commit: 448adb6e2a2b7b3d07f3dc00a3cd61158482584b Author: Mike Pagano <mpagano <AT> gentoo <DOT> org> AuthorDate: Sat Sep 15 10:10:19 2018 +0000 Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org> CommitDate: Wed Nov 14 14:36:59 2018 +0000 URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=448adb6e
Linux patch 4.9.127 Signed-off-by: Mike Pagano <mpagano <AT> gentoo.org> 0000_README | 4 + 1126_linux-4.9.127.patch | 1973 ++++++++++++++++++++++++++++++++++++++++++++++ 2 files changed, 1977 insertions(+) diff --git a/0000_README b/0000_README index eaa2495..ad1fe4a 100644 --- a/0000_README +++ b/0000_README @@ -547,6 +547,10 @@ Patch: 1125_linux-4.9.126.patch From: http://www.kernel.org Desc: Linux 4.9.126 +Patch: 1126_linux-4.9.127.patch +From: http://www.kernel.org +Desc: Linux 4.9.127 + Patch: 1500_XATTR_USER_PREFIX.patch From: https://bugs.gentoo.org/show_bug.cgi?id=470644 Desc: Support for namespace user.pax.* on tmpfs. diff --git a/1126_linux-4.9.127.patch b/1126_linux-4.9.127.patch new file mode 100644 index 0000000..0cd0eae --- /dev/null +++ b/1126_linux-4.9.127.patch @@ -0,0 +1,1973 @@ +diff --git a/Makefile b/Makefile +index b26481fef3f0..4e37716ae395 100644 +--- a/Makefile ++++ b/Makefile +@@ -1,6 +1,6 @@ + VERSION = 4 + PATCHLEVEL = 9 +-SUBLEVEL = 126 ++SUBLEVEL = 127 + EXTRAVERSION = + NAME = Roaring Lionus + +diff --git a/arch/arm/configs/imx_v6_v7_defconfig b/arch/arm/configs/imx_v6_v7_defconfig +index 6b7d4f535984..8ec4dbbb50b0 100644 +--- a/arch/arm/configs/imx_v6_v7_defconfig ++++ b/arch/arm/configs/imx_v6_v7_defconfig +@@ -271,7 +271,6 @@ CONFIG_USB_STORAGE=y + CONFIG_USB_CHIPIDEA=y + CONFIG_USB_CHIPIDEA_UDC=y + CONFIG_USB_CHIPIDEA_HOST=y +-CONFIG_USB_CHIPIDEA_ULPI=y + CONFIG_USB_SERIAL=m + CONFIG_USB_SERIAL_GENERIC=y + CONFIG_USB_SERIAL_FTDI_SIO=m +@@ -308,7 +307,6 @@ CONFIG_USB_GADGETFS=m + CONFIG_USB_FUNCTIONFS=m + CONFIG_USB_MASS_STORAGE=m + CONFIG_USB_G_SERIAL=m +-CONFIG_USB_ULPI_BUS=y + CONFIG_MMC=y + CONFIG_MMC_SDHCI=y + CONFIG_MMC_SDHCI_PLTFM=y +diff --git a/arch/arm/mach-rockchip/Kconfig b/arch/arm/mach-rockchip/Kconfig +index 9ad84cd01ba0..5ed8fa5a9825 100644 +--- a/arch/arm/mach-rockchip/Kconfig ++++ b/arch/arm/mach-rockchip/Kconfig +@@ -16,6 +16,7 @@ config ARCH_ROCKCHIP + select ROCKCHIP_TIMER + select ARM_GLOBAL_TIMER + select CLKSRC_ARM_GLOBAL_TIMER_SCHED_CLOCK ++ select PM + help + Support for Rockchip's Cortex-A9 Single-to-Quad-Core-SoCs + containing the RK2928, RK30xx and RK31xx series. +diff --git a/arch/arm64/Kconfig.platforms b/arch/arm64/Kconfig.platforms +index 08a4497f70a6..3428a4ba2ccd 100644 +--- a/arch/arm64/Kconfig.platforms ++++ b/arch/arm64/Kconfig.platforms +@@ -125,6 +125,7 @@ config ARCH_ROCKCHIP + select GPIOLIB + select PINCTRL + select PINCTRL_ROCKCHIP ++ select PM + select ROCKCHIP_TIMER + help + This enables support for the ARMv8 based Rockchip chipsets, +diff --git a/arch/arm64/include/asm/cachetype.h b/arch/arm64/include/asm/cachetype.h +index f5588692f1d4..877d4789dcb3 100644 +--- a/arch/arm64/include/asm/cachetype.h ++++ b/arch/arm64/include/asm/cachetype.h +@@ -22,6 +22,11 @@ + #define CTR_L1IP_MASK 3 + #define CTR_CWG_SHIFT 24 + #define CTR_CWG_MASK 15 ++#define CTR_DMINLINE_SHIFT 16 ++#define CTR_IMINLINE_SHIFT 0 ++ ++#define CTR_CACHE_MINLINE_MASK \ ++ ((0xf << CTR_DMINLINE_SHIFT) | (0xf << CTR_IMINLINE_SHIFT)) + + #define ICACHE_POLICY_RESERVED 0 + #define ICACHE_POLICY_AIVIVT 1 +diff --git a/arch/arm64/include/asm/cpucaps.h b/arch/arm64/include/asm/cpucaps.h +index 7010779a1429..8c7c4b23a8b1 100644 +--- a/arch/arm64/include/asm/cpucaps.h ++++ b/arch/arm64/include/asm/cpucaps.h +@@ -37,7 +37,8 @@ + #define ARM64_UNMAP_KERNEL_AT_EL0 16 + #define ARM64_HARDEN_BRANCH_PREDICTOR 17 + #define ARM64_SSBD 18 ++#define ARM64_MISMATCHED_CACHE_TYPE 19 + +-#define ARM64_NCAPS 19 ++#define ARM64_NCAPS 20 + + #endif /* __ASM_CPUCAPS_H */ +diff --git a/arch/arm64/kernel/cpu_errata.c b/arch/arm64/kernel/cpu_errata.c +index 1db97ad7b58b..930e74d9fcbd 100644 +--- a/arch/arm64/kernel/cpu_errata.c ++++ b/arch/arm64/kernel/cpu_errata.c +@@ -17,6 +17,7 @@ + */ + + #include <linux/types.h> ++#include <asm/cachetype.h> + #include <asm/cpu.h> + #include <asm/cputype.h> + #include <asm/cpufeature.h> +@@ -31,12 +32,18 @@ is_affected_midr_range(const struct arm64_cpu_capabilities *entry, int scope) + } + + static bool +-has_mismatched_cache_line_size(const struct arm64_cpu_capabilities *entry, +- int scope) ++has_mismatched_cache_type(const struct arm64_cpu_capabilities *entry, ++ int scope) + { ++ u64 mask = CTR_CACHE_MINLINE_MASK; ++ ++ /* Skip matching the min line sizes for cache type check */ ++ if (entry->capability == ARM64_MISMATCHED_CACHE_TYPE) ++ mask ^= arm64_ftr_reg_ctrel0.strict_mask; ++ + WARN_ON(scope != SCOPE_LOCAL_CPU || preemptible()); +- return (read_cpuid_cachetype() & arm64_ftr_reg_ctrel0.strict_mask) != +- (arm64_ftr_reg_ctrel0.sys_val & arm64_ftr_reg_ctrel0.strict_mask); ++ return (read_cpuid_cachetype() & mask) != ++ (arm64_ftr_reg_ctrel0.sys_val & mask); + } + + static int cpu_enable_trap_ctr_access(void *__unused) +@@ -446,7 +453,14 @@ const struct arm64_cpu_capabilities arm64_errata[] = { + { + .desc = "Mismatched cache line size", + .capability = ARM64_MISMATCHED_CACHE_LINE_SIZE, +- .matches = has_mismatched_cache_line_size, ++ .matches = has_mismatched_cache_type, ++ .def_scope = SCOPE_LOCAL_CPU, ++ .enable = cpu_enable_trap_ctr_access, ++ }, ++ { ++ .desc = "Mismatched cache type", ++ .capability = ARM64_MISMATCHED_CACHE_TYPE, ++ .matches = has_mismatched_cache_type, + .def_scope = SCOPE_LOCAL_CPU, + .enable = cpu_enable_trap_ctr_access, + }, +diff --git a/arch/arm64/kernel/cpufeature.c b/arch/arm64/kernel/cpufeature.c +index ab15747a49d4..a3ab7dfad50a 100644 +--- a/arch/arm64/kernel/cpufeature.c ++++ b/arch/arm64/kernel/cpufeature.c +@@ -152,7 +152,7 @@ static const struct arm64_ftr_bits ftr_ctr[] = { + ARM64_FTR_BITS(FTR_STRICT, FTR_EXACT, 28, 3, 0), + ARM64_FTR_BITS(FTR_STRICT, FTR_HIGHER_SAFE, 24, 4, 0), /* CWG */ + ARM64_FTR_BITS(FTR_STRICT, FTR_LOWER_SAFE, 20, 4, 0), /* ERG */ +- ARM64_FTR_BITS(FTR_STRICT, FTR_LOWER_SAFE, 16, 4, 1), /* DminLine */ ++ ARM64_FTR_BITS(FTR_STRICT, FTR_LOWER_SAFE, CTR_DMINLINE_SHIFT, 4, 1), + /* + * Linux can handle differing I-cache policies. Userspace JITs will + * make use of *minLine. +@@ -160,7 +160,7 @@ static const struct arm64_ftr_bits ftr_ctr[] = { + */ + ARM64_FTR_BITS(FTR_NONSTRICT, FTR_EXACT, 14, 2, ICACHE_POLICY_AIVIVT), /* L1Ip */ + ARM64_FTR_BITS(FTR_STRICT, FTR_EXACT, 4, 10, 0), /* RAZ */ +- ARM64_FTR_BITS(FTR_STRICT, FTR_LOWER_SAFE, 0, 4, 0), /* IminLine */ ++ ARM64_FTR_BITS(FTR_STRICT, FTR_LOWER_SAFE, CTR_IMINLINE_SHIFT, 4, 0), + ARM64_FTR_END, + }; + +diff --git a/arch/powerpc/platforms/pseries/ras.c b/arch/powerpc/platforms/pseries/ras.c +index 34989ce43147..8799d8a83d56 100644 +--- a/arch/powerpc/platforms/pseries/ras.c ++++ b/arch/powerpc/platforms/pseries/ras.c +@@ -357,7 +357,7 @@ static struct rtas_error_log *fwnmi_get_errinfo(struct pt_regs *regs) + int len, error_log_length; + + error_log_length = 8 + rtas_error_extended_log_length(h); +- len = max_t(int, error_log_length, RTAS_ERROR_LOG_MAX); ++ len = min_t(int, error_log_length, RTAS_ERROR_LOG_MAX); + memset(global_mce_data_buf, 0, RTAS_ERROR_LOG_MAX); + memcpy(global_mce_data_buf, h, len); + errhdr = (struct rtas_error_log *)global_mce_data_buf; +diff --git a/arch/powerpc/sysdev/mpic_msgr.c b/arch/powerpc/sysdev/mpic_msgr.c +index db2286be5d9a..47fb336741d4 100644 +--- a/arch/powerpc/sysdev/mpic_msgr.c ++++ b/arch/powerpc/sysdev/mpic_msgr.c +@@ -196,7 +196,7 @@ static int mpic_msgr_probe(struct platform_device *dev) + + /* IO map the message register block. */ + of_address_to_resource(np, 0, &rsrc); +- msgr_block_addr = ioremap(rsrc.start, rsrc.end - rsrc.start); ++ msgr_block_addr = ioremap(rsrc.start, resource_size(&rsrc)); + if (!msgr_block_addr) { + dev_err(&dev->dev, "Failed to iomap MPIC message registers"); + return -EFAULT; +diff --git a/arch/s390/kernel/crash_dump.c b/arch/s390/kernel/crash_dump.c +index 598254461fb7..167135294ca5 100644 +--- a/arch/s390/kernel/crash_dump.c ++++ b/arch/s390/kernel/crash_dump.c +@@ -401,11 +401,13 @@ static void *get_vmcoreinfo_old(unsigned long *size) + if (copy_oldmem_kernel(nt_name, addr + sizeof(note), + sizeof(nt_name) - 1)) + return NULL; +- if (strcmp(nt_name, "VMCOREINFO") != 0) ++ if (strcmp(nt_name, VMCOREINFO_NOTE_NAME) != 0) + return NULL; + vmcoreinfo = kzalloc_panic(note.n_descsz); +- if (copy_oldmem_kernel(vmcoreinfo, addr + 24, note.n_descsz)) ++ if (copy_oldmem_kernel(vmcoreinfo, addr + 24, note.n_descsz)) { ++ kfree(vmcoreinfo); + return NULL; ++ } + *size = note.n_descsz; + return vmcoreinfo; + } +@@ -415,15 +417,20 @@ static void *get_vmcoreinfo_old(unsigned long *size) + */ + static void *nt_vmcoreinfo(void *ptr) + { ++ const char *name = VMCOREINFO_NOTE_NAME; + unsigned long size; + void *vmcoreinfo; + + vmcoreinfo = os_info_old_entry(OS_INFO_VMCOREINFO, &size); +- if (!vmcoreinfo) +- vmcoreinfo = get_vmcoreinfo_old(&size); ++ if (vmcoreinfo) ++ return nt_init_name(ptr, 0, vmcoreinfo, size, name); ++ ++ vmcoreinfo = get_vmcoreinfo_old(&size); + if (!vmcoreinfo) + return ptr; +- return nt_init_name(ptr, 0, vmcoreinfo, size, "VMCOREINFO"); ++ ptr = nt_init_name(ptr, 0, vmcoreinfo, size, name); ++ kfree(vmcoreinfo); ++ return ptr; + } + + /* +diff --git a/arch/s390/lib/mem.S b/arch/s390/lib/mem.S +index e7672edc284a..5ff0520784f2 100644 +--- a/arch/s390/lib/mem.S ++++ b/arch/s390/lib/mem.S +@@ -27,7 +27,7 @@ + */ + ENTRY(memset) + ltgr %r4,%r4 +- bzr %r14 ++ jz .Lmemset_exit + ltgr %r3,%r3 + jnz .Lmemset_fill + aghi %r4,-1 +@@ -42,12 +42,13 @@ ENTRY(memset) + .Lmemset_clear_rest: + larl %r3,.Lmemset_xc + ex %r4,0(%r3) ++.Lmemset_exit: + BR_EX %r14 + .Lmemset_fill: + stc %r3,0(%r2) + cghi %r4,1 + lgr %r1,%r2 +- ber %r14 ++ je .Lmemset_fill_exit + aghi %r4,-2 + srlg %r3,%r4,8 + ltgr %r3,%r3 +@@ -59,6 +60,7 @@ ENTRY(memset) + .Lmemset_fill_rest: + larl %r3,.Lmemset_mvc + ex %r4,0(%r3) ++.Lmemset_fill_exit: + BR_EX %r14 + .Lmemset_xc: + xc 0(1,%r1),0(%r1) +@@ -73,7 +75,7 @@ EXPORT_SYMBOL(memset) + */ + ENTRY(memcpy) + ltgr %r4,%r4 +- bzr %r14 ++ jz .Lmemcpy_exit + aghi %r4,-1 + srlg %r5,%r4,8 + ltgr %r5,%r5 +@@ -82,6 +84,7 @@ ENTRY(memcpy) + .Lmemcpy_rest: + larl %r5,.Lmemcpy_mvc + ex %r4,0(%r5) ++.Lmemcpy_exit: + BR_EX %r14 + .Lmemcpy_loop: + mvc 0(256,%r1),0(%r3) +diff --git a/arch/x86/include/asm/pgtable-3level.h b/arch/x86/include/asm/pgtable-3level.h +index 5c686382d84b..095dbc25122a 100644 +--- a/arch/x86/include/asm/pgtable-3level.h ++++ b/arch/x86/include/asm/pgtable-3level.h +@@ -1,6 +1,8 @@ + #ifndef _ASM_X86_PGTABLE_3LEVEL_H + #define _ASM_X86_PGTABLE_3LEVEL_H + ++#include <asm/atomic64_32.h> ++ + /* + * Intel Physical Address Extension (PAE) Mode - three-level page + * tables on PPro+ CPUs. +@@ -142,10 +144,7 @@ static inline pte_t native_ptep_get_and_clear(pte_t *ptep) + { + pte_t res; + +- /* xchg acts as a barrier before the setting of the high bits */ +- res.pte_low = xchg(&ptep->pte_low, 0); +- res.pte_high = ptep->pte_high; +- ptep->pte_high = 0; ++ res.pte = (pteval_t)atomic64_xchg((atomic64_t *)ptep, 0); + + return res; + } +diff --git a/arch/x86/include/asm/pgtable.h b/arch/x86/include/asm/pgtable.h +index c535012bdb56..5736306bdaab 100644 +--- a/arch/x86/include/asm/pgtable.h ++++ b/arch/x86/include/asm/pgtable.h +@@ -420,7 +420,7 @@ static inline pmd_t pfn_pmd(unsigned long page_nr, pgprot_t pgprot) + + static inline pud_t pfn_pud(unsigned long page_nr, pgprot_t pgprot) + { +- phys_addr_t pfn = page_nr << PAGE_SHIFT; ++ phys_addr_t pfn = (phys_addr_t)page_nr << PAGE_SHIFT; + pfn ^= protnone_mask(pgprot_val(pgprot)); + pfn &= PHYSICAL_PUD_PAGE_MASK; + return __pud(pfn | massage_pgprot(pgprot)); +diff --git a/block/bio.c b/block/bio.c +index 4f93345c6a82..68972e3d3f5c 100644 +--- a/block/bio.c ++++ b/block/bio.c +@@ -155,7 +155,7 @@ out: + + unsigned int bvec_nr_vecs(unsigned short idx) + { +- return bvec_slabs[idx].nr_vecs; ++ return bvec_slabs[--idx].nr_vecs; + } + + void bvec_free(mempool_t *pool, struct bio_vec *bv, unsigned int idx) +diff --git a/drivers/acpi/scan.c b/drivers/acpi/scan.c +index 145dcf293c6f..0792ec5a9efc 100644 +--- a/drivers/acpi/scan.c ++++ b/drivers/acpi/scan.c +@@ -1453,7 +1453,8 @@ static int acpi_add_single_object(struct acpi_device **child, + * Note this must be done before the get power-/wakeup_dev-flags calls. + */ + if (type == ACPI_BUS_TYPE_DEVICE) +- acpi_bus_get_status(device); ++ if (acpi_bus_get_status(device) < 0) ++ acpi_set_device_status(device, 0); + + acpi_bus_get_power_flags(device); + acpi_bus_get_wakeup_device_flags(device); +@@ -1531,7 +1532,7 @@ static int acpi_bus_type_and_status(acpi_handle handle, int *type, + * acpi_add_single_object updates this once we've an acpi_device + * so that acpi_bus_get_status' quirk handling can be used. + */ +- *sta = 0; ++ *sta = ACPI_STA_DEFAULT; + break; + case ACPI_TYPE_PROCESSOR: + *type = ACPI_BUS_TYPE_PROCESSOR; +diff --git a/drivers/clk/rockchip/clk-rk3399.c b/drivers/clk/rockchip/clk-rk3399.c +index 05671c03efe2..410998800af5 100644 +--- a/drivers/clk/rockchip/clk-rk3399.c ++++ b/drivers/clk/rockchip/clk-rk3399.c +@@ -1521,6 +1521,7 @@ static const char *const rk3399_pmucru_critical_clocks[] __initconst = { + "pclk_pmu_src", + "fclk_cm0s_src_pmu", + "clk_timer_src_pmu", ++ "pclk_rkpwm_pmu", + }; + + static void __init rk3399_clk_init(struct device_node *np) +diff --git a/drivers/gpu/drm/drm_edid.c b/drivers/gpu/drm/drm_edid.c +index 6b31e0474271..37ba5f51378e 100644 +--- a/drivers/gpu/drm/drm_edid.c ++++ b/drivers/gpu/drm/drm_edid.c +@@ -110,6 +110,9 @@ static const struct edid_quirk { + /* CPT panel of Asus UX303LA reports 8 bpc, but is a 6 bpc panel */ + { "CPT", 0x17df, EDID_QUIRK_FORCE_6BPC }, + ++ /* SDC panel of Lenovo B50-80 reports 8 bpc, but is a 6 bpc panel */ ++ { "SDC", 0x3652, EDID_QUIRK_FORCE_6BPC }, ++ + /* Belinea 10 15 55 */ + { "MAX", 1516, EDID_QUIRK_PREFER_LARGE_60 }, + { "MAX", 0x77e, EDID_QUIRK_PREFER_LARGE_60 }, +diff --git a/drivers/infiniband/hw/hns/hns_roce_pd.c b/drivers/infiniband/hw/hns/hns_roce_pd.c +index 05db7d59812a..da61ce82c3d9 100644 +--- a/drivers/infiniband/hw/hns/hns_roce_pd.c ++++ b/drivers/infiniband/hw/hns/hns_roce_pd.c +@@ -35,7 +35,7 @@ + + static int hns_roce_pd_alloc(struct hns_roce_dev *hr_dev, unsigned long *pdn) + { +- return hns_roce_bitmap_alloc(&hr_dev->pd_bitmap, pdn); ++ return hns_roce_bitmap_alloc(&hr_dev->pd_bitmap, pdn) ? -ENOMEM : 0; + } + + static void hns_roce_pd_free(struct hns_roce_dev *hr_dev, unsigned long pdn) +diff --git a/drivers/infiniband/hw/hns/hns_roce_qp.c b/drivers/infiniband/hw/hns/hns_roce_qp.c +index e86dd8d06777..33cf1035030b 100644 +--- a/drivers/infiniband/hw/hns/hns_roce_qp.c ++++ b/drivers/infiniband/hw/hns/hns_roce_qp.c +@@ -114,7 +114,10 @@ static int hns_roce_reserve_range_qp(struct hns_roce_dev *hr_dev, int cnt, + { + struct hns_roce_qp_table *qp_table = &hr_dev->qp_table; + +- return hns_roce_bitmap_alloc_range(&qp_table->bitmap, cnt, align, base); ++ return hns_roce_bitmap_alloc_range(&qp_table->bitmap, cnt, align, ++ base) ? ++ -ENOMEM : ++ 0; + } + + enum hns_roce_qp_state to_hns_roce_state(enum ib_qp_state state) +diff --git a/drivers/irqchip/irq-bcm7038-l1.c b/drivers/irqchip/irq-bcm7038-l1.c +index c2662a1bfdd3..6e24facebb46 100644 +--- a/drivers/irqchip/irq-bcm7038-l1.c ++++ b/drivers/irqchip/irq-bcm7038-l1.c +@@ -215,6 +215,7 @@ static int bcm7038_l1_set_affinity(struct irq_data *d, + return 0; + } + ++#ifdef CONFIG_SMP + static void bcm7038_l1_cpu_offline(struct irq_data *d) + { + struct cpumask *mask = irq_data_get_affinity_mask(d); +@@ -239,6 +240,7 @@ static void bcm7038_l1_cpu_offline(struct irq_data *d) + } + irq_set_affinity_locked(d, &new_affinity, false); + } ++#endif + + static int __init bcm7038_l1_init_one(struct device_node *dn, + unsigned int idx, +@@ -291,7 +293,9 @@ static struct irq_chip bcm7038_l1_irq_chip = { + .irq_mask = bcm7038_l1_mask, + .irq_unmask = bcm7038_l1_unmask, + .irq_set_affinity = bcm7038_l1_set_affinity, ++#ifdef CONFIG_SMP + .irq_cpu_offline = bcm7038_l1_cpu_offline, ++#endif + }; + + static int bcm7038_l1_map(struct irq_domain *d, unsigned int virq, +diff --git a/drivers/md/dm-kcopyd.c b/drivers/md/dm-kcopyd.c +index 9e9d04cb7d51..56fcccc30554 100644 +--- a/drivers/md/dm-kcopyd.c ++++ b/drivers/md/dm-kcopyd.c +@@ -454,6 +454,8 @@ static int run_complete_job(struct kcopyd_job *job) + if (atomic_dec_and_test(&kc->nr_jobs)) + wake_up(&kc->destroyq); + ++ cond_resched(); ++ + return 0; + } + +diff --git a/drivers/mfd/sm501.c b/drivers/mfd/sm501.c +index 40534352e574..3270b8dbc949 100644 +--- a/drivers/mfd/sm501.c ++++ b/drivers/mfd/sm501.c +@@ -714,6 +714,7 @@ sm501_create_subdev(struct sm501_devdata *sm, char *name, + smdev->pdev.name = name; + smdev->pdev.id = sm->pdev_id; + smdev->pdev.dev.parent = sm->dev; ++ smdev->pdev.dev.coherent_dma_mask = 0xffffffff; + + if (res_count) { + smdev->pdev.resource = (struct resource *)(smdev+1); +diff --git a/drivers/misc/mei/pci-me.c b/drivers/misc/mei/pci-me.c +index f9c6ec4b98ab..013a7b3fe92d 100644 +--- a/drivers/misc/mei/pci-me.c ++++ b/drivers/misc/mei/pci-me.c +@@ -229,8 +229,11 @@ static int mei_me_probe(struct pci_dev *pdev, const struct pci_device_id *ent) + if (!pci_dev_run_wake(pdev)) + mei_me_set_pm_domain(dev); + +- if (mei_pg_is_enabled(dev)) ++ if (mei_pg_is_enabled(dev)) { + pm_runtime_put_noidle(&pdev->dev); ++ if (hw->d0i3_supported) ++ pm_runtime_allow(&pdev->dev); ++ } + + dev_dbg(&pdev->dev, "initialization successful.\n"); + +diff --git a/drivers/net/ethernet/broadcom/genet/bcmgenet.h b/drivers/net/ethernet/broadcom/genet/bcmgenet.h +index db7f289d65ae..3f8858db12eb 100644 +--- a/drivers/net/ethernet/broadcom/genet/bcmgenet.h ++++ b/drivers/net/ethernet/broadcom/genet/bcmgenet.h +@@ -185,6 +185,9 @@ struct bcmgenet_mib_counters { + #define UMAC_MAC1 0x010 + #define UMAC_MAX_FRAME_LEN 0x014 + ++#define UMAC_MODE 0x44 ++#define MODE_LINK_STATUS (1 << 5) ++ + #define UMAC_EEE_CTRL 0x064 + #define EN_LPI_RX_PAUSE (1 << 0) + #define EN_LPI_TX_PFC (1 << 1) +diff --git a/drivers/net/ethernet/broadcom/genet/bcmmii.c b/drivers/net/ethernet/broadcom/genet/bcmmii.c +index 2f9281936f0e..3b9e1a5dce82 100644 +--- a/drivers/net/ethernet/broadcom/genet/bcmmii.c ++++ b/drivers/net/ethernet/broadcom/genet/bcmmii.c +@@ -167,8 +167,14 @@ void bcmgenet_mii_setup(struct net_device *dev) + static int bcmgenet_fixed_phy_link_update(struct net_device *dev, + struct fixed_phy_status *status) + { +- if (dev && dev->phydev && status) +- status->link = dev->phydev->link; ++ struct bcmgenet_priv *priv; ++ u32 reg; ++ ++ if (dev && dev->phydev && status) { ++ priv = netdev_priv(dev); ++ reg = bcmgenet_umac_readl(priv, UMAC_MODE); ++ status->link = !!(reg & MODE_LINK_STATUS); ++ } + + return 0; + } +diff --git a/drivers/net/ethernet/cisco/enic/enic_main.c b/drivers/net/ethernet/cisco/enic/enic_main.c +index f7e7b79c6050..f314be07ec58 100644 +--- a/drivers/net/ethernet/cisco/enic/enic_main.c ++++ b/drivers/net/ethernet/cisco/enic/enic_main.c +@@ -2681,7 +2681,6 @@ static int enic_probe(struct pci_dev *pdev, const struct pci_device_id *ent) + */ + + enic->port_mtu = enic->config.mtu; +- (void)enic_change_mtu(netdev, enic->port_mtu); + + err = enic_set_mac_addr(netdev, enic->mac_addr); + if (err) { +@@ -2731,6 +2730,7 @@ static int enic_probe(struct pci_dev *pdev, const struct pci_device_id *ent) + netdev->features |= NETIF_F_HIGHDMA; + + netdev->priv_flags |= IFF_UNICAST_FLT; ++ netdev->mtu = enic->port_mtu; + + err = register_netdev(netdev); + if (err) { +diff --git a/drivers/net/ethernet/qlogic/qlge/qlge_main.c b/drivers/net/ethernet/qlogic/qlge/qlge_main.c +index fd4a8e473f11..6a507544682f 100644 +--- a/drivers/net/ethernet/qlogic/qlge/qlge_main.c ++++ b/drivers/net/ethernet/qlogic/qlge/qlge_main.c +@@ -2387,26 +2387,20 @@ static int qlge_update_hw_vlan_features(struct net_device *ndev, + return status; + } + +-static netdev_features_t qlge_fix_features(struct net_device *ndev, +- netdev_features_t features) +-{ +- int err; +- +- /* Update the behavior of vlan accel in the adapter */ +- err = qlge_update_hw_vlan_features(ndev, features); +- if (err) +- return err; +- +- return features; +-} +- + static int qlge_set_features(struct net_device *ndev, + netdev_features_t features) + { + netdev_features_t changed = ndev->features ^ features; ++ int err; ++ ++ if (changed & NETIF_F_HW_VLAN_CTAG_RX) { ++ /* Update the behavior of vlan accel in the adapter */ ++ err = qlge_update_hw_vlan_features(ndev, features); ++ if (err) ++ return err; + +- if (changed & NETIF_F_HW_VLAN_CTAG_RX) + qlge_vlan_mode(ndev, features); ++ } + + return 0; + } +@@ -4719,7 +4713,6 @@ static const struct net_device_ops qlge_netdev_ops = { + .ndo_set_mac_address = qlge_set_mac_address, + .ndo_validate_addr = eth_validate_addr, + .ndo_tx_timeout = qlge_tx_timeout, +- .ndo_fix_features = qlge_fix_features, + .ndo_set_features = qlge_set_features, + .ndo_vlan_rx_add_vid = qlge_vlan_rx_add_vid, + .ndo_vlan_rx_kill_vid = qlge_vlan_rx_kill_vid, +diff --git a/drivers/net/ethernet/realtek/r8169.c b/drivers/net/ethernet/realtek/r8169.c +index 59b932db0d42..f65e8cd6d144 100644 +--- a/drivers/net/ethernet/realtek/r8169.c ++++ b/drivers/net/ethernet/realtek/r8169.c +@@ -329,6 +329,7 @@ static const struct pci_device_id rtl8169_pci_tbl[] = { + { PCI_DEVICE(PCI_VENDOR_ID_REALTEK, 0x8161), 0, 0, RTL_CFG_1 }, + { PCI_DEVICE(PCI_VENDOR_ID_REALTEK, 0x8167), 0, 0, RTL_CFG_0 }, + { PCI_DEVICE(PCI_VENDOR_ID_REALTEK, 0x8168), 0, 0, RTL_CFG_1 }, ++ { PCI_DEVICE(PCI_VENDOR_ID_NCUBE, 0x8168), 0, 0, RTL_CFG_1 }, + { PCI_DEVICE(PCI_VENDOR_ID_REALTEK, 0x8169), 0, 0, RTL_CFG_0 }, + { PCI_VENDOR_ID_DLINK, 0x4300, + PCI_VENDOR_ID_DLINK, 0x4b10, 0, 0, RTL_CFG_1 }, +diff --git a/drivers/net/hyperv/netvsc_drv.c b/drivers/net/hyperv/netvsc_drv.c +index 36a04e182af1..53602fdf5b47 100644 +--- a/drivers/net/hyperv/netvsc_drv.c ++++ b/drivers/net/hyperv/netvsc_drv.c +@@ -29,6 +29,7 @@ + #include <linux/netdevice.h> + #include <linux/inetdevice.h> + #include <linux/etherdevice.h> ++#include <linux/pci.h> + #include <linux/skbuff.h> + #include <linux/if_vlan.h> + #include <linux/in.h> +@@ -1228,11 +1229,15 @@ static int netvsc_register_vf(struct net_device *vf_netdev) + { + struct net_device *ndev; + struct net_device_context *net_device_ctx; ++ struct device *pdev = vf_netdev->dev.parent; + struct netvsc_device *netvsc_dev; + + if (vf_netdev->addr_len != ETH_ALEN) + return NOTIFY_DONE; + ++ if (!pdev || !dev_is_pci(pdev) || dev_is_pf(pdev)) ++ return NOTIFY_DONE; ++ + /* + * We will use the MAC address to locate the synthetic interface to + * associate with the VF interface. If we don't find a matching +diff --git a/drivers/pci/host/pci-mvebu.c b/drivers/pci/host/pci-mvebu.c +index 90e0b6f134ad..23d7f73cc347 100644 +--- a/drivers/pci/host/pci-mvebu.c ++++ b/drivers/pci/host/pci-mvebu.c +@@ -1236,7 +1236,7 @@ static int mvebu_pcie_probe(struct platform_device *pdev) + pcie->realio.start = PCIBIOS_MIN_IO; + pcie->realio.end = min_t(resource_size_t, + IO_SPACE_LIMIT, +- resource_size(&pcie->io)); ++ resource_size(&pcie->io) - 1); + } else + pcie->realio = pcie->io; + +diff --git a/drivers/platform/x86/asus-nb-wmi.c b/drivers/platform/x86/asus-nb-wmi.c +index 687cc5b922ee..c857d2d7bbec 100644 +--- a/drivers/platform/x86/asus-nb-wmi.c ++++ b/drivers/platform/x86/asus-nb-wmi.c +@@ -531,6 +531,7 @@ static const struct key_entry asus_nb_wmi_keymap[] = { + { KE_KEY, 0xC4, { KEY_KBDILLUMUP } }, + { KE_KEY, 0xC5, { KEY_KBDILLUMDOWN } }, + { KE_IGNORE, 0xC6, }, /* Ambient Light Sensor notification */ ++ { KE_KEY, 0xFA, { KEY_PROG2 } }, /* Lid flip action */ + { KE_END, 0}, + }; + +diff --git a/drivers/platform/x86/intel_punit_ipc.c b/drivers/platform/x86/intel_punit_ipc.c +index