commit: 5952a88ca812123bc877a705a09eca931b0da0be Author: Mike Pagano <mpagano <AT> gentoo <DOT> org> AuthorDate: Wed Sep 26 10:42:40 2018 +0000 Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org> CommitDate: Wed Sep 26 10:42:40 2018 +0000 URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=5952a88c
Linux patch 4.9.129 0000_README | 4 + 1128_linux-4.9.129.patch | 2979 ++++++++++++++++++++++++++++++++++++++++++++++ 2 files changed, 2983 insertions(+) diff --git a/0000_README b/0000_README index 582011b..cf72302 100644 --- a/0000_README +++ b/0000_README @@ -555,6 +555,10 @@ Patch: 1127_linux-4.9.128.patch From: http://www.kernel.org Desc: Linux 4.9.128 +Patch: 1128_linux-4.9.129.patch +From: http://www.kernel.org +Desc: Linux 4.9.129 + Patch: 1500_XATTR_USER_PREFIX.patch From: https://bugs.gentoo.org/show_bug.cgi?id=470644 Desc: Support for namespace user.pax.* on tmpfs. diff --git a/1128_linux-4.9.129.patch b/1128_linux-4.9.129.patch new file mode 100644 index 0000000..4815392 --- /dev/null +++ b/1128_linux-4.9.129.patch @@ -0,0 +1,2979 @@ +diff --git a/Makefile b/Makefile +index 1892bdb6a760..3f3c340374c5 100644 +--- a/Makefile ++++ b/Makefile +@@ -1,6 +1,6 @@ + VERSION = 4 + PATCHLEVEL = 9 +-SUBLEVEL = 128 ++SUBLEVEL = 129 + EXTRAVERSION = + NAME = Roaring Lionus + +diff --git a/arch/arm/boot/dts/qcom-msm8974-lge-nexus5-hammerhead.dts b/arch/arm/boot/dts/qcom-msm8974-lge-nexus5-hammerhead.dts +index c0fb4a698c56..386b93c06a8c 100644 +--- a/arch/arm/boot/dts/qcom-msm8974-lge-nexus5-hammerhead.dts ++++ b/arch/arm/boot/dts/qcom-msm8974-lge-nexus5-hammerhead.dts +@@ -188,6 +188,8 @@ + regulator-max-microvolt = <2950000>; + + regulator-boot-on; ++ regulator-system-load = <200000>; ++ regulator-allow-set-load; + }; + + l21 { +diff --git a/arch/arm/mach-exynos/suspend.c b/arch/arm/mach-exynos/suspend.c +index 06332f626565..3e1430a886b2 100644 +--- a/arch/arm/mach-exynos/suspend.c ++++ b/arch/arm/mach-exynos/suspend.c +@@ -252,6 +252,7 @@ static int __init exynos_pmu_irq_init(struct device_node *node, + NULL); + if (!domain) { + iounmap(pmu_base_addr); ++ pmu_base_addr = NULL; + return -ENOMEM; + } + +diff --git a/arch/arm/mach-hisi/hotplug.c b/arch/arm/mach-hisi/hotplug.c +index a129aae72602..909bb2493781 100644 +--- a/arch/arm/mach-hisi/hotplug.c ++++ b/arch/arm/mach-hisi/hotplug.c +@@ -148,13 +148,20 @@ static int hi3xxx_hotplug_init(void) + struct device_node *node; + + node = of_find_compatible_node(NULL, NULL, "hisilicon,sysctrl"); +- if (node) { +- ctrl_base = of_iomap(node, 0); +- id = HI3620_CTRL; +- return 0; ++ if (!node) { ++ id = ERROR_CTRL; ++ return -ENOENT; + } +- id = ERROR_CTRL; +- return -ENOENT; ++ ++ ctrl_base = of_iomap(node, 0); ++ of_node_put(node); ++ if (!ctrl_base) { ++ id = ERROR_CTRL; ++ return -ENOMEM; ++ } ++ ++ id = HI3620_CTRL; ++ return 0; + } + + void hi3xxx_set_cpu(int cpu, bool enable) +@@ -173,11 +180,15 @@ static bool hix5hd2_hotplug_init(void) + struct device_node *np; + + np = of_find_compatible_node(NULL, NULL, "hisilicon,cpuctrl"); +- if (np) { +- ctrl_base = of_iomap(np, 0); +- return true; +- } +- return false; ++ if (!np) ++ return false; ++ ++ ctrl_base = of_iomap(np, 0); ++ of_node_put(np); ++ if (!ctrl_base) ++ return false; ++ ++ return true; + } + + void hix5hd2_set_cpu(int cpu, bool enable) +@@ -219,10 +230,10 @@ void hip01_set_cpu(int cpu, bool enable) + + if (!ctrl_base) { + np = of_find_compatible_node(NULL, NULL, "hisilicon,hip01-sysctrl"); +- if (np) +- ctrl_base = of_iomap(np, 0); +- else +- BUG(); ++ BUG_ON(!np); ++ ctrl_base = of_iomap(np, 0); ++ of_node_put(np); ++ BUG_ON(!ctrl_base); + } + + if (enable) { +diff --git a/arch/arm64/boot/dts/qcom/apq8016-sbc.dtsi b/arch/arm64/boot/dts/qcom/apq8016-sbc.dtsi +index bb062b547110..601be6127628 100644 +--- a/arch/arm64/boot/dts/qcom/apq8016-sbc.dtsi ++++ b/arch/arm64/boot/dts/qcom/apq8016-sbc.dtsi +@@ -170,7 +170,7 @@ + led@6 { + label = "apq8016-sbc:blue:bt"; + gpios = <&pm8916_mpps 3 GPIO_ACTIVE_HIGH>; +- linux,default-trigger = "bt"; ++ linux,default-trigger = "bluetooth-power"; + default-state = "off"; + }; + }; +diff --git a/arch/mips/ath79/setup.c b/arch/mips/ath79/setup.c +index f206dafbb0a3..26a058d58d37 100644 +--- a/arch/mips/ath79/setup.c ++++ b/arch/mips/ath79/setup.c +@@ -40,6 +40,7 @@ static char ath79_sys_type[ATH79_SYS_TYPE_LEN]; + + static void ath79_restart(char *command) + { ++ local_irq_disable(); + ath79_device_reset_set(AR71XX_RESET_FULL_CHIP); + for (;;) + if (cpu_wait) +diff --git a/arch/mips/include/asm/mach-ath79/ath79.h b/arch/mips/include/asm/mach-ath79/ath79.h +index 441faa92c3cd..6e6c0fead776 100644 +--- a/arch/mips/include/asm/mach-ath79/ath79.h ++++ b/arch/mips/include/asm/mach-ath79/ath79.h +@@ -134,6 +134,7 @@ static inline u32 ath79_pll_rr(unsigned reg) + static inline void ath79_reset_wr(unsigned reg, u32 val) + { + __raw_writel(val, ath79_reset_base + reg); ++ (void) __raw_readl(ath79_reset_base + reg); /* flush */ + } + + static inline u32 ath79_reset_rr(unsigned reg) +diff --git a/arch/mips/jz4740/Platform b/arch/mips/jz4740/Platform +index 28448d358c10..a2a5a85ea1f9 100644 +--- a/arch/mips/jz4740/Platform ++++ b/arch/mips/jz4740/Platform +@@ -1,4 +1,4 @@ + platform-$(CONFIG_MACH_INGENIC) += jz4740/ + cflags-$(CONFIG_MACH_INGENIC) += -I$(srctree)/arch/mips/include/asm/mach-jz4740 + load-$(CONFIG_MACH_INGENIC) += 0xffffffff80010000 +-zload-$(CONFIG_MACH_INGENIC) += 0xffffffff80600000 ++zload-$(CONFIG_MACH_INGENIC) += 0xffffffff81000000 +diff --git a/arch/mips/kernel/vdso.c b/arch/mips/kernel/vdso.c +index f9dbfb14af33..e88344e3d508 100644 +--- a/arch/mips/kernel/vdso.c ++++ b/arch/mips/kernel/vdso.c +@@ -14,12 +14,14 @@ + #include <linux/init.h> + #include <linux/ioport.h> + #include <linux/irqchip/mips-gic.h> ++#include <linux/kernel.h> + #include <linux/mm.h> + #include <linux/sched.h> + #include <linux/slab.h> + #include <linux/timekeeper_internal.h> + + #include <asm/abi.h> ++#include <asm/page.h> + #include <asm/vdso.h> + + /* Kernel-provided data used by the VDSO. */ +@@ -129,12 +131,30 @@ int arch_setup_additional_pages(struct linux_binprm *bprm, int uses_interp) + vvar_size = gic_size + PAGE_SIZE; + size = vvar_size + image->size; + ++ /* ++ * Find a region that's large enough for us to perform the ++ * colour-matching alignment below. ++ */ ++ if (cpu_has_dc_aliases) ++ size += shm_align_mask + 1; ++ + base = get_unmapped_area(NULL, 0, size, 0, 0); + if (IS_ERR_VALUE(base)) { + ret = base; + goto out; + } + ++ /* ++ * If we suffer from dcache aliasing, ensure that the VDSO data page ++ * mapping is coloured the same as the kernel's mapping of that memory. ++ * This ensures that when the kernel updates the VDSO data userland ++ * will observe it without requiring cache invalidations. ++ */ ++ if (cpu_has_dc_aliases) { ++ base = __ALIGN_MASK(base, shm_align_mask); ++ base += ((unsigned long)&vdso_data - gic_size) & shm_align_mask; ++ } ++ + data_addr = base + gic_size; + vdso_addr = data_addr + PAGE_SIZE; + +diff --git a/arch/mips/loongson64/common/cs5536/cs5536_ohci.c b/arch/mips/loongson64/common/cs5536/cs5536_ohci.c +index f7c905e50dc4..92dc6bafc127 100644 +--- a/arch/mips/loongson64/common/cs5536/cs5536_ohci.c ++++ b/arch/mips/loongson64/common/cs5536/cs5536_ohci.c +@@ -138,7 +138,7 @@ u32 pci_ohci_read_reg(int reg) + break; + case PCI_OHCI_INT_REG: + _rdmsr(DIVIL_MSR_REG(PIC_YSEL_LOW), &hi, &lo); +- if ((lo & 0x00000f00) == CS5536_USB_INTR) ++ if (((lo >> PIC_YSEL_LOW_USB_SHIFT) & 0xf) == CS5536_USB_INTR) + conf_data = 1; + break; + default: +diff --git a/arch/powerpc/platforms/powernv/opal.c b/arch/powerpc/platforms/powernv/opal.c +index 6c9a65b52e63..7fb61ebc99a2 100644 +--- a/arch/powerpc/platforms/powernv/opal.c ++++ b/arch/powerpc/platforms/powernv/opal.c +@@ -369,7 +369,7 @@ int opal_put_chars(uint32_t vtermno, const char *data, int total_len) + /* Closed or other error drop */ + if (rc != OPAL_SUCCESS && rc != OPAL_BUSY && + rc != OPAL_BUSY_EVENT) { +- written = total_len; ++ written += total_len; + break; + } + if (rc == OPAL_SUCCESS) { +diff --git a/crypto/api.c b/crypto/api.c +index bbc147cb5dec..abf53e67e3d8 100644 +--- a/crypto/api.c ++++ b/crypto/api.c +@@ -215,7 +215,7 @@ struct crypto_alg *crypto_larval_lookup(const char *name, u32 type, u32 mask) + type &= mask; + + alg = crypto_alg_lookup(name, type, mask); +- if (!alg) { ++ if (!alg && !(mask & CRYPTO_NOLOAD)) { + request_module("crypto-%s", name); + + if (!((type ^ CRYPTO_ALG_NEED_FALLBACK) & mask & +diff --git a/drivers/base/core.c b/drivers/base/core.c +index a0ed957d738f..f43caad30e1e 100644 +--- a/drivers/base/core.c ++++ b/drivers/base/core.c +@@ -2072,6 +2072,9 @@ void device_shutdown(void) + { + struct device *dev, *parent; + ++ wait_for_device_probe(); ++ device_block_probing(); ++ + spin_lock(&devices_kset->list_lock); + /* + * Walk the devices list backward, shutting down each in turn. +diff --git a/drivers/clk/clk-fixed-factor.c b/drivers/clk/clk-fixed-factor.c +index a5d402de5584..20724abd38bd 100644 +--- a/drivers/clk/clk-fixed-factor.c ++++ b/drivers/clk/clk-fixed-factor.c +@@ -177,8 +177,15 @@ static struct clk *_of_fixed_factor_clk_setup(struct device_node *node) + + clk = clk_register_fixed_factor(NULL, clk_name, parent_name, flags, + mult, div); +- if (IS_ERR(clk)) ++ if (IS_ERR(clk)) { ++ /* ++ * If parent clock is not registered, registration would fail. ++ * Clear OF_POPULATED flag so that clock registration can be ++ * attempted again from probe function. ++ */ ++ of_node_clear_flag(node, OF_POPULATED); + return clk; ++ } + + ret = of_clk_add_provider(node, of_clk_src_simple_get, clk); + if (ret) { +diff --git a/drivers/clk/imx/clk-imx6ul.c b/drivers/clk/imx/clk-imx6ul.c +index d1d7787ce211..db2901646403 100644 +--- a/drivers/clk/imx/clk-imx6ul.c ++++ b/drivers/clk/imx/clk-imx6ul.c +@@ -120,6 +120,7 @@ static void __init imx6ul_clocks_init(struct device_node *ccm_node) + + np = of_find_compatible_node(NULL, NULL, "fsl,imx6ul-anatop"); + base = of_iomap(np, 0); ++ of_node_put(np); + WARN_ON(!base); + + clks[IMX6UL_PLL1_BYPASS_SRC] = imx_clk_mux("pll1_bypass_src", base + 0x00, 14, 1, pll_bypass_src_sels, ARRAY_SIZE(pll_bypass_src_sels)); +diff --git a/drivers/crypto/sahara.c b/drivers/crypto/sahara.c +index 0c49956ee0ce..4d0ec7bb3bc9 100644 +--- a/drivers/crypto/sahara.c ++++ b/drivers/crypto/sahara.c +@@ -1352,7 +1352,7 @@ err_sha_v4_algs: + + err_sha_v3_algs: + for (j = 0; j < k; j++) +- crypto_unregister_ahash(&sha_v4_algs[j]); ++ crypto_unregister_ahash(&sha_v3_algs[j]); + + err_aes_algs: + for (j = 0; j < i; j++) +@@ -1368,7 +1368,7 @@ static void sahara_unregister_algs(struct sahara_dev *dev) + for (i = 0; i < ARRAY_SIZE(aes_algs); i++) + crypto_unregister_alg(&aes_algs[i]); + +- for (i = 0; i < ARRAY_SIZE(sha_v4_algs); i++) ++ for (i = 0; i < ARRAY_SIZE(sha_v3_algs); i++) + crypto_unregister_ahash(&sha_v3_algs[i]); + + if (dev->version > SAHARA_VERSION_3) +diff --git a/drivers/dma/mv_xor_v2.c b/drivers/dma/mv_xor_v2.c +index 71866646ffef..be1f5c26fae8 100644 +--- a/drivers/dma/mv_xor_v2.c ++++ b/drivers/dma/mv_xor_v2.c +@@ -844,6 +844,8 @@ static int mv_xor_v2_remove(struct platform_device *pdev) + + platform_msi_domain_free_irqs(&pdev->dev); + ++ tasklet_kill(&xor_dev->irq_tasklet); ++ + clk_disable_unprepare(xor_dev->clk); + + return 0; +diff --git a/drivers/dma/pl330.c b/drivers/dma/pl330.c +index b9dad4e40bb8..6d7e3cd4aba4 100644 +--- a/drivers/dma/pl330.c ++++ b/drivers/dma/pl330.c +@@ -2167,13 +2167,14 @@ static int pl330_terminate_all(struct dma_chan *chan) + + pm_runtime_get_sync(pl330->ddma.dev); + spin_lock_irqsave(&pch->lock, flags); ++ + spin_lock(&pl330->lock); + _stop(pch->thread); +- spin_unlock(&pl330->lock); +- + pch->thread->req[0].desc = NULL; + pch->thread->req[1].desc = NULL; + pch->thread->req_running = -1; ++ spin_unlock(&pl330->lock); ++ + power_down = pch->active; + pch->active = false; + +diff --git a/drivers/firmware/efi/arm-init.c b/drivers/firmware/efi/arm-init.c +index 8efe13075c92..1d1c9693ebfb 100644 +--- a/drivers/firmware/efi/arm-init.c ++++ b/drivers/firmware/efi/arm-init.c +@@ -250,7 +250,6 @@ void __init efi_init(void) + reserve_regions(); + efi_memattr_init(); + efi_esrt_init(); +- efi_memmap_unmap(); + + memblock_reserve(params.mmap & PAGE_MASK, + PAGE_ALIGN(params.mmap_size + +diff --git a/drivers/firmware/efi/arm-runtime.c b/drivers/firmware/efi/arm-runtime.c +index 6bdf39e1e385..4d788e0debfe 100644 +--- a/drivers/firmware/efi/arm-runtime.c ++++ b/drivers/firmware/efi/arm-runtime.c +@@ -118,11 +118,13 @@ static int __init arm_enable_runtime_services(void) + { + u64 mapsize; + +- if (!efi_enabled(EFI_BOOT)) { ++ if (!efi_enabled(EFI_BOOT) || !efi_enabled(EFI_MEMMAP)) { + pr_info("EFI services will not be available.