++ skb_setup_tx_timestamp(skb, sockc->tsflags); + skb_zcopy_set_nouarg(skb, ph.raw); + + skb_reserve(skb, hlen); +@@ -2965,7 +2965,7 @@ static int packet_snd(struct socket *sock, struct msghdr *msg, size_t len) + goto out_free; + } + +- sock_tx_timestamp(sk, sockc.tsflags, &skb_shinfo(skb)->tx_flags); ++ skb_setup_tx_timestamp(skb, sockc.tsflags); + + if (!vnet_hdr.gso_type && (len > dev->mtu + reserve + extra_len) && + !packet_extra_vlan_len_allowed(dev, skb)) { +diff --git a/net/rxrpc/net_ns.c b/net/rxrpc/net_ns.c +index 417d80867c4f4..1b403c2573da2 100644 +--- a/net/rxrpc/net_ns.c ++++ b/net/rxrpc/net_ns.c +@@ -117,8 +117,8 @@ static __net_exit void rxrpc_exit_net(struct net *net) + struct rxrpc_net *rxnet = rxrpc_net(net); + + rxnet->live = false; +- del_timer_sync(&rxnet->peer_keepalive_timer); + cancel_work_sync(&rxnet->peer_keepalive_work); ++ del_timer_sync(&rxnet->peer_keepalive_timer); + rxrpc_destroy_all_calls(rxnet); + rxrpc_destroy_all_connections(rxnet); + rxrpc_destroy_all_peers(rxnet); +diff --git a/net/smc/smc_core.c b/net/smc/smc_core.c +index 6add3094ea9e7..4d421407d6fc6 100644 +--- a/net/smc/smc_core.c ++++ b/net/smc/smc_core.c +@@ -709,7 +709,7 @@ static struct smc_buf_desc *smc_buf_get_slot(int compressed_bufsize, + */ + static inline int smc_rmb_wnd_update_limit(int rmbe_size) + { +- return min_t(int, rmbe_size / 10, SOCK_MIN_SNDBUF / 2); ++ return max_t(int, rmbe_size / 10, SOCK_MIN_SNDBUF / 2); + } + + static struct smc_buf_desc *smcr_new_buf_create(struct smc_link_group *lgr, +diff --git a/net/sunrpc/sched.c b/net/sunrpc/sched.c +index e339f8da1b0a7..e36ae4d4b540c 100644 +--- a/net/sunrpc/sched.c ++++ b/net/sunrpc/sched.c +@@ -893,8 +893,10 @@ int rpc_malloc(struct rpc_task *task) + struct rpc_buffer *buf; + gfp_t gfp = GFP_NOIO | __GFP_NOWARN; + ++ if (RPC_IS_ASYNC(task)) ++ gfp = GFP_NOWAIT | __GFP_NOWARN; + if (RPC_IS_SWAPPER(task)) +- gfp = __GFP_MEMALLOC | GFP_NOWAIT | __GFP_NOWARN; ++ gfp |= __GFP_MEMALLOC; + + size += sizeof(struct rpc_buffer); + if (size <= RPC_BUFFER_MAXSIZE) +diff --git a/net/sunrpc/xprt.c b/net/sunrpc/xprt.c +index 9c4235ce57894..d05fa7c36d001 100644 +--- a/net/sunrpc/xprt.c ++++ b/net/sunrpc/xprt.c +@@ -1545,7 +1545,14 @@ static void xprt_destroy(struct rpc_xprt *xprt) + */ + wait_on_bit_lock(&xprt->state, XPRT_LOCKED, TASK_UNINTERRUPTIBLE); + ++ /* ++ * xprt_schedule_autodisconnect() can run after XPRT_LOCKED ++ * is cleared. We use ->transport_lock to ensure the mod_timer() ++ * can only run *before* del_time_sync(), never after. ++ */ ++ spin_lock(&xprt->transport_lock); + del_timer_sync(&xprt->timer); ++ spin_unlock(&xprt->transport_lock); + + /* + * Destroy sockets etc from the system workqueue so they can +diff --git a/net/sunrpc/xprtrdma/transport.c b/net/sunrpc/xprtrdma/transport.c +index fdd14908eacbd..e87a79be7ef02 100644 +--- a/net/sunrpc/xprtrdma/transport.c ++++ b/net/sunrpc/xprtrdma/transport.c +@@ -665,8 +665,10 @@ xprt_rdma_allocate(struct rpc_task *task) + gfp_t flags; + + flags = RPCRDMA_DEF_GFP; ++ if (RPC_IS_ASYNC(task)) ++ flags = GFP_NOWAIT | __GFP_NOWARN; + if (RPC_IS_SWAPPER(task)) +- flags = __GFP_MEMALLOC | GFP_NOWAIT | __GFP_NOWARN; ++ flags |= __GFP_MEMALLOC; + + if (!rpcrdma_get_sendbuf(r_xprt, req, rqst->rq_callsize, flags)) + goto out_fail; +diff --git a/net/x25/af_x25.c b/net/x25/af_x25.c +index f870027928363..77d8adb27ec76 100644 +--- a/net/x25/af_x25.c ++++ b/net/x25/af_x25.c +@@ -1797,10 +1797,15 @@ void x25_kill_by_neigh(struct x25_neigh *nb) + + write_lock_bh(&x25_list_lock); + +- sk_for_each(s, &x25_list) +- if (x25_sk(s)->neighbour == nb) ++ sk_for_each(s, &x25_list) { ++ if (x25_sk(s)->neighbour == nb) { ++ write_unlock_bh(&x25_list_lock); ++ lock_sock(s); + x25_disconnect(s, ENETUNREACH, 0, 0); +- ++ release_sock(s); ++ write_lock_bh(&x25_list_lock); ++ } ++ } + write_unlock_bh(&x25_list_lock); + + /* Remove any related forwards */ +diff --git a/net/xfrm/xfrm_interface.c b/net/xfrm/xfrm_interface.c +index 1ae8caca28a06..3c642328a117c 100644 +--- a/net/xfrm/xfrm_interface.c ++++ b/net/xfrm/xfrm_interface.c +@@ -300,7 +300,10 @@ xfrmi_xmit2(struct sk_buff *skb, struct net_device *dev, struct flowi *fl) + if (mtu < IPV6_MIN_MTU) + mtu = IPV6_MIN_MTU; + +- icmpv6_ndo_send(skb, ICMPV6_PKT_TOOBIG, 0, mtu); ++ if (skb->len > 1280) ++ icmpv6_ndo_send(skb, ICMPV6_PKT_TOOBIG, 0, mtu); ++ else ++ goto xmit; + } else { + if (!