b5b890127479..b7dfe06261f1 100644 +--- a/drivers/platform/x86/intel_punit_ipc.c ++++ b/drivers/platform/x86/intel_punit_ipc.c +@@ -17,6 +17,7 @@ + #include <linux/bitops.h> + #include <linux/device.h> + #include <linux/interrupt.h> ++#include <linux/io.h> + #include <linux/platform_device.h> + #include <asm/intel_punit_ipc.h> + +diff --git a/drivers/s390/block/dasd_eckd.c b/drivers/s390/block/dasd_eckd.c +index 0f5bc2f8382b..be17de9807b6 100644 +--- a/drivers/s390/block/dasd_eckd.c ++++ b/drivers/s390/block/dasd_eckd.c +@@ -1834,6 +1834,9 @@ static void dasd_eckd_uncheck_device(struct dasd_device *device) + struct dasd_eckd_private *private = device->private; + int i; + ++ if (!private) ++ return; ++ + dasd_alias_disconnect_device_from_lcu(device); + private->ned = NULL; + private->sneq = NULL; +@@ -2085,8 +2088,11 @@ static int dasd_eckd_basic_to_ready(struct dasd_device *device) + + static int dasd_eckd_online_to_ready(struct dasd_device *device) + { +- cancel_work_sync(&device->reload_device); +- cancel_work_sync(&device->kick_validate); ++ if (cancel_work_sync(&device->reload_device)) ++ dasd_put_device(device); ++ if (cancel_work_sync(&device->kick_validate)) ++ dasd_put_device(device); ++ + return 0; + }; + +diff --git a/drivers/scsi/aic94xx/aic94xx_init.c b/drivers/scsi/aic94xx/aic94xx_init.c +index 662b2321d1b0..913ebb6d0d29 100644 +--- a/drivers/scsi/aic94xx/aic94xx_init.c ++++ b/drivers/scsi/aic94xx/aic94xx_init.c +@@ -1031,8 +1031,10 @@ static int __init aic94xx_init(void) + + aic94xx_transport_template = + sas_domain_attach_transport(&aic94xx_transport_functions); +- if (!aic94xx_transport_template) ++ if (!aic94xx_transport_template) { ++ err = -ENOMEM; + goto out_destroy_caches; ++ } + + err = pci_register_driver(&aic94xx_pci_driver); + if (err) +diff --git a/drivers/staging/comedi/drivers/ni_mio_common.c b/drivers/staging/comedi/drivers/ni_mio_common.c +index 18c5312f7886..0fa85d55c82f 100644 +--- a/drivers/staging/comedi/drivers/ni_mio_common.c ++++ b/drivers/staging/comedi/drivers/ni_mio_common.c +@@ -5407,11 +5407,11 @@ static int ni_E_init(struct comedi_device *dev, + /* Digital I/O (PFI) subdevice */ + s = &dev->subdevices[NI_PFI_DIO_SUBDEV]; + s->type = COMEDI_SUBD_DIO; +- s->subdev_flags = SDF_READABLE | SDF_WRITABLE | SDF_INTERNAL; + s->maxdata = 1; + if (devpriv->is_m_series) { + s->n_chan = 16; + s->insn_bits = ni_pfi_insn_bits; ++ s->subdev_flags = SDF_READABLE | SDF_WRITABLE | SDF_INTERNAL; + + ni_writew(dev, s->state, NI_M_PFI_DO_REG); + for (i = 0; i < NUM_PFI_OUTPUT_SELECT_REGS; ++i) { +@@ -5420,6 +5420,7 @@ static int ni_E_init(struct comedi_device *dev, + } + } else { + s->n_chan = 10; ++ s->subdev_flags = SDF_INTERNAL; + } + s->insn_config = ni_pfi_insn_config; + +diff --git a/drivers/vhost/vhost.c b/drivers/vhost/vhost.c +index 8b6489ae74eb..c569b6454a9d 100644 +--- a/drivers/vhost/vhost.c ++++ b/drivers/vhost/vhost.c +@@ -905,7 +905,7 @@ static void vhost_iotlb_notify_vq(struct vhost_dev *d, + list_for_each_entry_safe(node, n, &d->pending_list, node) { + struct vhost_iotlb_msg *vq_msg = &node->msg.iotlb; + if (msg->iova <= vq_msg->iova && +- msg->iova + msg->size - 1 > vq_msg->iova && ++ msg->iova + msg->size - 1 >= vq_msg->iova && + vq_msg->type == VHOST_IOTLB_MISS) { + vhost_poll_queue(&node->vq->poll); + list_del(&node->node); +diff --git a/drivers/virtio/virtio_pci_legacy.c b/drivers/virtio/virtio_pci_legacy.c +index 6d9e5173d5fa..fbc4761987e8 100644 +--- a/drivers/virtio/virtio_pci_legacy.c ++++ b/drivers/virtio/virtio_pci_legacy.c +@@ -121,6 +121,7 @@ static struct virtqueue *setup_vq(struct virtio_pci_device *vp_dev, + struct virtqueue *vq; + u16 num; + int err; ++ u64 q_pfn; + + /* Select the queue we're interested in */ + iowrite16(index, vp_dev->ioaddr + VIRTIO_PCI_QUEUE_SEL); +@@ -139,9 +140,17 @@ static struct virtqueue *setup_vq(struct virtio_pci_device *vp_dev, + if (!vq) + return ERR_PTR(-ENOMEM); + ++ q_pfn = virtqueue_get_desc_addr(vq) >> VIRTIO_PCI_QUEUE_ADDR_SHIFT; ++ if (q_pfn >> 32) { ++ dev_err(&vp_dev->pci_dev->dev, ++ "platform bug: legacy virtio-mmio must not be used with RAM above 0x%llxGB\n", ++ 0x1ULL << (32 + PAGE_SHIFT - 30)); ++ err = -E2BIG; ++ goto out_del_vq; ++ } ++ + /* activate the queue */ +- iowrite32(virtqueue_get_desc_addr(vq) >> VIRTIO_PCI_QUEUE_ADDR_SHIFT, +- vp_dev->ioaddr + VIRTIO_PCI_QUEUE_PFN); ++ iowrite32(q_pfn, vp_dev->ioaddr + VIRTIO_PCI_QUEUE_PFN); + + vq->priv = (void __force *)vp_dev->ioaddr + VIRTIO_PCI_QUEUE_NOTIFY; + +@@ -158,6 +167,7 @@ static struct virtqueue *setup_vq(struct virtio_pci_device *vp_dev, + + out_deactivate: + iowrite32(0, vp_dev->ioaddr + VIRTIO_PCI_QUEUE_PFN); ++out_del_vq: + vring_del_virtqueue(vq); + return ERR_PTR(err); + } +diff --git a/fs/btrfs/dev-replace.c b/fs/btrfs/dev-replace.c +index 05169ef30596..b450adf65236 100644 +--- a/fs/btrfs/dev-replace.c ++++ b/fs/btrfs/dev-replace.c +@@ -585,6 +585,12 @@ static int btrfs_dev_replace_finishing(struct btrfs_fs_info *fs_info, + + btrfs_rm_dev_replace_unblocked(fs_info); + ++ /* ++ * Increment dev_stats_ccnt so that btrfs_run_dev_stats() will ++ * update on-disk dev stats value during commit transaction ++ */ ++ atomic_inc(&tgt_device->dev_stats_ccnt); ++ + /* + * this is again a consistent state where no dev_replace procedure + * is running, the target device is part of the filesystem, the +diff --git a/fs/btrfs/disk-io.c b/fs/btrfs/disk-io.c +index 92f3b231d5a2..18d05323ca53 100644 +--- a/fs/btrfs/disk-io.c ++++ b/fs/btrfs/disk-io.c +@@ -1096,8 +1096,9 @@ static int btree_writepages(struct address_space *mapping, + + fs_info = BTRFS_I(mapping->host)->root->fs_info; + /* this is a bit racy, but that's ok */ +- ret = percpu_counter_compare(&fs_info->dirty_metadata_bytes, +- BTRFS_DIRTY_METADATA_THRESH); ++ ret = __percpu_counter_compare(&fs_info->dirty_metadata_bytes, ++ BTRFS_DIRTY_METADATA_THRESH, ++ fs_info->dirty_metadata_batch); + if (ret < 0) + return 0; + } +@@ -4107,8 +4108,9 @@ static void __btrfs_btree_balance_dirty(struct btrfs_root *root, + if (flush_delayed) + btrfs_balance_delayed_items(root); + +- ret = percpu_counter_compare(&root->fs_info->dirty_metadata_bytes, +- BTRFS_DIRTY_METADATA_THRESH); ++ ret = __percpu_counter_compare(&root->fs_info->dirty_metadata_bytes, ++ BTRFS_DIRTY_METADATA_THRESH, ++ root->fs_info->dirty_metadata_batch); + if (ret > 0) { + balance_dirty_pages_ratelimited( + root->fs_info->btree_inode->i_mapping); +diff --git a/fs/btrfs/extent-tree.c b/fs/btrfs/extent-tree.c +index 44a43851404a..6661116c47d9 100644 +--- a/fs/btrfs/extent-tree.c ++++ b/fs/btrfs/extent-tree.c +@@ -10853,7 +10853,7 @@ void btrfs_delete_unused_bgs(struct btrfs_fs_info *fs_info) + /* Don't want to race with allocators so take the groups_sem */ + down_write(&space_info->groups_sem); + spin_lock(&block_group->lock); +- if (block_group->reserved || ++ if (block_group->reserved || block_group->pinned || + btrfs_block_group_used(&block_group->item) || + block_group->ro || + list_is_singular(&block_group->list)) { +diff --git a/fs/btrfs/relocation.c b/fs/btrfs/relocation.c +index 04c61bcf62e5..9140aede5869 100644 +--- a/fs/btrfs/relocation.c ++++ b/fs/btrfs/relocation.c +@@ -1325,18 +1325,19 @@ static void __del_reloc_root(struct btrfs_root *root) + struct mapping_node *node = NULL; + struct reloc_control *rc = root->fs_info->reloc_ctl; + +- spin_lock(&rc->reloc_root_tree.lock); +- rb_node = tree_search(&rc->reloc_root_tree.rb_root, +- root->node->start); +- if (rb_node) { +- node = rb_entry(rb_node, struct mapping_node, rb_node); +- rb_erase(&node->rb_node, &rc->reloc_root_tree.rb_root); ++ if (rc) { ++ spin_lock(&rc->reloc_root_tree.lock); ++ rb_node = tree_search(&rc->reloc_root_tree.rb_root, ++ root->node->start); ++ if (rb_node) { ++ node = rb_entry(rb_node, struct mapping_node, rb_node); ++ rb_erase(&node->rb_node, &rc->reloc_root_tree.rb_root); ++ } ++ spin_unlock(&rc->reloc_root_tree.lock); ++ if (!node) ++ return; ++ BUG_ON((struct btrfs_root *)node->data != root); + } +- spin_unlock(&rc->reloc_root_tree.lock); +- +- if (!node) +- return; +- BUG_ON((struct btrfs_root *)node->data != root); + + spin_lock(&root->fs_info->trans_lock); + list_del_init(&root->root_list); +diff --git a/fs/cifs/cifs_debug.c b/fs/cifs/cifs_debug.c +index ad8bd96093f7..e06468f8e041 100644 +--- a/fs/cifs/cifs_debug.c ++++ b/fs/cifs/cifs_debug.c +@@ -284,6 +284,10 @@ static ssize_t cifs_stats_proc_write(struct file *file, + atomic_set(&totBufAllocCount, 0); + atomic_set(&totSmBufAllocCount, 0); + #endif /* CONFIG_CIFS_STATS2 */ ++ spin_lock(&GlobalMid_Lock); ++ GlobalMaxActiveXid = 0; ++ GlobalCurrentXid = 0; ++ spin_unlock(&GlobalMid_Lock); + spin_lock(&cifs_tcp_ses_lock); + list_for_each(tmp1, &cifs_tcp_ses_list) { + server = list_entry(tmp1, struct TCP_Server_Info, +@@ -296,6 +300,10 @@ static ssize_t cifs_stats_proc_write(struct file *file, + struct cifs_tcon, + tcon_list); + atomic_set(&tcon->num_smbs_sent, 0); ++ spin_lock(&tcon->stat_lock); ++ tcon->bytes_read = 0; ++ tcon->bytes_written = 0; ++ spin_unlock(&tcon->stat_lock); + if (server->ops->clear_stats) + server->ops->clear_stats(tcon); + } +diff --git a/fs/cifs/smb2misc.c b/fs/cifs/smb2misc.c +index 967dfe656ced..e96a74da756f 100644 +--- a/fs/cifs/smb2misc.c ++++ b/fs/cifs/smb2misc.c +@@ -208,6 +208,13 @@ smb2_check_message(char *buf, unsigned int length, struct TCP_Server_Info *srvr) + if (clc_len == 4 + len + 1) + return 0; + ++ /* ++ * Some windows servers (win2016) will pad also the final ++ * PDU in a compound to 8 bytes. ++ */ ++ if (((clc_len + 7) & ~7) == len) ++ return 0; ++ + /* + * MacOS server pads after SMB2.1 write response with 3 bytes + * of junk. Other servers match RFC1001 len to actual +diff --git a/fs/cifs/smb2pdu.c b/fs/cifs/smb2pdu.c +index 4ded64b8b43b..383cf8148fe7 100644 +--- a/fs/cifs/smb2pdu.c ++++ b/fs/cifs/smb2pdu.c +@@ -320,7 +320,7 @@ small_smb2_init(__le16 smb2_command, struct cifs_tcon *tcon, + smb2_hdr_assemble((struct smb2_hdr *) *request_buf, smb2_command, tcon); + + if (tcon != NULL) { +-#ifdef CONFIG_CIFS_STATS2 ++#ifdef CONFIG_CIFS_STATS + uint16_t com_code = le16_to_cpu(smb2_command); + cifs_stats_inc(&tcon->stats.smb2_stats.smb2_com_sent[com_code]); + #endif +diff --git a/fs/dcache.c b/fs/dcache.c +index 461ff8f234e3..f903b86b06e5 100644 +--- a/fs/dcache.c ++++ b/fs/dcache.c +@@ -286,7 +286,8 @@ void take_dentry_name_snapshot(struct name_snapshot *name, struct dentry *dentry + spin_unlock(&dentry->d_lock); + name->name = p->name; + } else { +- memcpy(name->inline_name, dentry->d_iname, DNAME_INLINE_LEN); ++ memcpy(name->inline_name, dentry->d_iname, ++ dentry->d_name.len + 1); + spin_unlock(&dentry->d_lock); + name->name = name->inline_name; + } +diff --git a/fs/fat/cache.c b/fs/fat/cache.c +index 5d384921524d..f04b189fd90d 100644 +--- a/fs/fat/cache.c ++++ b/fs/fat/cache.c +@@ -224,7 +224,8 @@ static inline void cache_init(struct fat_cache_id *cid, int fclus, int dclus) + int fat_get_cluster(struct inode *inode, int cluster, int *fclus, int *dclus) + { + struct super_block *sb = inode->i_sb; +- const int limit = sb->s_maxbytes >> MSDOS_SB(sb)->cluster_bits; ++ struct msdos_sb_info *sbi = MSDOS_SB(sb); ++ const int limit = sb->s_maxbytes >> sbi->cluster_bits; + struct fat_entry fatent; + struct fat_cache_id cid; + int nr; +@@ -233,6 +234,12 @@ int fat_get_cluster(struct inode *inode, int cluster, int *fclus, int *dclus) + + *fclus = 0; + *dclus = MSDOS_I(inode)->i_start; ++ if (!fat_valid_entry(sbi, *dclus)) { ++ fat_fs_error_ratelimit(sb, ++ "%s: invalid start cluster (i_pos %lld, start %08x)", ++ __func__, MSDOS_I(inode)->i_pos, *dclus); ++ return -EIO; ++ } + if (cluster == 0) + return 0; + +@@ -249,9 +256,8 @@ int fat_get_cluster(struct inode *inode, int cluster, int *fclus, int *dclus) + /* prevent the infinite loop of cluster chain */ + if (*fclus > limit) { + fat_fs_error_ratelimit(sb, +- "%s: detected the cluster chain loop" +- " (i_pos %lld)", __func__, +- MSDOS_I(inode)->i_pos); ++ "%s: detected the cluster chain loop (i_pos %lld)", ++ __func__, MSDOS_I(inode)->i_pos); + nr = -EIO; + goto out; + } +@@ -261,9 +267,8 @@ int fat_get_cluster(struct inode *inode, int cluster, int *fclus, int *dclus) + goto out; + else if (nr == FAT_ENT_FREE) { + fat_fs_error_ratelimit(sb, +- "%s: invalid cluster chain (i_pos %lld)", +- __func__, +- MSDOS_I(inode)->i_pos); ++ "%s: invalid cluster chain (i_pos %lld)", ++ __func__, MSDOS_I(inode)->i_pos); + nr = -EIO; + goto out; + } else if (nr == FAT_ENT_EOF) { +diff --git a/fs/fat/fat.h b/fs/fat/fat.h +index e6b764a17a9c..437affe987c5 100644 +--- a/fs/fat/fat.h ++++ b/fs/fat/fat.h +@@ -347,6 +347,11 @@ static inline void fatent_brelse(struct fat_entry *fatent) + fatent->fat_inode = NULL; + } + ++static inline bool fat_valid_entry(struct msdos_sb_info *sbi, int entry) ++{ ++ return FAT_START_ENT <= entry && entry < sbi->max_cluster; ++} ++ + extern void fat_ent_access_init(struct super_block *sb); + extern int fat_ent_read(struct inode *inode, struct fat_entry *fatent, + int entry); +diff --git a/fs/fat/fatent.c b/fs/fat/fatent.c +index 1d9a8c4e9de0..3b7644e43796 100644 +--- a/fs/fat/fatent.c ++++ b/fs/fat/fatent.c +@@ -23,7 +23,7 @@ static void fat12_ent_blocknr(struct super_block *sb, int entry, + { + struct msdos_sb_info *sbi = MSDOS_SB(sb); + int bytes = entry + (entry >> 1); +- WARN_ON(entry < FAT_START_ENT || sbi->max_cluster <= entry); ++ WARN_ON(!fat_valid_entry(sbi, entry)); + *offset = bytes & (sb->s_blocksize - 1); + *blocknr = sbi->fat_start + (bytes >> sb->s_blocksize_bits); + } +@@ -33,7 +33,7 @@ static void fat_ent_blocknr(struct super_block *sb, int entry, + { + struct msdos_sb_info *sbi = MSDOS_SB(sb); + int bytes = (entry << sbi->fatent_shift); +- WARN_ON(entry < FAT_START_ENT || sbi->max_cluster <= entry); ++ WARN_ON(!fat_valid_entry(sbi, entry)); + *offset = bytes & (sb->s_blocksize - 1); + *blocknr = sbi->fat_start + (bytes >> sb->s_blocksize_bits); + } +@@ -353,7 +353,7 @@ int fat_ent_read(struct inode *inode, struct fat_entry *fatent, int entry) + int err, offset; + sector_t blocknr; + +- if (entry < FAT_START_ENT || sbi->max_cluster <= entry) { ++ if (!fat_valid_entry(sbi, entry)) { + fatent_brelse(fatent); + fat_fs_error(sb, "invalid access to FAT (entry 0x%08x)", entry); + return -EIO; +diff --git a/fs/hfs/brec.c b/fs/hfs/brec.c +index 6fc766df0461..2a6f3c67cb3f 100644 +--- a/fs/hfs/brec.c ++++ b/fs/hfs/brec.c +@@ -74,9 +74,10 @@ int hfs_brec_insert(struct hfs_find_data *fd, void *entry, int entry_len) + if (!fd->bnode) { + if (!tree->root) + hfs_btree_inc_height(tree); +- fd->bnode = hfs_bnode_find(tree, tree->leaf_head); +- if (IS_ERR(fd->bnode)) +- return PTR_ERR(fd->bnode); ++ node = hfs_bnode_find(tree, tree->leaf_head); ++ if (IS_ERR(node)) ++ return PTR_ERR(node); ++ fd->bnode = node; + fd->record = -1; + } + new_node = NULL; +diff --git a/fs/hfsplus/dir.c b/fs/hfsplus/dir.c +index 31d5e3f1fe17..193d5411210a 100644 +--- a/fs/hfsplus/dir.c ++++ b/fs/hfsplus/dir.c +@@ -77,13 +77,13 @@ again: + cpu_to_be32(HFSP_HARDLINK_TYPE) && + entry.file.user_info.fdCreator == + cpu_to_be32(HFSP_HFSPLUS_CREATOR) && ++ HFSPLUS_SB(sb)->hidden_dir && + (entry.file.create_date == + HFSPLUS_I(HFSPLUS_SB(sb)->hidden_dir)-> + create_date || + entry.file.create_date == + HFSPLUS_I(d_inode(sb->s_root))-> +- create_date) && +- HFSPLUS_SB(sb)->hidden_dir) { ++ create_date)) { + struct qstr str; + char name[32]; + +diff --git a/fs/hfsplus/super.c b/fs/hfsplus/super.c +index b9563cdcfe28..7fb976e0aa07 100644 +--- a/fs/hfsplus/super.c ++++ b/fs/hfsplus/super.c +@@ -524,8 +524,10 @@ static int hfsplus_fill_super(struct super_block *sb, void *data, int silent) + goto out_put_root; + if (!hfs_brec_read(&fd, &entry, sizeof(entry))) { + hfs_find_exit(&fd); +- if (entry.type != cpu_to_be16(HFSPLUS_FOLDER)) ++ if (entry.type != cpu_to_be16(HFSPLUS_FOLDER)) { ++ err = -EINVAL; + goto out_put_root; ++ } + inode = hfsplus_iget(sb, be32_to_cpu(entry.folder.id)); + if (IS_ERR(inode)) { + err = PTR_ERR(inode); +diff --git a/fs/reiserfs/reiserfs.h b/fs/reiserfs/reiserfs.h +index 6ca00471afbf..d920a646b578 100644 +--- a/fs/reiserfs/reiserfs.h ++++ b/fs/reiserfs/reiserfs.h +@@ -270,7 +270,7 @@ struct reiserfs_journal_list { + + struct mutex j_commit_mutex; + unsigned int j_trans_id; +- time_t j_timestamp; ++ time64_t j_timestamp; /* write-only but useful for crash dump analysis */ + struct reiserfs_list_bitmap *j_list_bitmap; + struct buffer_head *j_commit_bh; /* commit buffer head */ + struct reiserfs_journal_cnode *j_realblock; +diff --git a/include/linux/pci_ids.h b/include/linux/pci_ids.h +index 43082049baf2..bba5604f3a03 100644 +--- a/include/linux/pci_ids.h ++++ b/include/linux/pci_ids.h +@@ -3054,4 +3054,6 @@ + + #define PCI_VENDOR_ID_OCZ 0x1b85 + ++#define PCI_VENDOR_ID_NCUBE 0x10ff ++ + #endif /* _LINUX_PCI_IDS_H */ +diff --git a/kernel/fork.c b/kernel/fork.c +index 2c98b987808d..5d0e2f366766 100644 +--- a/kernel/fork.c ++++ b/kernel/fork.c +@@ -1304,7 +1304,9 @@ static int copy_sighand(unsigned long clone_flags, struct task_struct *tsk) + return -ENOMEM; + + atomic_set(&sig->count, 1); ++ spin_lock_irq(¤t->sighand->siglock); + memcpy(sig->action, current->sighand->action, sizeof(sig->action)); ++ spin_unlock_irq(¤t->sighand->siglock); + return 0; + } + +diff --git a/lib/debugobjects.c b/lib/debugobjects.c +index 056052dc8e91..88580e8ee39e 100644 +--- a/lib/debugobjects.c ++++ b/lib/debugobjects.c +@@ -294,9 +294,12 @@ static void debug_object_is_on_stack(void *addr, int onstack) + + limit++; + if (is_on_stack) +- pr_warn("object is on stack, but not annotated\n"); ++ pr_warn("object %p is on stack %p, but NOT annotated.\n", addr, ++ task_stack_page(current)); + else +- pr_warn("object is not on stack, but annotated\n"); ++ pr_warn("object %p is NOT on stack %p, but annotated.\n", addr, ++ task_stack_page(current)); ++ + WARN_ON(1); + } + +diff --git a/mm/fadvise.c b/mm/fadvise.c +index 27fc9ad267ac..eb3269e59002 100644 +--- a/mm/fadvise.c ++++ b/mm/fadvise.c +@@ -68,8 +68,12 @@ SYSCALL_DEFINE4(fadvise64_64, int, fd, loff_t, offset, loff_t, len, int, advice) + goto out; + } + +- /* Careful about overflows. Len == 0 means "as much as possible" */ +- endbyte = offset + len; ++ /* ++ * Careful about overflows. Len == 0 means "as much as possible". Use ++ * unsigned math because signed overflows are undefined and UBSan ++ * complains. ++ */ ++ endbyte = (u64)offset + (u64)len; + if (!len || endbyte < len) + endbyte = -1; + else +diff --git a/mm/huge_memory.c b/mm/huge_memory.c +index 9efe88ef9702..e4c6c3edaf6a 100644 +--- a/mm/huge_memory.c ++++ b/mm/huge_memory.c +@@ -1259,12 +1259,12 @@ int do_huge_pmd_numa_page(struct fault_env *fe, pmd_t pmd) + + /* Migration could have started since the pmd_trans_migrating check */ + if (!page_locked) { ++ page_nid = -1; + if (!get_page_unless_zero(page)) + goto out_unlock; + spin_unlock(fe->ptl); + wait_on_page_locked(page); + put_page(page); +- page_nid = -1; + goto out; + } + +diff --git a/net/9p/trans_fd.c b/net/9p/trans_fd.c +index 2b543532e2f1..aa4586672cee 100644 +--- a/net/9p/trans_fd.c ++++ b/net/9p/trans_fd.c +@@ -195,15 +195,14 @@ static void p9_mux_poll_stop(struct p9_conn *m) + static void p9_conn_cancel(struct p9_conn *m, int err) + { + struct p9_req_t *req, *rtmp; +- unsigned long flags; + LIST_HEAD(cancel_list); + + p9_debug(P9_DEBUG_ERROR, "mux %p err %d\n", m, err); + +- spin_lock_irqsave(&m->client->lock, flags); ++ spin_lock(&m->client->lock); + + if (m->err) { +- spin_unlock_irqrestore(&m->client->lock, flags); ++ spin_unlock(&m->client->lock); + return; + } + +@@ -215,7 +214,6 @@ static void p9_conn_cancel(struct p9_conn *m, int err) + list_for_each_entry_safe(req, rtmp, &m->unsent_req_list, req_list) { + list_move(&req->req_list, &cancel_list); + } +- spin_unlock_irqrestore(&m->client->lock, flags); + + list_for_each_entry_safe(req, rtmp, &cancel_list, req_list) { + p9_debug(P9_DEBUG_ERROR, "call back req %p\n", req); +@@ -224,6 +222,7 @@ static void p9_conn_cancel(struct p9_conn *m, int err) + req->t_err = err; + p9_client_cb(m->client, req, REQ_STATUS_ERROR); + } ++ spin_unlock(&m->client->lock); + } + + static int +@@ -379,8 +378,9 @@ static void p9_read_work(struct work_struct *work) + if (m->req->status != REQ_STATUS_ERROR) + status = REQ_STATUS_RCVD; + list_del(&m->req->req_list); +- spin_unlock(&m->client->lock); ++ /* update req->status while holding client->lock */ + p9_client_cb(m->client, m->req, status); ++ spin_unlock(&m->client->lock); + m->rc.sdata = NULL; + m->rc.offset = 0; + m->rc.capacity = 0; +diff --git a/net/9p/trans_virtio.c b/net/9p/trans_virtio.c +index da0d3b257459..e73fd647065a 100644 +--- a/net/9p/trans_virtio.c ++++ b/net/9p/trans_virtio.c +@@ -571,7 +571,7 @@ static int p9_virtio_probe(struct virtio_device *vdev) + chan->vq = virtio_find_single_vq(vdev, req_done, "requests"); + if (IS_ERR(chan->vq)) { + err = PTR_ERR(chan->vq); +- goto out_free_vq; ++ goto out_free_chan; + } + chan->vq->vdev->priv = chan; + spin_lock_init(&chan->lock); +@@ -624,6 +624,7 @@ out_free_tag: + kfree(tag); + out_free_vq: + vdev->config->del_vqs(vdev); ++out_free_chan: + kfree(chan); + fail: + return err; +diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c +index 504cdae41013..16dea67792e0 100644 +--- a/net/ipv4/tcp_ipv4.c ++++ b/net/ipv4/tcp_ipv4.c +@@ -2440,6 +2440,12 @@ static int __net_init tcp_sk_init(struct net *net) + if (res) + goto fail; + sock_set_flag(sk, SOCK_USE_WRITE_QUEUE); ++ ++ /* Please enforce IP_DF and IPID==0 for RST and ++ * ACK sent in SYN-RECV and TIME-WAIT state. ++ */ ++ inet_sk(sk)->pmtudisc = IP_PMTUDISC_DO; ++ + *per_cpu_ptr(net->ipv4.tcp_sk, cpu) = sk; + } + +diff --git a/net/ipv4/tcp_minisocks.c b/net/ipv4/tcp_minisocks.c +index 830a5645d8c1..a501b45d0334 100644 +--- a/net/ipv4/tcp_minisocks.c ++++ b/net/ipv4/tcp_minisocks.c +@@ -194,8 +194,9 @@ kill: + inet_twsk_deschedule_put(tw); + return TCP_TW_SUCCESS; + } ++ } else { ++ inet_twsk_reschedule(tw, TCP_TIMEWAIT_LEN); + } +- inet_twsk_reschedule(tw, TCP_TIMEWAIT_LEN); + + if (tmp_opt.saw_tstamp) { + tcptw->tw_ts_recent = tmp_opt.rcv_tsval; +diff --git a/net/ipv4/tcp_probe.c b/net/ipv4/tcp_probe.c +index 3d063eb37848..f6c50af24a64 100644 +--- a/net/ipv4/tcp_probe.c ++++ b/net/ipv4/tcp_probe.c +@@ -117,7 +117,7 @@ static void jtcp_rcv_established(struct sock *sk, struct sk_buff *skb, + (fwmark > 0 && skb->mark == fwmark)) && + (full || tp->snd_cwnd != tcp_probe.lastcwnd)) { + +- spin_lock_bh(&tcp_probe.lock); ++ spin_lock(&tcp_probe.lock); + /* If log fills, just silently drop */ + if (tcp_probe_avail() > 1) { + struct tcp_log *p = tcp_probe.log + tcp_probe.head; +@@ -157,7 +157,7 @@ static void jtcp_rcv_established(struct sock *sk, struct sk_buff *skb, + tcp_probe.head = (tcp_probe.head + 1) & (bufsize - 1); + } + tcp_probe.lastcwnd = tp->snd_cwnd; +- spin_unlock_bh(&tcp_probe.lock); ++ spin_unlock(&tcp_probe.lock); + + wake_up(&tcp_probe.wait); + } +diff --git a/net/ipv6/ip6_vti.c b/net/ipv6/ip6_vti.c +index a5aeeb613fac..3213921cdfee 100644 +--- a/net/ipv6/ip6_vti.c ++++ b/net/ipv6/ip6_vti.c +@@ -481,7 +481,7 @@ vti6_xmit(struct sk_buff *skb, struct net_device *dev, struct flowi *fl) + } + + mtu = dst_mtu(dst); +- if (!skb->ignore_df && skb->len > mtu) { ++ if (skb->len > mtu) { + skb_dst(skb)->ops->update_pmtu(dst, NULL, skb, mtu); + + if (skb->protocol == htons(ETH_P_IPV6)) { +diff --git a/net/irda/af_irda.c b/net/irda/af_irda.c +index 101ed6c42808..0a78f17006a4 100644 +--- a/net/irda/af_irda.c ++++ b/net/irda/af_irda.c +@@ -774,6 +774,13 @@ static int irda_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len) + return -EINVAL; + + lock_sock(sk); ++ ++ /* Ensure that the socket is not already bound */ ++ if (self->ias_obj) { ++ err = -EINVAL; ++ goto out; ++ } ++ + #ifdef CONFIG_IRDA_ULTRA + /* Special care for Ultra sockets */ + if ((sk->sk_type == SOCK_DGRAM) && +@@ -2016,7 +2023,11 @@ static int irda_setsockopt(struct socket *sock, int level, int optname, + err = -EINVAL; + goto out; + } +- irias_insert_object(ias_obj); ++ ++ /* Only insert newly allocated objects */ ++ if (free_ias) ++ irias_insert_object(ias_obj); ++ + kfree(ias_opt); + break; + case IRLMP_IAS_DEL: +diff --git a/net/netfilter/ipvs/ip_vs_core.c b/net/netfilter/ipvs/ip_vs_core.c +index e34d3f60fccd..fd186b011a99 100644 +--- a/net/netfilter/ipvs/ip_vs_core.c ++++ b/net/netfilter/ipvs/ip_vs_core.c +@@ -1968,13 +1968,20 @@ ip_vs_in(struct netns_ipvs *ipvs, unsigned int hooknum, struct sk_buff *skb, int + if (cp->dest && !