commit: 81b53e647edd5e728ad3940cded91a2382010bf6 Author: Mike Pagano <mpagano <AT> gentoo <DOT> org> AuthorDate: Wed Aug 30 10:08:04 2017 +0000 Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org> CommitDate: Wed Aug 30 10:08:04 2017 +0000 URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=81b53e64
Linux patch 4.4.85 0000_README | 4 + 1084_linux-4.4.85.patch | 1511 +++++++++++++++++++++++++++++++++++++++++++++++ 2 files changed, 1515 insertions(+) diff --git a/0000_README b/0000_README index ddf9728..e008a1d 100644 --- a/0000_README +++ b/0000_README @@ -379,6 +379,10 @@ Patch: 1083_linux-4.4.84.patch From: http://www.kernel.org Desc: Linux 4.4.84 +Patch: 1084_linux-4.4.85.patch +From: http://www.kernel.org +Desc: Linux 4.4.85 + Patch: 1500_XATTR_USER_PREFIX.patch From: https://bugs.gentoo.org/show_bug.cgi?id=470644 Desc: Support for namespace user.pax.* on tmpfs. diff --git a/1084_linux-4.4.85.patch b/1084_linux-4.4.85.patch new file mode 100644 index 0000000..27aa21d --- /dev/null +++ b/1084_linux-4.4.85.patch @@ -0,0 +1,1511 @@ +diff --git a/Makefile b/Makefile +index 9d77ac063ec0..0f3d843f42a7 100644 +--- a/Makefile ++++ b/Makefile +@@ -1,6 +1,6 @@ + VERSION = 4 + PATCHLEVEL = 4 +-SUBLEVEL = 84 ++SUBLEVEL = 85 + EXTRAVERSION = + NAME = Blurry Fish Butt + +diff --git a/arch/arc/include/asm/cache.h b/arch/arc/include/asm/cache.h +index 210ef3e72332..0ddd7144c492 100644 +--- a/arch/arc/include/asm/cache.h ++++ b/arch/arc/include/asm/cache.h +@@ -88,7 +88,9 @@ extern int ioc_exists; + #define ARC_REG_SLC_FLUSH 0x904 + #define ARC_REG_SLC_INVALIDATE 0x905 + #define ARC_REG_SLC_RGN_START 0x914 ++#define ARC_REG_SLC_RGN_START1 0x915 + #define ARC_REG_SLC_RGN_END 0x916 ++#define ARC_REG_SLC_RGN_END1 0x917 + + /* Bit val in SLC_CONTROL */ + #define SLC_CTRL_IM 0x040 +diff --git a/arch/arc/mm/cache.c b/arch/arc/mm/cache.c +index d81b6d7e11e7..9a84cbdd44b0 100644 +--- a/arch/arc/mm/cache.c ++++ b/arch/arc/mm/cache.c +@@ -543,6 +543,7 @@ noinline void slc_op(phys_addr_t paddr, unsigned long sz, const int op) + static DEFINE_SPINLOCK(lock); + unsigned long flags; + unsigned int ctrl; ++ phys_addr_t end; + + spin_lock_irqsave(&lock, flags); + +@@ -572,8 +573,16 @@ noinline void slc_op(phys_addr_t paddr, unsigned long sz, const int op) + * END needs to be setup before START (latter triggers the operation) + * END can't be same as START, so add (l2_line_sz - 1) to sz + */ +- write_aux_reg(ARC_REG_SLC_RGN_END, (paddr + sz + l2_line_sz - 1)); +- write_aux_reg(ARC_REG_SLC_RGN_START, paddr); ++ end = paddr + sz + l2_line_sz - 1; ++ if (is_pae40_enabled()) ++ write_aux_reg(ARC_REG_SLC_RGN_END1, upper_32_bits(end)); ++ ++ write_aux_reg(ARC_REG_SLC_RGN_END, lower_32_bits(end)); ++ ++ if (is_pae40_enabled()) ++ write_aux_reg(ARC_REG_SLC_RGN_START1, upper_32_bits(paddr)); ++ ++ write_aux_reg(ARC_REG_SLC_RGN_START, lower_32_bits(paddr)); + + while (read_aux_reg(ARC_REG_SLC_CTRL) & SLC_CTRL_BUSY); + +diff --git a/drivers/acpi/apei/ghes.c b/drivers/acpi/apei/ghes.c +index eac4f3b02df9..bb81cd05f0bc 100644 +--- a/drivers/acpi/apei/ghes.c ++++ b/drivers/acpi/apei/ghes.c +@@ -1067,6 +1067,7 @@ static int ghes_remove(struct platform_device *ghes_dev) + if (list_empty(&ghes_sci)) + unregister_acpi_hed_notifier(&ghes_notifier_sci); + mutex_unlock(&ghes_list_mutex); ++ synchronize_rcu(); + break; + case ACPI_HEST_NOTIFY_NMI: + ghes_nmi_remove(ghes); +diff --git a/drivers/acpi/ioapic.c b/drivers/acpi/ioapic.c +index ccdc8db16bb8..fa2cf2dc4e33 100644 +--- a/drivers/acpi/ioapic.c ++++ b/drivers/acpi/ioapic.c +@@ -45,6 +45,12 @@ static acpi_status setup_res(struct acpi_resource *acpi_res, void *data) + struct resource *res = data; + struct resource_win win; + ++ /* ++ * We might assign this to 'res' later, make sure all pointers are ++ * cleared before the resource is added to the global list ++ */ ++ memset(&win, 0, sizeof(win)); ++ + res->flags = 0; + if (acpi_dev_filter_resource_type(acpi_res, IORESOURCE_MEM) == 0) + return AE_OK; +diff --git a/drivers/android/binder.c b/drivers/android/binder.c +index 47ddfefe2443..5531f020e561 100644 +--- a/drivers/android/binder.c ++++ b/drivers/android/binder.c +@@ -1718,8 +1718,12 @@ static void binder_transaction(struct binder_proc *proc, + list_add_tail(&t->work.entry, target_list); + tcomplete->type = BINDER_WORK_TRANSACTION_COMPLETE; + list_add_tail(&tcomplete->entry, &thread->todo); +- if (target_wait) +- wake_up_interruptible(target_wait); ++ if (target_wait) { ++ if (reply || !(t->flags & TF_ONE_WAY)) ++ wake_up_interruptible_sync(target_wait); ++ else ++ wake_up_interruptible(target_wait); ++ } + return; + + err_get_unused_fd_failed: +@@ -2865,7 +2869,7 @@ static int binder_mmap(struct file *filp, struct vm_area_struct *vma) + const char *failure_string; + struct binder_buffer *buffer; + +- if (proc->tsk != current) ++ if (proc->tsk != current->group_leader) + return -EINVAL; + + if ((vma->vm_end - vma->vm_start) > SZ_4M) +@@ -2966,8 +2970,8 @@ static int binder_open(struct inode *nodp, struct file *filp) + proc = kzalloc(sizeof(*proc), GFP_KERNEL); + if (proc == NULL) + return -ENOMEM; +- get_task_struct(current); +- proc->tsk = current; ++ get_task_struct(current->group_leader); ++ proc->tsk = current->group_leader; + INIT_LIST_HEAD(&proc->todo); + init_waitqueue_head(&proc->wait); + proc->default_priority = task_nice(current); +diff --git a/drivers/gpu/drm/drm_atomic.c b/drivers/gpu/drm/drm_atomic.c +index 6253775b8d9c..50d74e5ce41b 100644 +--- a/drivers/gpu/drm/drm_atomic.c ++++ b/drivers/gpu/drm/drm_atomic.c +@@ -1247,6 +1247,9 @@ int drm_atomic_check_only(struct drm_atomic_state *state) + if (config->funcs->atomic_check) + ret = config->funcs->atomic_check(state->dev, state); + ++ if (ret) ++ return ret; ++ + if (!state->allow_modeset) { + for_each_crtc_in_state(state, crtc, crtc_state, i) { + if (drm_atomic_crtc_needs_modeset(crtc_state)) { +@@ -1257,7 +1260,7 @@ int drm_atomic_check_only(struct drm_atomic_state *state) + } + } + +- return ret; ++ return 0; + } + EXPORT_SYMBOL(drm_atomic_check_only); + +diff --git a/drivers/gpu/drm/drm_gem.c b/drivers/gpu/drm/drm_gem.c +index b205224f1a44..9147113139be 100644 +--- a/drivers/gpu/drm/drm_gem.c ++++ b/drivers/gpu/drm/drm_gem.c +@@ -715,13 +715,13 @@ drm_gem_object_release_handle(int id, void *ptr, void *data) + struct drm_gem_object *obj = ptr; + struct drm_device *dev = obj->dev; + ++ if (dev->driver->gem_close_object) ++ dev->driver->gem_close_object(obj, file_priv); ++ + if (drm_core_check_feature(dev, DRIVER_PRIME)) + drm_gem_remove_prime_handles(obj, file_priv); + drm_vma_node_revoke(&obj->vma_node, file_priv->filp); + +- if (dev->driver->gem_close_object) +- dev->driver->gem_close_object(obj, file_priv); +- + drm_gem_object_handle_unreference_unlocked(obj); + + return 0; +diff --git a/drivers/gpu/drm/rcar-du/rcar_du_crtc.c b/drivers/gpu/drm/rcar-du/rcar_du_crtc.c +index 9255b9c096b6..9befd624a5f0 100644 +--- a/drivers/gpu/drm/rcar-du/rcar_du_crtc.c ++++ b/drivers/gpu/drm/rcar-du/rcar_du_crtc.c +@@ -148,8 +148,8 @@ static void rcar_du_crtc_set_display_timing(struct rcar_du_crtc *rcrtc) + rcar_du_group_write(rcrtc->group, rcrtc->index % 2 ? OTAR2 : OTAR, 0); + + /* Signal polarities */ +- value = ((mode->flags & DRM_MODE_FLAG_PVSYNC) ? 