\n"); + return 0; + } + ++ efi_memmap_unmap(); ++ + if (efi_runtime_disabled()) { + pr_info("EFI runtime services will be disabled.\n"); + return 0; +diff --git a/drivers/firmware/efi/esrt.c b/drivers/firmware/efi/esrt.c +index 311c9d0e8cbb..241dd7c63d2c 100644 +--- a/drivers/firmware/efi/esrt.c ++++ b/drivers/firmware/efi/esrt.c +@@ -333,7 +333,8 @@ void __init efi_esrt_init(void) + + end = esrt_data + size; + pr_info("Reserving ESRT space from %pa to %pa.\n", &esrt_data, &end); +- efi_mem_reserve(esrt_data, esrt_data_size); ++ if (md.type == EFI_BOOT_SERVICES_DATA) ++ efi_mem_reserve(esrt_data, esrt_data_size); + + pr_debug("esrt-init: loaded.\n"); + err_memunmap: +diff --git a/drivers/gpio/gpio-pxa.c b/drivers/gpio/gpio-pxa.c +index 76ac906b4d78..7a6305884f97 100644 +--- a/drivers/gpio/gpio-pxa.c ++++ b/drivers/gpio/gpio-pxa.c +@@ -660,6 +660,8 @@ static int pxa_gpio_probe(struct platform_device *pdev) + pchip->irq0 = irq0; + pchip->irq1 = irq1; + res = platform_get_resource(pdev, IORESOURCE_MEM, 0); ++ if (!res) ++ return -EINVAL; + gpio_reg_base = devm_ioremap(&pdev->dev, res->start, + resource_size(res)); + if (!gpio_reg_base) +diff --git a/drivers/gpio/gpiolib.h b/drivers/gpio/gpiolib.h +index 346fbda39220..6c4d72872309 100644 +--- a/drivers/gpio/gpiolib.h ++++ b/drivers/gpio/gpiolib.h +@@ -85,7 +85,7 @@ struct acpi_gpio_info { + }; + + /* gpio suffixes used for ACPI and device tree lookup */ +-static const char * const gpio_suffixes[] = { "gpios", "gpio" }; ++static __maybe_unused const char * const gpio_suffixes[] = { "gpios", "gpio" }; + + #ifdef CONFIG_OF_GPIO + struct gpio_desc *of_find_gpio(struct device *dev, +diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_process.c b/drivers/gpu/drm/amd/amdkfd/kfd_process.c +index 171480bb95d0..6e7eb76189f9 100644 +--- a/drivers/gpu/drm/amd/amdkfd/kfd_process.c ++++ b/drivers/gpu/drm/amd/amdkfd/kfd_process.c +@@ -124,6 +124,8 @@ struct kfd_process *kfd_get_process(const struct task_struct *thread) + return ERR_PTR(-EINVAL); + + process = find_process(thread); ++ if (!process) ++ return ERR_PTR(-EINVAL); + + return process; + } +diff --git a/drivers/gpu/drm/nouveau/nvkm/engine/device/tegra.c b/drivers/gpu/drm/nouveau/nvkm/engine/device/tegra.c +index 9b638bd905ff..d370bf8bc409 100644 +--- a/drivers/gpu/drm/nouveau/nvkm/engine/device/tegra.c ++++ b/drivers/gpu/drm/nouveau/nvkm/engine/device/tegra.c +@@ -23,6 +23,10 @@ + #ifdef CONFIG_NOUVEAU_PLATFORM_DRIVER + #include "priv.h" + ++#if IS_ENABLED(CONFIG_ARM_DMA_USE_IOMMU) ++#include <asm/dma-iommu.h> ++#endif ++ + static int + nvkm_device_tegra_power_up(struct nvkm_device_tegra *tdev) + { +@@ -95,6 +99,15 @@ nvkm_device_tegra_probe_iommu(struct nvkm_device_tegra *tdev) + unsigned long pgsize_bitmap; + int ret; + ++#if IS_ENABLED(CONFIG_ARM_DMA_USE_IOMMU) ++ if (dev->archdata.mapping) { ++ struct dma_iommu_mapping *mapping = to_dma_iommu_mapping(dev); ++ ++ arm_iommu_detach_device(dev); ++ arm_iommu_release_mapping(mapping); ++ } ++#endif ++ + if (!tdev->func->iommu_bit) + return; + +diff --git a/drivers/gpu/drm/panel/panel-samsung-s6e8aa0.c b/drivers/gpu/drm/panel/panel-samsung-s6e8aa0.c +index a188a3959f1a..6ad827b93ae1 100644 +--- a/drivers/gpu/drm/panel/panel-samsung-s6e8aa0.c ++++ b/drivers/gpu/drm/panel/panel-samsung-s6e8aa0.c +@@ -823,7 +823,7 @@ static void s6e8aa0_read_mtp_id(struct s6e8aa0 *ctx) + int ret, i; + + ret = s6e8aa0_dcs_read(ctx, 0xd1, id, ARRAY_SIZE(id)); +- if (ret < ARRAY_SIZE(id) || id[0] == 0x00) { ++ if (ret < 0 || ret < ARRAY_SIZE(id) || id[0] == 0x00) { + dev_err(ctx->dev, "read id failed\n"); + ctx->error = -EIO; + return; +diff --git a/drivers/gpu/ipu-v3/ipu-csi.c b/drivers/gpu/ipu-v3/ipu-csi.c +index d6e5ded24418..8774bf17c853 100644 +--- a/drivers/gpu/ipu-v3/ipu-csi.c ++++ b/drivers/gpu/ipu-v3/ipu-csi.c +@@ -316,13 +316,17 @@ static int mbus_code_to_bus_cfg(struct ipu_csi_bus_config *cfg, u32 mbus_code) + /* + * Fill a CSI bus config struct from mbus_config and mbus_framefmt. + */ +-static void fill_csi_bus_cfg(struct ipu_csi_bus_config *csicfg, ++static int fill_csi_bus_cfg(struct ipu_csi_bus_config *csicfg, + struct v4l2_mbus_config *mbus_cfg, + struct v4l2_mbus_framefmt *mbus_fmt) + { ++ int ret; ++ + memset(csicfg, 0, sizeof(*csicfg)); + +- mbus_code_to_bus_cfg(csicfg, mbus_fmt->code); ++ ret = mbus_code_to_bus_cfg(csicfg, mbus_fmt->code); ++ if (ret < 0) ++ return ret; + + switch (mbus_cfg->type) { + case V4L2_MBUS_PARALLEL: +@@ -353,6 +357,8 @@ static void fill_csi_bus_cfg(struct ipu_csi_bus_config *csicfg, + /* will never get here, keep compiler quiet */ + break; + } ++ ++ return 0; + } + + int ipu_csi_init_interface(struct ipu_csi *csi, +@@ -362,8 +368,11 @@ int ipu_csi_init_interface(struct ipu_csi *csi, + struct ipu_csi_bus_config cfg; + unsigned long flags; + u32 width, height, data = 0; ++ int ret; + +- fill_csi_bus_cfg(&cfg, mbus_cfg, mbus_fmt); ++ ret = fill_csi_bus_cfg(&cfg, mbus_cfg, mbus_fmt); ++ if (ret < 0) ++ return ret; + + /* set default sensor frame width and height */ + width = mbus_fmt->width; +@@ -567,11 +576,14 @@ int ipu_csi_set_mipi_datatype(struct ipu_csi *csi, u32 vc, + struct ipu_csi_bus_config cfg; + unsigned long flags; + u32 temp; ++ int ret; + + if (vc > 3) + return -EINVAL; + +- mbus_code_to_bus_cfg(&cfg, mbus_fmt->code); ++ ret = mbus_code_to_bus_cfg(&cfg, mbus_fmt->code); ++ if (ret < 0) ++ return ret; + + spin_lock_irqsave(&csi->lock, flags); + +diff --git a/drivers/hwtracing/coresight/coresight-tpiu.c b/drivers/hwtracing/coresight/coresight-tpiu.c +index ff579a7c6d00..7473c6ea99e9 100644 +--- a/drivers/hwtracing/coresight/coresight-tpiu.c ++++ b/drivers/hwtracing/coresight/coresight-tpiu.c +@@ -47,8 +47,9 @@ + + /** register definition **/ + /* FFSR - 0x300 */ +-#define FFSR_FT_STOPPED BIT(1) ++#define FFSR_FT_STOPPED_BIT 1 + /* FFCR - 0x304 */ ++#define FFCR_FON_MAN_BIT 6 + #define FFCR_FON_MAN BIT(6) + #define FFCR_STOP_FI BIT(12) + +@@ -93,9 +94,9 @@ static void tpiu_disable_hw(struct tpiu_drvdata *drvdata) + /* Generate manual flush */ + writel_relaxed(FFCR_STOP_FI | FFCR_FON_MAN, drvdata->base + TPIU_FFCR); + /* Wait for flush to complete */ +- coresight_timeout(drvdata->base, TPIU_FFCR, FFCR_FON_MAN, 0); ++ coresight_timeout(drvdata->base, TPIU_FFCR, FFCR_FON_MAN_BIT, 0); + /* Wait for formatter to stop */ +- coresight_timeout(drvdata->base, TPIU_FFSR, FFSR_FT_STOPPED, 1); ++ coresight_timeout(drvdata->base, TPIU_FFSR, FFSR_FT_STOPPED_BIT, 1); + + CS_LOCK(drvdata->base); + } +diff --git a/drivers/hwtracing/coresight/coresight.c b/drivers/hwtracing/coresight/coresight.c +index 4383324ec01c..398e44a9ec45 100644 +--- a/drivers/hwtracing/coresight/coresight.c ++++ b/drivers/hwtracing/coresight/coresight.c +@@ -107,7 +107,7 @@ static int coresight_find_link_inport(struct coresight_device *csdev, + dev_err(&csdev->dev, "couldn't find inport, parent: %s, child: %s\n", + dev_name(&parent->dev), dev_name(&csdev->dev)); + +- return 0; ++ return -ENODEV; + } + + static int coresight_find_link_outport(struct coresight_device *csdev, +@@ -125,7 +125,7 @@ static int coresight_find_link_outport(struct coresight_device *csdev, + dev_err(&csdev->dev, "couldn't find outport, parent: %s, child: %s\n", + dev_name(&csdev->dev), dev_name(&child->dev)); + +- return 0; ++ return -ENODEV; + } + + static int coresight_enable_sink(struct coresight_device *csdev, u32 mode) +@@ -178,6 +178,9 @@ static int coresight_enable_link(struct coresight_device *csdev, + else + refport = 0; + ++ if (refport < 0) ++ return refport; ++ + if (atomic_inc_return(&csdev->refcnt[refport]) == 1) { + if (link_ops(csdev)->enable) { + ret = link_ops(csdev)->enable(csdev, inport, outport); +diff --git a/drivers/infiniband/core/cma.c b/drivers/infiniband/core/cma.c +index 575afba1056a..85d4ef319c90 100644 +--- a/drivers/infiniband/core/cma.c ++++ b/drivers/infiniband/core/cma.c +@@ -673,6 +673,7 @@ static int cma_resolve_ib_dev(struct rdma_id_private *id_priv) + dgid = (union ib_gid *) &addr->sib_addr; + pkey = ntohs(addr->sib_pkey); + ++ mutex_lock(&lock); + list_for_each_entry(cur_dev, &dev_list, list) { + for (p = 1; p <= cur_dev->device->phys_port_cnt; ++p) { + if (!rdma_cap_af_ib(cur_dev->device, p)) +@@ -696,18 +697,19 @@ static int cma_resolve_ib_dev(struct rdma_id_private *id_priv) + cma_dev = cur_dev; + sgid = gid; + id_priv->id.port_num = p; ++ goto found; + } + } + } + } +- +- if (!cma_dev) +- return -ENODEV; ++ mutex_unlock(&lock); ++ return -ENODEV; + + found: + cma_attach_to_dev(id_priv, cma_dev); +- addr = (struct sockaddr_ib *) cma_src_addr(id_priv); +- memcpy(&addr->sib_addr, &sgid, sizeof sgid); ++ mutex_unlock(&lock); ++ addr = (struct sockaddr_ib *)cma_src_addr(id_priv); ++ memcpy(&addr->sib_addr, &sgid, sizeof(sgid)); + cma_translate_ib(addr, &id_priv->id.route.addr.dev_addr); + return 0; + } +diff --git a/drivers/infiniband/sw/rxe/rxe_recv.c b/drivers/infiniband/sw/rxe/rxe_recv.c +index 46f062842a9a..db6bb026ae90 100644 +--- a/drivers/infiniband/sw/rxe/rxe_recv.c ++++ b/drivers/infiniband/sw/rxe/rxe_recv.c +@@ -225,9 +225,14 @@ static int hdr_check(struct rxe_pkt_info *pkt) + goto err1; + } + ++ if (unlikely(qpn == 0)) { ++ pr_warn_once("QP 0 not supported"); ++ goto err1; ++ } ++ + if (qpn != IB_MULTICAST_QPN) { +- index = (qpn == 0) ? port->qp_smi_index : +- ((qpn == 1) ? port->qp_gsi_index : qpn); ++ index = (qpn == 1) ? port->qp_gsi_index : qpn; ++ + qp = rxe_pool_get_index(&rxe->qp_pool, index); + if (unlikely(!qp)) { + pr_warn_ratelimited("no qp matches qpn 0x%x\n", qpn); +diff --git a/drivers/infiniband/ulp/ipoib/ipoib_cm.c b/drivers/infiniband/ulp/ipoib/ipoib_cm.c +index 75761667be59..ad9b486ca7ea 100644 +--- a/drivers/infiniband/ulp/ipoib/ipoib_cm.c ++++ b/drivers/infiniband/ulp/ipoib/ipoib_cm.c +@@ -1009,12 +1009,14 @@ static int ipoib_cm_rep_handler(struct ib_cm_id *cm_id, struct ib_cm_event *even + + skb_queue_head_init(&skqueue); + ++ netif_tx_lock_bh(p->dev); + spin_lock_irq(&priv->lock); + set_bit(IPOIB_FLAG_OPER_UP, &p->flags); + if (p->neigh) + while ((skb = __skb_dequeue(&p->neigh->queue))) + __skb_queue_tail(&skqueue, skb); + spin_unlock_irq(&priv->lock); ++ netif_tx_unlock_bh(p->dev); + + while ((skb = __skb_dequeue(&skqueue))) { + skb->dev = p->dev; +diff --git a/drivers/input/touchscreen/rohm_bu21023.c b/drivers/input/touchscreen/rohm_bu21023.c +index 611156a2ef80..be29984c0e4c 100644 +--- a/drivers/input/touchscreen/rohm_bu21023.c ++++ b/drivers/input/touchscreen/rohm_bu21023.c +@@ -304,7 +304,7 @@ static int rohm_i2c_burst_read(struct i2c_client *client, u8 start, void *buf, + msg[1].len = len; + msg[1].buf = buf; + +- i2c_lock_adapter(adap); ++ i2c_lock_bus(adap, I2C_LOCK_SEGMENT); + + for (i = 0; i < 2; i++) { + if (__i2c_transfer(adap, &msg[i], 1) < 0) { +@@ -313,7 +313,7 @@ static int rohm_i2c_burst_read(struct i2c_client *client, u8 start, void *buf, + } + } + +- i2c_unlock_adapter(adap); ++ i2c_unlock_bus(adap, I2C_LOCK_SEGMENT); + + return ret; + } +diff --git a/drivers/iommu/arm-smmu-v3.c b/drivers/iommu/arm-smmu-v3.c +index 7f294f785ce6..ff4be1174ff0 100644 +--- a/drivers/iommu/arm-smmu-v3.c ++++ b/drivers/iommu/arm-smmu-v3.c +@@ -1233,6 +1233,7 @@ static irqreturn_t arm_smmu_priq_thread(int irq, void *dev) + + /* Sync our overflow flag, as we believe we're up to speed */ + q->cons = Q_OVF(q, q->prod) | Q_WRP(q, q->cons) | Q_IDX(q, q->cons); ++ writel(q->cons, q->cons_reg); + return IRQ_HANDLED; + } + +diff --git a/drivers/media/pci/tw686x/tw686x-video.c b/drivers/media/pci/tw686x/tw686x-video.c +index 0ea8dd44026c..3a06c000f97b 100644 +--- a/drivers/media/pci/tw686x/tw686x-video.c ++++ b/drivers/media/pci/tw686x/tw686x-video.c +@@ -1190,6 +1190,14 @@ int tw686x_video_init(struct tw686x_dev *dev) + return err; + } + ++ /* Initialize vc->dev and vc->ch for the error path */ ++ for (ch = 0; ch < max_channels(dev); ch++) { ++ struct tw686x_video_channel *vc = &dev->video_channels[ch]; ++ ++ vc->dev = dev; ++ vc->ch = ch; ++ } ++ + for (ch = 0; ch < max_channels(dev); ch++) { + struct tw686x_video_channel *vc = &dev->video_channels[ch]; + struct video_device *vdev; +@@ -1198,9 +1206,6 @@ int tw686x_video_init(struct tw686x_dev *dev) + spin_lock_init(&vc->qlock); + INIT_LIST_HEAD(&vc->vidq_queued); + +- vc->dev = dev; +- vc->ch = ch; +- + /* default settings */ + err = tw686x_set_standard(vc, V4L2_STD_NTSC); + if (err) +diff --git a/drivers/media/v4l2-core/videobuf2-core.c b/drivers/media/v4l2-core/videobuf2-core.c +index b3a9fa75e8e7..f7ca1fab4808 100644 +--- a/drivers/media/v4l2-core/videobuf2-core.c ++++ b/drivers/media/v4l2-core/videobuf2-core.c +@@ -1375,6 +1375,11 @@ int vb2_core_qbuf(struct vb2_queue *q, unsigned