(ip_hdr(skb)->frag_off & htons(IP_DF))) + goto xmit; +diff --git a/net/xfrm/xfrm_policy.c b/net/xfrm/xfrm_policy.c +index ab6d0c6576a6b..bb1c94e20e820 100644 +--- a/net/xfrm/xfrm_policy.c ++++ b/net/xfrm/xfrm_policy.c +@@ -727,14 +727,10 @@ static void xfrm_policy_requeue(struct xfrm_policy *old, + spin_unlock_bh(&pq->hold_queue.lock); + } + +-static bool xfrm_policy_mark_match(struct xfrm_policy *policy, +- struct xfrm_policy *pol) ++static inline bool xfrm_policy_mark_match(const struct xfrm_mark *mark, ++ struct xfrm_policy *pol) + { +- if (policy->mark.v == pol->mark.v && +- policy->priority == pol->priority) +- return true; +- +- return false; ++ return mark->v == pol->mark.v && mark->m == pol->mark.m; + } + + int xfrm_policy_insert(int dir, struct xfrm_policy *policy, int excl) +@@ -753,7 +749,7 @@ int xfrm_policy_insert(int dir, struct xfrm_policy *policy, int excl) + if (pol->type == policy->type && + pol->if_id == policy->if_id && + !selector_cmp(&pol->selector, &policy->selector) && +- xfrm_policy_mark_match(policy, pol) && ++ xfrm_policy_mark_match(&policy->mark, pol) && + xfrm_sec_ctx_match(pol->security, policy->security) && + !WARN_ON(delpol)) { + if (excl) { +@@ -803,11 +799,10 @@ int xfrm_policy_insert(int dir, struct xfrm_policy *policy, int excl) + } + EXPORT_SYMBOL(xfrm_policy_insert); + +-struct xfrm_policy *xfrm_policy_bysel_ctx(struct net *net, u32 mark, u32 if_id, +- u8 type, int dir, +- struct xfrm_selector *sel, +- struct xfrm_sec_ctx *ctx, int delete, +- int *err) ++struct xfrm_policy * ++xfrm_policy_bysel_ctx(struct net *net, const struct xfrm_mark *mark, u32 if_id, ++ u8 type, int dir, struct xfrm_selector *sel, ++ struct xfrm_sec_ctx *ctx, int delete, int *err) + { + struct xfrm_policy *pol, *ret; + struct hlist_head *chain; +@@ -819,7 +814,7 @@ struct xfrm_policy *xfrm_policy_bysel_ctx(struct net *net, u32 mark, u32 if_id, + hlist_for_each_entry(pol, chain, bydst) { + if (pol->type == type && + pol->if_id == if_id && +- (mark & pol->mark.m) == pol->mark.v && ++ xfrm_policy_mark_match(mark, pol) && + !selector_cmp(sel, &pol->selector) && + xfrm_sec_ctx_match(ctx, pol->security)) { + xfrm_pol_hold(pol); +@@ -844,9 +839,9 @@ struct xfrm_policy *xfrm_policy_bysel_ctx(struct net *net, u32 mark, u32 if_id, + } + EXPORT_SYMBOL(xfrm_policy_bysel_ctx); + +-struct xfrm_policy *xfrm_policy_byid(struct net *net, u32 mark, u32 if_id, +- u8 type, int dir, u32 id, int delete, +- int *err) ++struct xfrm_policy * ++xfrm_policy_byid(struct net *net, const struct xfrm_mark *mark, u32 if_id, ++ u8 type, int dir, u32 id, int delete, int *err) + { + struct xfrm_policy *pol, *ret; + struct hlist_head *chain; +@@ -861,8 +856,7 @@ struct xfrm_policy *xfrm_policy_byid(struct net *net, u32 mark, u32 if_id, + ret = NULL; + hlist_for_each_entry(pol, chain, byidx) { + if (pol->type == type && pol->index == id && +- pol->if_id == if_id && +- (mark & pol->mark.m) == pol->mark.v) { ++ pol->if_id == if_id && xfrm_policy_mark_match(mark, pol)) { + xfrm_pol_hold(pol); + if (delete) { + *err = security_xfrm_policy_delete( +diff --git a/net/xfrm/xfrm_user.c b/net/xfrm/xfrm_user.c +index 3db5cd70b16ac..94c7ebc26c48e 100644 +--- a/net/xfrm/xfrm_user.c ++++ b/net/xfrm/xfrm_user.c +@@ -1862,7 +1862,6 @@ static int xfrm_get_policy(struct sk_buff *skb, struct nlmsghdr *nlh, + struct km_event c; + int delete; + struct xfrm_mark m; +- u32 mark = xfrm_mark_get(attrs, &m); + u32 if_id = 0; + + p = nlmsg_data(nlh); +@@ -1879,8 +1878,11 @@ static int xfrm_get_policy(struct sk_buff *skb, struct nlmsghdr *nlh, + if (attrs[XFRMA_IF_ID]) + if_id = nla_get_u32(attrs[XFRMA_IF_ID]); + ++ xfrm_mark_get(attrs, &m); ++ + if (p->index) +- xp = xfrm_policy_byid(net, mark, if_id, type, p->dir, p->index, delete, &err); ++ xp = xfrm_policy_byid(net, &m, if_id, type, p->dir, ++ p->index, delete, &err); + else { + struct nlattr *rt = attrs[XFRMA_SEC_CTX]; + struct xfrm_sec_ctx *ctx; +@@ -1897,8 +1899,8 @@ static int xfrm_get_policy(struct sk_buff *skb, struct nlmsghdr *nlh, + if (err) + return err; + } +- xp = xfrm_policy_bysel_ctx(net, mark, if_id, type, p->dir, &p->sel, +- ctx, delete, &err); ++ xp = xfrm_policy_bysel_ctx(net, &m, if_id, type, p->dir, ++ &p->sel, ctx, delete, &err); + security_xfrm_policy_free(ctx); + } + if (xp == NULL) +@@ -2165,7 +2167,6 @@ static int xfrm_add_pol_expire(struct sk_buff *skb, struct nlmsghdr *nlh, + u8 type = XFRM_POLICY_TYPE_MAIN; + int err = -ENOENT; + struct xfrm_mark m; +- u32 mark = xfrm_mark_get(attrs, &m); + u32 if_id = 0; + + err = copy_from_user_policy_type(&type, attrs); +@@ -2179,8 +2180,11 @@ static int xfrm_add_pol_expire(struct sk_buff *skb, struct nlmsghdr *nlh, + if (attrs[XFRMA_IF_ID]) + if_id = nla_get_u32(attrs[XFRMA_IF_ID]); + ++ xfrm_mark_get(attrs, &m); ++ + if (p->index) +- xp = xfrm_policy_byid(net, mark, if_id, type, p->dir, p->index, 0, &err); ++ xp = xfrm_policy_byid(net, &m, if_id, type, p->dir, p->index, ++ 0, &err); + else { + struct nlattr *rt = attrs[XFRMA_SEC_CTX]; + struct xfrm_sec_ctx *ctx; +@@ -2197,7 +2201,7 @@ static int xfrm_add_pol_expire(struct sk_buff *skb, struct nlmsghdr *nlh, + if (err) + return err; + } +- xp = xfrm_policy_bysel_ctx(net, mark, if_id, type, p->dir, ++ xp = xfrm_policy_bysel_ctx(net, &m, if_id, type, p->dir, + &p->sel, ctx, 0, &err); + security_xfrm_policy_free(ctx); + } +diff --git a/security/selinux/xfrm.c b/security/selinux/xfrm.c +index 91dc3783ed944..9e803d2a687a6 100644 +--- a/security/selinux/xfrm.c ++++ b/security/selinux/xfrm.c +@@ -349,7 +349,7 @@ int selinux_xfrm_state_alloc_acquire(struct xfrm_state *x, + int rc; + struct xfrm_sec_ctx *ctx; + char *ctx_str = NULL; +- int str_len; ++ u32 str_len; + + if (!polsec) + return 0; +diff --git a/security/smack/smack_lsm.c b/security/smack/smack_lsm.c +index 221de4c755c31..4f65d953fe318 100644 +--- a/security/smack/smack_lsm.c ++++ b/security/smack/smack_lsm.c +@@ -2586,7 +2586,7 @@ static int smk_ipv6_check(struct smack_known *subject, + #ifdef CONFIG_AUDIT + smk_ad_init_net(&ad, __func__, LSM_AUDIT_DATA_NET, &net); + ad.a.u.net->family = PF_INET6; +- ad.a.u.net->dport = ntohs(address->sin6_port); ++ ad.a.u.net->dport = address->sin6_port; + if (act == SMK_RECEIVING) + ad.a.u.net->v6info.saddr = address->sin6_addr; + else +diff --git a/security/tomoyo/load_policy.c b/security/tomoyo/load_policy.c +index 81b9516520511..f8baef1f32775 100644 +--- a/security/tomoyo/load_policy.c ++++ b/security/tomoyo/load_policy.c +@@ -24,7 +24,7 @@ static const char *tomoyo_loader; + static int __init tomoyo_loader_setup(char *str) + { + tomoyo_loader = str; +- return 0; ++ return 1; + } + + __setup("TOMOYO_loader=", tomoyo_loader_setup); +@@ -63,7 +63,7 @@ static const char *tomoyo_trigger; + static int __init tomoyo_trigger_setup(char *str) + { + tomoyo_trigger = str; +- return 0; ++ return 1; + } + + __setup("TOMOYO_trigger=", tomoyo_trigger_setup); +diff --git a/sound/firewire/fcp.c b/sound/firewire/fcp.c +index 61dda828f767b..c8fbb54269cb1 100644 +--- a/sound/firewire/fcp.c ++++ b/sound/firewire/fcp.c +@@ -240,9 +240,7 @@ int fcp_avc_transaction(struct fw_unit *unit, + t.response_match_bytes = response_match_bytes; + t.state = STATE_PENDING; + init_waitqueue_head(&t.wait); +- +- if (*(const u8 *)command == 0x00 || *(const u8 *)command == 0x03) +- t.deferrable = true; ++ t.deferrable = (*(const u8 *)command == 0x00 || *(const u8 *)command == 0x03); + + spin_lock_irq(&transactions_lock); + list_add_tail(&t.list, &transactions); +diff --git a/sound/isa/cs423x/cs4236.c b/sound/isa/cs423x/cs4236.c +index 7d4e18cb63510..6fff77fe34a8e 100644 +--- a/sound/isa/cs423x/cs4236.c ++++ b/sound/isa/cs423x/cs4236.c +@@ -559,7 +559,7 @@ static int snd_cs423x_pnpbios_detect(struct pnp_dev *pdev, + static int dev; + int err; + struct snd_card *card; +- struct pnp_dev *cdev; ++ struct pnp_dev *cdev, *iter; + char cid[PNP_ID_LEN]; + + if (pnp_device_is_isapnp(pdev)) +@@ -575,9 +575,11 @@ static int snd_cs423x_pnpbios_detect(struct pnp_dev *pdev, + strcpy(cid, pdev->id[0].id); + cid[5] = '1'; + cdev = NULL; +- list_for_each_entry(cdev, &(pdev->protocol->devices), protocol_list) { +- if (!strcmp(cdev->id[0].id, cid)) ++ list_for_each_entry(iter, &(pdev->protocol->devices), protocol_list) { ++ if (!strcmp(iter->id[0].id, cid)) { ++ cdev = iter; + break; ++ } + } + err = snd_cs423x_card_new(&pdev->dev, dev, &card); + if (err < 0) +diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c +index 459f629fa0a86..3f9c2b1e3be63 100644 +--- a/sound/pci/hda/patch_realtek.c ++++ b/sound/pci/hda/patch_realtek.c +@@ -3400,8 +3400,8 @@ static void alc256_shutup(struct hda_codec *codec) + /* If disable 3k pulldown control for alc257, the Mic detection will not work correctly + * when booting with headset plugged. So skip setting it for the codec alc257 + */ +- if (spec->codec_variant != ALC269_TYPE_ALC257 && +- spec->codec_variant != ALC269_TYPE_ALC256) ++ if (codec->core.vendor_id != 0x10ec0236 && ++ codec->core.vendor_id != 0x10ec0257) + alc_update_coef_idx(codec, 0x46, 0, 3 << 12); + + if (!spec->no_shutup_pins) +diff --git a/sound/soc/atmel/atmel_ssc_dai.c b/sound/soc/atmel/atmel_ssc_dai.c +index d3b69682d9c22..7272f00222fd2 100644 +--- a/sound/soc/atmel/atmel_ssc_dai.c ++++ b/sound/soc/atmel/atmel_ssc_dai.c +@@ -296,7 +296,10 @@ static int atmel_ssc_startup(struct snd_pcm_substream *substream, + + /* Enable PMC peripheral clock for this SSC */ + pr_debug("atmel_ssc_dai: Starting clock\n"); +- clk_enable(ssc_p->ssc->clk); ++ ret = clk_enable(ssc_p->ssc->clk); ++ if (ret) ++ return ret; ++ + ssc_p->mck_rate = clk_get_rate(ssc_p->ssc->clk); + + /* Reset the SSC unless initialized to keep it in a clean state */ +diff --git a/sound/soc/atmel/sam9g20_wm8731.c b/sound/soc/atmel/sam9g20_wm8731.c +index 98f93e79c6547..5041f43ee5f79 100644 +--- a/sound/soc/atmel/sam9g20_wm8731.c ++++ b/sound/soc/atmel/sam9g20_wm8731.c +@@ -225,6 +225,7 @@ static int at91sam9g20ek_audio_probe(struct platform_device *pdev) + cpu_np = of_parse_phandle(np, "atmel,ssc-controller", 0); + if (!cpu_np) { + dev_err(&pdev->dev, "dai and pcm info missing\n"); ++ of_node_put(codec_np); + return -EINVAL; + } + at91sam9g20ek_dai.cpu_of_node = cpu_np; +diff --git a/sound/soc/codecs/msm8916-wcd-digital.c b/sound/soc/codecs/msm8916-wcd-digital.c +index 6de2ab6f97068..e6750bda542a9 100644 +--- a/sound/soc/codecs/msm8916-wcd-digital.c ++++ b/sound/soc/codecs/msm8916-wcd-digital.c +@@ -918,7 +918,7 @@ static int msm8916_wcd_digital_probe(struct platform_device *pdev) + ret = clk_prepare_enable(priv->mclk); + if (ret < 0) { + dev_err(dev, "failed to enable mclk %d\n", ret); +- return ret; ++ goto err_clk; + } + + dev_set_drvdata(dev, priv); +@@ -926,6 +926,9 @@ static int msm8916_wcd_digital_probe(struct platform_device *pdev) + return devm_snd_soc_register_component(dev, &msm8916_wcd_digital, + msm8916_wcd_digital_dai, + ARRAY_SIZE(msm8916_wcd_digital_dai)); ++err_clk: ++ clk_disable_unprepare(priv->ahbclk); ++ return ret; + } + + static int msm8916_wcd_digital_remove(struct platform_device *pdev) +diff --git a/sound/soc/codecs/rt5663.c b/sound/soc/codecs/rt5663.c +index dd77f131ce6c5..b92e1b6ed3830 100644 +--- a/sound/soc/codecs/rt5663.c ++++ b/sound/soc/codecs/rt5663.c +@@ -3463,6 +3463,8 @@ static int rt5663_parse_dp(struct rt5663_priv *rt5663, struct device *dev) + table_size = sizeof(struct impedance_mapping_table) * + rt5663->pdata.impedance_sensing_num; + rt5663->imp_table = devm_kzalloc(dev, table_size, GFP_KERNEL); ++ if (!rt5663->imp_table) ++ return -ENOMEM; + ret = device_property_read_u32_array(dev, + "realtek,impedance_sensing_table", + (u32 *)rt5663->imp_table, table_size); +diff --git a/sound/soc/codecs/wm8350.c b/sound/soc/codecs/wm8350.c +index e92ebe52d485d..707b31ef93466 100644 +--- a/sound/soc/codecs/wm8350.c ++++ b/sound/soc/codecs/wm8350.c +@@ -1538,18 +1538,38 @@ static int wm8350_component_probe(struct snd_soc_component *component) + wm8350_clear_bits(wm8350, WM8350_JACK_DETECT, + WM8350_JDL_ENA | WM8350_JDR_ENA); + +- wm8350_register_irq(wm8350, WM8350_IRQ_CODEC_JCK_DET_L, ++ ret = wm8350_register_irq(wm8350, WM8350_IRQ_CODEC_JCK_DET_L, + wm8350_hpl_jack_handler, 0, "Left jack detect", + priv); +- wm8350_register_irq(wm8350, WM8350_IRQ_CODEC_JCK_DET_R, ++ if (ret != 0) ++ goto err; ++ ++ ret = wm8350_register_irq(wm8350, WM8350_IRQ_CODEC_JCK_DET_R, + wm8350_hpr_jack_handler, 0, "Right jack detect", + priv); +- wm8350_register_irq(wm8350, WM8350_IRQ_CODEC_MICSCD, ++ if (ret != 0) ++ goto free_jck_det_l; ++ ++ ret = wm8350_register_irq(wm8350, WM8350_IRQ_CODEC_MICSCD, + wm8350_mic_handler, 0, "Microphone short", priv); +- wm8350_register_irq(wm8350, WM8350_IRQ_CODEC_MICD, ++ if (ret != 0) ++ goto free_jck_det_r; ++ ++ ret = wm8350_register_irq(wm8350, WM8350_IRQ_CODEC_MICD, + wm8350_mic_handler, 0, "Microphone detect", priv); ++ if (ret != 0) ++ goto free_micscd; + + return 0; ++ ++free_micscd: ++ wm8350_free_irq(wm8350, WM8350_IRQ_CODEC_MICSCD, priv); ++free_jck_det_r: ++ wm8350_free_irq(wm8350, WM8350_IRQ_CODEC_JCK_DET_R, priv); ++free_jck_det_l: ++ wm8350_free_irq(wm8350, WM8350_IRQ_CODEC_JCK_DET_L, priv); ++err: ++ return ret; + } + + static void wm8350_component_remove(struct snd_soc_component *component) +diff --git a/sound/soc/davinci/davinci-i2s.c b/sound/soc/davinci/davinci-i2s.c +index a3206e65e5e54..205841e46046a 100644 +--- a/sound/soc/davinci/davinci-i2s.c ++++ b/sound/soc/davinci/davinci-i2s.c +@@ -721,7 +721,9 @@ static int davinci_i2s_probe(struct platform_device *pdev) + dev->clk = clk_get(&pdev->dev, NULL); + if (IS_ERR(dev->clk)) + return -ENODEV; +- clk_enable(dev->clk); ++ ret = clk_enable(dev->clk); ++ if (ret) ++ goto err_put_clk; + + dev->dev = &pdev->dev; + dev_set_drvdata(&pdev->dev, dev); +@@ -743,6 +745,7 @@ err_unregister_component: + snd_soc_unregister_component(&pdev->dev); + err_release_clk: + clk_disable(dev->clk); ++err_put_clk: + clk_put(dev->clk); + return ret; + } +diff --git a/sound/soc/fsl/imx-es8328.c b/sound/soc/fsl/imx-es8328.c +index 9953438086e47..735693274f495 100644 +--- a/sound/soc/fsl/imx-es8328.c ++++ b/sound/soc/fsl/imx-es8328.c +@@ -93,6 +93,7 @@ static int imx_es8328_probe(struct platform_device *pdev) + if (int_port > MUX_PORT_MAX || int_port == 0) { + dev_err(dev, "mux-int-port: hardware only has %d mux ports\n", + MUX_PORT_MAX); ++ ret = -EINVAL; + goto fail; + } + +diff --git a/sound/soc/mxs/mxs-saif.c b/sound/soc/mxs/mxs-saif.c +index 156aa7c007878..93c0196701998 100644 +--- a/sound/soc/mxs/mxs-saif.c ++++ b/sound/soc/mxs/mxs-saif.c +@@ -467,7 +467,10 @@ static int mxs_saif_hw_params(struct snd_pcm_substream *substream, + * basic clock which should be fast enough for the internal + * logic. + */ +- clk_enable(saif->clk); ++ ret = clk_enable(saif->clk); ++ if (ret) ++ return ret; ++ + ret = clk_set_rate(saif->clk, 24000000); + clk_disable(saif->clk); + if (ret) +diff --git a/sound/soc/mxs/mxs-sgtl5000.c b/sound/soc/mxs/mxs-sgtl5000.c +index 2b3f2408301af..c40e0ab49657f 100644 +--- a/sound/soc/mxs/mxs-sgtl5000.c ++++ b/sound/soc/mxs/mxs-sgtl5000.c +@@ -120,6 +120,9 @@ static int mxs_sgtl5000_probe(struct platform_device *pdev) + codec_np = of_parse_phandle(np, "audio-codec", 0); + if (!saif_np[0] || !saif_np[1] || !codec_np) { + dev_err(&pdev->dev, "phandle missing or invalid\n"); ++ of_node_put(codec_np); ++ of_node_put(saif_np[0]); ++ of_node_put(saif_np[1]); + return -EINVAL; + } + +diff --git a/sound/soc/sh/fsi.c b/sound/soc/sh/fsi.c +index aa7e902f0c025..f486e2b2c540c 100644 +--- a/sound/soc/sh/fsi.c ++++ b/sound/soc/sh/fsi.c +@@ -816,14 +816,27 @@ static int fsi_clk_enable(struct device *dev, + return ret; + } + +- clk_enable(clock->xck); +- clk_enable(clock->ick); +- clk_enable(clock->div); ++ ret = clk_enable(clock->xck); ++ if (ret) ++ goto err; ++ ret = clk_enable(clock->ick); ++ if (ret) ++ goto disable_xck; ++ ret = clk_enable(clock->div); ++ if (ret) ++ goto disable_ick; + + clock->count++; + } + + return ret; ++ ++disable_ick: ++ clk_disable(clock->ick); ++disable_xck: ++ clk_disable(clock->xck); ++err: ++ return ret; + } + + static int fsi_clk_disable(struct device *dev, +diff --git a/sound/soc/soc-core.c b/sound/soc/soc-core.c +index 273898b358c4b..9ca7dff5593d1 100644 +--- a/sound/soc/soc-core.c ++++ b/sound/soc/soc-core.c +@@ -3708,7 +3708,7 @@ int snd_soc_get_dai_name(struct of_phandle_args *args, + if (!component_of_node && pos->dev->parent) + component_of_node = pos->dev->parent->of_node; + +- if (component_of_node != args->np) ++ if (component_of_node != args->np || !pos->num_dai) + continue; + + if (pos->driver->of_xlate_dai_name) { +diff --git a/sound/soc/soc-generic-dmaengine-pcm.c b/sound/soc/soc-generic-dmaengine-pcm.c +index 232df04ca5866..45cce7376191c 100644 +--- a/sound/soc/soc-generic-dmaengine-pcm.c ++++ b/sound/soc/soc-generic-dmaengine-pcm.c +@@ -91,10 +91,10 @@ static int dmaengine_pcm_hw_params(struct snd_pcm_substream *substream, + + memset(&slave_config, 0, sizeof(slave_config)); + +- if (!pcm->config) +- prepare_slave_config = snd_dmaengine_pcm_prepare_slave_config; +- else ++ if (pcm->config && pcm->config->prepare_slave_config) + prepare_slave_config = pcm->config->prepare_slave_config; ++ else ++ prepare_slave_config = snd_dmaengine_pcm_prepare_slave_config; + + if (prepare_slave_config) { + ret = prepare_slave_config(substream, params, &slave_config); +diff --git a/sound/soc/soc-topology.c b/sound/soc/soc-topology.c +index ccf6dd9411975..776250feb3008 100644 +--- a/sound/soc/soc-topology.c ++++ b/sound/soc/soc-topology.c +@@ -547,7 +547,8 @@ static int soc_tplg_kcontrol_bind_io(struct snd_soc_tplg_ctl_hdr *hdr, + + if (hdr->ops.info == SND_SOC_TPLG_CTL_BYTES + && k->iface & SNDRV_CTL_ELEM_IFACE_MIXER +- && k->access & SNDRV_CTL_ELEM_ACCESS_TLV_READWRITE ++ && (k->access & SNDRV_CTL_ELEM_ACCESS_TLV_READ ++ || k->access & SNDRV_CTL_ELEM_ACCESS_TLV_WRITE) + && k->access & SNDRV_CTL_ELEM_ACCESS_TLV_CALLBACK) { + struct soc_bytes_ext *sbe; + struct snd_soc_tplg_bytes_control *be; +diff --git a/sound/spi/at73c213.c b/sound/spi/at73c213.c +index 1ef52edeb5384..3763f06ed7845 100644 +--- a/sound/spi/at73c213.c ++++ b/sound/spi/at73c213.c +@@ -221,7 +221,9 @@ static int snd_at73c213_pcm_open(struct snd_pcm_substream *substream) + runtime->hw = snd_at73c213_playback_hw; + chip->substream = substream; + +- clk_enable(chip->ssc->clk); ++ err = clk_enable(chip->ssc->clk); ++ if (err) ++ return err; + + return 0; + } +@@ -787,7 +789,9 @@ static int snd_at73c213_chip_init(struct snd_at73c213 *chip) + goto out; + + /* Enable DAC master clock. */ +- clk_enable(chip->board->dac_clk); ++ retval = clk_enable(chip->board->dac_clk); ++ if (retval) ++ goto out; + + /* Initialize at73c213 on SPI bus. */ + retval = snd_at73c213_write_reg(chip, DAC_RST, 0x04); +@@ -900,7 +904,9 @@ static int snd_at73c213_dev_init(struct snd_card *card, + chip->card = card; + chip->irq = -1; + +- clk_enable(chip->ssc->clk); ++ retval = clk_enable(chip->ssc->clk); ++ if (retval) ++ return retval; + + retval = request_irq(irq, snd_at73c213_interrupt, 0, "at73c213", chip); + if (retval) { +@@ -1019,7 +1025,9 @@ static int snd_at73c213_remove(struct spi_device *spi) + int retval; + + /* Stop playback. */ +- clk_enable(chip->ssc->clk); ++ retval = clk_enable(chip->ssc->clk); ++ if (retval) ++ goto out; + ssc_writel(chip->ssc->regs, CR, SSC_BIT(CR_TXDIS)); + clk_disable(chip->ssc->clk); + +@@ -1099,9 +1107,16 @@ static int snd_at73c213_resume(struct device *dev) + { + struct snd_card *card = dev_get_drvdata(dev); + struct snd_at73c213 *chip = card->private_data; ++ int retval; + +- clk_enable(chip->board->dac_clk); +- clk_enable(chip->ssc->clk); ++ retval = clk_enable(chip->board->dac_clk); ++ if (retval) ++ return retval; ++ retval = clk_enable(chip->ssc->clk); ++ if (retval) { ++ clk_disable(chip->board->dac_clk); ++ return retval; ++ } + ssc_writel(chip->ssc->regs, CR, SSC_BIT(CR_TXEN)); + + return 0; +diff --git a/tools/build/feature/Makefile b/tools/build/feature/Makefile +index 6696a4b79614a..763ee60ac0db8 100644 +--- a/tools/build/feature/Makefile ++++ b/tools/build/feature/Makefile +@@ -193,9 +193,16 @@ strip-libs = $(filter-out -l%,$(1)) + PERL_EMBED_LDOPTS = $(shell perl -MExtUtils::Embed -e ldopts 2>/dev/null) + PERL_EMBED_LDFLAGS = $(call strip-libs,$(PERL_EMBED_LDOPTS)) + PERL_EMBED_LIBADD = $(call grep-libs,$(PERL_EMBED_LDOPTS)) +-PERL_EMBED_CCOPTS = `perl -MExtUtils::Embed -e ccopts 2>/dev/null` ++PERL_EMBED_CCOPTS = $(shell perl -MExtUtils::Embed -e ccopts 2>/dev/null) + FLAGS_PERL_EMBED=$(PERL_EMBED_CCOPTS) $(PERL_EMBED_LDOPTS) + ++ifeq ($(CC_NO_CLANG), 0) ++ PERL_EMBED_LDOPTS := $(filter-out -specs=%,$(PERL_EMBED_LDOPTS)) ++ PERL_EMBED_CCOPTS := $(filter-out -flto=auto -ffat-lto-objects, $(PERL_EMBED_CCOPTS)) ++ PERL_EMBED_CCOPTS := $(filter-out -specs=%,$(PERL_EMBED_CCOPTS)) ++ FLAGS_PERL_EMBED += -Wno-compound-token-split-by-macro ++endif ++ + $(OUTPUT)test-libperl.bin: + $(BUILD) $(FLAGS_PERL_EMBED) + +diff --git a/tools/include/uapi/linux/bpf.h b/tools/include/uapi/linux/bpf.h +index 9e060c6a01ac2..0c30ab898e2a5 100644 +--- a/tools/include/uapi/linux/bpf.h ++++ b/tools/include/uapi/linux/bpf.h +@@ -1205,8 +1205,8 @@ union bpf_attr { + * Return + * The return value depends on the result of the test, and can be: + * +- * * 0, if current task belongs to the cgroup2. +- * * 1, if current task does not belong to the cgroup2. ++ * * 1, if current task belongs to the cgroup2. ++ * * 0, if current task does not belong to the cgroup2. + * * A negative error code, if an error occurred. + * + * int bpf_skb_change_tail(struct sk_buff *skb, u32 len, u64 flags) +diff --git a/tools/perf/Makefile.config b/tools/perf/Makefile.config +index 8e59b42119176..878e49849bfdf 100644 +--- a/tools/perf/Makefile.config ++++ b/tools/perf/Makefile.config +@@ -662,6 +662,9 @@ else + LDFLAGS += $(PERL_EMBED_LDFLAGS) + EXTLIBS += $(PERL_EMBED_LIBADD) + CFLAGS += -DHAVE_LIBPERL_SUPPORT ++ ifeq ($(CC_NO_CLANG), 0) ++ CFLAGS += -Wno-compound-token-split-by-macro ++ endif + $(call detected,CONFIG_LIBPERL) + endif + endif +diff --git a/tools/testing/selftests/bpf/test_lirc_mode2.sh b/tools/testing/selftests/bpf/test_lirc_mode2.sh +index 677686198df34..795e56e3eaec5 100755 +--- a/tools/testing/selftests/bpf/test_lirc_mode2.sh ++++ b/tools/testing/selftests/bpf/test_lirc_mode2.sh +@@ -3,6 +3,7 @@ + + # Kselftest framework requirement - SKIP code is 4. + ksft_skip=4 ++ret=$ksft_skip + + msg="skip all tests:" + if [ $UID != 0 ]; then +@@ -24,7 +25,7 @@ do + fi + done + +-if [ -n $LIRCDEV ]; ++if [ -n "$LIRCDEV" ]; + then + TYPE=lirc_mode2 + ./test_lirc_mode2_user $LIRCDEV +@@ -35,3 +36,5 @@ then + echo -e ${GREEN}"PASS: $TYPE"${NC} + fi + fi ++ ++exit $ret +diff --git a/tools/testing/selftests/cgroup/cgroup_util.c b/tools/testing/selftests/cgroup/cgroup_util.c +index 90418d79ef676..a516d01f0bfc5 100644 +--- a/tools/testing/selftests/cgroup/cgroup_util.c ++++ b/tools/testing/selftests/cgroup/cgroup_util.c +@@ -192,7 +192,7 @@ int cg_find_unified_root(char *root, size_t len) + + int cg_create(const char *cgroup) + { +- return mkdir(cgroup, 0644); ++ return mkdir(cgroup, 0755); + } + + static int cg_killall(const char *cgroup) +diff --git a/tools/testing/selftests/cgroup/test_core.c b/tools/testing/selftests/cgroup/test_core.c +index 79053a4f47838..599234c5e496c 100644 +--- a/tools/testing/selftests/cgroup/test_core.c ++++ b/tools/testing/selftests/cgroup/test_core.c +@@ -1,8 +1,13 @@ + /* SPDX-License-Identifier: GPL-2.0 */ + ++#define _GNU_SOURCE + #include ++#include + #include ++#include + #include ++#include ++#include + #include + #include + +@@ -354,6 +359,166 @@ cleanup: + return ret; + } + ++/* ++ * cgroup migration permission check should be performed based on the ++ * credentials at the time of open instead of write. ++ */ ++static int test_cgcore_lesser_euid_open(const char *root) ++{ ++ const uid_t test_euid = 65534; /* usually nobody, any !root is fine */ ++ int ret = KSFT_FAIL; ++ char *cg_test_a = NULL, *cg_test_b = NULL; ++ char *cg_test_a_procs = NULL, *cg_test_b_procs = NULL; ++ int cg_test_b_procs_fd = -1; ++ uid_t saved_uid; ++ ++ cg_test_a = cg_name(root, "cg_test_a"); ++ cg_test_b = cg_name(root, "cg_test_b"); ++ ++ if (!cg_test_a || !cg_test_b) ++ goto cleanup; ++ ++ cg_test_a_procs = cg_name(cg_test_a, "cgroup.procs"); ++ cg_test_b_procs = cg_name(cg_test_b, "cgroup.procs"); ++ ++ if (!cg_test_a_procs || !cg_test_b_procs) ++ goto cleanup; ++ ++ if (cg_create(cg_test_a) || cg_create(cg_test_b)) ++ goto cleanup; ++ ++ if (cg_enter_current(cg_test_a)) ++ goto cleanup; ++ ++ if (chown(cg_test_a_procs, test_euid, -1) || ++ chown(cg_test_b_procs, test_euid, -1)) ++ goto cleanup; ++ ++ saved_uid = geteuid(); ++ if (seteuid(test_euid)) ++ goto cleanup; ++ ++ cg_test_b_procs_fd = open(cg_test_b_procs, O_RDWR); ++ ++ if (seteuid(saved_uid)) ++ goto cleanup; ++ ++ if (cg_test_b_procs_fd < 0) ++ goto cleanup; ++ ++ if (write(cg_test_b_procs_fd, "0", 1) >= 0 || errno != EACCES) ++ goto cleanup; ++ ++ ret = KSFT_PASS; ++ ++cleanup: ++ cg_enter_current(root); ++ if (cg_test_b_procs_fd >= 0) ++ close(cg_test_b_procs_fd); ++ if (cg_test_b) ++ cg_destroy(cg_test_b); ++ if (cg_test_a) ++ cg_destroy(cg_test_a); ++ free(cg_test_b_procs); ++ free(cg_test_a_procs); ++ free(cg_test_b); ++ free(cg_test_a); ++ return ret; ++} ++ ++struct lesser_ns_open_thread_arg { ++ const char *path; ++ int fd; ++ int err; ++}; ++ ++static int lesser_ns_open_thread_fn(void *arg) ++{ ++ struct lesser_ns_open_thread_arg *targ = arg; ++ ++ targ->fd = open(targ->path, O_RDWR); ++ targ->err = errno; ++ return 0; ++} ++ ++/* ++ * cgroup migration permission check should be performed based on the cgroup ++ * namespace at the time of open instead of write. ++ */ ++static int test_cgcore_lesser_ns_open(const char *root) ++{ ++ static char stack[65536]; ++ const uid_t test_euid = 65534; /* usually nobody, any !root is fine */ ++ int ret = KSFT_FAIL; ++ char *cg_test_a = NULL, *cg_test_b = NULL; ++ char *cg_test_a_procs = NULL, *cg_test_b_procs = NULL; ++ int cg_test_b_procs_fd = -1; ++ struct lesser_ns_open_thread_arg targ = { .fd = -1 }; ++ pid_t pid; ++ int status; ++ ++ cg_test_a = cg_name(root, "cg_test_a"); ++ cg_test_b = cg_name(root, "cg_test_b"); ++ ++ if (!cg_test_a || !cg_test_b) ++ goto cleanup; ++ ++ cg_test_a_procs = cg_name(cg_test_a, "cgroup.procs"); ++ cg_test_b_procs = cg_name(cg_test_b, "cgroup.procs"); ++ ++ if (!cg_test_a_procs || !cg_test_b_procs) ++ goto cleanup; ++ ++ if (cg_create(cg_test_a) || cg_create(cg_test_b)) ++ goto cleanup; ++ ++ if (cg_enter_current(cg_test_b)) ++ goto cleanup; ++ ++ if (chown(cg_test_a_procs, test_euid, -1) || ++ chown(cg_test_b_procs, test_euid, -1)) ++ goto cleanup; ++ ++ targ.path = cg_test_b_procs; ++ pid = clone(lesser_ns_open_thread_fn, stack + sizeof(stack), ++ CLONE_NEWCGROUP | CLONE_FILES | CLONE_VM | SIGCHLD, ++ &targ); ++ if (pid < 0) ++ goto cleanup; ++ ++ if (waitpid(pid, &status, 0) < 0) ++ goto cleanup; ++ ++ if (!WIFEXITED(status)) ++ goto cleanup; ++ ++ cg_test_b_procs_fd = targ.fd; ++ if (cg_test_b_procs_fd < 0) ++ goto cleanup; ++ ++ if (cg_enter_current(cg_test_a)) ++ goto cleanup; ++ ++ if ((status = write(cg_test_b_procs_fd, "0", 1)) >= 0 || errno != ENOENT) ++ goto cleanup; ++ ++ ret = KSFT_PASS; ++ ++cleanup: ++ cg_enter_current(root); ++ if (cg_test_b_procs_fd >= 0) ++ close(cg_test_b_procs_fd); ++ if (cg_test_b) ++ cg_destroy(cg_test_b); ++ if (cg_test_a) ++ cg_destroy(cg_test_a); ++ free(cg_test_b_procs); ++ free(cg_test_a_procs); ++ free(cg_test_b); ++ free(cg_test_a); ++ return ret; ++} ++ + #define T(x) { x, #x } + struct corecg_test { + int (*fn)(const char *root); +@@ -366,6 +531,8 @@ struct corecg_test { + T(test_cgcore_parent_becomes_threaded), + T(test_cgcore_invalid_domain), + T(test_cgcore_populated), ++ T(test_cgcore_lesser_euid_open), ++ T(test_cgcore_lesser_ns_open), + }; + #undef T + +diff --git a/tools/testing/selftests/x86/check_cc.sh b/tools/testing/selftests/x86/check_cc.sh +index 172d3293fb7be..356689c563975 100755 +--- a/tools/testing/selftests/x86/check_cc.sh ++++ b/tools/testing/selftests/x86/check_cc.sh +@@ -7,7 +7,7 @@ CC="$1" + TESTPROG="$2" + shift 2 + +-if "$CC" -o /dev/null "$TESTPROG" -O0 "$@" 2>/dev/null; then ++if [ -n "$CC" ] && $CC -o /dev/null "$TESTPROG" -O0 "$@" 2>/dev/null; then + echo 1 + else + echo 0 +diff --git a/virt/kvm/kvm_main.c b/virt/kvm/kvm_main.c +index 86ef740763b50..3d45ce1342278 100644 +--- a/virt/kvm/kvm_main.c ++++ b/virt/kvm/kvm_main.c +@@ -112,6 +112,8 @@ EXPORT_SYMBOL_GPL(kvm_debugfs_dir); + static int kvm_debugfs_num_entries; + static const struct file_operations *stat_fops_per_vm[]; + ++static struct file_operations kvm_chardev_ops; ++ + static long kvm_vcpu_ioctl(struct file *file, unsigned int ioctl, + unsigned long arg); + #ifdef CONFIG_KVM_COMPAT +@@ -741,6 +743,16 @@ static struct kvm *kvm_create_vm(unsigned long type) + + preempt_notifier_inc(); + ++ /* ++ * When the fd passed to this ioctl() is opened it pins the module, ++ * but try_module_get() also prevents getting a reference if the module ++ * is in MODULE_STATE_GOING (e.g. if someone ran "rmmod --wait"). ++ */ ++ if (!try_module_get(kvm_chardev_ops.owner)) { ++ r = -ENODEV; ++ goto out_err; ++ } ++ + return kvm; + + out_err: +@@ -817,6 +829,7 @@ static void kvm_destroy_vm(struct kvm *kvm) + preempt_notifier_dec(); + hardware_disable_all(); + mmdrop(mm); ++ module_put(kvm_chardev_ops.owner); + } + + void kvm_get_kvm(struct kvm *kvm)