0 : DSMR_VSL) +- | ((mode->flags & DRM_MODE_FLAG_PHSYNC) ? 0 : DSMR_HSL) ++ value = ((mode->flags & DRM_MODE_FLAG_PVSYNC) ? DSMR_VSL : 0) ++ | ((mode->flags & DRM_MODE_FLAG_PHSYNC) ? DSMR_HSL : 0) + | DSMR_DIPM_DE | DSMR_CSPM; + rcar_du_crtc_write(rcrtc, DSMR, value); + +@@ -171,7 +171,7 @@ static void rcar_du_crtc_set_display_timing(struct rcar_du_crtc *rcrtc) + mode->crtc_vsync_start - 1); + rcar_du_crtc_write(rcrtc, VCR, mode->crtc_vtotal - 1); + +- rcar_du_crtc_write(rcrtc, DESR, mode->htotal - mode->hsync_start); ++ rcar_du_crtc_write(rcrtc, DESR, mode->htotal - mode->hsync_start - 1); + rcar_du_crtc_write(rcrtc, DEWR, mode->hdisplay); + } + +diff --git a/drivers/gpu/drm/rcar-du/rcar_du_kms.c b/drivers/gpu/drm/rcar-du/rcar_du_kms.c +index 46429c4be8e5..2b75a4891dec 100644 +--- a/drivers/gpu/drm/rcar-du/rcar_du_kms.c ++++ b/drivers/gpu/drm/rcar-du/rcar_du_kms.c +@@ -642,13 +642,13 @@ static int rcar_du_encoders_init_one(struct rcar_du_device *rcdu, + } + + ret = rcar_du_encoder_init(rcdu, enc_type, output, encoder, connector); +- of_node_put(encoder); +- of_node_put(connector); +- + if (ret && ret != -EPROBE_DEFER) + dev_warn(rcdu->dev, +- "failed to initialize encoder %s (%d), skipping\n", +- encoder->full_name, ret); ++ "failed to initialize encoder %s on output %u (%d), skipping\n", ++ of_node_full_name(encoder), output, ret); ++ ++ of_node_put(encoder); ++ of_node_put(connector); + + return ret; + } +diff --git a/drivers/gpu/drm/rcar-du/rcar_du_lvdsenc.c b/drivers/gpu/drm/rcar-du/rcar_du_lvdsenc.c +index 85043c5bad03..873e04aa9352 100644 +--- a/drivers/gpu/drm/rcar-du/rcar_du_lvdsenc.c ++++ b/drivers/gpu/drm/rcar-du/rcar_du_lvdsenc.c +@@ -56,11 +56,11 @@ static int rcar_du_lvdsenc_start(struct rcar_du_lvdsenc *lvds, + return ret; + + /* PLL clock configuration */ +- if (freq <= 38000) ++ if (freq < 39000) + pllcr = LVDPLLCR_CEEN | LVDPLLCR_COSEL | LVDPLLCR_PLLDLYCNT_38M; +- else if (freq <= 60000) ++ else if (freq < 61000) + pllcr = LVDPLLCR_CEEN | LVDPLLCR_COSEL | LVDPLLCR_PLLDLYCNT_60M; +- else if (freq <= 121000) ++ else if (freq < 121000) + pllcr = LVDPLLCR_CEEN | LVDPLLCR_COSEL | LVDPLLCR_PLLDLYCNT_121M; + else + pllcr = LVDPLLCR_PLLDLYCNT_150M; +@@ -102,7 +102,7 @@ static int rcar_du_lvdsenc_start(struct rcar_du_lvdsenc *lvds, + /* Turn the PLL on, wait for the startup delay, and turn the output + * on. + */ +- lvdcr0 |= LVDCR0_PLLEN; ++ lvdcr0 |= LVDCR0_PLLON; + rcar_lvds_write(lvds, LVDCR0, lvdcr0); + + usleep_range(100, 150); +diff --git a/drivers/gpu/drm/rcar-du/rcar_lvds_regs.h b/drivers/gpu/drm/rcar-du/rcar_lvds_regs.h +index 77cf9289ab65..b1eafd097a79 100644 +--- a/drivers/gpu/drm/rcar-du/rcar_lvds_regs.h ++++ b/drivers/gpu/drm/rcar-du/rcar_lvds_regs.h +@@ -18,7 +18,7 @@ + #define LVDCR0_DMD (1 << 12) + #define LVDCR0_LVMD_MASK (0xf << 8) + #define LVDCR0_LVMD_SHIFT 8 +-#define LVDCR0_PLLEN (1 << 4) ++#define LVDCR0_PLLON (1 << 4) + #define LVDCR0_BEN (1 << 2) + #define LVDCR0_LVEN (1 << 1) + #define LVDCR0_LVRES (1 << 0) +diff --git a/drivers/i2c/busses/i2c-designware-platdrv.c b/drivers/i2c/busses/i2c-designware-platdrv.c +index 6b00061c3746..a2ae2213ef3e 100644 +--- a/drivers/i2c/busses/i2c-designware-platdrv.c ++++ b/drivers/i2c/busses/i2c-designware-platdrv.c +@@ -294,7 +294,7 @@ static void dw_i2c_plat_complete(struct device *dev) + #endif + + #ifdef CONFIG_PM +-static int dw_i2c_plat_suspend(struct device *dev) ++static int dw_i2c_plat_runtime_suspend(struct device *dev) + { + struct platform_device *pdev = to_platform_device(dev); + struct dw_i2c_dev *i_dev = platform_get_drvdata(pdev); +@@ -318,11 +318,21 @@ static int dw_i2c_plat_resume(struct device *dev) + return 0; + } + ++#ifdef CONFIG_PM_SLEEP ++static int dw_i2c_plat_suspend(struct device *dev) ++{ ++ pm_runtime_resume(dev); ++ return dw_i2c_plat_runtime_suspend(dev); ++} ++#endif ++ + static const struct dev_pm_ops dw_i2c_dev_pm_ops = { + .prepare = dw_i2c_plat_prepare, + .complete = dw_i2c_plat_complete, + SET_SYSTEM_SLEEP_PM_OPS(dw_i2c_plat_suspend, dw_i2c_plat_resume) +- SET_RUNTIME_PM_OPS(dw_i2c_plat_suspend, dw_i2c_plat_resume, NULL) ++ SET_RUNTIME_PM_OPS(dw_i2c_plat_runtime_suspend, ++ dw_i2c_plat_resume, ++ NULL) + }; + + #define DW_I2C_DEV_PMOPS (&dw_i2c_dev_pm_ops) +diff --git a/drivers/iio/common/hid-sensors/hid-sensor-trigger.c b/drivers/iio/common/hid-sensors/hid-sensor-trigger.c +index 0a86ef43e781..a8db38db622e 100644 +--- a/drivers/iio/common/hid-sensors/hid-sensor-trigger.c ++++ b/drivers/iio/common/hid-sensors/hid-sensor-trigger.c +@@ -36,8 +36,6 @@ static int _hid_sensor_power_state(struct hid_sensor_common *st, bool state) + s32 poll_value = 0; + + if (state) { +- if (!atomic_read(&st->user_requested_state)) +- return 0; + if (sensor_hub_device_open(st->hsdev)) + return -EIO; + +@@ -84,6 +82,9 @@ static int _hid_sensor_power_state(struct hid_sensor_common *st, bool state) + &report_val); + } + ++ pr_debug("HID_SENSOR %s set power_state %d report_state %d\n", ++ st->pdev->name, state_val, report_val); ++ + sensor_hub_get_feature(st->hsdev, st->power_state.report_id, + st->power_state.index, + sizeof(state_val), &state_val); +@@ -107,6 +108,7 @@ int hid_sensor_power_state(struct hid_sensor_common *st, bool state) + ret = pm_runtime_get_sync(&st->pdev->dev); + else { + pm_runtime_mark_last_busy(&st->pdev->dev); ++ pm_runtime_use_autosuspend(&st->pdev->dev); + ret = pm_runtime_put_autosuspend(&st->pdev->dev); + } + if (ret < 0) { +@@ -175,8 +177,6 @@ int hid_sensor_setup_trigger(struct iio_dev *indio_dev, const char *name, + /* Default to 3 seconds, but can be changed from sysfs */ + pm_runtime_set_autosuspend_delay(&attrb->pdev->dev, + 