int index, void *pb) + struct vb2_buffer *vb; + int ret; + ++ if (q->error) { ++ dprintk(1, "fatal error occurred on queue\n"); ++ return -EIO; ++ } ++ + vb = q->bufs[index]; + + switch (vb->state) { +diff --git a/drivers/mfd/88pm860x-i2c.c b/drivers/mfd/88pm860x-i2c.c +index 84e313107233..7b9052ea7413 100644 +--- a/drivers/mfd/88pm860x-i2c.c ++++ b/drivers/mfd/88pm860x-i2c.c +@@ -146,14 +146,14 @@ int pm860x_page_reg_write(struct i2c_client *i2c, int reg, + unsigned char zero; + int ret; + +- i2c_lock_adapter(i2c->adapter); ++ i2c_lock_bus(i2c->adapter, I2C_LOCK_SEGMENT); + read_device(i2c, 0xFA, 0, &zero); + read_device(i2c, 0xFB, 0, &zero); + read_device(i2c, 0xFF, 0, &zero); + ret = write_device(i2c, reg, 1, &data); + read_device(i2c, 0xFE, 0, &zero); + read_device(i2c, 0xFC, 0, &zero); +- i2c_unlock_adapter(i2c->adapter); ++ i2c_unlock_bus(i2c->adapter, I2C_LOCK_SEGMENT); + return ret; + } + EXPORT_SYMBOL(pm860x_page_reg_write); +@@ -164,14 +164,14 @@ int pm860x_page_bulk_read(struct i2c_client *i2c, int reg, + unsigned char zero = 0; + int ret; + +- i2c_lock_adapter(i2c->adapter); ++ i2c_lock_bus(i2c->adapter, I2C_LOCK_SEGMENT); + read_device(i2c, 0xfa, 0, &zero); + read_device(i2c, 0xfb, 0, &zero); + read_device(i2c, 0xff, 0, &zero); + ret = read_device(i2c, reg, count, buf); + read_device(i2c, 0xFE, 0, &zero); + read_device(i2c, 0xFC, 0, &zero); +- i2c_unlock_adapter(i2c->adapter); ++ i2c_unlock_bus(i2c->adapter, I2C_LOCK_SEGMENT); + return ret; + } + EXPORT_SYMBOL(pm860x_page_bulk_read); +diff --git a/drivers/misc/hmc6352.c b/drivers/misc/hmc6352.c +index 90520d76633f..9cde4c5bfba4 100644 +--- a/drivers/misc/hmc6352.c ++++ b/drivers/misc/hmc6352.c +@@ -27,6 +27,7 @@ + #include <linux/err.h> + #include <linux/delay.h> + #include <linux/sysfs.h> ++#include <linux/nospec.h> + + static DEFINE_MUTEX(compass_mutex); + +@@ -50,6 +51,7 @@ static int compass_store(struct device *dev, const char *buf, size_t count, + return ret; + if (val >= strlen(map)) + return -EINVAL; ++ val = array_index_nospec(val, strlen(map)); + mutex_lock(&compass_mutex); + ret = compass_command(c, map[val]); + mutex_unlock(&compass_mutex); +diff --git a/drivers/misc/mei/bus-fixup.c b/drivers/misc/mei/bus-fixup.c +index 75b9d4ac8b1e..371f5f66a9d6 100644 +--- a/drivers/misc/mei/bus-fixup.c ++++ b/drivers/misc/mei/bus-fixup.c +@@ -178,7 +178,7 @@ static int mei_nfc_if_version(struct mei_cl *cl, + + ret = 0; + bytes_recv = __mei_cl_recv(cl, (u8 *)reply, if_version_length); +- if (bytes_recv < if_version_length) { ++ if (bytes_recv < 0 || bytes_recv < if_version_length) { + dev_err(bus->dev, "Could not read IF version\n"); + ret = -EIO; + goto err; +diff --git a/drivers/misc/mei/hbm.c b/drivers/misc/mei/hbm.c +index dd7f15a65eed..ae4a570abae3 100644 +--- a/drivers/misc/mei/hbm.c ++++ b/drivers/misc/mei/hbm.c +@@ -1137,15 +1137,18 @@ int mei_hbm_dispatch(struct mei_device *dev, struct mei_msg_hdr *hdr) + + props_res = (struct hbm_props_response *)mei_msg; + +- if (props_res->status) { ++ if (props_res->status == MEI_HBMS_CLIENT_NOT_FOUND) { ++ dev_dbg(dev->dev, "hbm: properties response: %d CLIENT_NOT_FOUND\n", ++ props_res->me_addr); ++ } else if (props_res->status) { + dev_err(dev->dev, "hbm: properties response: wrong status = %d %s\n", + props_res->status, + mei_hbm_status_str(props_res->status)); + return -EPROTO; ++ } else { ++ mei_hbm_me_cl_add(dev, props_res); + } + +- mei_hbm_me_cl_add(dev, props_res); +- + /* request property for the next client */ + if (mei_hbm_prop_req(dev, props_res->me_addr + 1)) + return -EIO; +diff --git a/drivers/mmc/host/omap_hsmmc.c b/drivers/mmc/host/omap_hsmmc.c +index a082aa330f47..f7d1c8c4e5ad 100644 +--- a/drivers/mmc/host/omap_hsmmc.c ++++ b/drivers/mmc/host/omap_hsmmc.c +@@ -2215,6 +2215,7 @@ static int omap_hsmmc_remove(struct platform_device *pdev) + dma_release_channel(host->tx_chan); + dma_release_channel(host->rx_chan); + ++ dev_pm_clear_wake_irq(host->dev); + pm_runtime_dont_use_autosuspend(host->dev); + pm_runtime_put_sync(host->dev); + pm_runtime_disable(host->dev); +diff --git a/drivers/mmc/host/sdhci-tegra.c b/drivers/mmc/host/sdhci-tegra.c +index 20b6ff5b4af1..088a3ae0dff0 100644 +--- a/drivers/mmc/host/sdhci-tegra.c ++++ b/drivers/mmc/host/sdhci-tegra.c +@@ -350,7 +350,8 @@ static const struct sdhci_pltfm_data sdhci_tegra30_pdata = { + SDHCI_QUIRK_NO_HISPD_BIT | + SDHCI_QUIRK_BROKEN_ADMA_ZEROLEN_DESC | + SDHCI_QUIRK_CAP_CLOCK_BASE_BROKEN, +- .quirks2 = SDHCI_QUIRK2_PRESET_VALUE_BROKEN, ++ .quirks2 = SDHCI_QUIRK2_PRESET_VALUE_BROKEN | ++ SDHCI_QUIRK2_BROKEN_HS200, + .ops = &tegra_sdhci_ops, + }; + +diff --git a/drivers/mmc/host/sdhci.c b/drivers/mmc/host/sdhci.c +index 44ea9d88651f..6bf58d27b6fc 100644 +--- a/drivers/mmc/host/sdhci.c ++++ b/drivers/mmc/host/sdhci.c +@@ -3328,14 +3328,21 @@ int sdhci_setup_host(struct sdhci_host *host) + mmc_gpio_get_cd(host->mmc) < 0) + mmc->caps |= MMC_CAP_NEEDS_POLL; + +- /* If vqmmc regulator and no 1.8V signalling, then there's no UHS */ + if (!IS_ERR(mmc->supply.vqmmc)) { + ret = regulator_enable(mmc->supply.vqmmc); ++ ++ /* If vqmmc provides no 1.8V signalling, then there's no UHS */ + if (!regulator_is_supported_voltage(mmc->supply.vqmmc, 1700000, + 1950000)) + host->caps1 &= ~(SDHCI_SUPPORT_SDR104 | + SDHCI_SUPPORT_SDR50 | + SDHCI_SUPPORT_DDR50); ++ ++ /* In eMMC case vqmmc might be a fixed 1.8V regulator */ ++ if (!regulator_is_supported_voltage(mmc->supply.vqmmc, 2700000, ++ 3600000)) ++ host->flags &= ~SDHCI_SIGNALING_330; ++ + if (ret) { + pr_warn("%s: Failed to enable vqmmc regulator: %d\n", + mmc_hostname(mmc), ret); +diff --git a/drivers/mtd/maps/solutionengine.c b/drivers/mtd/maps/solutionengine.c +index bb580bc16445..c07f21b20463 100644 +--- a/drivers/mtd/maps/solutionengine.c ++++ b/drivers/mtd/maps/solutionengine.c +@@ -59,9 +59,9 @@ static int __init init_soleng_maps(void) + return -ENXIO; + } + } +- printk(KERN_NOTICE "Solution Engine: Flash at 0x%08lx, EPROM at 0x%08lx\n", +- soleng_flash_map.phys & 0x1fffffff, +- soleng_eprom_map.phys & 0x1fffffff); ++ printk(KERN_NOTICE "Solution Engine: Flash at 0x%pap, EPROM at 0x%pap\n", ++ &soleng_flash_map.phys, ++ &soleng_eprom_map.phys); + flash_mtd->owner = THIS_MODULE; + + eprom_mtd = do_map_probe("map_rom", &soleng_eprom_map); +diff --git a/drivers/mtd/mtdchar.c b/drivers/mtd/mtdchar.c +index b4092eab53ac..95b6a6640bca 100644 +--- a/drivers/mtd/mtdchar.c ++++ b/drivers/mtd/mtdchar.c +@@ -160,8 +160,12 @@ static ssize_t mtdchar_read(struct file *file, char __user *buf, size_t count, + + pr_debug("MTD_read\n"); + +- if (*ppos + count > mtd->size) +- count = mtd->size - *ppos; ++ if (*ppos + count > mtd->size) { ++ if (*ppos < mtd->size) ++ count = mtd->size - *ppos; ++ else ++ count = 0; ++ } + + if (!count) + return 0; +@@ -246,7 +250,7 @@ static ssize_t mtdchar_write(struct file *file, const char __user *buf, size_t c + + pr_debug("MTD_write\n"); + +- if (*ppos == mtd->size) ++ if (*ppos >= mtd->size) + return -ENOSPC; + + if (*ppos + count > mtd->size) +diff --git a/drivers/net/ethernet/emulex/benet/be_cmds.c b/drivers/net/ethernet/emulex/benet/be_cmds.c +index 30e855004c57..8887dd3abed7 100644 +--- a/drivers/net/ethernet/emulex/benet/be_cmds.c ++++ b/drivers/net/ethernet/emulex/benet/be_cmds.c +@@ -4500,7 +4500,7 @@ int be_cmd_get_profile_config(struct be_adapter *adapter, + port_res->max_vfs += le16_to_cpu(pcie->num_vfs); + } + } +- return status; ++ goto err; + } + + pcie = be_get_pcie_desc(resp->func_param, desc_count, +diff --git a/drivers/net/ethernet/intel/e1000e/defines.h b/drivers/net/ethernet/intel/e1000e/defines.h +index afb7ebe20b24..824fd44e25f0 100644 +--- a/drivers/net/ethernet/intel/e1000e/defines.h ++++ b/drivers/net/ethernet/intel/e1000e/defines.h +@@ -400,6 +400,10 @@ + #define E1000_ICR_RXDMT0 0x00000010 /* Rx desc min. threshold (0) */ + #define E1000_ICR_RXO 0x00000040 /* Receiver Overrun */ + #define E1000_ICR_RXT0 0x00000080 /* Rx timer intr (ring 0) */ ++#define E1000_ICR_MDAC 0x00000200 /* MDIO Access Complete */ ++#define E1000_ICR_SRPD 0x00010000 /* Small Receive Packet Detected */ ++#define E1000_ICR_ACK 0x00020000 /* Receive ACK Frame Detected */ ++#define E1000_ICR_MNG 0x00040000 /* Manageability Event Detected */ + #define E1000_ICR_ECCER 0x00400000 /* Uncorrectable ECC Error */ + /* If this bit asserted, the driver should claim the interrupt */ + #define E1000_ICR_INT_ASSERTED 0x80000000 +@@ -407,7 +411,7 @@ + #define E1000_ICR_RXQ1 0x00200000 /* Rx Queue 1 Interrupt */ + #define E1000_ICR_TXQ0 0x00400000 /* Tx Queue 0 Interrupt */ + #define E1000_ICR_TXQ1 0x00800000 /* Tx Queue 1 Interrupt */ +-#define E1000_ICR_OTHER 0x01000000 /* Other Interrupts */ ++#define E1000_ICR_OTHER 0x01000000 /* Other Interrupt */ + + /* PBA ECC Register */ + #define E1000_PBA_ECC_COUNTER_MASK 0xFFF00000 /* ECC counter mask */ +@@ -431,12 +435,27 @@ + E1000_IMS_RXSEQ | \ + E1000_IMS_LSC) + ++/* These are all of the events related to the OTHER interrupt. ++ */ ++#define IMS_OTHER_MASK ( \ ++ E1000_IMS_LSC | \ ++ E1000_IMS_RXO | \ ++ E1000_IMS_MDAC | \ ++ E1000_IMS_SRPD | \ ++ E1000_IMS_ACK | \ ++ E1000_IMS_MNG) ++ + /* Interrupt Mask Set */ + #define E1000_IMS_TXDW E1000_ICR_TXDW /* Transmit desc written back */ + #define E1000_IMS_LSC E1000_ICR_LSC /* Link Status Change */ + #define E1000_IMS_RXSEQ E1000_ICR_RXSEQ /* Rx sequence error */ + #define E1000_IMS_RXDMT0 E1000_ICR_RXDMT0 /* Rx desc min. threshold */ ++#define E1000_IMS_RXO E1000_ICR_RXO /* Receiver Overrun */ + #define E1000_IMS_RXT0 E1000_ICR_RXT0 /* Rx timer intr */ ++#define E1000_IMS_MDAC E1000_ICR_MDAC /* MDIO Access Complete */ ++#define E1000_IMS_SRPD E1000_ICR_SRPD /* Small Receive Packet */ ++#define E1000_IMS_ACK E1000_ICR_ACK /* Receive ACK Frame Detected */ ++#define E1000_IMS_MNG E1000_ICR_MNG /* Manageability Event */ + #define E1000_IMS_ECCER E1000_ICR_ECCER /* Uncorrectable ECC Error */ + #define E1000_IMS_RXQ0 E1000_ICR_RXQ0 /* Rx Queue 0 Interrupt */ + #define E1000_IMS_RXQ1 E1000_ICR_RXQ1 /* Rx Queue 1 Interrupt */ +diff --git a/drivers/net/ethernet/intel/e1000e/ich8lan.c b/drivers/net/ethernet/intel/e1000e/ich8lan.c +index 7ddac956ffb5..dc7d671b903c 100644 +--- a/drivers/net/ethernet/intel/e1000e/ich8lan.c ++++ b/drivers/net/ethernet/intel/e1000e/ich8lan.c +@@ -1364,9 +1364,6 @@ out: + * Checks to see of the link status of the hardware has changed. If a + * change in link status has been detected, then we read the PHY registers + * to get the current speed/duplex if link exists. +- * +- * Returns a negative error code (-E1000_ERR_*) or 0 (link down) or 1 (link +- * up). + **/ + static s32 e1000_check_for_copper_link_ich8lan(struct e1000_hw *hw) + { +@@ -1382,7 +1379,8 @@ static s32 e1000_check_for_copper_link_ich8lan(struct e1000_hw *hw) + * Change or Rx Sequence Error interrupt. + */ + if (!mac->get_link_status) +- return 1; ++ return 0; ++ mac->get_link_status = false; + + /* First we want to see if the MII Status Register reports + * link. If so, then we want to get the current speed/duplex +@@ -1390,12 +1388,12 @@ static s32 e1000_check_for_copper_link_ich8lan(struct e1000_hw *hw) + */ + ret_val = e1000e_phy_has_link_generic(hw, 1, 0, &link); + if (ret_val) +- return ret_val; ++ goto out; + + if (hw->mac.type == e1000_pchlan) { + ret_val = e1000_k1_gig_workaround_hv(hw, link); + if (ret_val) +- return ret_val; ++ goto out; + } + + /* When connected at 10Mbps half-duplex, some parts are excessively +@@ -1430,7 +1428,7 @@ static s32 e1000_check_for_copper_link_ich8lan(struct e1000_hw *hw) + + ret_val = hw->phy.ops.acquire(hw); + if (ret_val) +- return ret_val; ++ goto out; + + if (hw->mac.type == e1000_pch2lan) + emi_addr = I82579_RX_CONFIG; +@@ -1453,7 +1451,7 @@ static s32 e1000_check_for_copper_link_ich8lan(struct e1000_hw *hw) + hw->phy.ops.release(hw); + + if (ret_val) +- return ret_val; ++ goto out; + + if (hw->mac.type == e1000_pch_spt) { + u16 data; +@@ -1462,14 +1460,14 @@ static s32 e1000_check_for_copper_link_ich8lan(struct e1000_hw *hw) + if (speed == SPEED_1000) { + ret_val = hw->phy.ops.acquire(hw); + if (ret_val) +- return ret_val; ++ goto out; + + ret_val = e1e_rphy_locked(hw, + PHY_REG(776, 20), + &data); + if (ret_val) { + hw->phy.ops.release(hw); +- return ret_val; ++ goto out; + } + + ptr_gap = (data & (0x3FF << 2)) >> 2; +@@ -1483,18 +1481,18 @@ static s32 e1000_check_for_copper_link_ich8lan(struct e1000_hw *hw) + } + hw->phy.ops.release(hw); + if (ret_val) +- return ret_val; ++ goto out; + } else { + ret_val = hw->phy.ops.acquire(hw); + if (ret_val) +- return ret_val; ++ goto out; + + ret_val = e1e_wphy_locked(hw, + PHY_REG(776, 20), + 0xC023); + hw->phy.ops.release(hw); + if (ret_val) +- return ret_val; ++ goto out; + + } + } +@@ -1521,7 +1519,7 @@ static s32 e1000_check_for_copper_link_ich8lan(struct e1000_hw *hw) + (hw->adapter->pdev->device == E1000_DEV_ID_PCH_I218_V3)) { + ret_val = e1000_k1_workaround_lpt_lp(hw, link); + if (ret_val) +- return ret_val; ++ goto out; + } + if ((hw->mac.type == e1000_pch_lpt) || + (hw->mac.type == e1000_pch_spt)) { +@@ -1530,7 +1528,7 @@ static s32 e1000_check_for_copper_link_ich8lan(struct e1000_hw *hw) + */ + ret_val = e1000_platform_pm_pch_lpt(hw, link); + if (ret_val) +- return ret_val; ++ goto out; + } + + /* Clear link partner's EEE ability */ +@@ -1550,9 +1548,7 @@ static s32 e1000_check_for_copper_link_ich8lan(struct e1000_hw *hw) + } + + if (!link) +- return 0; /* No link detected */ +- +- mac->get_link_status = false; ++ goto out; + + switch (hw->mac.type) { + case e1000_pch2lan: +@@ -1600,7 +1596,7 @@ static s32 e1000_check_for_copper_link_ich8lan(struct e1000_hw *hw) + * we have already determined whether we have link or not. + */ + if (!mac->autoneg) +- return 1; ++ return -E1000_ERR_CONFIG; + + /* Auto-Neg is enabled. Auto Speed Detection takes care + * of MAC speed/duplex configuration. So we only need to +@@ -1614,12 +1610,14 @@ static s32 e1000_check_for_copper_link_ich8lan(struct e1000_hw *hw) + * different link partner. + */ + ret_val = e1000e_config_fc_after_link_up(hw); +- if (ret_val) { ++ if (ret_val) + e_dbg("Error configuring flow control\n"); +- return ret_val; +- } + +- return 1; ++ return ret_val; ++ ++out: ++ mac->get_link_status = true; ++ return ret_val; + } + + static s32 e1000_get_variants_ich8lan(struct e1000_adapter *adapter) +diff --git a/drivers/net/ethernet/intel/e1000e/mac.c b/drivers/net/ethernet/intel/e1000e/mac.c +index db735644b312..5bdc3a2d4fd7 100644 +--- a/drivers/net/ethernet/intel/e1000e/mac.c ++++ b/drivers/net/ethernet/intel/e1000e/mac.c +@@ -410,9 +410,6 @@ void e1000e_clear_hw_cntrs_base(struct e1000_hw *hw) + * Checks to see of the link status of the hardware has changed. If a + * change in link status has been detected, then we read the PHY registers + * to get the current speed/duplex if link exists. +- * +- * Returns a negative error code (-E1000_ERR_*) or 0 (link down) or 1 (link +- * up). + **/ + s32 e1000e_check_for_copper_link(struct e1000_hw *hw) + { +@@ -426,20 +423,16 @@ s32 e1000e_check_for_copper_link(struct e1000_hw *hw) + * Change or Rx Sequence Error interrupt. + */ + if (!mac->get_link_status) +- return 1; ++ return 0; ++ mac->get_link_status = false; + + /* First we want to see if the MII Status Register reports + * link. If so, then we want to get the current speed/duplex + * of the PHY. + */ + ret_val = e1000e_phy_has_link_generic(hw, 1, 0, &link); +- if (ret_val) +- return ret_val; +- +- if (!link) +- return 0; /* No link detected */ +- +- mac->get_link_status = false; ++ if (ret_val || !link) ++ goto out; + + /* Check if there was DownShift, must be checked + * immediately after link-up +@@ -450,7 +443,7 @@ s32 e1000e_check_for_copper_link(struct e1000_hw *hw) + * we have already determined whether we have link or not. + */ + if (!mac->autoneg) +- return 1; ++ return -E1000_ERR_CONFIG; + + /* Auto-Neg is enabled. Auto Speed Detection takes care + * of MAC speed/duplex configuration. So we only need to +@@ -464,12 +457,14 @@ s32 e1000e_check_for_copper_link(struct e1000_hw *hw) + * different link partner. + */ + ret_val = e1000e_config_fc_after_link_up(hw); +- if (ret_val) { ++ if (ret_val) + e_dbg("Error configuring flow control\n"); +- return ret_val; +- } + +- return 1; ++ return ret_val; ++ ++out: ++ mac->get_link_status = true; ++ return ret_val; + } + + /** +diff --git a/drivers/net/ethernet/intel/e1000e/netdev.c b/drivers/net/ethernet/intel/e1000e/netdev.c +index 9c95222e6536..6855b3380a83 100644 +--- a/drivers/net/ethernet/intel/e1000e/netdev.c ++++ b/drivers/net/ethernet/intel/e1000e/netdev.c +@@ -1911,30 +1911,20 @@ static irqreturn_t e1000_msix_other(int __always_unused irq, void *data) + struct net_device *netdev = data; + struct e1000_adapter *adapter = netdev_priv(netdev); + struct e1000_hw *hw = &adapter->hw; +- u32 icr; +- bool enable = true; +- +- icr = er32(ICR); +- if (icr & E1000_ICR_RXO) { +- ew32(ICR, E1000_ICR_RXO); +- enable = false; +- /* napi poll will re-enable Other, make sure it runs */ +- if (napi_schedule_prep(&adapter->napi)) { +- adapter->total_rx_bytes = 0; +- adapter->total_rx_packets = 0; +- __napi_schedule(&adapter->napi); +- } +- } ++ u32 icr = er32(ICR); ++ ++ if (icr & adapter->eiac_mask) ++ ew32(ICS, (icr & adapter->eiac_mask)); ++ + if (icr & E1000_ICR_LSC) { +- ew32(ICR, E1000_ICR_LSC); + hw->mac.get_link_status = true; + /* guard against interrupt when we're going down */ + if (!test_bit(__E1000_DOWN, &adapter->state)) + mod_timer(&adapter->watchdog_timer, jiffies + 1); + } + +- if (enable && !test_bit(__E1000_DOWN, &adapter->state)) +- ew32(IMS, E1000_IMS_OTHER); ++ if (!test_bit(__E1000_DOWN, &adapter->state)) ++ ew32(IMS, E1000_IMS_OTHER | IMS_OTHER_MASK); + + return IRQ_HANDLED; + } +@@ -2037,7 +2027,6 @@ static void e1000_configure_msix(struct e1000_adapter *adapter) + hw->hw_addr + E1000_EITR_82574(vector)); + else + writel(1, hw->hw_addr + E1000_EITR_82574(vector)); +- adapter->eiac_mask |= E1000_IMS_OTHER; + + /* Cause Tx interrupts on every write back */ + ivar |= BIT(31); +@@ -2262,7 +2251,8 @@ static void e1000_irq_enable(struct e1000_adapter *adapter) + + if (adapter->msix_entries) { + ew32(EIAC_82574, adapter->eiac_mask & E1000_EIAC_MASK_82574); +- ew32(IMS, adapter->eiac_mask | E1000_IMS_LSC); ++ ew32(IMS, adapter->eiac_mask | E1000_IMS_OTHER | ++ IMS_OTHER_MASK); + } else if ((hw->mac.type == e1000_pch_lpt) || + (hw->mac.type == e1000_pch_spt)) { + ew32(IMS, IMS_ENABLE_MASK | E1000_IMS_ECCER); +@@ -2705,8 +2695,7 @@ static int e1000e_poll(struct napi_struct *napi, int weight) + napi_complete_done(napi, work_done); + if (!test_bit(__E1000_DOWN, &adapter->state)) { + if (adapter->msix_entries) +- ew32(IMS, adapter->rx_ring->ims_val | +- E1000_IMS_OTHER); ++ ew32(IMS, adapter->rx_ring->ims_val); + else + e1000_irq_enable(adapter); + } +@@ -5085,7 +5074,7 @@ static bool e1000e_has_link(struct e1000_adapter *adapter) + case e1000_media_type_copper: + if (hw->mac.get_link_status) { + ret_val = hw->mac.ops.check_for_link(hw); +- link_active = ret_val > 0; ++ link_active = !hw->mac.get_link_status; + } else { + link_active = true; + } +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/health.c b/drivers/net/ethernet/mellanox/mlx5/core/health.c +index 8beecd615a21..448e71e07668 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/health.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/health.c +@@ -339,9 +339,17 @@ void mlx5_start_health_poll(struct mlx5_core_dev *dev) + add_timer(&health->timer); + } + +-void mlx5_stop_health_poll(struct mlx5_core_dev *dev) ++void mlx5_stop_health_poll(struct mlx5_core_dev *dev, bool disable_health) + { + struct mlx5_core_health *health = &dev->priv.health; ++ unsigned long flags; ++ ++ if (disable_health) { ++ spin_lock_irqsave(&health->wq_lock, flags); ++ set_bit(MLX5_DROP_NEW_HEALTH_WORK, &health->flags); ++ set_bit(MLX5_DROP_NEW_RECOVERY_WORK, &health->flags); ++ spin_unlock_irqrestore(&health->wq_lock, flags); ++ } + + del_timer_sync(&health->timer); + } +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/main.c b/drivers/net/ethernet/mellanox/mlx5/core/main.c +index 3c183b8c083a..6698a3a07406 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/main.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/main.c +@@ -787,8 +787,10 @@ static int mlx5_pci_init(struct mlx5_core_dev *dev, struct mlx5_priv *priv) + priv->numa_node = dev_to_node(&dev->pdev->dev); + + priv->dbg_root = debugfs_create_dir(dev_name(&pdev->dev), mlx5_debugfs_root); +- if (!priv->dbg_root) ++ if (!priv->dbg_root) { ++ dev_err(&pdev->dev, "Cannot create debugfs dir, aborting\n"); + return -ENOMEM; ++ } + + err = mlx5_pci_enable_device(dev); + if (err) { +@@ -837,7 +839,7 @@ static void mlx5_pci_close(struct mlx5_core_dev *dev, struct mlx5_priv *priv) + pci_clear_master(dev->pdev); + release_bar(dev->pdev); + mlx5_pci_disable_device(dev); +- debugfs_remove(priv->dbg_root); ++ debugfs_remove_recursive(priv->dbg_root); + } + + static int mlx5_init_once(struct mlx5_core_dev *dev, struct mlx5_priv *priv) +@@ -1130,7 +1132,7 @@ err_cleanup_once: + mlx5_cleanup_once(dev); + + err_stop_poll: +- mlx5_stop_health_poll(dev); ++ mlx5_stop_health_poll(dev, boot); + if (mlx5_cmd_teardown_hca(dev)) { + dev_err(&dev->pdev->dev, "tear_down_hca failed, skip cleanup\n"); + goto out_err; +@@ -1187,7 +1189,7 @@ static int mlx5_unload_one(struct mlx5_core_dev *dev, struct mlx5_priv *priv, + mlx5_disable_msix(dev); + if (cleanup) + mlx5_cleanup_once(dev); +- mlx5_stop_health_poll(dev); ++ mlx5_stop_health_poll(dev, cleanup); + err = mlx5_cmd_teardown_hca(dev); + if (err) { + dev_err(&dev->pdev->dev, "tear_down_hca failed, skip cleanup\n"); +diff --git a/drivers/net/ethernet/netronome/nfp/nfp_net_common.c b/drivers/net/ethernet/netronome/nfp/nfp_net_common.c +index eee6e59e6cf3..2e8703da536d 100644 +--- a/drivers/net/ethernet/netronome/nfp/nfp_net_common.c ++++ b/drivers/net/ethernet/netronome/nfp/nfp_net_common.c +@@ -990,7 +990,7 @@ static void nfp_net_tx_complete(struct nfp_net_tx_ring *tx_ring) + * @nn: NFP Net device + * @tx_ring: TX ring structure + * +- * Assumes that the device is stopped ++ * Assumes that the device is stopped, must be idempotent. + */ + static void + nfp_net_tx_ring_reset(struct nfp_net *nn, struct nfp_net_tx_ring *tx_ring) +@@ -1144,13 +1144,18 @@ static void nfp_net_rx_give_one(struct nfp_net_rx_ring *rx_ring, + * nfp_net_rx_ring_reset() - Reflect in SW state of freelist after disable + * @rx_ring: RX ring structure + * +- * Warning: Do *not* call if ring buffers were never put on the FW freelist +- * (i.e. device was not enabled)! ++ * Assumes that the device is stopped, must be idempotent. + */ + static void nfp_net_rx_ring_reset(struct nfp_net_rx_ring *rx_ring) + { + unsigned int wr_idx, last_idx; + ++ /* wr_p == rd_p means ring was never fed FL bufs. RX rings are always ++ * kept at cnt - 1 FL bufs. ++ */ ++ if (rx_ring->wr_p == 0 && rx_ring->rd_p == 0) ++ return; ++ + /* Move the empty entry to the end of the list */ + wr_idx = rx_ring->wr_p % rx_ring->cnt; + last_idx = rx_ring->cnt - 1; +@@ -1919,6 +1924,8 @@ static void nfp_net_vec_clear_ring_data(struct nfp_net *nn, unsigned int idx) + /** + * nfp_net_clear_config_and_disable() - Clear control BAR and disable NFP + * @nn: NFP Net device to reconfigure ++ * ++ * Warning: must be fully idempotent. + */ + static void nfp_net_clear_config_and_disable(struct nfp_net *nn) + { +diff --git a/drivers/net/wan/fsl_ucc_hdlc.c b/drivers/net/wan/fsl_ucc_hdlc.c +index a8bd68f252e9..7a62316c570d 100644 +--- a/drivers/net/wan/fsl_ucc_hdlc.c ++++ b/drivers/net/wan/fsl_ucc_hdlc.c +@@ -161,7 +161,7 @@ static int uhdlc_init(struct ucc_hdlc_private *priv) + priv->ucc_pram_offset = qe_muram_alloc(sizeof(struct ucc_hdlc_param), + ALIGNMENT_OF_UCC_HDLC_PRAM); + +- if (priv->ucc_pram_offset < 0) { ++ if (IS_ERR_VALUE(priv->ucc_pram_offset)) { + dev_err(priv->dev, "Can not allocate MURAM for hdlc parameter.