3000); +- pm_runtime_use_autosuspend(&attrb->pdev->dev); +- + return ret; + error_unreg_trigger: + iio_trigger_unregister(trig); +diff --git a/drivers/iio/imu/adis16480.c b/drivers/iio/imu/adis16480.c +index 2485b88ee1b6..1880105cc8c4 100644 +--- a/drivers/iio/imu/adis16480.c ++++ b/drivers/iio/imu/adis16480.c +@@ -696,7 +696,7 @@ static const struct adis16480_chip_info adis16480_chip_info[] = { + .gyro_max_val = IIO_RAD_TO_DEGREE(22500), + .gyro_max_scale = 450, + .accel_max_val = IIO_M_S_2_TO_G(12500), +- .accel_max_scale = 5, ++ .accel_max_scale = 10, + }, + [ADIS16485] = { + .channels = adis16485_channels, +diff --git a/drivers/input/mouse/elan_i2c_core.c b/drivers/input/mouse/elan_i2c_core.c +index 98d4e515587a..681dce15fbc8 100644 +--- a/drivers/input/mouse/elan_i2c_core.c ++++ b/drivers/input/mouse/elan_i2c_core.c +@@ -1234,6 +1234,7 @@ static const struct acpi_device_id elan_acpi_id[] = { + { "ELAN0000", 0 }, + { "ELAN0100", 0 }, + { "ELAN0600", 0 }, ++ { "ELAN0602", 0 }, + { "ELAN0605", 0 }, + { "ELAN0608", 0 }, + { "ELAN0605", 0 }, +diff --git a/drivers/input/mouse/trackpoint.c b/drivers/input/mouse/trackpoint.c +index 354d47ecd66a..ce6ff9b301bb 100644 +--- a/drivers/input/mouse/trackpoint.c ++++ b/drivers/input/mouse/trackpoint.c +@@ -265,7 +265,8 @@ static int trackpoint_start_protocol(struct psmouse *psmouse, unsigned char *fir + if (ps2_command(&psmouse->ps2dev, param, MAKE_PS2_CMD(0, 2, TP_READ_ID))) + return -1; + +- if (param[0] != TP_MAGIC_IDENT) ++ /* add new TP ID. */ ++ if (!(param[0] & TP_MAGIC_IDENT)) + return -1; + + if (firmware_id) +diff --git a/drivers/input/mouse/trackpoint.h b/drivers/input/mouse/trackpoint.h +index 5617ed3a7d7a..88055755f82e 100644 +--- a/drivers/input/mouse/trackpoint.h ++++ b/drivers/input/mouse/trackpoint.h +@@ -21,8 +21,9 @@ + #define TP_COMMAND 0xE2 /* Commands start with this */ + + #define TP_READ_ID 0xE1 /* Sent for device identification */ +-#define TP_MAGIC_IDENT 0x01 /* Sent after a TP_READ_ID followed */ ++#define TP_MAGIC_IDENT 0x03 /* Sent after a TP_READ_ID followed */ + /* by the firmware ID */ ++ /* Firmware ID includes 0x1, 0x2, 0x3 */ + + + /* +diff --git a/drivers/misc/mei/hw-me-regs.h b/drivers/misc/mei/hw-me-regs.h +index a2661381ddfc..d2774197fe58 100644 +--- a/drivers/misc/mei/hw-me-regs.h ++++ b/drivers/misc/mei/hw-me-regs.h +@@ -125,6 +125,11 @@ + #define MEI_DEV_ID_KBP 0xA2BA /* Kaby Point */ + #define MEI_DEV_ID_KBP_2 0xA2BB /* Kaby Point 2 */ + ++#define MEI_DEV_ID_LBG 0xA1BA /* Lewisburg (SPT) */ ++ ++#define MEI_DEV_ID_BXT_M 0x1A9A /* Broxton M */ ++#define MEI_DEV_ID_APL_I 0x5A9A /* Apollo Lake I */ ++ + /* + * MEI HW Section + */ +diff --git a/drivers/misc/mei/pci-me.c b/drivers/misc/mei/pci-me.c +index 01e20384ac44..adab5bbb642a 100644 +--- a/drivers/misc/mei/pci-me.c ++++ b/drivers/misc/mei/pci-me.c +@@ -86,10 +86,14 @@ static const struct pci_device_id mei_me_pci_tbl[] = { + {MEI_PCI_DEVICE(MEI_DEV_ID_SPT_2, mei_me_pch8_cfg)}, + {MEI_PCI_DEVICE(MEI_DEV_ID_SPT_H, mei_me_pch8_sps_cfg)}, + {MEI_PCI_DEVICE(MEI_DEV_ID_SPT_H_2, mei_me_pch8_sps_cfg)}, ++ {MEI_PCI_DEVICE(MEI_DEV_ID_LBG, mei_me_pch8_cfg)}, + + {MEI_PCI_DEVICE(MEI_DEV_ID_KBP, mei_me_pch8_cfg)}, + {MEI_PCI_DEVICE(MEI_DEV_ID_KBP_2, mei_me_pch8_cfg)}, + ++ {MEI_PCI_DEVICE(MEI_DEV_ID_BXT_M, mei_me_pch8_cfg)}, ++ {MEI_PCI_DEVICE(MEI_DEV_ID_APL_I, mei_me_pch8_cfg)}, ++ + /* required last entry */ + {0, } + }; +diff --git a/drivers/ntb/ntb_transport.c b/drivers/ntb/ntb_transport.c +index ecc6fb9ca92f..3bbdf60f8908 100644 +--- a/drivers/ntb/ntb_transport.c ++++ b/drivers/ntb/ntb_transport.c +@@ -599,7 +599,7 @@ static int ntb_transport_setup_qp_mw(struct ntb_transport_ctx *nt, + if (!mw->virt_addr) + return -ENOMEM; + +- if (qp_count % mw_count && mw_num + 1 < qp_count / mw_count) ++ if (mw_num < qp_count % mw_count) + num_qps_mw = qp_count / mw_count + 1; + else + num_qps_mw = qp_count / mw_count; +@@ -947,7 +947,7 @@ static int ntb_transport_init_queue(struct ntb_transport_ctx *nt, + qp->event_handler = NULL; + ntb_qp_link_down_reset(qp); + +- if (qp_count % mw_count && mw_num + 1 < qp_count / mw_count) ++ if (mw_num < qp_count % mw_count) + num_qps_mw = qp_count / mw_count + 1; + else + num_qps_mw = qp_count / mw_count; +@@ -1065,8 +1065,8 @@ static int ntb_transport_probe(struct ntb_client *self, struct ntb_dev *ndev) + qp_count = ilog2(qp_bitmap); + if (max_num_clients && max_num_clients < qp_count) + qp_count = max_num_clients; +- else if (mw_count < qp_count) +- qp_count = mw_count; ++ else if (nt->mw_count < qp_count) ++ qp_count = nt->mw_count; + + qp_bitmap &= BIT_ULL(qp_count) - 1; + +diff --git a/drivers/staging/rtl8188eu/os_dep/usb_intf.c b/drivers/staging/rtl8188eu/os_dep/usb_intf.c +index 02c3feef4e36..c2d2c17550a7 100644 +--- a/drivers/staging/rtl8188eu/os_dep/usb_intf.c ++++ b/drivers/staging/rtl8188eu/os_dep/usb_intf.c +@@ -49,6 +49,7 @@ static struct usb_device_id rtw_usb_id_tbl[] = { + {USB_DEVICE(0x2001, 0x3311)}, /* DLink GO-USB-N150 REV B1 */ + {USB_DEVICE(0x2357, 0x010c)}, /* TP-Link TL-WN722N v2 */ + {USB_DEVICE(0x0df6, 0x0076)}, /* Sitecom N150 v2 */ ++ {USB_DEVICE(USB_VENDER_ID_REALTEK, 0xffef)}, /* Rosewill RNX-N150NUB */ + {} /* Terminating entry */ + }; + +diff --git a/fs/cifs/dir.c b/fs/cifs/dir.c +index 26a3b389a265..fa8df3fef6fc 100644 +--- a/fs/cifs/dir.c ++++ b/fs/cifs/dir.c +@@ -183,15 +183,20 @@ cifs_bp_rename_retry: + } + + /* ++ * Don't allow path components longer than the server max. + * Don't allow the separator character in a path component. + * The VFS will not allow "/", but "\" is allowed by posix. + */ + static int +-check_name(struct dentry *direntry) ++check_name(struct dentry *direntry, struct cifs_tcon *tcon) + { + struct cifs_sb_info *cifs_sb = CIFS_SB(direntry->d_sb); + int i; + ++ if (unlikely(direntry->d_name.len > ++ tcon->fsAttrInfo.MaxPathNameComponentLength)) ++ return -ENAMETOOLONG; ++ + if (!