\n"); + ret = -ENOMEM; + goto free_tx_bd; +@@ -197,14 +197,14 @@ static int uhdlc_init(struct ucc_hdlc_private *priv) + + /* Alloc riptr, tiptr */ + riptr = qe_muram_alloc(32, 32); +- if (riptr < 0) { ++ if (IS_ERR_VALUE(riptr)) { + dev_err(priv->dev, "Cannot allocate MURAM mem for Receive internal temp data pointer\n"); + ret = -ENOMEM; + goto free_tx_skbuff; + } + + tiptr = qe_muram_alloc(32, 32); +- if (tiptr < 0) { ++ if (IS_ERR_VALUE(tiptr)) { + dev_err(priv->dev, "Cannot allocate MURAM mem for Transmit internal temp data pointer\n"); + ret = -ENOMEM; + goto free_riptr; +diff --git a/drivers/net/xen-netfront.c b/drivers/net/xen-netfront.c +index cd2c6ffdbdde..7f6af10f09ee 100644 +--- a/drivers/net/xen-netfront.c ++++ b/drivers/net/xen-netfront.c +@@ -86,8 +86,7 @@ struct netfront_cb { + /* IRQ name is queue name with "-tx" or "-rx" appended */ + #define IRQ_NAME_SIZE (QUEUE_NAME_SIZE + 3) + +-static DECLARE_WAIT_QUEUE_HEAD(module_load_q); +-static DECLARE_WAIT_QUEUE_HEAD(module_unload_q); ++static DECLARE_WAIT_QUEUE_HEAD(module_wq); + + struct netfront_stats { + u64 packets; +@@ -1350,11 +1349,11 @@ static struct net_device *xennet_create_dev(struct xenbus_device *dev) + netif_carrier_off(netdev); + + xenbus_switch_state(dev, XenbusStateInitialising); +- wait_event(module_load_q, +- xenbus_read_driver_state(dev->otherend) != +- XenbusStateClosed && +- xenbus_read_driver_state(dev->otherend) != +- XenbusStateUnknown); ++ wait_event(module_wq, ++ xenbus_read_driver_state(dev->otherend) != ++ XenbusStateClosed && ++ xenbus_read_driver_state(dev->otherend) != ++ XenbusStateUnknown); + return netdev; + + exit: +@@ -1622,6 +1621,7 @@ static int xennet_init_queue(struct netfront_queue *queue) + { + unsigned short i; + int err = 0; ++ char *devid; + + spin_lock_init(&queue->tx_lock); + spin_lock_init(&queue->rx_lock); +@@ -1629,8 +1629,9 @@ static int xennet_init_queue(struct netfront_queue *queue) + setup_timer(&queue->rx_refill_timer, rx_refill_timeout, + (unsigned long)queue); + +- snprintf(queue->name, sizeof(queue->name), "%s-q%u", +- queue->info->netdev->name, queue->id); ++ devid = strrchr(queue->info->xbdev->nodename, '/') + 1; ++ snprintf(queue->name, sizeof(queue->name), "vif%s-q%u", ++ devid, queue->id); + + /* Initialise tx_skbs as a free chain containing every entry. */ + queue->tx_skb_freelist = 0; +@@ -2037,15 +2038,14 @@ static void netback_changed(struct xenbus_device *dev, + + dev_dbg(&dev->dev, "%s\n", xenbus_strstate(backend_state)); + ++ wake_up_all(&module_wq); ++ + switch (backend_state) { + case XenbusStateInitialising: + case XenbusStateInitialised: + case XenbusStateReconfiguring: + case XenbusStateReconfigured: +- break; +- + case XenbusStateUnknown: +- wake_up_all(&module_unload_q); + break; + + case XenbusStateInitWait: +@@ -2061,12 +2061,10 @@ static void netback_changed(struct xenbus_device *dev, + break; + + case XenbusStateClosed: +- wake_up_all(&module_unload_q); + if (dev->state == XenbusStateClosed) + break; + /* Missed the backend's CLOSING state -- fallthrough */ + case XenbusStateClosing: +- wake_up_all(&module_unload_q); + xenbus_frontend_closed(dev); + break; + } +@@ -2174,14 +2172,14 @@ static int xennet_remove(struct xenbus_device *dev) + + if (xenbus_read_driver_state(dev->otherend) != XenbusStateClosed) { + xenbus_switch_state(dev, XenbusStateClosing); +- wait_event(module_unload_q, ++ wait_event(module_wq, + xenbus_read_driver_state(dev->otherend) == + XenbusStateClosing || + xenbus_read_driver_state(dev->otherend) == + XenbusStateUnknown); + + xenbus_switch_state(dev, XenbusStateClosed); +- wait_event(module_unload_q, ++ wait_event(module_wq, + xenbus_read_driver_state(dev->otherend) == + XenbusStateClosed || + xenbus_read_driver_state(dev->otherend) == +diff --git a/drivers/parport/parport_sunbpp.c b/drivers/parport/parport_sunbpp.c +index 01cf1c1a841a..8de329546b82 100644 +--- a/drivers/parport/parport_sunbpp.c ++++ b/drivers/parport/parport_sunbpp.c +@@ -286,12 +286,16 @@ static int bpp_probe(struct platform_device *op) + + ops = kmemdup(&parport_sunbpp_ops, sizeof(struct parport_operations), + GFP_KERNEL); +- if (!ops) ++ if (!ops) { ++ err = -ENOMEM; + goto out_unmap; ++ } + + dprintk(("register_port\n")); +- if (!(p = parport_register_port((unsigned long)base, irq, dma, ops))) ++ if (!(p = parport_register_port((unsigned long)base, irq, dma, ops))) { ++ err = -ENOMEM; + goto out_free_ops; ++ } + + p->size = size; + p->dev = &op->dev; +diff --git a/drivers/pinctrl/qcom/pinctrl-spmi-gpio.c b/drivers/pinctrl/qcom/pinctrl-spmi-gpio.c +index 664b641fd776..8093afd17aa4 100644 +--- a/drivers/pinctrl/qcom/pinctrl-spmi-gpio.c ++++ b/drivers/pinctrl/qcom/pinctrl-spmi-gpio.c +@@ -287,31 +287,47 @@ static int pmic_gpio_config_get(struct pinctrl_dev *pctldev, + + switch (param) { + case PIN_CONFIG_DRIVE_PUSH_PULL: +- arg = pad->buffer_type == PMIC_GPIO_OUT_BUF_CMOS; ++ if (pad->buffer_type != PMIC_GPIO_OUT_BUF_CMOS) ++ return -EINVAL; ++ arg = 1; + break; + case PIN_CONFIG_DRIVE_OPEN_DRAIN: +- arg = pad->buffer_type == PMIC_GPIO_OUT_BUF_OPEN_DRAIN_NMOS; ++ if (pad->buffer_type != PMIC_GPIO_OUT_BUF_OPEN_DRAIN_NMOS) ++ return -EINVAL; ++ arg = 1; + break; + case PIN_CONFIG_DRIVE_OPEN_SOURCE: +- arg = pad->buffer_type == PMIC_GPIO_OUT_BUF_OPEN_DRAIN_PMOS; ++ if (pad->buffer_type != PMIC_GPIO_OUT_BUF_OPEN_DRAIN_PMOS) ++ return -EINVAL; ++ arg = 1; + break; + case PIN_CONFIG_BIAS_PULL_DOWN: +- arg = pad->pullup == PMIC_GPIO_PULL_DOWN; ++ if (pad->pullup != PMIC_GPIO_PULL_DOWN) ++ return -EINVAL; ++ arg = 1; + break; + case PIN_CONFIG_BIAS_DISABLE: +- arg = pad->pullup = PMIC_GPIO_PULL_DISABLE; ++ if (pad->pullup != PMIC_GPIO_PULL_DISABLE) ++ return -EINVAL; ++ arg = 1; + break; + case PIN_CONFIG_BIAS_PULL_UP: +- arg = pad->pullup == PMIC_GPIO_PULL_UP_30; ++ if (pad->pullup != PMIC_GPIO_PULL_UP_30) ++ return -EINVAL; ++ arg = 1; + break; + case PIN_CONFIG_BIAS_HIGH_IMPEDANCE: +- arg = !pad->is_enabled; ++ if (pad->is_enabled) ++ return -EINVAL; ++ arg = 1; + break; + case PIN_CONFIG_POWER_SOURCE: + arg = pad->power_source; + break; + case PIN_CONFIG_INPUT_ENABLE: +- arg = pad->input_enabled; ++ if (!pad->input_enabled) ++ return -EINVAL; ++ arg = 1; + break; + case PIN_CONFIG_OUTPUT: + arg = pad->out_value; +diff --git a/drivers/platform/x86/toshiba_acpi.c b/drivers/platform/x86/toshiba_acpi.c +index 074bf2fa1c55..79a228937072 100644 +--- a/drivers/platform/x86/toshiba_acpi.c ++++ b/drivers/platform/x86/toshiba_acpi.c +@@ -34,6 +34,7 @@ + #define TOSHIBA_ACPI_VERSION "0.24" + #define PROC_INTERFACE_VERSION 1 + ++#include <linux/compiler.h> + #include <linux/kernel.h> + #include <linux/module.h> + #include <linux/moduleparam.h> +@@ -1687,7 +1688,7 @@ static const struct file_operations keys_proc_fops = { + .write = keys_proc_write, + }; + +-static int version_proc_show(struct seq_file *m, void *v) ++static int __maybe_unused version_proc_show(struct seq_file *m, void *v) + { + seq_printf(m, "driver: %s\n", TOSHIBA_ACPI_VERSION); + seq_printf(m, "proc_interface: %d\n", PROC_INTERFACE_VERSION); +diff --git a/drivers/rtc/rtc-bq4802.c b/drivers/rtc/rtc-bq4802.c +index bd170cb3361c..5747a54cbd42 100644 +--- a/drivers/rtc/rtc-bq4802.c ++++ b/drivers/rtc/rtc-bq4802.c +@@ -164,6 +164,10 @@ static int bq4802_probe(struct platform_device *pdev) + } else if (p->r->flags & IORESOURCE_MEM) { + p->regs = devm_ioremap(&pdev->dev, p->r->start, + resource_size(p->r)); ++ if (!p->regs){ ++ err = -ENOMEM; ++ goto out; ++ } + p->read = bq4802_read_mem; + p->write = bq4802_write_mem; + } else { +diff --git a/drivers/s390/net/qeth_core_main.c b/drivers/s390/net/qeth_core_main.c +index 283416aefa56..258a72869f57 100644 +--- a/drivers/s390/net/qeth_core_main.c ++++ b/drivers/s390/net/qeth_core_main.c +@@ -3499,13 +3499,14 @@ static void qeth_flush_buffers(struct qeth_qdio_out_q *queue, int index, + qdio_flags = QDIO_FLAG_SYNC_OUTPUT; + if (atomic_read(&queue->set_pci_flags_count)) + qdio_flags |= QDIO_FLAG_PCI_OUT; ++ atomic_add(count, &queue->used_buffers); ++ + rc = do_QDIO(CARD_DDEV(queue->card), qdio_flags, + queue->queue_no, index, count); + if (queue->card->options.performance_stats) + queue->card->perf_stats.outbound_do_qdio_time += + qeth_get_micros() - + queue->card->perf_stats.outbound_do_qdio_start_time; +- atomic_add(count, &queue->used_buffers); + if (rc) { + queue->card->stats.tx_errors += count; + /* ignore temporary SIGA errors without busy condition */ +diff --git a/drivers/s390/net/qeth_core_sys.c b/drivers/s390/net/qeth_core_sys.c +index db6a285d41e0..0a7a6da36dfd 100644 +--- a/drivers/s390/net/qeth_core_sys.c ++++ b/drivers/s390/net/qeth_core_sys.c +@@ -423,6 +423,7 @@ static ssize_t qeth_dev_layer2_store(struct device *dev, + if (card->discipline) { + card->discipline->remove(card->gdev); + qeth_core_free_discipline(card); ++ card->options.layer2 = -1; + } + + rc = qeth_core_load_discipline(card, newdis); +diff --git a/drivers/usb/class/cdc-acm.c b/drivers/usb/class/cdc-acm.c +index a9c950d29ce2..25ae9b9895a9 100644 +--- a/drivers/usb/class/cdc-acm.c ++++ b/drivers/usb/class/cdc-acm.c +@@ -705,20 +705,9 @@ static int acm_tty_write(struct tty_struct *tty, + } + + if (acm->susp_count) { +- if (acm->putbuffer) { +- /* now to preserve order */ +- usb_anchor_urb(acm->putbuffer->urb, &acm->delayed); +- acm->putbuffer = NULL; +- } + usb_anchor_urb(wb->urb, &acm->delayed); + spin_unlock_irqrestore(&acm->write_lock, flags); + return count; +- } else { +- if (acm->putbuffer) { +- /* at this point there is no good way to handle errors */ +- acm_start_wb(acm, acm->putbuffer); +- acm->putbuffer = NULL; +- } + } + + stat = acm_start_wb(acm, wb); +@@ -729,66 +718,6 @@ static int acm_tty_write(struct tty_struct *tty, + return count; + } + +-static void acm_tty_flush_chars(struct tty_struct *tty) +-{ +- struct acm *acm = tty->driver_data; +- struct acm_wb *cur; +- int err; +- unsigned long flags; +- +- spin_lock_irqsave(&acm->write_lock, flags); +- +- cur = acm->putbuffer; +- if (!cur) /* nothing to do */ +- goto out; +- +- acm->putbuffer = NULL; +- err = usb_autopm_get_interface_async(acm->control); +- if (err < 0) { +- cur->use = 0; +- acm->putbuffer = cur; +- goto out; +- } +- +- if (acm->susp_count) +- usb_anchor_urb(cur->urb, &acm->delayed); +- else +- acm_start_wb(acm, cur); +-out: +- spin_unlock_irqrestore(&acm->write_lock, flags); +- return; +-} +- +-static int acm_tty_put_char(struct tty_struct *tty, unsigned char ch) +-{ +- struct acm *acm = tty->driver_data; +- struct acm_wb *cur; +- int wbn; +- unsigned long flags; +- +-overflow: +- cur = acm->putbuffer; +- if (!cur) { +- spin_lock_irqsave(&acm->write_lock, flags); +- wbn = acm_wb_alloc(acm); +- if (wbn >= 0) { +- cur = &acm->wb[wbn]; +- acm->putbuffer = cur; +- } +- spin_unlock_irqrestore(&acm->write_lock, flags); +- if (!cur) +- return 0; +- } +- +- if (cur->len == acm->writesize) { +- acm_tty_flush_chars(tty); +- goto overflow; +- } +- +- cur->buf[cur->len++] = ch; +- return 1; +-} +- + static int acm_tty_write_room(struct tty_struct *tty) + { + struct acm *acm = tty->driver_data; +@@ -1940,8 +1869,6 @@ static const struct tty_operations acm_ops = { + .cleanup = acm_tty_cleanup, + .hangup = acm_tty_hangup, + .write = acm_tty_write, +- .put_char = acm_tty_put_char, +- .flush_chars = acm_tty_flush_chars, + .write_room = acm_tty_write_room, + .ioctl = acm_tty_ioctl, + .throttle = acm_tty_throttle, +diff --git a/drivers/usb/class/cdc-acm.h b/drivers/usb/class/cdc-acm.h +index 1f1eabfd8462..b30ac5fcde68 100644 +--- a/drivers/usb/class/cdc-acm.h ++++ b/drivers/usb/class/cdc-acm.h +@@ -94,7 +94,6 @@ struct acm { + unsigned long read_urbs_free; + struct urb *read_urbs[ACM_NR]; + struct acm_rb read_buffers[ACM_NR]; +- struct acm_wb *putbuffer; /* for acm_tty_put_char() */ + int rx_buflimit; + spinlock_t read_lock; + int write_used; /* number of non-empty write buffers */ +diff --git a/drivers/usb/class/cdc-wdm.c b/drivers/usb/class/cdc-wdm.c +index 9f001659807a..adc0f78dc54d 100644 +--- a/drivers/usb/class/cdc-wdm.c ++++ b/drivers/usb/class/cdc-wdm.c +@@ -470,7 +470,7 @@ static int service_outstanding_interrupt(struct wdm_device *desc) + + set_bit(WDM_RESPONDING, &desc->flags); + spin_unlock_irq(&desc->iuspin); +- rv = usb_submit_urb(desc->response, GFP_KERNEL); ++ rv = usb_submit_urb(desc->response, GFP_ATOMIC); + spin_lock_irq(&desc->iuspin); + if (rv) { + dev_err(&desc->intf->dev, +diff --git a/drivers/usb/core/hcd-pci.c b/drivers/usb/core/hcd-pci.c +index 7859d738df41..7af23b215254 100644 +--- a/drivers/usb/core/hcd-pci.c ++++ b/drivers/usb/core/hcd-pci.c +@@ -528,8 +528,6 @@ static int resume_common(struct device *dev, int event) + event == PM_EVENT_RESTORE); + if (retval) { + dev_err(dev, "PCI post-resume error %d!\n", retval); +- if (hcd->shared_hcd) +- usb_hc_died(hcd->shared_hcd); + usb_hc_died(hcd); + } + } +diff --git a/drivers/usb/core/message.c b/drivers/usb/core/message.c +index 9cb66475c211..c0c5d5b3ec40 100644 +--- a/drivers/usb/core/message.c ++++ b/drivers/usb/core/message.c +@@ -1279,6 +1279,11 @@ void usb_enable_interface(struct usb_device *dev, + * is submitted that needs that bandwidth. Some other operating systems + * allocate bandwidth early, when a configuration is chosen. + * ++ * xHCI reserves bandwidth and configures the alternate setting in ++ * usb_hcd_alloc_bandwidth(). If it fails the original interface altsetting ++ * may be disabled. Drivers cannot rely on any particular alternate ++ * setting being in effect after a failure. ++ * + * This call is synchronous, and may not be used in an interrupt context. + * Also, drivers must not change altsettings while urbs are scheduled for + * endpoints in that interface; all such urbs must first be completed +@@ -1314,6 +1319,12 @@ int usb_set_interface(struct usb_device *dev, int interface, int alternate) + alternate); + return -EINVAL; + } ++ /* ++ * usb3 hosts configure the interface in usb_hcd_alloc_bandwidth, ++ * including freeing dropped endpoint ring buffers. ++ * Make sure the interface endpoints are flushed before that ++ */ ++ usb_disable_interface(dev, iface, false); + + /* Make sure we have enough bandwidth for this alternate interface. + * Remove the current alt setting and add the new alt setting. +diff --git a/drivers/usb/core/quirks.c b/drivers/usb/core/quirks.c +index 99f67764765f..37a5e07b3488 100644 +--- a/drivers/usb/core/quirks.c ++++ b/drivers/usb/core/quirks.c +@@ -37,6 +37,10 @@ static const struct usb_device_id usb_quirk_list[] = { + /* CBM - Flash disk */ + { USB_DEVICE(0x0204, 0x6025), .driver_info = USB_QUIRK_RESET_RESUME }, + ++ /* WORLDE Controller KS49 or Prodipe MIDI 49C USB controller */ ++ { USB_DEVICE(0x0218, 0x0201), .driver_info = ++ USB_QUIRK_CONFIG_INTF_STRINGS }, ++ + /* WORLDE easy key (easykey.25) MIDI controller */ + { USB_DEVICE(0x0218, 0x0401), .driver_info = + USB_QUIRK_CONFIG_INTF_STRINGS }, +@@ -259,6 +263,9 @@ static const struct usb_device_id usb_quirk_list[] = { + { USB_DEVICE(0x2040, 0x7200), .driver_info = + USB_QUIRK_CONFIG_INTF_STRINGS }, + ++ /* DJI CineSSD */ ++ { USB_DEVICE(0x2ca3, 0x0031), .driver_info = USB_QUIRK_NO_LPM }, ++ + /* INTEL VALUE SSD */ + { USB_DEVICE(0x8086, 0xf1a5), .driver_info = USB_QUIRK_RESET_RESUME }, + +diff --git a/drivers/usb/gadget/udc/net2280.c b/drivers/usb/gadget/udc/net2280.c +index d133252ef2c3..7a8c36642293 100644 +--- a/drivers/usb/gadget/udc/net2280.c ++++ b/drivers/usb/gadget/udc/net2280.c +@@ -1549,11 +1549,14 @@ static int net2280_pullup(struct usb_gadget *_gadget, int is_on) + writel(tmp | BIT(USB_DETECT_ENABLE), &dev->usb->usbctl); + } else { + writel(tmp & ~BIT(USB_DETECT_ENABLE), &dev->usb->usbctl); +- stop_activity(dev, dev->driver); ++ stop_activity(dev, NULL); + } + + spin_unlock_irqrestore(&dev->lock, flags); + ++ if (!is_on && dev->driver) ++ dev->driver->disconnect(&dev->gadget); ++ + return 0; + } + +@@ -2470,8 +2473,11 @@ static void stop_activity(struct net2280 *dev, struct usb_gadget_driver *driver) + nuke(&dev->ep[i]); + + /* report disconnect; the driver is already quiesced */ +- if (driver) ++ if (driver) { ++ spin_unlock(&dev->lock); + driver->disconnect(&dev->gadget); ++ spin_lock(&dev->lock); ++ } + + usb_reinit(dev); + } +@@ -3345,6 +3351,8 @@ next_endpoints: + BIT(PCI_RETRY_ABORT_INTERRUPT)) + + static void handle_stat1_irqs(struct net2280 *dev, u32 stat) ++__releases(dev->lock) ++__acquires(dev->lock) + { + struct net2280_ep *ep; + u32 tmp, num, mask, scratch; +@@ -3385,12 +3393,14 @@ static void handle_stat1_irqs(struct net2280 *dev, u32 stat) + if (disconnect || reset) { + stop_activity(dev, dev->driver); + ep0_start(dev); ++ spin_unlock(&dev->lock); + if (reset) + usb_gadget_udc_reset + (&dev->gadget, dev->driver); + else + (dev->driver->disconnect) + (&dev->gadget); ++ spin_lock(&dev->lock); + return; + } + } +@@ -3409,6 +3419,7 @@ static void handle_stat1_irqs(struct net2280 *dev, u32 stat) + tmp = BIT(SUSPEND_REQUEST_CHANGE_INTERRUPT); + if (stat & tmp) { + writel(tmp, &dev->regs->irqstat1); ++ spin_unlock(&dev->lock); + if (stat & BIT(SUSPEND_REQUEST_INTERRUPT)) { + if (dev->driver->suspend) + dev->driver->suspend(&dev->gadget); +@@ -3419,6 +3430,7 @@ static void handle_stat1_irqs(struct net2280 *dev, u32 stat) + dev->driver->resume(&dev->gadget); + /* at high speed, note erratum 0133 */ + } ++ spin_lock(&dev->lock); + stat &= ~tmp; + } + +diff --git a/drivers/usb/gadget/udc/renesas_usb3.c b/drivers/usb/gadget/udc/renesas_usb3.c +index b1ae944c83a9..924c08ab0724 100644 +--- a/drivers/usb/gadget/udc/renesas_usb3.c ++++ b/drivers/usb/gadget/udc/renesas_usb3.c +@@ -628,12 +628,15 @@ static void usb3_irq_epc_int_1_speed(struct renesas_usb3 *usb3) + switch (speed) { + case USB_STA_SPEED_SS: + usb3->gadget.speed = USB_SPEED_SUPER; ++ usb3->gadget.ep0->maxpacket = USB3_EP0_SS_MAX_PACKET_SIZE; + break; + case USB_STA_SPEED_HS: + usb3->gadget.speed = USB_SPEED_HIGH; ++ usb3->gadget.ep0->maxpacket = USB3_EP0_HSFS_MAX_PACKET_SIZE; + break; + case USB_STA_SPEED_FS: + usb3->gadget.speed = USB_SPEED_FULL; ++ usb3->gadget.ep0->maxpacket = USB3_EP0_HSFS_MAX_PACKET_SIZE; + break; + default: + usb3->gadget.speed = USB_SPEED_UNKNOWN; +@@ -1858,7 +1861,7 @@ static int renesas_usb3_init_ep(struct renesas_usb3 *usb3, struct device *dev, + /* for control pipe */ + usb3->gadget.ep0 = &usb3_ep->ep; + usb_ep_set_maxpacket_limit(&usb3_ep->ep, +- USB3_EP0_HSFS_MAX_PACKET_SIZE); ++ USB3_EP0_SS_MAX_PACKET_SIZE); + usb3_ep->ep.caps.type_control = true; + usb3_ep->ep.caps.dir_in = true; + usb3_ep->ep.caps.dir_out = true; +diff --git a/drivers/usb/host/u132-hcd.c b/drivers/usb/host/u132-hcd.c +index 43d52931b5bf..43618976d68a 100644 +--- a/drivers/usb/host/u132-hcd.c ++++ b/drivers/usb/host/u132-hcd.c +@@ -2559,7 +2559,7 @@ static int u132_get_frame(struct usb_hcd *hcd) + } else { + int frame = 0; + dev_err(&u132->platform_dev->dev, "TODO: u132_get_frame\n"); +- msleep(100); ++ mdelay(100); + return frame; + } + } +diff --git a/drivers/usb/misc/uss720.c b/drivers/usb/misc/uss720.c +index 9ff66525924e..e77465a30ac6 100644 +--- a/drivers/usb/misc/uss720.c ++++ b/drivers/usb/misc/uss720.c +@@ -385,7 +385,7 @@ static unsigned char parport_uss720_frob_control(struct parport *pp, unsigned ch + mask &= 0x0f; + val &= 0x0f; + d = (priv->reg[1] & (~mask)) ^ val; +- if (set_1284_register(pp, 2, d, GFP_KERNEL)) ++ if (set_1284_register(pp, 2, d, GFP_ATOMIC)) + return 0; + priv->reg[1] = d; + return d & 0xf; +@@ -395,7 +395,7 @@ static unsigned char parport_uss720_read_status(struct parport *pp) + { + unsigned char ret; + +- if (get_1284_register(pp, 1, &ret, GFP_KERNEL)) ++ if (get_1284_register(pp, 1, &ret, GFP_ATOMIC)) + return 0; + return ret & 0xf8; + } +diff --git a/drivers/usb/misc/yurex.c b/drivers/usb/misc/yurex.c +index f36968ee2e70..e36c6c6452cd 100644 +--- a/drivers/usb/misc/yurex.c ++++ b/drivers/usb/misc/yurex.c +@@ -431,13 +431,13 @@ static ssize_t yurex_write(struct file *file, const char __user *user_buffer, + { + struct usb_yurex *dev; + int i, set = 0, retval = 0; +- char buffer[16]; ++ char buffer[16 + 1]; + char *data = buffer; + unsigned long long c, c2 = 0; + signed long timeout = 0; + DEFINE_WAIT(wait); + +- count = min(sizeof(buffer), count); ++ count = min(sizeof(buffer) - 1, count); + dev = file->private_data; + + /* verify that we actually have some data to write */ +@@ -456,6 +456,7 @@ static ssize_t yurex_write(struct file *file, const char __user *user_buffer, + retval = -EFAULT; + goto error; + } ++ buffer[count] = 0; + memset(dev->cntl_buffer, CMD_PADDING, YUREX_BUF_SIZE); + + switch (buffer[0]) { +diff --git a/drivers/usb/serial/io_ti.h b/drivers/usb/serial/io_ti.h +index 1bd67b24f916..bc9ff5ebd67c 100644 +--- a/drivers/usb/serial/io_ti.h ++++ b/drivers/usb/serial/io_ti.h +@@ -178,7 +178,7 @@ struct ump_interrupt { + } __attribute__((packed)); + + +-#define TIUMP_GET_PORT_FROM_CODE(c) (((c) >> 4) - 3) ++#define TIUMP_GET_PORT_FROM_CODE(c) (((c) >> 6) & 0x01) + #define TIUMP_GET_FUNC_FROM_CODE(c) ((c) & 0x0f) + #define TIUMP_INTERRUPT_CODE_LSR 0x03 + #define TIUMP_INTERRUPT_CODE_MSR 0x04 +diff --git a/drivers/usb/serial/ti_usb_3410_5052.c b/drivers/usb/serial/ti_usb_3410_5052.c +index 6bcb874b4832..836cb93ba49e 100644 +--- a/drivers/usb/serial/ti_usb_3410_5052.c ++++ b/drivers/usb/serial/ti_usb_3410_5052.c +@@ -1129,7 +1129,7 @@ static void ti_break(struct tty_struct *tty, int break_state) + + static int ti_get_port_from_code(unsigned char code) + { +- return (code >> 4) - 3; ++ return (code >> 6) & 0x01; + } + + static int ti_get_func_from_code(unsigned char code) +diff --git a/drivers/usb/storage/scsiglue.c b/drivers/usb/storage/scsiglue.c +index 8cd2926fb1fe..344ec8631481 100644 +--- a/drivers/usb/storage/scsiglue.c ++++ b/drivers/usb/storage/scsiglue.c +@@ -392,6 +392,15 @@ static int queuecommand_lck(struct scsi_cmnd *srb, + return 0; + } + ++ if ((us->fflags & US_FL_NO_ATA_1X) && ++ (srb->cmnd[0] == ATA_12 || srb->cmnd[0] == ATA_16)) { ++ memcpy(srb->sense_buffer, usb_stor_sense_invalidCDB, ++ sizeof(usb_stor_sense_invalidCDB)); ++ srb->result = SAM_STAT_CHECK_CONDITION; ++ done(srb); ++ return 0; ++ } ++ + /* enqueue the command and wake up the control thread */ + srb->scsi_done = done; + us->srb = srb; +diff --git a/drivers/usb/storage/uas.c b/drivers/usb/storage/uas.c +index 8dd200f92020..64af88977b03 100644 +--- a/drivers/usb/storage/uas.c ++++ b/drivers/usb/storage/uas.c +@@ -842,6 +842,27 @@ static int uas_slave_configure(struct scsi_device *sdev) + sdev->skip_ms_page_8 = 1; + sdev->wce_default_on = 1; + } ++ ++ /* ++ * Some disks return the total number of blocks in response ++ * to READ CAPACITY rather than the highest block number. ++ * If this device makes that mistake, tell the sd driver. ++ */ ++ if (devinfo->flags & US_FL_FIX_CAPACITY) ++ sdev->fix_capacity = 1; ++ ++ /* ++ * Some devices don't like MODE SENSE with page=0x3f, ++ * which is the command used for checking if a device ++ * is write-protected. Now that we tell the sd driver ++ * to do a 192-byte transfer with this command the ++ * majority of devices work fine, but a few still can't ++ * handle it. The sd driver will simply assume those ++ * devices are write-enabled. ++ */ ++ if (devinfo->flags & US_FL_NO_WP_DETECT) ++ sdev->skip_ms_page_3f = 1; ++ + scsi_change_queue_depth(sdev, devinfo->qdepth - 2); + return 0; + } +diff --git a/drivers/usb/storage/unusual_devs.h b/drivers/usb/storage/unusual_devs.h +index fc5ed351defb..0a86b3f3638e 100644 +--- a/drivers/usb/storage/unusual_devs.h ++++ b/drivers/usb/storage/unusual_devs.h +@@ -2307,6 +2307,13 @@ UNUSUAL_DEV( 0x2735, 0x100b, 0x0000, 0x9999, + USB_SC_DEVICE, USB_PR_DEVICE, NULL, + US_FL_GO_SLOW ), + ++/* Reported-by: Tim Anderson <[email protected]> */ ++UNUSUAL_DEV( 0x2ca3, 0x0031, 0x0000, 0x9999, ++ "DJI", ++ "CineSSD", ++ USB_SC_DEVICE, USB_PR_DEVICE, NULL, ++ US_FL_NO_ATA_1X), ++ + /* + * Reported by Frederic Marchal <[email protected]> + * Mio Moov 330 +diff --git a/drivers/video/fbdev/core/modedb.c b/drivers/video/fbdev/core/modedb.c +index 2510fa728d77..de119f11b78f 100644 +--- a/drivers/video/fbdev/core/modedb.c ++++ b/drivers/video/fbdev/core/modedb.c +@@ -644,7 +644,7 @@ static int fb_try_mode(struct fb_var_screeninfo *var, struct fb_info *info, + * + * Valid mode specifiers for @mode_option: + * +- * <xres>x<yres>[M][R][-<bpp>][@<refresh>][i][m] or ++ * <xres>x<yres>[M][R][-<bpp>][@<refresh>][i][p][m] or + * <name>[-<bpp>][@<refresh>] + * + * with <xres>, <yres>, <bpp> and <refresh> decimal numbers and +@@ -653,10 +653,10 @@ static int fb_try_mode(struct fb_var_screeninfo *var, struct fb_info *info, + * If 'M' is present after yres (and before refresh/bpp if present), + * the function will compute the timings using VESA(tm) Coordinated + * Video Timings (CVT). If 'R' is present after 'M', will compute with +- * reduced blanking (for flatpanels). If 'i' is present, compute +- * interlaced mode. If 'm' is present, add margins equal to 1.8% +- * of xres rounded down to 8 pixels, and 1.8% of yres. The char +- * 'i' and 'm' must be after 'M' and 'R'. Example: ++ * reduced blanking (for flatpanels). If 'i' or 'p' are present, compute ++ * interlaced or progressive mode. If 'm' is present, add margins equal ++ * to 1.8% of xres rounded down to 8 pixels, and 1.8% of yres. The chars ++ * 'i', 'p' and 'm' must be after 'M' and 'R'. Example: + * + * 1024x768MR-8@60m - Reduced blank with margins at 60Hz. + * +@@ -697,7 +697,8 @@ int fb_find_mode(struct fb_var_screeninfo *var, + unsigned int namelen = strlen(name); + int res_specified = 0, bpp_specified = 0, refresh_specified = 0; + unsigned int xres = 0, yres = 0, bpp = default_bpp, refresh = 0; +- int yres_specified = 0, cvt = 0, rb = 0, interlace = 0; ++ int yres_specified = 0, cvt = 0, rb = 0; ++ int interlace_specified = 0, interlace = 0; + int margins = 0; + u32 best, diff, tdiff; + +@@ -748,9 +749,17 @@ int fb_find_mode(struct fb_var_screeninfo *var, + if (!cvt) + margins = 1; + break; ++ case 'p': ++ if (!cvt) { ++ interlace = 0; ++ interlace_specified = 1; ++ } ++ break; + case 'i': +- if (!cvt) ++ if (!cvt) { + interlace = 1; ++ interlace_specified = 1; ++ } + break; + default: + goto done; +@@ -819,11 +828,21 @@ done: + if ((name_matches(db[i], name, namelen) || + (res_specified && res_matches(db[i], xres, yres))) && + !fb_try_mode(var, info, &db[i], bpp)) { +- if (refresh_specified && db[i].refresh == refresh) +- return 1; ++ const int db_interlace = (db[i].vmode & ++ FB_VMODE_INTERLACED ? 