(cifs_sb->mnt_cifs_flags & CIFS_MOUNT_POSIX_PATHS)) { + for (i = 0; i < direntry->d_name.len; i++) { + if (direntry->d_name.name[i] == '\\') { +@@ -489,10 +494,6 @@ cifs_atomic_open(struct inode *inode, struct dentry *direntry, + return finish_no_open(file, res); + } + +- rc = check_name(direntry); +- if (rc) +- return rc; +- + xid = get_xid(); + + cifs_dbg(FYI, "parent inode = 0x%p name is: %pd and dentry = 0x%p\n", +@@ -505,6 +506,11 @@ cifs_atomic_open(struct inode *inode, struct dentry *direntry, + } + + tcon = tlink_tcon(tlink); ++ ++ rc = check_name(direntry, tcon); ++ if (rc) ++ goto out_free_xid; ++ + server = tcon->ses->server; + + if (server->ops->new_lease_key) +@@ -765,7 +771,7 @@ cifs_lookup(struct inode *parent_dir_inode, struct dentry *direntry, + } + pTcon = tlink_tcon(tlink); + +- rc = check_name(direntry); ++ rc = check_name(direntry, pTcon); + if (rc) + goto lookup_out; + +diff --git a/fs/cifs/smb2pdu.c b/fs/cifs/smb2pdu.c +index f4afa3b1cc56..6c484ddf26a9 100644 +--- a/fs/cifs/smb2pdu.c ++++ b/fs/cifs/smb2pdu.c +@@ -2768,8 +2768,8 @@ copy_fs_info_to_kstatfs(struct smb2_fs_full_size_info *pfs_inf, + kst->f_bsize = le32_to_cpu(pfs_inf->BytesPerSector) * + le32_to_cpu(pfs_inf->SectorsPerAllocationUnit); + kst->f_blocks = le64_to_cpu(pfs_inf->TotalAllocationUnits); +- kst->f_bfree = le64_to_cpu(pfs_inf->ActualAvailableAllocationUnits); +- kst->f_bavail = le64_to_cpu(pfs_inf->CallerAvailableAllocationUnits); ++ kst->f_bfree = kst->f_bavail = ++ le64_to_cpu(pfs_inf->CallerAvailableAllocationUnits); + return; + } + +diff --git a/fs/nfsd/nfs4xdr.c b/fs/nfsd/nfs4xdr.c +index 3f68a25f2169..544672b440de 100644 +--- a/fs/nfsd/nfs4xdr.c ++++ b/fs/nfsd/nfs4xdr.c +@@ -129,7 +129,7 @@ static void next_decode_page(struct nfsd4_compoundargs *argp) + argp->p = page_address(argp->pagelist[0]); + argp->pagelist++; + if (argp->pagelen < PAGE_SIZE) { +- argp->end = argp->p + (argp->pagelen>>2); ++ argp->end = argp->p + XDR_QUADLEN(argp->pagelen); + argp->pagelen = 0; + } else { + argp->end = argp->p + (PAGE_SIZE>>2); +@@ -1246,9 +1246,7 @@ nfsd4_decode_write(struct nfsd4_compoundargs *argp, struct nfsd4_write *write) + argp->pagelen -= pages * PAGE_SIZE; + len -= pages * PAGE_SIZE; + +- argp->p = (__be32 *)page_address(argp->pagelist[0]); +- argp->pagelist++; +- argp->end = argp->p + XDR_QUADLEN(PAGE_SIZE); ++ next_decode_page(argp); + } + argp->p += XDR_QUADLEN(len); + +diff --git a/include/net/ip.h b/include/net/ip.h +index b450d8653b30..7476bb10ff37 100644 +--- a/include/net/ip.h ++++ b/include/net/ip.h +@@ -314,7 +314,7 @@ static inline unsigned int ip_dst_mtu_maybe_forward(const struct dst_entry *dst, + !forwarding) + return dst_mtu(dst); + +- return min(dst->dev->mtu, IP_MAX_MTU); ++ return min(READ_ONCE(dst->dev->mtu), IP_MAX_MTU); + } + + static inline unsigned int ip_skb_dst_mtu(const struct sk_buff *skb) +@@ -327,7 +327,7 @@ static inline unsigned int ip_skb_dst_mtu(const struct sk_buff *skb) + return ip_dst_mtu_maybe_forward(skb_dst(skb), forwarding); + } + +- return min(skb_dst(skb)->dev->mtu, IP_MAX_MTU); ++ return min(READ_ONCE(skb_dst(skb)->dev->mtu), IP_MAX_MTU); + } + + u32 ip_idents_reserve(u32 hash, int segs); +diff --git a/include/net/sch_generic.h b/include/net/sch_generic.h +index e5bba897d206..7a5d6a073165 100644 +--- a/include/net/sch_generic.h ++++ b/include/net/sch_generic.h +@@ -717,8 +717,11 @@ static inline struct Qdisc *qdisc_replace(struct Qdisc *sch, struct Qdisc *new, + old = *pold; + *pold = new; + if (old != NULL) { +- qdisc_tree_reduce_backlog(old, old->q.qlen, old->qstats.backlog); ++ unsigned int qlen = old->q.qlen; ++ unsigned int backlog = old->qstats.backlog; ++ + qdisc_reset(old); ++ qdisc_tree_reduce_backlog(old, qlen, backlog); + } + sch_tree_unlock(sch); + +diff --git a/kernel/events/core.c b/kernel/events/core.c +index 784ab8fe8714..3697063dd09a 100644 +--- a/kernel/events/core.c ++++ b/kernel/events/core.c +@@ -8473,28 +8473,27 @@ SYSCALL_DEFINE5(perf_event_open, + goto err_context; + + /* +- * Do not allow to attach to a group in a different +- * task or CPU context: ++ * Make sure we're both events for the same CPU; ++ * grouping events for different CPUs is broken; since ++ * you can never concurrently schedule them anyhow. + */ +- if (move_group) { +- /* +- * Make sure we're both on the same task, or both +- * per-cpu events. +- */ +- if (group_leader->ctx->task != ctx->task) +- goto err_context; ++ if (group_leader->cpu != event->cpu) ++ goto err_context; + +- /* +- * Make sure we're both events for the same CPU; +- * grouping events for different CPUs is broken; since +- * you can never concurrently schedule them anyhow. +- */ +- if (group_leader->cpu != event->cpu) +- goto err_context; +- } else { +- if (group_leader->ctx != ctx) +- goto err_context; +- } ++ /* ++ * Make sure we're both on the same task, or both ++ * per-CPU events. ++ */ ++ if (group_leader->ctx->task != ctx->task) ++ goto err_context; ++ ++ /* ++ * Do not allow to attach to a group in a different task ++ * or CPU context. If we're moving SW events, we'll fix ++ * this up later, so allow that. ++ */ ++ if (!move_group && group_leader->ctx != ctx) ++ goto err_context; + + /* + * Only a group leader can be exclusive or pinned +diff --git a/kernel/trace/trace_events_filter.c b/kernel/trace/trace_events_filter.c +index 6816302542b2..f0e5408499b6 100644 +--- a/kernel/trace/trace_events_filter.c ++++ b/kernel/trace/trace_events_filter.c +@@ -1979,6 +1979,10 @@ static int create_filter(struct trace_event_call *call, + if (err && set_str) + append_filter_err(ps, filter); + } ++ if (err && !set_str) { ++ free_event_filter(filter); ++ filter = NULL; ++ } + create_filter_finish(ps); + + *filterp = filter; +diff --git a/net/bluetooth/bnep/core.c b/net/bluetooth/bnep/core.c +index 1641367e54ca..69f56073b337 100644 +--- a/net/bluetooth/bnep/core.c ++++ b/net/bluetooth/bnep/core.c +@@ -484,16 +484,16 @@ static int bnep_session(void *arg) + struct net_device *dev = s->dev; + struct sock *sk = s->sock->sk; + struct sk_buff *skb; +- wait_queue_t wait; ++ DEFINE_WAIT_FUNC(wait, woken_wake_function); + + BT_DBG(""); + + set_user_nice(current, -15); + +- init_waitqueue_entry(&wait, current); + add_wait_queue(sk_sleep(sk), &wait); + while (1) { +- set_current_state(TASK_INTERRUPTIBLE); ++ /* Ensure session->terminate is updated */ ++ smp_mb__before_atomic(); + + if (atomic_read(&s->terminate)) + break; +@@ -515,9 +515,8 @@ static int bnep_session(void *arg) + break; + netif_wake_queue(dev); + +- schedule(); ++ wait_woken(&wait, TASK_INTERRUPTIBLE, MAX_SCHEDULE_TIMEOUT); + } +- __set_current_state(TASK_RUNNING); + remove_wait_queue(sk_sleep(sk), &wait); + + /* Cleanup session */ +@@ -663,7 +662,7 @@ int bnep_del_connection(struct bnep_conndel_req *req) + s = __bnep_get_session(req->dst); + if (s) { + atomic_inc(&s->terminate); +- wake_up_process(s->task); ++ wake_up_interruptible(sk_sleep(s->sock->sk)); + } else + err = -ENOENT; + +diff --git a/net/bluetooth/cmtp/core.c b/net/bluetooth/cmtp/core.c +index 298ed37010e6..3a39fd523e40 100644 +--- a/net/bluetooth/cmtp/core.c ++++ b/net/bluetooth/cmtp/core.c +@@ -281,16 +281,16 @@ static int cmtp_session(void *arg) + struct cmtp_session *session = arg; + struct sock *sk = session->sock->sk; + struct sk_buff *skb; +- wait_queue_t wait; ++ DEFINE_WAIT_FUNC(wait, woken_wake_function); + + BT_DBG("session %p", session); + + set_user_nice(current, -15); + +- init_waitqueue_entry(&wait, current); + add_wait_queue(sk_sleep(sk), &wait); + while (1) { +- set_current_state(TASK_INTERRUPTIBLE); ++ /* Ensure session->terminate is updated */ ++ smp_mb__before_atomic(); + + if (atomic_read(&session->terminate)) + break; +@@ -307,9 +307,8 @@ static int cmtp_session(void *arg) + + cmtp_process_transmit(session); + +- schedule(); ++ wait_woken(&wait, TASK_INTERRUPTIBLE, MAX_SCHEDULE_TIMEOUT); + } +- __set_current_state(TASK_RUNNING); + remove_wait_queue(sk_sleep(sk), &wait); + + down_write(&cmtp_session_sem); +@@ -394,7 +393,7 @@ int cmtp_add_connection(struct cmtp_connadd_req *req, struct socket *sock) + err = cmtp_attach_device(session); + if (err < 0) { + atomic_inc(&session->terminate); +- wake_up_process(session->task); ++ wake_up_interruptible(sk_sleep(session->sock->sk)); + up_write(&cmtp_session_sem); + return err; + } +@@ -432,7 +431,11 @@ int cmtp_del_connection(struct cmtp_conndel_req *req) + + /* Stop session thread */ + atomic_inc(&session->terminate); +- wake_up_process(session->task); ++ ++ /* Ensure session->terminate is updated */ ++ smp_mb__after_atomic(); ++ ++ wake_up_interruptible(sk_sleep(session->sock->sk)); + } else + err = -ENOENT; + +diff --git a/net/bluetooth/hidp/core.c b/net/bluetooth/hidp/core.c +index 0bec4588c3c8..1fc076420d1e 100644 +--- a/net/bluetooth/hidp/core.c ++++ b/net/bluetooth/hidp/core.c +@@ -36,6 +36,7 @@ + #define VERSION "1.2" + + static DECLARE_RWSEM(hidp_session_sem); ++static DECLARE_WAIT_QUEUE_HEAD(hidp_session_wq); + static LIST_HEAD(hidp_session_list); + + static unsigned char hidp_keycode[256] = { +@@ -1068,12 +1069,12 @@ static int hidp_session_start_sync(struct hidp_session *session) + * Wake up session thread and notify it to stop. This is asynchronous and + * returns immediately. Call this whenever a runtime error occurs and you want + * the session to stop. +- * Note: wake_up_process() performs any necessary memory-barriers for us. ++ * Note: wake_up_interruptible() performs any necessary memory-barriers for us. + */ + static void hidp_session_terminate(struct hidp_session *session) + { + atomic_inc(&session->terminate); +- wake_up_process(session->task); ++ wake_up_interruptible(&hidp_session_wq); + } + + /* +@@ -1180,7 +1181,9 @@ static void hidp_session_run(struct hidp_session *session) + struct sock *ctrl_sk = session->ctrl_sock->sk; + struct sock *intr_sk = session->intr_sock->sk; + struct sk_buff *skb; ++ DEFINE_WAIT_FUNC(wait, woken_wake_function); + ++ add_wait_queue(&hidp_session_wq, &wait); + for (;;) { + /* + * This thread can be woken up two ways: +@@ -1188,12 +1191,10 @@ static void hidp_session_run(struct hidp_session *session) + * session->terminate flag and wakes this thread up. + * - Via modifying the socket state of ctrl/intr_sock. This + * thread is woken up by ->sk_state_changed(). +- * +- * Note: set_current_state() performs any necessary +- * memory-barriers for us. + */ +- set_current_state(TASK_INTERRUPTIBLE); + ++ /* Ensure session->terminate is updated */ ++ smp_mb__before_atomic(); + if (atomic_read(&session->terminate)) + break; + +@@ -1227,11 +1228,22 @@ static void hidp_session_run(struct hidp_session *session) + hidp_process_transmit(session, &session->ctrl_transmit, + session->ctrl_sock); + +- schedule(); ++ wait_woken(&wait, TASK_INTERRUPTIBLE, MAX_SCHEDULE_TIMEOUT); + } ++ remove_wait_queue(&hidp_session_wq, &wait); + + atomic_inc(&session->terminate); +- set_current_state(TASK_RUNNING); ++ ++ /* Ensure session->terminate is updated */ ++ smp_mb__after_atomic(); ++} ++ ++static int hidp_session_wake_function(wait_queue_t *wait, ++ unsigned int mode, ++ int sync, void *key) ++{ ++ wake_up_interruptible(&hidp_session_wq); ++ return false; + } + + /* +@@ -1244,7 +1256,8 @@ static void hidp_session_run(struct hidp_session *session) + static int hidp_session_thread(void *arg) + { + struct hidp_session *session = arg; +- wait_queue_t ctrl_wait, intr_wait; ++ DEFINE_WAIT_FUNC(ctrl_wait, hidp_session_wake_function); ++ DEFINE_WAIT_FUNC(intr_wait, hidp_session_wake_function); + + BT_DBG("session %p", session); + +@@ -1254,8 +1267,6 @@ static int hidp_session_thread(void *arg) + set_user_nice(current, -15); + hidp_set_timer(session); + +- init_waitqueue_entry(&ctrl_wait, current); +- init_waitqueue_entry(&intr_wait, current); + add_wait_queue(sk_sleep(session->ctrl_sock->sk), &ctrl_wait); + add_wait_queue(sk_sleep(session->intr_sock->sk), &intr_wait); + /* This memory barrier is paired with wq_has_sleeper(). See +diff --git a/net/dccp/proto.c b/net/dccp/proto.c +index 9fe25bf63296..b68168fcc06a 100644 +--- a/net/dccp/proto.c ++++ b/net/dccp/proto.c +@@ -24,6 +24,7 @@ + #include <net/checksum.h> + + #include <net/inet_sock.h> ++#include <net/inet_common.h> + #include <net/sock.h> + #include <net/xfrm.h> + +@@ -170,6 +171,15 @@ const char *dccp_packet_name(const int type) + + EXPORT_SYMBOL_GPL(dccp_packet_name); + ++static void dccp_sk_destruct(struct sock *sk) ++{ ++ struct dccp_sock *dp = dccp_sk(sk); ++ ++ ccid_hc_tx_delete(dp->dccps_hc_tx_ccid, sk); ++ dp->dccps_hc_tx_ccid = NULL; ++ inet_sock_destruct(sk); ++} ++ + int dccp_init_sock(struct sock *sk, const __u8 ctl_sock_initialized) + { + struct dccp_sock *dp = dccp_sk(sk); +@@ -179,6 +189,7 @@ int dccp_init_sock(struct sock *sk, const __u8 ctl_sock_initialized) + icsk->icsk_syn_retries = sysctl_dccp_request_retries; + sk->sk_state = DCCP_CLOSED; + sk->sk_write_space = dccp_write_space; ++ sk->sk_destruct = dccp_sk_destruct; + icsk->icsk_sync_mss = dccp_sync_mss; + dp->dccps_mss_cache = 536; + dp->dccps_rate_last = jiffies; +@@ -201,10 +212,7 @@ void dccp_destroy_sock(struct sock *sk) + { + struct dccp_sock *dp = dccp_sk(sk); + +- /* +- * DCCP doesn't use sk_write_queue, just sk_send_head +- * for retransmissions +- */ ++ __skb_queue_purge(&sk->sk_write_queue); + if (sk->sk_send_head != NULL) { + kfree_skb(sk->sk_send_head); + sk->sk_send_head = NULL; +@@ -222,8 +230,7 @@ void dccp_destroy_sock(struct sock *sk) + dp->dccps_hc_rx_ackvec = NULL; + } + ccid_hc_rx_delete(dp->dccps_hc_rx_ccid, sk); +- ccid_hc_tx_delete(dp->dccps_hc_tx_ccid, sk); +- dp->dccps_hc_rx_ccid = dp->dccps_hc_tx_ccid = NULL; ++ dp->dccps_hc_rx_ccid = NULL; + + /* clean up feature negotiation state */ + dccp_feat_list_purge(&dp->dccps_featneg); +diff --git a/net/ipv4/fib_semantics.c b/net/ipv4/fib_semantics.c +index b2504712259f..313e3c11a15a 100644 +--- a/net/ipv4/fib_semantics.c ++++ b/net/ipv4/fib_semantics.c +@@ -1044,15 +1044,17 @@ struct fib_info *fib_create_info(struct fib_config *cfg) + fi = kzalloc(sizeof(*fi)+nhs*sizeof(struct fib_nh), GFP_KERNEL); + if (!fi) + goto failure; +- fib_info_cnt++; + if (cfg->fc_mx) { + fi->fib_metrics = kzalloc(sizeof(*fi->fib_metrics), GFP_KERNEL); +- if (!fi->fib_metrics) +- goto failure; ++ if (unlikely(!fi->fib_metrics)) { ++ kfree(fi); ++ return ERR_PTR(err); ++ } + atomic_set(&fi->fib_metrics->refcnt, 1); +- } else ++ } else { + fi->fib_metrics = (struct dst_metrics *)&dst_default_metrics; +- ++ } ++ fib_info_cnt++; + fi->fib_net = net; + fi->fib_protocol = cfg->fc_protocol; + fi->fib_scope = cfg->fc_scope; +diff --git a/net/ipv4/route.c b/net/ipv4/route.c +index c295d882c6e0..0294f7c99c85 100644 +--- a/net/ipv4/route.c ++++ b/net/ipv4/route.c +@@ -1241,7 +1241,7 @@ static unsigned int ipv4_mtu(const struct dst_entry *dst) + if (mtu) + return mtu; + +- mtu = dst->dev->mtu; ++ mtu = READ_ONCE(dst->dev->mtu); + + if (unlikely(dst_metric_locked(dst, RTAX_MTU))) { + if (rt->rt_uses_gateway && mtu > 576) +diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c +index f0dabd125c43..c4bbf704ff9c 100644 +--- a/net/ipv4/tcp_input.c ++++ b/net/ipv4/tcp_input.c +@@ -3028,8 +3028,7 @@ void tcp_rearm_rto(struct sock *sk) + /* delta may not be positive if the socket is locked + * when the retrans timer fires and is rescheduled. + */ +- if (delta > 0) +- rto = delta; ++ rto = max(delta, 1); + } + inet_csk_reset_xmit_timer(sk, ICSK_TIME_RETRANS, rto, + TCP_RTO_MAX); +diff --git a/net/ipv6/ip6_fib.c b/net/ipv6/ip6_fib.c +index f60e8caea767..aad8cdf15472 100644 +--- a/net/ipv6/ip6_fib.c ++++ b/net/ipv6/ip6_fib.c +@@ -892,6 +892,8 @@ add: + } + nsiblings = iter->rt6i_nsiblings; + fib6_purge_rt(iter, fn, info->nl_net); ++ if (fn->rr_ptr == iter) ++ fn->rr_ptr = NULL; + rt6_release(iter); + + if (nsiblings) { +@@ -904,6 +906,8 @@ add: + if (rt6_qualify_for_ecmp(iter)) { + *ins = iter->dst.rt6_next; + fib6_purge_rt(iter, fn, info->nl_net); ++ if (fn->rr_ptr == iter) ++ fn->rr_ptr = NULL; + rt6_release(iter); + nsiblings--; + } else { +@@ -992,7 +996,7 @@ int fib6_add(struct fib6_node *root, struct rt6_info *rt, + /* Create subtree root node */ + sfn = node_alloc(); + if (!sfn) +- goto st_failure; ++ goto failure; + + sfn->leaf = info->nl_net->ipv6.ip6_null_entry; + atomic_inc(&info->nl_net->ipv6.ip6_null_entry->rt6i_ref); +@@ -1008,12 +1012,12 @@ int fib6_add(struct fib6_node *root, struct rt6_info *rt, + + if (IS_ERR(sn)) { + /* If it is failed, discard just allocated +- root, and then (in st_failure) stale node ++ root, and then (in failure) stale node + in main tree. + */ + node_free(sfn); + err = PTR_ERR(sn); +- goto st_failure; ++ goto failure; + } + + /* Now link new subtree to main tree */ +@@ -1027,7 +1031,7 @@ int fib6_add(struct fib6_node *root, struct rt6_info *rt, + + if (IS_ERR(sn)) { + err = PTR_ERR(sn); +- goto st_failure; ++ goto failure; + } + } + +@@ -1069,22 +1073,22 @@ out: + atomic_inc(&pn->leaf->rt6i_ref); + } + #endif +- if (!(rt->dst.flags & DST_NOCACHE)) +- dst_free(&rt->dst); ++ goto failure; + } + return err; + +-#ifdef CONFIG_IPV6_SUBTREES +- /* Subtree creation failed, probably main tree node +- is orphan. If it is, shoot it. ++failure: ++ /* fn->leaf could be NULL if fn is an intermediate node and we ++ * failed to add the new route to it in both subtree creation ++ * failure and fib6_add_rt2node() failure case. ++ * In both cases, fib6_repair_tree() should be called to fix ++ * fn->leaf. + */ +-st_failure: + if (fn && !(fn->fn_flags & (RTN_RTINFO|RTN_ROOT))) + fib6_repair_tree(info->nl_net, fn); + if (!(rt->dst.flags & DST_NOCACHE)) + dst_free(&rt->dst); + return err; +-#endif + } + + /* +diff --git a/net/irda/af_irda.c b/net/irda/af_irda.c +index 8d2f7c9b491d..4a116d766c15 100644 +--- a/net/irda/af_irda.c ++++ b/net/irda/af_irda.c +@@ -2227,7 +2227,7 @@ static int irda_getsockopt(struct socket *sock, int level, int optname, + { + struct sock *sk = sock->sk; + struct irda_sock *self = irda_sk(sk); +- struct irda_device_list list; ++ struct irda_device_list list = { 0 }; + struct irda_device_info *discoveries; + struct irda_ias_set * ias_opt; /* IAS get/query params */ + struct ias_object * ias_obj; /* Object in IAS */ +diff --git a/net/key/af_key.c b/net/key/af_key.c +index 2e1050ec2cf0..94bf810ad242 100644 +--- a/net/key/af_key.c ++++ b/net/key/af_key.c +@@ -228,7 +228,7 @@ static int pfkey_broadcast_one(struct sk_buff *skb, struct sk_buff **skb2, + #define BROADCAST_ONE 1 + #define BROADCAST_REGISTERED 2 + #define BROADCAST_PROMISC_ONLY 4 +-static int pfkey_broadcast(struct sk_buff *skb, ++static int pfkey_broadcast(struct sk_buff *skb, gfp_t allocation, + int broadcast_flags, struct sock *one_sk, + struct net *net) + { +@@ -278,7 +278,7 @@ static int pfkey_broadcast(struct sk_buff *skb, + rcu_read_unlock(); + + if (one_sk != NULL) +- err = pfkey_broadcast_one(skb, &skb2, GFP_KERNEL, one_sk); ++ err = pfkey_broadcast_one(skb, &skb2, allocation, one_sk); + + kfree_skb(skb2); + kfree_skb(skb); +@@ -311,7 +311,7 @@ static int pfkey_do_dump(struct pfkey_sock *pfk) + hdr = (struct sadb_msg *) pfk->dump.skb->data; + hdr->sadb_msg_seq = 0; + hdr->sadb_msg_errno = rc; +- pfkey_broadcast(pfk->dump.skb, BROADCAST_ONE, ++ pfkey_broadcast(pfk->dump.skb, GFP_ATOMIC, BROADCAST_ONE, + &pfk->sk, sock_net(&pfk->sk)); + pfk->dump.skb = NULL; + } +@@ -355,7 +355,7 @@ static int pfkey_error(const struct sadb_msg *orig, int err, struct sock *sk) + hdr->sadb_msg_len = (sizeof(struct sadb_msg) / + sizeof(uint64_t)); + +- pfkey_broadcast(skb, BROADCAST_ONE, sk, sock_net(sk)); ++ pfkey_broadcast(skb, GFP_KERNEL, BROADCAST_ONE, sk, sock_net(sk)); + + return 0; + } +@@ -1396,7 +1396,7 @@ static int pfkey_getspi(struct sock *sk, struct sk_buff *skb, const struct sadb_ + + xfrm_state_put(x); + +- pfkey_broadcast(resp_skb, BROADCAST_ONE, sk, net); ++ pfkey_broadcast(resp_skb, GFP_KERNEL, BROADCAST_ONE, sk, net); + + return 0; + } +@@ -1483,7 +1483,7 @@ static int key_notify_sa(struct xfrm_state *x, const struct