1 : 0); ++ int score = abs(db[i].refresh - refresh); ++ ++ if (interlace_specified) ++ score += abs(db_interlace - interlace); ++ ++ if (!interlace_specified || ++ db_interlace == interlace) ++ if (refresh_specified && ++ db[i].refresh == refresh) ++ return 1; + +- if (abs(db[i].refresh - refresh) < diff) { +- diff = abs(db[i].refresh - refresh); ++ if (score < diff) { ++ diff = score; + best = i; + } + } +diff --git a/drivers/video/fbdev/goldfishfb.c b/drivers/video/fbdev/goldfishfb.c +index 7f6c9e6cfc6c..14a93cb21310 100644 +--- a/drivers/video/fbdev/goldfishfb.c ++++ b/drivers/video/fbdev/goldfishfb.c +@@ -301,6 +301,7 @@ static int goldfish_fb_remove(struct platform_device *pdev) + dma_free_coherent(&pdev->dev, framesize, (void *)fb->fb.screen_base, + fb->fb.fix.smem_start); + iounmap(fb->reg_base); ++ kfree(fb); + return 0; + } + +diff --git a/drivers/video/fbdev/omap/omapfb_main.c b/drivers/video/fbdev/omap/omapfb_main.c +index 6429f33167f5..77c97c697fea 100644 +--- a/drivers/video/fbdev/omap/omapfb_main.c ++++ b/drivers/video/fbdev/omap/omapfb_main.c +@@ -956,7 +956,7 @@ int omapfb_register_client(struct omapfb_notifier_block *omapfb_nb, + { + int r; + +- if ((unsigned)omapfb_nb->plane_idx > OMAPFB_PLANE_NUM) ++ if ((unsigned)omapfb_nb->plane_idx >= OMAPFB_PLANE_NUM) + return -EINVAL; + + if (!notifier_inited) { +diff --git a/drivers/video/fbdev/pxafb.c b/drivers/video/fbdev/pxafb.c +index ef73f14d7ba0..8503310a3816 100644 +--- a/drivers/video/fbdev/pxafb.c ++++ b/drivers/video/fbdev/pxafb.c +@@ -2128,8 +2128,8 @@ static int of_get_pxafb_display(struct device *dev, struct device_node *disp, + return -EINVAL; + + ret = -ENOMEM; +- info->modes = kmalloc_array(timings->num_timings, +- sizeof(info->modes[0]), GFP_KERNEL); ++ info->modes = kcalloc(timings->num_timings, sizeof(info->modes[0]), ++ GFP_KERNEL); + if (!info->modes) + goto out; + info->num_modes = timings->num_timings; +diff --git a/drivers/video/fbdev/via/viafbdev.c b/drivers/video/fbdev/via/viafbdev.c +index badee04ef496..71b5dca95bdb 100644 +--- a/drivers/video/fbdev/via/viafbdev.c ++++ b/drivers/video/fbdev/via/viafbdev.c +@@ -19,6 +19,7 @@ + * 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA. + */ + ++#include <linux/compiler.h> + #include <linux/module.h> + #include <linux/seq_file.h> + #include <linux/slab.h> +@@ -1468,7 +1469,7 @@ static const struct file_operations viafb_vt1636_proc_fops = { + + #endif /* CONFIG_FB_VIA_DIRECT_PROCFS */ + +-static int viafb_sup_odev_proc_show(struct seq_file *m, void *v) ++static int __maybe_unused viafb_sup_odev_proc_show(struct seq_file *m, void *v) + { + via_odev_to_seq(m, supported_odev_map[ + viaparinfo->shared->chip_info.gfx_chip_name]); +diff --git a/fs/binfmt_elf.c b/fs/binfmt_elf.c +index a4fabf60d5ee..e7e25a86bbff 100644 +--- a/fs/binfmt_elf.c ++++ b/fs/binfmt_elf.c +@@ -1706,7 +1706,7 @@ static int fill_thread_core_info(struct elf_thread_core_info *t, + const struct user_regset *regset = &view->regsets[i]; + do_thread_regset_writeback(t->task, regset); + if (regset->core_note_type && regset->get && +- (!regset->active || regset->active(t->task, regset))) { ++ (!regset->active || regset->active(t->task, regset) > 0)) { + int ret; + size_t size = regset->n * regset->size; + void *data = kmalloc(size, GFP_KERNEL); +diff --git a/fs/cifs/readdir.c b/fs/cifs/readdir.c +index a27fc8791551..ef24b4527459 100644 +--- a/fs/cifs/readdir.c ++++ b/fs/cifs/readdir.c +@@ -376,8 +376,15 @@ static char *nxt_dir_entry(char *old_entry, char *end_of_smb, int level) + + new_entry = old_entry + sizeof(FIND_FILE_STANDARD_INFO) + + pfData->FileNameLength; +- } else +- new_entry = old_entry + le32_to_cpu(pDirInfo->NextEntryOffset); ++ } else { ++ u32 next_offset = le32_to_cpu(pDirInfo->NextEntryOffset); ++ ++ if (old_entry + next_offset < old_entry) { ++ cifs_dbg(VFS, "invalid offset %u\n", next_offset); ++ return NULL; ++ } ++ new_entry = old_entry + next_offset; ++ } + cifs_dbg(FYI, "new entry %p old entry %p\n", new_entry, old_entry); + /* validate that new_entry is not past end of SMB */ + if (new_entry >= end_of_smb) { +diff --git a/fs/cifs/smb2pdu.c b/fs/cifs/smb2pdu.c +index 383cf8148fe7..50251a8af0ce 100644 +--- a/fs/cifs/smb2pdu.c ++++ b/fs/cifs/smb2pdu.c +@@ -2565,33 +2565,38 @@ num_entries(char *bufstart, char *end_of_buf, char **lastentry, size_t size) + int len; + unsigned int entrycount = 0; + unsigned int next_offset = 0; +- FILE_DIRECTORY_INFO *entryptr; ++ char *entryptr; ++ FILE_DIRECTORY_INFO *dir_info; + + if (bufstart == NULL) + return 0; + +- entryptr = (FILE_DIRECTORY_INFO *)bufstart; ++ entryptr = bufstart; + + while (1) { +- entryptr = (FILE_DIRECTORY_INFO *) +- ((char *)entryptr + next_offset); +- +- if ((char *)entryptr + size > end_of_buf) { ++ if (entryptr + next_offset < entryptr || ++ entryptr + next_offset > end_of_buf || ++ entryptr + next_offset + size > end_of_buf) { + cifs_dbg(VFS, "malformed search entry would overflow\n"); + break; + } + +- len = le32_to_cpu(entryptr->FileNameLength); +- if ((char *)entryptr + len + size > end_of_buf) { ++ entryptr = entryptr + next_offset; ++ dir_info = (FILE_DIRECTORY_INFO *)entryptr; ++ ++ len = le32_to_cpu(dir_info->FileNameLength); ++ if (entryptr + len < entryptr || ++ entryptr + len > end_of_buf || ++ entryptr + len + size > end_of_buf) { + cifs_dbg(VFS, "directory entry name would overflow frame end of buf %p\n", + end_of_buf); + break; + } + +- *lastentry = (char *)entryptr; ++ *lastentry = entryptr; + entrycount++; + +- next_offset = le32_to_cpu(entryptr->NextEntryOffset); ++ next_offset = le32_to_cpu(dir_info->NextEntryOffset); + if (!next_offset) + break; + } +diff --git a/fs/configfs/dir.c b/fs/configfs/dir.c +index 56fb26127fef..d2a1a79fa324 100644 +--- a/fs/configfs/dir.c ++++ b/fs/configfs/dir.c +@@ -1777,6 +1777,16 @@ void configfs_unregister_group(struct config_group *group) + struct dentry *dentry = group->cg_item.ci_dentry; + struct dentry *parent = group->cg_item.ci_parent->ci_dentry; + ++ mutex_lock(&subsys->su_mutex); ++ if (!group->cg_item.ci_parent->ci_group) { ++ /* ++ * The parent has already been unlinked and detached ++ * due to a rmdir. ++ */ ++ goto unlink_group; ++ } ++ mutex_unlock(&subsys->su_mutex); ++ + inode_lock_nested(d_inode(parent), I_MUTEX_PARENT); + spin_lock(&configfs_dirent_lock); + configfs_detach_prep(dentry, NULL); +@@ -1791,6 +1801,7 @@ void configfs_unregister_group(struct config_group *group) + dput(dentry); + + mutex_lock(&subsys->su_mutex); ++unlink_group: + unlink_group(group); + mutex_unlock(&subsys->su_mutex); + } +diff --git a/fs/gfs2/bmap.c b/fs/gfs2/bmap.c +index fc5da4cbe88c..39af17b407f0 100644 +--- a/fs/gfs2/bmap.c ++++ b/fs/gfs2/bmap.c +@@ -1472,7 +1472,7 @@ int gfs2_write_alloc_required(struct gfs2_inode *ip, u64 offset, + end_of_file = (i_size_read(&ip->i_inode) + sdp->sd_sb.sb_bsize - 1) >> shift; + lblock = offset >> shift; + lblock_stop = (offset + len + sdp->sd_sb.sb_bsize - 1) >> shift; +- if (lblock_stop > end_of_file) ++ if (lblock_stop > end_of_file && ip != GFS2_I(sdp->sd_rindex)) + return 1; + + size = (lblock_stop - lblock) << shift; +diff --git a/fs/gfs2/rgrp.c b/fs/gfs2/rgrp.c +index 86ccc0159393..832824994aae 100644 +--- a/fs/gfs2/rgrp.c ++++ b/fs/gfs2/rgrp.c +@@ -1675,7 +1675,8 @@ static int gfs2_rbm_find(struct gfs2_rbm *rbm, u8 state, u32 *minext, + + while(1) { + bi = rbm_bi(rbm); +- if (test_bit(GBF_FULL, &bi->bi_flags) && ++ if ((ip == NULL || !gfs2_rs_active(&ip->i_res)) && ++ test_bit(GBF_FULL, &bi->bi_flags) && + (state == GFS2_BLKST_FREE)) + goto next_bitmap; + +diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c +index e7ca62a86dab..eb55ab6930b5 100644 +--- a/fs/nfs/nfs4proc.c ++++ b/fs/nfs/nfs4proc.c +@@ -2539,14 +2539,18 @@ static void nfs41_check_delegation_stateid(struct nfs4_state *state) + } + + nfs4_stateid_copy(&stateid, &delegation->stateid); +- if (test_bit(NFS_DELEGATION_REVOKED, &delegation->flags) || +- !test_and_clear_bit(NFS_DELEGATION_TEST_EXPIRED, +- &delegation->flags)) { ++ if (test_bit(NFS_DELEGATION_REVOKED, &delegation->flags)) { + rcu_read_unlock(); + nfs_finish_clear_delegation_stateid(state, &stateid); + return; + } + ++ if (!test_and_clear_bit(NFS_DELEGATION_TEST_EXPIRED, ++ &delegation->flags)) { ++ rcu_read_unlock(); ++ return; ++ } ++ + cred = get_rpccred(delegation->cred); + rcu_read_unlock(); + status = nfs41_test_and_free_expired_stateid(server, &stateid, cred); +diff --git a/fs/nfs/nfs4state.c b/fs/nfs/nfs4state.c +index 353691366fca..857af951831f 100644 +--- a/fs/nfs/nfs4state.c ++++ b/fs/nfs/nfs4state.c +@@ -1336,6 +1336,8 @@ int nfs4_schedule_stateid_recovery(const struct nfs_server *server, struct nfs4_ + + if (!nfs4_state_mark_reclaim_nograce(clp, state)) + return -EBADF; ++ nfs_inode_find_delegation_state_and_recover(state->inode, ++ &state->stateid); + dprintk("%s: scheduling stateid recovery for server %s\n", __func__, + clp->cl_hostname); + nfs4_schedule_state_manager(clp); +diff --git a/fs/pstore/ram_core.c b/fs/pstore/ram_core.c +index e11672aa4575..ecdb3baa1283 100644 +--- a/fs/pstore/ram_core.c ++++ b/fs/pstore/ram_core.c +@@ -421,7 +421,12 @@ static void *persistent_ram_vmap(phys_addr_t start, size_t size, + vaddr = vmap(pages, page_count, VM_MAP, prot); + kfree(pages); + +- return vaddr; ++ /* ++ * Since vmap() uses page granularity, we must add the offset ++ * into the page here, to get the byte granularity address ++ * into the mapping to represent the actual "start" location. ++ */ ++ return vaddr + offset_in_page(start); + } + + static void *persistent_ram_iomap(phys_addr_t start, size_t size, +@@ -440,6 +445,11 @@ static void *persistent_ram_iomap(phys_addr_t start, size_t size, + else + va = ioremap_wc(start, size); + ++ /* ++ * Since request_mem_region() and ioremap() are byte-granularity ++ * there is no need handle anything special like we do when the ++ * vmap() case in persistent_ram_vmap() above. ++ */ + return va; + } + +@@ -460,7 +470,7 @@ static int persistent_ram_buffer_map(phys_addr_t start, phys_addr_t size, + return -ENOMEM; + } + +- prz->buffer = prz->vaddr + offset_in_page(start); ++ prz->buffer = prz->vaddr; + prz->buffer_size = size - sizeof(struct persistent_ram_buffer); + + return 0; +@@ -507,7 +517,8 @@ void persistent_ram_free(struct persistent_ram_zone *prz) + + if (prz->vaddr) { + if (pfn_valid(prz->paddr >> PAGE_SHIFT)) { +- vunmap(prz->vaddr); ++ /* We must vunmap() at page-granularity. */ ++ vunmap(prz->vaddr - offset_in_page(prz->paddr)); + } else { + iounmap(prz->vaddr); + release_mem_region(prz->paddr, prz->size); +diff --git a/include/linux/crypto.h b/include/linux/crypto.h +index 8edb3ba6f640..9de26962338e 100644 +--- a/include/linux/crypto.h ++++ b/include/linux/crypto.h +@@ -108,6 +108,11 @@ + */ + #define CRYPTO_ALG_OPTIONAL_KEY 0x00004000 + ++/* ++ * Don't trigger module loading ++ */ ++#define CRYPTO_NOLOAD 0x00008000 ++ + /* + * Transform masks and values (for crt_flags). + */ +diff --git a/include/linux/mlx5/driver.h b/include/linux/mlx5/driver.h +index 7751d72a6a40..859fd209603a 100644 +--- a/include/linux/mlx5/driver.h ++++ b/include/linux/mlx5/driver.h +@@ -786,7 +786,7 @@ void mlx5_unmap_free_uar(struct mlx5_core_dev *mdev, struct mlx5_uar *uar); + void mlx5_health_cleanup(struct mlx5_core_dev *dev); + int mlx5_health_init(struct mlx5_core_dev *dev); + void mlx5_start_health_poll(struct mlx5_core_dev *dev); +-void mlx5_stop_health_poll(struct mlx5_core_dev *dev); ++void mlx5_stop_health_poll(struct mlx5_core_dev *dev, bool disable_health); + void mlx5_drain_health_wq(struct mlx5_core_dev *dev); + void mlx5_drain_health_recovery(struct mlx5_core_dev *dev); + int mlx5_buf_alloc_node(struct mlx5_core_dev *dev, int size, +diff --git a/kernel/audit_watch.c b/kernel/audit_watch.c +index 690e1e3c59f7..f036b6ada6ef 100644 +--- a/kernel/audit_watch.c ++++ b/kernel/audit_watch.c +@@ -419,6 +419,13 @@ int audit_add_watch(struct audit_krule *krule, struct list_head **list) + struct path parent_path; + int h, ret = 0; + ++ /* ++ * When we will be calling audit_add_to_parent, krule->watch might have ++ * been updated and watch might have been freed. ++ * So we need to keep a reference of watch. ++ */ ++ audit_get_watch(watch); ++ + mutex_unlock(&audit_filter_mutex); + + /* Avoid calling path_lookup under audit_filter_mutex. */ +@@ -427,8 +434,10 @@ int audit_add_watch(struct audit_krule *krule, struct list_head **list) + /* caller expects mutex locked */ + mutex_lock(&audit_filter_mutex); + +- if (ret) ++ if (ret) { ++ audit_put_watch(watch); + return ret; ++ } + + /* either find an old parent or attach a new one */ + parent = audit_find_parent(d_backing_inode(parent_path.dentry)); +@@ -446,6 +455,7 @@ int audit_add_watch(struct audit_krule *krule, struct list_head **list) + *list = &audit_inode_hash[h]; + error: + path_put(&parent_path); ++ audit_put_watch(watch); + return ret; + } + +diff --git a/kernel/events/core.c b/kernel/events/core.c +index 6e6ec229c780..95bd00d9f2c3 100644 +--- a/kernel/events/core.c ++++ b/kernel/events/core.c +@@ -5563,6 +5563,7 @@ perf_output_sample_ustack(struct