km_event *c) + hdr->sadb_msg_seq = c->seq; + hdr->sadb_msg_pid = c->portid; + +- pfkey_broadcast(skb, BROADCAST_ALL, NULL, xs_net(x)); ++ pfkey_broadcast(skb, GFP_ATOMIC, BROADCAST_ALL, NULL, xs_net(x)); + + return 0; + } +@@ -1596,7 +1596,7 @@ static int pfkey_get(struct sock *sk, struct sk_buff *skb, const struct sadb_msg + out_hdr->sadb_msg_reserved = 0; + out_hdr->sadb_msg_seq = hdr->sadb_msg_seq; + out_hdr->sadb_msg_pid = hdr->sadb_msg_pid; +- pfkey_broadcast(out_skb, BROADCAST_ONE, sk, sock_net(sk)); ++ pfkey_broadcast(out_skb, GFP_ATOMIC, BROADCAST_ONE, sk, sock_net(sk)); + + return 0; + } +@@ -1701,8 +1701,8 @@ static int pfkey_register(struct sock *sk, struct sk_buff *skb, const struct sad + return -ENOBUFS; + } + +- pfkey_broadcast(supp_skb, BROADCAST_REGISTERED, sk, sock_net(sk)); +- ++ pfkey_broadcast(supp_skb, GFP_KERNEL, BROADCAST_REGISTERED, sk, ++ sock_net(sk)); + return 0; + } + +@@ -1720,7 +1720,8 @@ static int unicast_flush_resp(struct sock *sk, const struct sadb_msg *ihdr) + hdr->sadb_msg_errno = (uint8_t) 0; + hdr->sadb_msg_len = (sizeof(struct sadb_msg) / sizeof(uint64_t)); + +- return pfkey_broadcast(skb, BROADCAST_ONE, sk, sock_net(sk)); ++ return pfkey_broadcast(skb, GFP_ATOMIC, BROADCAST_ONE, sk, ++ sock_net(sk)); + } + + static int key_notify_sa_flush(const struct km_event *c) +@@ -1741,7 +1742,7 @@ static int key_notify_sa_flush(const struct km_event *c) + hdr->sadb_msg_len = (sizeof(struct sadb_msg) / sizeof(uint64_t)); + hdr->sadb_msg_reserved = 0; + +- pfkey_broadcast(skb, BROADCAST_ALL, NULL, c->net); ++ pfkey_broadcast(skb, GFP_ATOMIC, BROADCAST_ALL, NULL, c->net); + + return 0; + } +@@ -1798,7 +1799,7 @@ static int dump_sa(struct xfrm_state *x, int count, void *ptr) + out_hdr->sadb_msg_pid = pfk->dump.msg_portid; + + if (pfk->dump.skb) +- pfkey_broadcast(pfk->dump.skb, BROADCAST_ONE, ++ pfkey_broadcast(pfk->dump.skb, GFP_ATOMIC, BROADCAST_ONE, + &pfk->sk, sock_net(&pfk->sk)); + pfk->dump.skb = out_skb; + +@@ -1886,7 +1887,7 @@ static int pfkey_promisc(struct sock *sk, struct sk_buff *skb, const struct sadb + new_hdr->sadb_msg_errno = 0; + } + +- pfkey_broadcast(skb, BROADCAST_ALL, NULL, sock_net(sk)); ++ pfkey_broadcast(skb, GFP_KERNEL, BROADCAST_ALL, NULL, sock_net(sk)); + return 0; + } + +@@ -2219,7 +2220,7 @@ static int key_notify_policy(struct xfrm_policy *xp, int dir, const struct km_ev + out_hdr->sadb_msg_errno = 0; + out_hdr->sadb_msg_seq = c->seq; + out_hdr->sadb_msg_pid = c->portid; +- pfkey_broadcast(out_skb, BROADCAST_ALL, NULL, xp_net(xp)); ++ pfkey_broadcast(out_skb, GFP_ATOMIC, BROADCAST_ALL, NULL, xp_net(xp)); + return 0; + + } +@@ -2439,7 +2440,7 @@ static int key_pol_get_resp(struct sock *sk, struct xfrm_policy *xp, const struc + out_hdr->sadb_msg_errno = 0; + out_hdr->sadb_msg_seq = hdr->sadb_msg_seq; + out_hdr->sadb_msg_pid = hdr->sadb_msg_pid; +- pfkey_broadcast(out_skb, BROADCAST_ONE, sk, xp_net(xp)); ++ pfkey_broadcast(out_skb, GFP_ATOMIC, BROADCAST_ONE, sk, xp_net(xp)); + err = 0; + + out: +@@ -2695,7 +2696,7 @@ static int dump_sp(struct xfrm_policy *xp, int dir, int count, void *ptr) + out_hdr->sadb_msg_pid = pfk->dump.msg_portid; + + if (pfk->dump.skb) +- pfkey_broadcast(pfk->dump.skb, BROADCAST_ONE, ++ pfkey_broadcast(pfk->dump.skb, GFP_ATOMIC, BROADCAST_ONE, + &pfk->sk, sock_net(&pfk->sk)); + pfk->dump.skb = out_skb; + +@@ -2752,7 +2753,7 @@ static int key_notify_policy_flush(const struct km_event *c) + hdr->sadb_msg_satype = SADB_SATYPE_UNSPEC; + hdr->sadb_msg_len = (sizeof(struct sadb_msg) / sizeof(uint64_t)); + hdr->sadb_msg_reserved = 0; +- pfkey_broadcast(skb_out, BROADCAST_ALL, NULL, c->net); ++ pfkey_broadcast(skb_out, GFP_ATOMIC, BROADCAST_ALL, NULL, c->net); + return 0; + + } +@@ -2814,7 +2815,7 @@ static int pfkey_process(struct sock *sk, struct sk_buff *skb, const struct sadb + void *ext_hdrs[SADB_EXT_MAX]; + int err; + +- pfkey_broadcast(skb_clone(skb, GFP_KERNEL), ++ pfkey_broadcast(skb_clone(skb, GFP_KERNEL), GFP_KERNEL, + BROADCAST_PROMISC_ONLY, NULL, sock_net(sk)); + + memset(ext_hdrs, 0, sizeof(ext_hdrs)); +@@ -3036,7 +3037,8 @@ static int key_notify_sa_expire(struct xfrm_state *x, const struct km_event *c) + out_hdr->sadb_msg_seq = 0; + out_hdr->sadb_msg_pid = 0; + +- pfkey_broadcast(out_skb, BROADCAST_REGISTERED, NULL, xs_net(x)); ++ pfkey_broadcast(out_skb, GFP_ATOMIC, BROADCAST_REGISTERED, NULL, ++ xs_net(x)); + return 0; + } + +@@ -3226,7 +3228,8 @@ static int pfkey_send_acquire(struct xfrm_state *x, struct xfrm_tmpl *t, struct + xfrm_ctx->ctx_len); + } + +- return pfkey_broadcast(skb, BROADCAST_REGISTERED, NULL, xs_net(x)); ++ return pfkey_broadcast(skb, GFP_ATOMIC, BROADCAST_REGISTERED, NULL, ++ xs_net(x)); + } + + static struct xfrm_policy *pfkey_compile_policy(struct sock *sk, int opt, +@@ -3424,7 +3427,8 @@ static int pfkey_send_new_mapping(struct xfrm_state *x, xfrm_address_t *ipaddr, + n_port->sadb_x_nat_t_port_port = sport; + n_port->sadb_x_nat_t_port_reserved = 0; + +- return pfkey_broadcast(skb, BROADCAST_REGISTERED, NULL, xs_net(x)); ++ return pfkey_broadcast(skb, GFP_ATOMIC, BROADCAST_REGISTERED, NULL, ++ xs_net(x)); + } + + #ifdef CONFIG_NET_KEY_MIGRATE +@@ -3616,7 +3620,7 @@ static int pfkey_send_migrate(const struct xfrm_selector *sel, u8 dir, u8 type, + } + + /* broadcast migrate message to sockets */ +- pfkey_broadcast(skb, BROADCAST_ALL, NULL, &init_net); ++ pfkey_broadcast(skb, GFP_ATOMIC, BROADCAST_ALL, NULL, &init_net); + + return 0; + +diff --git a/net/sched/act_ipt.c b/net/sched/act_ipt.c +index 0915d448ba23..075b0d22f213 100644 +--- a/net/sched/act_ipt.c ++++ b/net/sched/act_ipt.c +@@ -34,6 +34,7 @@ static int ipt_init_target(struct xt_entry_target *t, char *table, unsigned int + { + struct xt_tgchk_param par; + struct xt_target *target; ++ struct ipt_entry e = {}; + int ret = 0; + + target = xt_request_find_target(AF_INET, t->u.user.name, +@@ -44,6 +45,7 @@ static int ipt_init_target(struct xt_entry_target *t, char *table, unsigned int + t->u.kernel.target = target; + memset(&par, 0, sizeof(par)); + par.table = table; ++ par.entryinfo = &e; + par.target = target; + par.targinfo = t->data; + par.hook_mask = hook; +diff --git a/net/sched/sch_sfq.c b/net/sched/sch_sfq.c +index 4431e2833e45..3f2c3eed04da 100644 +--- a/net/sched/sch_sfq.c ++++ b/net/sched/sch_sfq.c +@@ -434,6 +434,7 @@ congestion_drop: + qdisc_drop(head, sch); + + slot_queue_add(slot, skb); ++ qdisc_tree_reduce_backlog(sch, 0, delta); + return NET_XMIT_CN; + } + +@@ -465,8 +466,10 @@ enqueue: + /* Return Congestion Notification only if we dropped a packet + * from this flow. + */ +- if (qlen != slot->qlen) ++ if (qlen != slot->qlen) { ++ qdisc_tree_reduce_backlog(sch, 0, dropped - qdisc_pkt_len(skb)); + return NET_XMIT_CN; ++ } + + /* As we dropped a packet, better let upper stack know this */ + qdisc_tree_reduce_backlog(sch, 1, dropped); +diff --git a/net/sctp/ipv6.c b/net/sctp/ipv6.c +index 7527c168e471..e33e9bd4ed5a 100644 +--- a/net/sctp/ipv6.c ++++ b/net/sctp/ipv6.c +@@ -510,7 +510,9 @@ static void sctp_v6_to_addr(union sctp_addr *addr, struct in6_addr *saddr, + { + addr->sa.sa_family = AF_INET6; + addr->v6.sin6_port = port; ++ addr->v6.sin6_flowinfo = 0; + addr->v6.sin6_addr = *saddr; ++ addr->v6.sin6_scope_id = 0; + } + + /* Compare addresses exactly. +diff --git a/net/tipc/netlink_compat.c b/net/tipc/netlink_compat.c +index a0c90572d0e5..f86c6555a539 100644 +--- a/net/tipc/netlink_compat.c ++++ b/net/tipc/netlink_compat.c +@@ -258,13 +258,15 @@ static int tipc_nl_compat_dumpit(struct tipc_nl_compat_cmd_dump *cmd, + arg = nlmsg_new(0, GFP_KERNEL); + if (!arg) { + kfree_skb(msg->rep); ++ msg->rep = NULL; + return -ENOMEM; + } + + err = __tipc_nl_compat_dumpit(cmd, msg, arg); +- if (err) ++ if (err) { + kfree_skb(msg->rep); +- ++ msg->rep = NULL; ++ } + kfree_skb(arg); + + return err; +diff --git a/sound/core/control.c b/sound/core/control.c +index b4fe9b002512..bd01d492f46a 100644 +--- a/sound/core/control.c ++++ b/sound/core/control.c +@@ -1126,7 +1126,7 @@ static int snd_ctl_elem_user_tlv(struct snd_kcontrol *kcontrol, + mutex_lock(&ue->card->user_ctl_lock); + change = ue->tlv_data_size != size; + if (!change) +- change = memcmp(ue->tlv_data, new_data, size); ++ change = memcmp(ue->tlv_data, new_data, size) != 0; + kfree(ue->tlv_data); + ue->tlv_data = new_data; + ue->tlv_data_size = size; +diff --git a/sound/pci/hda/patch_conexant.c b/sound/pci/hda/patch_conexant.c +index 46f7b023f69c..ac5de4365e15 100644 +--- a/sound/pci/hda/patch_conexant.c ++++ b/sound/pci/hda/patch_conexant.c +@@ -854,6 +854,7 @@ static const struct snd_pci_quirk cxt5066_fixups[] = { + SND_PCI_QUIRK(0x17aa, 0x390b, "Lenovo G50-80", CXT_FIXUP_STEREO_DMIC), + SND_PCI_QUIRK(0x17aa, 0x3975, "Lenovo U300s", CXT_FIXUP_STEREO_DMIC), + SND_PCI_QUIRK(0x17aa, 0x3977, "Lenovo IdeaPad U310", CXT_FIXUP_STEREO_DMIC), ++ SND_PCI_QUIRK(0x17aa, 0x3978, "Lenovo G50-70", CXT_FIXUP_STEREO_DMIC), + SND_PCI_QUIRK(0x17aa, 0x397b, "Lenovo S205", CXT_FIXUP_STEREO_DMIC), + SND_PCI_QUIRK_VENDOR(0x17aa, "Thinkpad", CXT_FIXUP_THINKPAD_ACPI), + SND_PCI_QUIRK(0x1c06, 0x2011, "Lemote A1004", CXT_PINCFG_LEMOTE_A1004), +diff --git a/sound/soc/generic/simple-card.c b/sound/soc/generic/simple-card.c +index 54c33204541f..ff6fcd9f92f7 100644 +--- a/sound/soc/generic/simple-card.c ++++ b/sound/soc/generic/simple-card.c +@@ -100,7 +100,7 @@ static int asoc_simple_card_hw_params(struct snd_pcm_substream *substream, + if (ret && ret != -ENOTSUPP) + goto err; + } +- ++ return 0; + err: + return ret; + } +diff --git a/sound/soc/sh/rcar/adg.c b/sound/soc/sh/rcar/adg.c +index 2a5b3a293cd2..b123734f9fbd 100644 +--- a/sound/soc/sh/rcar/adg.c ++++ b/sound/soc/sh/rcar/adg.c +@@ -437,7 +437,7 @@ static void rsnd_adg_get_clkout(struct rsnd_priv *priv, + struct device *dev = rsnd_priv_to_dev(priv); + struct device_node *np = dev->of_node; + u32 ckr, rbgx, rbga, rbgb; +- u32 rate, req_rate, div; ++ u32 rate, req_rate = 0, div; + uint32_t count = 0; + unsigned long req_48kHz_rate, req_441kHz_rate; + int i; +diff --git a/sound/soc/sh/rcar/core.c b/sound/soc/sh/rcar/core.c +index deed48ef28b8..362446c36c9e 100644 +--- a/sound/soc/sh/rcar/core.c ++++ b/sound/soc/sh/rcar/core.c +@@ -192,19 +192,16 @@ void rsnd_mod_interrupt(struct rsnd_mod *mod, + struct rsnd_priv *priv = rsnd_mod_to_priv(mod); + struct rsnd_dai_stream *io; + struct rsnd_dai *rdai; +- int i, j; +- +- for_each_rsnd_dai(rdai, priv, j) { ++ int i; + +- for (i = 0; i < RSND_MOD_MAX; i++) { +- io = &rdai->playback; +- if (mod == io->mod[i]) +- callback(mod, io); ++ for_each_rsnd_dai(rdai, priv, i) { ++ io = &rdai->playback; ++ if (mod == io->mod[mod->type]) ++ callback(mod, io); + +- io = &rdai->capture; +- if (mod == io->mod[i]) +- callback(mod, io); +- } ++ io = &rdai->capture; ++ if (mod == io->mod[mod->type]) ++ callback(mod, io); + } + } + +@@ -1019,7 +1016,7 @@ static int rsnd_kctrl_put(struct snd_kcontrol *kctrl, + } + } + +- if (change) ++ if (change && cfg->update) + cfg->update(cfg->io, mod); + + return change; +diff --git a/sound/soc/sh/rcar/src.c b/sound/soc/sh/rcar/src.c +index 68b439ed22d7..460d29cbaaa5 100644 +--- a/sound/soc/sh/rcar/src.c ++++ b/sound/soc/sh/rcar/src.c +@@ -691,13 +691,27 @@ static int _rsnd_src_stop_gen2(struct rsnd_mod *mod) + { + rsnd_src_irq_disable_gen2(mod); + +- rsnd_mod_write(mod, SRC_CTRL, 0); ++ /* ++ * stop SRC output only ++ * see rsnd_src_quit_gen2 ++ */ ++ rsnd_mod_write(mod, SRC_CTRL, 0x01); + + rsnd_src_error_record_gen2(mod); + + return rsnd_src_stop(mod); + } + ++static int rsnd_src_quit_gen2(struct rsnd_mod *mod, ++ struct rsnd_dai_stream *io, ++ struct rsnd_priv *priv) ++{ ++ /* stop both out/in */ ++ rsnd_mod_write(mod, SRC_CTRL, 0); ++ ++ return 0; ++} ++ + static void __rsnd_src_interrupt_gen2(struct rsnd_mod *mod, + struct rsnd_dai_stream *io) + { +@@ -971,7 +985,7 @@ static struct rsnd_mod_ops rsnd_src_gen2_ops = { + .probe = rsnd_src_probe_gen2, + .remove = rsnd_src_remove_gen2, + .init = rsnd_src_init_gen2, +- .quit = rsnd_src_quit, ++ .quit = rsnd_src_quit_gen2, + .start = rsnd_src_start_gen2, + .stop = rsnd_src_stop_gen2, + .hw_params = rsnd_src_hw_params, +diff --git a/sound/soc/sh/rcar/ssi.c b/sound/soc/sh/rcar/ssi.c +index 1427ec21bd7e..c62a2947ac14 100644 +--- a/sound/soc/sh/rcar/ssi.c ++++ b/sound/soc/sh/rcar/ssi.c +@@ -39,6 +39,7 @@ + #define SCKP (1 << 13) /* Serial Bit Clock Polarity */ + #define SWSP (1 << 12) /* Serial WS Polarity */ + #define SDTA (1 << 10) /* Serial Data Alignment */ ++#define PDTA (1 << 9) /* Parallel Data Alignment */ + #define DEL (1 << 8) /* Serial Data Delay */ + #define CKDV(v) (v << 4) /* Serial Clock Division Ratio */ + #define TRMD (1 << 1) /* Transmit/Receive Mode Select */ +@@ -286,7 +287,7 @@ static int rsnd_ssi_init(struct rsnd_mod *mod, + struct snd_pcm_runtime *runtime = rsnd_io_to_runtime(io); + u32 cr; + +- cr = FORCE; ++ cr = FORCE | PDTA; + + /* + * always use 32bit system word for easy clock calculation.