perf_output_handle *handle, u64 dump_size, + unsigned long sp; + unsigned int rem; + u64 dyn_size; ++ mm_segment_t fs; + + /* + * We dump: +@@ -5580,7 +5581,10 @@ perf_output_sample_ustack(struct perf_output_handle *handle, u64 dump_size, + + /* Data. */ + sp = perf_user_stack_pointer(regs); ++ fs = get_fs(); ++ set_fs(USER_DS); + rem = __output_copy_user(handle, (void *) sp, dump_size); ++ set_fs(fs); + dyn_size = dump_size - rem; + + perf_output_skip(handle, rem); +diff --git a/net/mac80211/cfg.c b/net/mac80211/cfg.c +index d7801f6877af..e63fd12f923a 100644 +--- a/net/mac80211/cfg.c ++++ b/net/mac80211/cfg.c +@@ -454,7 +454,7 @@ static int ieee80211_del_key(struct wiphy *wiphy, struct net_device *dev, + goto out_unlock; + } + +- ieee80211_key_free(key, true); ++ ieee80211_key_free(key, sdata->vif.type == NL80211_IFTYPE_STATION); + + ret = 0; + out_unlock: +diff --git a/net/mac80211/key.c b/net/mac80211/key.c +index 4c625a325ce2..6e02f8dfce2b 100644 +--- a/net/mac80211/key.c ++++ b/net/mac80211/key.c +@@ -648,11 +648,15 @@ int ieee80211_key_link(struct ieee80211_key *key, + { + struct ieee80211_local *local = sdata->local; + struct ieee80211_key *old_key; +- int idx, ret; +- bool pairwise; +- +- pairwise = key->conf.flags & IEEE80211_KEY_FLAG_PAIRWISE; +- idx = key->conf.keyidx; ++ int idx = key->conf.keyidx; ++ bool pairwise = key->conf.flags & IEEE80211_KEY_FLAG_PAIRWISE; ++ /* ++ * We want to delay tailroom updates only for station - in that ++ * case it helps roaming speed, but in other cases it hurts and ++ * can cause warnings to appear. ++ */ ++ bool delay_tailroom = sdata->vif.type == NL80211_IFTYPE_STATION; ++ int ret; + + mutex_lock(&sdata->local->key_mtx); + +@@ -680,14 +684,14 @@ int ieee80211_key_link(struct ieee80211_key *key, + increment_tailroom_need_count(sdata); + + ieee80211_key_replace(sdata, sta, pairwise, old_key, key); +- ieee80211_key_destroy(old_key, true); ++ ieee80211_key_destroy(old_key, delay_tailroom); + + ieee80211_debugfs_key_add(key); + + if (!local->wowlan) { + ret = ieee80211_key_enable_hw_accel(key); + if (ret) +- ieee80211_key_free(key, true); ++ ieee80211_key_free(key, delay_tailroom); + } else { + ret = 0; + } +@@ -922,7 +926,8 @@ void ieee80211_free_sta_keys(struct ieee80211_local *local, + ieee80211_key_replace(key->sdata, key->sta, + key->conf.flags & IEEE80211_KEY_FLAG_PAIRWISE, + key, NULL); +- __ieee80211_key_destroy(key, true); ++ __ieee80211_key_destroy(key, key->sdata->vif.type == ++ NL80211_IFTYPE_STATION); + } + + for (i = 0; i < NUM_DEFAULT_KEYS; i++) { +@@ -932,7 +937,8 @@ void ieee80211_free_sta_keys(struct ieee80211_local *local, + ieee80211_key_replace(key->sdata, key->sta, + key->conf.flags & IEEE80211_KEY_FLAG_PAIRWISE, + key, NULL); +- __ieee80211_key_destroy(key, true); ++ __ieee80211_key_destroy(key, key->sdata->vif.type == ++ NL80211_IFTYPE_STATION); + } + + mutex_unlock(&local->key_mtx); +diff --git a/net/rds/bind.c b/net/rds/bind.c +index adb53ae97a02..cc7e3a138598 100644 +--- a/net/rds/bind.c ++++ b/net/rds/bind.c +@@ -60,11 +60,13 @@ struct rds_sock *rds_find_bound(__be32 addr, __be16 port) + u64 key = ((u64)addr << 32) | port; + struct rds_sock *rs; + +- rs = rhashtable_lookup_fast(&bind_hash_table, &key, ht_parms); ++ rcu_read_lock(); ++ rs = rhashtable_lookup(&bind_hash_table, &key, ht_parms); + if (rs && !sock_flag(rds_rs_to_sk(rs), SOCK_DEAD)) + rds_sock_addref(rs); + else + rs = NULL; ++ rcu_read_unlock(); + + rdsdebug("returning rs %p for %pI4:%u\n", rs, &addr, + ntohs(port)); +@@ -157,6 +159,7 @@ int rds_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len) + goto out; + } + ++ sock_set_flag(sk, SOCK_RCU_FREE); + ret = rds_add_bound(rs, sin->sin_addr.s_addr, &sin->sin_port); + if (ret) + goto out; +diff --git a/net/xfrm/xfrm_policy.c b/net/xfrm/xfrm_policy.c +index 1f943d97dc29..d0dcfc68c043 100644 +--- a/net/xfrm/xfrm_policy.c ++++ b/net/xfrm/xfrm_policy.c +@@ -1873,7 +1873,10 @@ xfrm_resolve_and_create_bundle(struct xfrm_policy **pols, int num_pols, + /* Try to instantiate a bundle */ + err = xfrm_tmpl_resolve(pols, num_pols, fl, xfrm, family); + if (err <= 0) { +- if (err != 0 && err != -EAGAIN) ++ if (err == 0) ++ return NULL; ++ ++ if (err != -EAGAIN) + XFRM_INC_STATS(net, LINUX_MIB_XFRMOUTPOLERROR); + return ERR_PTR(err); + } +diff --git a/scripts/Kbuild.include b/scripts/Kbuild.include +index 63774307a751..8f8965608ee3 100644 +--- a/scripts/Kbuild.include ++++ b/scripts/Kbuild.include +@@ -394,3 +394,6 @@ endif + endef + # + ############################################################################### ++ ++# delete partially updated (i.e. corrupted) files on error ++.DELETE_ON_ERROR: +diff --git a/security/integrity/evm/evm_crypto.c b/security/integrity/evm/evm_crypto.c +index bf663915412e..6fcbd8e99baf 100644 +--- a/security/integrity/evm/evm_crypto.c ++++ b/security/integrity/evm/evm_crypto.c +@@ -94,7 +94,8 @@ static struct shash_desc *init_desc(char type) + mutex_lock(&mutex); + if (*tfm) + goto out; +- *tfm = crypto_alloc_shash(algo, 0, CRYPTO_ALG_ASYNC); ++ *tfm = crypto_alloc_shash(algo, 0, ++ CRYPTO_ALG_ASYNC | CRYPTO_NOLOAD); + if (IS_ERR(*tfm)) { + rc = PTR_ERR(*tfm); + pr_err("Can not allocate %s (reason: %ld)\n", algo, rc); +diff --git a/security/smack/smack_lsm.c b/security/smack/smack_lsm.c +index ca3ea985c100..fb7c534fb57d 100644 +--- a/security/smack/smack_lsm.c ++++ b/security/smack/smack_lsm.c +@@ -3966,15 +3966,19 @@ static int smack_socket_sock_rcv_skb(struct sock *sk, struct sk_buff *skb) + struct smack_known *skp = NULL; + int rc = 0; + struct smk_audit_info ad; ++ u16 family = sk->sk_family; + #ifdef CONFIG_AUDIT + struct lsm_network_audit net; + #endif + #if IS_ENABLED(CONFIG_IPV6) + struct sockaddr_in6 sadd; + int proto; ++ ++ if (family == PF_INET6 && skb->protocol == htons(ETH_P_IP)) ++ family = PF_INET; + #endif /* CONFIG_IPV6 */ + +- switch (sk->sk_family) { ++ switch (family) { + case PF_INET: + #ifdef CONFIG_SECURITY_SMACK_NETFILTER + /* +@@ -3992,7 +3996,7 @@ static int smack_socket_sock_rcv_skb(struct sock *sk, struct sk_buff *skb) + */ + netlbl_secattr_init(&secattr); + +- rc = netlbl_skbuff_getattr(skb, sk->sk_family, &secattr); ++ rc = netlbl_skbuff_getattr(skb, family, &secattr); + if (rc == 0) + skp = smack_from_secattr(&secattr, ssp); + else +@@ -4005,7 +4009,7 @@ access_check: + #endif + #ifdef CONFIG_AUDIT + smk_ad_init_net(&ad, __func__, LSM_AUDIT_DATA_NET, &net); +- ad.a.u.net->family = sk->sk_family; ++ ad.a.u.net->family = family; + ad.a.u.net->netif = skb->skb_iif; + ipv4_skb_to_auditdata(skb, &ad.a, NULL); + #endif +@@ -4019,7 +4023,7 @@ access_check: + rc = smk_bu_note("IPv4 delivery", skp, ssp->smk_in, + MAY_WRITE, rc); + if (rc != 0) +- netlbl_skbuff_err(skb, sk->sk_family, rc, 0); ++ netlbl_skbuff_err(skb, family, rc, 0); + break; + #if IS_ENABLED(CONFIG_IPV6) + case PF_INET6: +@@ -4035,7 +4039,7 @@ access_check: + skp = smack_net_ambient; + #ifdef CONFIG_AUDIT + smk_ad_init_net(&ad, __func__, LSM_AUDIT_DATA_NET, &net); +- ad.a.u.net->family = sk->sk_family; ++ ad.a.u.net->family = family; + ad.a.u.net->netif = skb->skb_iif; + ipv6_skb_to_auditdata(skb, &ad.a, NULL); + #endif /* CONFIG_AUDIT */ +diff --git a/sound/core/pcm_lib.c b/sound/core/pcm_lib.c +index 9306604f5070..f57a58ac7ae0 100644 +--- a/sound/core/pcm_lib.c ++++ b/sound/core/pcm_lib.c +@@ -648,27 +648,33 @@ EXPORT_SYMBOL(snd_interval_refine); + + static int snd_interval_refine_first(struct snd_interval *i) + { ++ const unsigned int last_max = i->max; ++ + if (snd_BUG_ON(snd_interval_empty(i))) + return -EINVAL; + if (snd_interval_single(i)) + return 0; + i->max = i->min; +- i->openmax = i->openmin; +- if (i->openmax) ++ if (i->openmin) + i->max++; ++ /* only exclude max value if also excluded before refine */ ++ i->openmax = (i->openmax && i->max >= last_max); + return 1; + } + + static int snd_interval_refine_last(struct snd_interval *i) + { ++ const unsigned int last_min = i->min; ++ + if (snd_BUG_ON(snd_interval_empty(i))) + return -EINVAL; + if (snd_interval_single(i)) + return 0; + i->min = i->max; +- i->openmin = i->openmax; +- if (i->openmin) ++ if (i->openmax) + i->min--; ++ /* only exclude min value if also excluded before refine */ ++ i->openmin = (i->openmin && i->min <= last_min); + return 1; + } + +diff --git a/sound/isa/msnd/msnd_pinnacle.c b/sound/isa/msnd/msnd_pinnacle.c +index a31ea6c22d19..2d7379dec1f0 100644 +--- a/sound/isa/msnd/msnd_pinnacle.c ++++ b/sound/isa/msnd/msnd_pinnacle.c +@@ -82,10 +82,10 @@ + + static void set_default_audio_parameters(struct snd_msnd *chip) + { +- chip->play_sample_size = DEFSAMPLESIZE; ++ chip->play_sample_size = snd_pcm_format_width(DEFSAMPLESIZE); + chip->play_sample_rate = DEFSAMPLERATE; + chip->play_channels = DEFCHANNELS; +- chip->capture_sample_size = DEFSAMPLESIZE; ++ chip->capture_sample_size = snd_pcm_format_width(DEFSAMPLESIZE); + chip->capture_sample_rate = DEFSAMPLERATE; + chip->capture_channels = DEFCHANNELS; + } +diff --git a/sound/usb/quirks-table.h b/sound/usb/quirks-table.h +index 69bf5cf1e91e..15cbe2565703 100644 +--- a/sound/usb/quirks-table.h ++++ b/sound/usb/quirks-table.h +@@ -2875,7 +2875,8 @@ YAMAHA_DEVICE(0x7010, "UB99"), + */ + + #define AU0828_DEVICE(vid, pid, vname, pname) { \ +- USB_DEVICE_VENDOR_SPEC(vid, pid), \ ++ .idVendor = vid, \ ++ .idProduct = pid, \ + .match_flags = USB_DEVICE_ID_MATCH_DEVICE | \ + USB_DEVICE_ID_MATCH_INT_CLASS | \ + USB_DEVICE_ID_MATCH_INT_SUBCLASS, \ +diff --git a/tools/hv/hv_kvp_daemon.c b/tools/hv/hv_kvp_daemon.c +index 60a94b3e532e..177480066816 100644 +--- a/tools/hv/hv_kvp_daemon.c ++++ b/tools/hv/hv_kvp_daemon.c +@@ -286,7 +286,7 @@ static int kvp_key_delete(int pool, const __u8 *key, int key_size) + * Found a match; just move the remaining + * entries up. + */ +- if (i == num_records) { ++ if (i == (num_records - 1)) { + kvp_file_info[pool].num_records--; + kvp_update_file(pool); + return 0; +diff --git a/tools/perf/arch/powerpc/util/skip-callchain-idx.c b/tools/perf/arch/powerpc/util/skip-callchain-idx.c +index bd630c222e65..9a53f6e9ef43 100644 +--- a/tools/perf/arch/powerpc/util/skip-callchain-idx.c ++++ b/tools/perf/arch/powerpc/util/skip-callchain-idx.c +@@ -58,9 +58,13 @@ static int check_return_reg(int ra_regno, Dwarf_Frame *frame) + } + + /* +- * Check if return address is on the stack. ++ * Check if return address is on the stack. If return address ++ * is in a register (typically R0), it is yet to be saved on ++ * the stack. + */ +- if (nops != 0 || ops != NULL) ++ if ((nops != 0 || ops != NULL) && ++ !(nops == 1 && ops[0].atom == DW_OP_regx && ++ ops[0].number2 == 0 && ops[0].offset == 0)) + return 0; + + /* +@@ -246,7 +250,7 @@ int arch_skip_callchain_idx(struct thread *thread, struct ip_callchain *chain) + if (!chain || chain->nr < 3) + return skip_slot; + +- ip = chain->ips[2]; ++ ip = chain->ips[1]; + + thread__find_addr_location(thread, PERF_RECORD_MISC_USER, + MAP__FUNCTION, ip, &al); +diff --git a/tools/perf/tests/builtin-test.c b/tools/perf/tests/builtin-test.c +index 778668a2a966..ade7213943ad 100644 +--- a/tools/perf/tests/builtin-test.c ++++ b/tools/perf/tests/builtin-test.c +@@ -413,7 +413,7 @@ static int __cmd_test(int argc, const char *argv[], struct intlist *skiplist) + for (subi = 0; subi < subn; subi++) { + pr_info("%2d.%1d: %-*s:", i, subi + 1, subw, + t->subtest.get_desc(subi)); +- err = test_and_print(t, skip, subi); ++ err = test_and_print(t, skip, subi + 1); + if (err != TEST_OK && t->subtest.skip_if_fail) + skip = true; + } +diff --git a/tools/testing/selftests/timers/raw_skew.c b/tools/testing/selftests/timers/raw_skew.c +index 30906bfd9c1b..0ab937a17ebb 100644 +--- a/tools/testing/selftests/timers/raw_skew.c ++++ b/tools/testing/selftests/timers/raw_skew.c +@@ -146,6 +146,11 @@ int main(int argv, char **argc) + printf(" %lld.%i(act)", ppm/1000, abs((int)(ppm%1000))); + + if (llabs(eppm - ppm) > 1000) { ++ if (tx1.offset || tx2.offset || ++ tx1.freq != tx2.freq || tx1.tick != tx2.tick) { ++ printf(" [SKIP]\n"); ++ return ksft_exit_skip("The clock was adjusted externally. Shutdown NTPd or other time sync daemons\n"); ++ } + printf(" [FAILED]\n"); + return ksft_exit_fail(); + } +diff --git a/virt/kvm/arm/vgic/vgic-init.c b/virt/kvm/arm/vgic/vgic-init.c +index 539d3f5cb619..80d8888549ee 100644 +--- a/virt/kvm/arm/vgic/vgic-init.c ++++ b/virt/kvm/arm/vgic/vgic-init.c +@@ -241,6 +241,10 @@ int vgic_init(struct kvm *kvm) + if (vgic_initialized(kvm)) + return 0; + ++ /* Are we also in the middle of creating a VCPU? */ ++ if (kvm->created_vcpus != atomic_read(&kvm->online_vcpus)) ++ return -EBUSY; ++ + /* freeze the number of spis */ + if (!dist->nr_spis) + dist->nr_spis = VGIC_NR_IRQS_LEGACY - VGIC_NR_PRIVATE_IRQS;