(cp->dest->flags & IP_VS_DEST_F_AVAILABLE)) { + /* the destination server is not available */ + +- if (sysctl_expire_nodest_conn(ipvs)) { ++ __u32 flags = cp->flags; ++ ++ /* when timer already started, silently drop the packet.*/ ++ if (timer_pending(&cp->timer)) ++ __ip_vs_conn_put(cp); ++ else ++ ip_vs_conn_put(cp); ++ ++ if (sysctl_expire_nodest_conn(ipvs) && ++ !(flags & IP_VS_CONN_F_ONE_PACKET)) { + /* try to expire the connection immediately */ + ip_vs_conn_expire_now(cp); + } +- /* don't restart its timer, and silently +- drop the packet. */ +- __ip_vs_conn_put(cp); ++ + return NF_DROP; + } + +diff --git a/net/rds/ib_frmr.c b/net/rds/ib_frmr.c +index 66b3d6228a15..3d9c4c6397c3 100644 +--- a/net/rds/ib_frmr.c ++++ b/net/rds/ib_frmr.c +@@ -61,6 +61,7 @@ static struct rds_ib_mr *rds_ib_alloc_frmr(struct rds_ib_device *rds_ibdev, + pool->fmr_attr.max_pages); + if (IS_ERR(frmr->mr)) { + pr_warn("RDS/IB: %s failed to allocate MR", __func__); ++ err = PTR_ERR(frmr->mr); + goto out_no_cigar; + } + +diff --git a/net/sched/act_ife.c b/net/sched/act_ife.c +index 235db2c9bbbb..d2932dc4c83d 100644 +--- a/net/sched/act_ife.c ++++ b/net/sched/act_ife.c +@@ -267,10 +267,8 @@ static int ife_validate_metatype(struct tcf_meta_ops *ops, void *val, int len) + } + + /* called when adding new meta information +- * under ife->tcf_lock for existing action + */ +-static int load_metaops_and_vet(struct tcf_ife_info *ife, u32 metaid, +- void *val, int len, bool exists) ++static int load_metaops_and_vet(u32 metaid, void *val, int len) + { + struct tcf_meta_ops *ops = find_ife_oplist(metaid); + int ret = 0; +@@ -278,13 +276,9 @@ static int load_metaops_and_vet(struct tcf_ife_info *ife, u32 metaid, + if (!ops) { + ret = -ENOENT; + #ifdef CONFIG_MODULES +- if (exists) +- spin_unlock_bh(&ife->tcf_lock); + rtnl_unlock(); + request_module("ifemeta%u", metaid); + rtnl_lock(); +- if (exists) +- spin_lock_bh(&ife->tcf_lock); + ops = find_ife_oplist(metaid); + #endif + } +@@ -301,24 +295,17 @@ static int load_metaops_and_vet(struct tcf_ife_info *ife, u32 metaid, + } + + /* called when adding new meta information +- * under ife->tcf_lock for existing action + */ +-static int add_metainfo(struct tcf_ife_info *ife, u32 metaid, void *metaval, +- int len, bool atomic) ++static int __add_metainfo(const struct tcf_meta_ops *ops, ++ struct tcf_ife_info *ife, u32 metaid, void *metaval, ++ int len, bool atomic, bool exists) + { + struct tcf_meta_info *mi = NULL; +- struct tcf_meta_ops *ops = find_ife_oplist(metaid); + int ret = 0; + +- if (!ops) +- return -ENOENT; +- + mi = kzalloc(sizeof(*mi), atomic ? GFP_ATOMIC : GFP_KERNEL); +- if (!mi) { +- /*put back what find_ife_oplist took */ +- module_put(ops->owner); ++ if (!mi) + return -ENOMEM; +- } + + mi->metaid = metaid; + mi->ops = ops; +@@ -326,17 +313,49 @@ static int add_metainfo(struct tcf_ife_info *ife, u32 metaid, void *metaval, + ret = ops->alloc(mi, metaval, atomic ? GFP_ATOMIC : GFP_KERNEL); + if (ret != 0) { + kfree(mi); +- module_put(ops->owner); + return ret; + } + } + ++ if (exists) ++ spin_lock_bh(&ife->tcf_lock); + list_add_tail(&mi->metalist, &ife->metalist); ++ if (exists) ++ spin_unlock_bh(&ife->tcf_lock); ++ ++ return ret; ++} ++ ++static int add_metainfo_and_get_ops(const struct tcf_meta_ops *ops, ++ struct tcf_ife_info *ife, u32 metaid, ++ bool exists) ++{ ++ int ret; ++ ++ if (!try_module_get(ops->owner)) ++ return -ENOENT; ++ ret = __add_metainfo(ops, ife, metaid, NULL, 0, true, exists); ++ if (ret) ++ module_put(ops->owner); ++ return ret; ++} ++ ++static int add_metainfo(struct tcf_ife_info *ife, u32 metaid, void *metaval, ++ int len, bool exists) ++{ ++ const struct tcf_meta_ops *ops = find_ife_oplist(metaid); ++ int ret; + ++ if (!ops) ++ return -ENOENT; ++ ret = __add_metainfo(ops, ife, metaid, metaval, len, false, exists); ++ if (ret) ++ /*put back what find_ife_oplist took */ ++ module_put(ops->owner); + return ret; + } + +-static int use_all_metadata(struct tcf_ife_info *ife) ++static int use_all_metadata(struct tcf_ife_info *ife, bool exists) + { + struct tcf_meta_ops *o; + int rc = 0; +@@ -344,7 +363,7 @@ static int use_all_metadata(struct tcf_ife_info *ife) + + read_lock(&ife_mod_lock); + list_for_each_entry(o, &ifeoplist, list) { +- rc = add_metainfo(ife, o->metaid, NULL, 0, true); ++ rc = add_metainfo_and_get_ops(o, ife, o->metaid, exists); + if (rc == 0) + installed += 1; + } +@@ -395,7 +414,6 @@ static void _tcf_ife_cleanup(struct tc_action *a, int bind) + struct tcf_meta_info *e, *n; + + list_for_each_entry_safe(e, n, &ife->metalist, metalist) { +- module_put(e->ops->owner); + list_del(&e->metalist); + if (e->metaval) { + if (e->ops->release) +@@ -403,6 +421,7 @@ static void _tcf_ife_cleanup(struct tc_action *a, int bind) + else + kfree(e->metaval); + } ++ module_put(e->ops->owner); + kfree(e); + } + } +@@ -416,7 +435,6 @@ static void tcf_ife_cleanup(struct tc_action *a, int bind) + spin_unlock_bh(&ife->tcf_lock); + } + +-/* under ife->tcf_lock for existing action */ + static int populate_metalist(struct tcf_ife_info *ife, struct nlattr **tb, + bool exists) + { +@@ -430,7 +448,7 @@ static int populate_metalist(struct tcf_ife_info *ife, struct nlattr **tb, + val = nla_data(tb[i]); + len = nla_len(tb[i]); + +- rc = load_metaops_and_vet(ife, i, val, len, exists); ++ rc = load_metaops_and_vet(i, val, len); + if (rc != 0) + return rc; + +@@ -510,6 +528,8 @@ static int tcf_ife_init(struct net *net, struct nlattr *nla, + if (exists) + spin_lock_bh(&ife->tcf_lock); + ife->tcf_action = parm->action; ++ if (exists) ++ spin_unlock_bh(&ife->tcf_lock); + + if (parm->flags & IFE_ENCODE) { + if (daddr) +@@ -537,9 +557,6 @@ metadata_parse_err: + tcf_hash_release(*a, bind); + if (ret == ACT_P_CREATED) + _tcf_ife_cleanup(*a, bind); +- +- if (exists) +- spin_unlock_bh(&ife->tcf_lock); + return err; + } + +@@ -553,20 +570,14 @@ metadata_parse_err: + * as we can. You better have at least one else we are + * going to bail out + */ +- err = use_all_metadata(ife); ++ err = use_all_metadata(ife, exists); + if (err) { + if (ret == ACT_P_CREATED) + _tcf_ife_cleanup(*a, bind); +- +- if (exists) +- spin_unlock_bh(&ife->tcf_lock); + return err; + } + } + +- if (exists) +- spin_unlock_bh(&ife->tcf_lock); +- + if (ret == ACT_P_CREATED) + tcf_hash_insert(tn, *a); + +diff --git a/net/sched/cls_u32.c b/net/sched/cls_u32.c +index da574a16e7b3..e377dd5b06a6 100644 +--- a/net/sched/cls_u32.c ++++ b/net/sched/cls_u32.c +@@ -851,6 +851,7 @@ static int u32_change(struct net *net, struct sk_buff *in_skb, + struct nlattr *opt = tca[TCA_OPTIONS]; + struct nlattr *tb[TCA_U32_MAX + 1]; + u32 htid, flags = 0; ++ size_t sel_size; + int err; + #ifdef CONFIG_CLS_U32_PERF + size_t size; +@@ -967,8 +968,11 @@ static int u32_change(struct net *net, struct sk_buff *in_skb, + return -EINVAL; + + s = nla_data(tb[TCA_U32_SEL]); ++ sel_size = sizeof(*s) + sizeof(*s->keys) * s->nkeys; ++ if (nla_len(tb[TCA_U32_SEL]) < sel_size) ++ return -EINVAL; + +- n = kzalloc(sizeof(*n) + s->nkeys*sizeof(struct tc_u32_key), GFP_KERNEL); ++ n = kzalloc(offsetof(typeof(*n), sel) + sel_size, GFP_KERNEL); + if (n == NULL) + return -ENOBUFS; + +@@ -981,7 +985,7 @@ static int u32_change(struct net *net, struct sk_buff *in_skb, + } + #endif + +- memcpy(&n->sel, s, sizeof(*s) + s->nkeys*sizeof(struct tc_u32_key)); ++ memcpy(&n->sel, s, sel_size); + RCU_INIT_POINTER(n->ht_up, ht); + n->handle = handle; + n->fshift = s->hmask ? ffs(ntohl(s->hmask)) - 1 : 0; +diff --git a/net/sched/sch_hhf.c b/net/sched/sch_hhf.c +index 2fae8b5f1b80..f4b2d69973c3 100644 +--- a/net/sched/sch_hhf.c ++++ b/net/sched/sch_hhf.c +@@ -492,6 +492,9 @@ static void hhf_destroy(struct Qdisc *sch) + hhf_free(q->hhf_valid_bits[i]); + } + ++ if (!q->hh_flows) ++ return; ++ + for (i = 0; i < HH_FLOWS_CNT; i++) { + struct hh_flow_state *flow, *next; + struct list_head *head = &q->hh_flows[i]; +diff --git a/net/sched/sch_htb.c b/net/sched/sch_htb.c +index c798d0de8a9d..95fe75d441eb 100644 +--- a/net/sched/sch_htb.c ++++ b/net/sched/sch_htb.c +@@ -1013,6 +1013,9 @@ static int htb_init(struct Qdisc *sch, struct nlattr *opt) + int err; + int i; + ++ qdisc_watchdog_init(&q->watchdog, sch); ++ INIT_WORK(&q->work, htb_work_func); ++ + if (!opt) + return -EINVAL; + +@@ -1033,8 +1036,6 @@ static int htb_init(struct Qdisc *sch, struct nlattr *opt) + for (i = 0; i < TC_HTB_NUMPRIO; i++) + INIT_LIST_HEAD(q->drops + i); + +- qdisc_watchdog_init(&q->watchdog, sch); +- INIT_WORK(&q->work, htb_work_func); + qdisc_skb_head_init(&q->direct_queue); + + if (tb[TCA_HTB_DIRECT_QLEN]) +diff --git a/net/sched/sch_multiq.c b/net/sched/sch_multiq.c +index 9ffbb025b37e..66b6e807b4ec 100644 +--- a/net/sched/sch_multiq.c ++++ b/net/sched/sch_multiq.c +@@ -234,7 +234,7 @@ static int multiq_tune(struct Qdisc *sch, struct nlattr *opt) + static int multiq_init(struct Qdisc *sch, struct nlattr *opt) + { + struct multiq_sched_data *q = qdisc_priv(sch); +- int i, err; ++ int i; + + q->queues = NULL; + +@@ -249,12 +249,7 @@ static int multiq_init(struct Qdisc *sch, struct nlattr *opt) + for (i = 0; i < q->max_bands; i++) + q->queues[i] = &noop_qdisc; + +- err = multiq_tune(sch, opt); +- +- if (err) +- kfree(q->queues); +- +- return err; ++ return multiq_tune(sch, opt); + } + + static int multiq_dump(struct Qdisc *sch, struct sk_buff *skb) +diff --git a/net/sched/sch_netem.c b/net/sched/sch_netem.c +index e899d9eb76cb..3f87ddb1777d 100644 +--- a/net/sched/sch_netem.c ++++ b/net/sched/sch_netem.c +@@ -937,11 +937,11 @@ static int netem_init(struct Qdisc *sch, struct nlattr *opt) + struct netem_sched_data *q = qdisc_priv(sch); + int ret; + ++ qdisc_watchdog_init(&q->watchdog, sch); ++ + if (!opt) + return -EINVAL; + +- qdisc_watchdog_init(&q->watchdog, sch); +- + q->loss_model = CLG_RANDOM; + ret = netem_change(sch, opt); + if (ret) +diff --git a/net/sched/sch_tbf.c b/net/sched/sch_tbf.c +index 303355c449ab..b3f7980b0f27 100644 +--- a/net/sched/sch_tbf.c ++++ b/net/sched/sch_tbf.c +@@ -423,12 +423,13 @@ static int tbf_init(struct Qdisc *sch, struct nlattr *opt) + { + struct tbf_sched_data *q = qdisc_priv(sch); + ++ qdisc_watchdog_init(&q->watchdog, sch); ++ q->qdisc = &noop_qdisc; ++ + if (opt == NULL) + return -EINVAL; + + q->t_c = ktime_get_ns(); +- qdisc_watchdog_init(&q->watchdog, sch); +- q->qdisc = &noop_qdisc; + + return tbf_change(sch, opt); + } +diff --git a/net/sctp/proc.c b/net/sctp/proc.c +index 206377fe91ec..fd7f23566ed6 100644 +--- a/net/sctp/proc.c ++++ b/net/sctp/proc.c +@@ -337,8 +337,6 @@ static int sctp_assocs_seq_show(struct seq_file *seq, void *v) + } + + transport = (struct sctp_transport *)v; +- if (!sctp_transport_hold(transport)) +- return 0; + assoc = transport->asoc; + epb = &assoc->base; + sk = epb->sk; +@@ -428,8 +426,6 @@ static int sctp_remaddr_seq_show(struct seq_file *seq, void *v) + } + + transport = (struct sctp_transport *)v; +- if (!sctp_transport_hold(transport)) +- return 0; + assoc = transport->asoc; + + list_for_each_entry_rcu(tsp, &assoc->peer.transport_addr_list, +diff --git a/net/sctp/socket.c b/net/sctp/socket.c +index 78f38056fca6..64d2d9ea2f8c 100644 +--- a/net/sctp/socket.c ++++ b/net/sctp/socket.c +@@ -4476,9 +4476,14 @@ struct sctp_transport *sctp_transport_get_next(struct net *net, + break; + } + ++ if (!sctp_transport_hold(t)) ++ continue; ++ + if (net_eq(sock_net(t->asoc->base.sk), net) && + t->asoc->peer.primary_path == t) + break; ++ ++ sctp_transport_put(t); + } + + return t; +@@ -4488,13 +4493,18 @@ struct sctp_transport *sctp_transport_get_idx(struct net *net, + struct rhashtable_iter *iter, + int pos) + { +- void *obj = SEQ_START_TOKEN; ++ struct sctp_transport *t; + +- while (pos && (obj = sctp_transport_get_next(net, iter)) && +- !IS_ERR(obj)) +- pos--; ++ if (!pos) ++ return SEQ_START_TOKEN; + +- return obj; ++ while ((t = sctp_transport_get_next(net, iter)) && !IS_ERR(t)) { ++ if (!--pos) ++ break; ++ sctp_transport_put(t); ++ } ++ ++ return t; + } + + int sctp_for_each_endpoint(int (*cb)(struct sctp_endpoint *, void *), +@@ -4556,8 +4566,6 @@ int sctp_for_each_transport(int (*cb)(struct sctp_transport *, void *), + for (; !IS_ERR_OR_NULL(obj); obj = sctp_transport_get_next(net, &hti)) { + struct sctp_transport *transport = obj; + +- if (!sctp_transport_hold(transport)) +- continue; + err = cb(transport, p); + sctp_transport_put(transport); + if (err) +diff --git a/net/sunrpc/auth_gss/gss_krb5_crypto.c b/net/sunrpc/auth_gss/gss_krb5_crypto.c +index 4afd4149a632..bad69e91fea3 100644 +--- a/net/sunrpc/auth_gss/gss_krb5_crypto.c ++++ b/net/sunrpc/auth_gss/gss_krb5_crypto.c +@@ -169,7 +169,7 @@ make_checksum_hmac_md5(struct krb5_ctx *kctx, char *header, int hdrlen, + struct scatterlist sg[1]; + int err = -1; + u8 *checksumdata; +- u8 rc4salt[4]; ++ u8 *rc4salt; + struct crypto_ahash *md5; + struct crypto_ahash *hmac_md5; + struct ahash_request *req; +@@ -183,14 +183,18 @@ make_checksum_hmac_md5(struct krb5_ctx *kctx, char *header, int hdrlen, + return GSS_S_FAILURE; + } + ++ rc4salt = kmalloc_array(4, sizeof(*rc4salt), GFP_NOFS); ++ if (!rc4salt) ++ return GSS_S_FAILURE; ++ + if (arcfour_hmac_md5_usage_to_salt(usage, rc4salt)) { + dprintk("%s: invalid usage value %u\n", __func__, usage); +- return GSS_S_FAILURE; ++ goto out_free_rc4salt; + } + + checksumdata = kmalloc(GSS_KRB5_MAX_CKSUM_LEN, GFP_NOFS); + if (!checksumdata) +- return GSS_S_FAILURE; ++ goto out_free_rc4salt; + + md5 = crypto_alloc_ahash("md5", 0, CRYPTO_ALG_ASYNC); + if (IS_ERR(md5)) +@@ -258,6 +262,8 @@ out_free_md5: + crypto_free_ahash(md5); + out_free_cksum: + kfree(checksumdata); ++out_free_rc4salt: ++ kfree(rc4salt); + return err ? GSS_S_FAILURE : 0; + } + +diff --git a/scripts/depmod.sh b/scripts/depmod.sh +index ea1e96921e3b..baedaef53ca0 100755 +--- a/scripts/depmod.sh ++++ b/scripts/depmod.sh +@@ -15,9 +15,9 @@ if ! test -r System.map ; then + fi + + if [ -z $(command -v $DEPMOD) ]; then +- echo "'make modules_install' requires $DEPMOD. Please install it." >&2 ++ echo "Warning: 'make modules_install' requires $DEPMOD. Please install it." >&2 + echo "This is probably in the kmod package." >&2 +- exit 1 ++ exit 0 + fi + + # older versions of depmod don't support -P <symbol-prefix> +diff --git a/scripts/mod/modpost.c b/scripts/mod/modpost.c +index 238db4ffd30c..88b3dc19bbae 100644 +--- a/scripts/mod/modpost.c ++++ b/scripts/mod/modpost.c +@@ -649,7 +649,7 @@ static void handle_modversions(struct module *mod, struct elf_info *info, + if (ELF_ST_TYPE(sym->st_info) == STT_SPARC_REGISTER) + break; + if (symname[0] == '.') { +- char *munged = strdup(symname); ++ char *munged = NOFAIL(strdup(symname)); + munged[0] = '_'; + munged[1] = toupper(munged[1]); + symname = munged; +@@ -1312,7 +1312,7 @@ static Elf_Sym *find_elf_symbol2(struct elf_info *elf, Elf_Addr addr, + static char *sec2annotation(const char *s) + { + if (match(s, init_exit_sections)) { +- char *p = malloc(20); ++ char *p = NOFAIL(malloc(20)); + char *r = p; + + *p++ = '_'; +@@ -1332,7 +1332,7 @@ static char *sec2annotation(const char *s) + strcat(p, " "); + return r; + } else { +- return strdup(""); ++ return NOFAIL(strdup("")); + } + } + +@@ -2033,7 +2033,7 @@ void buf_write(struct buffer *buf, const char *s, int len) + { + if (buf->size - buf->pos < len) { + buf->size += len + SZ; +- buf->p = realloc(buf->p, buf->size); ++ buf->p = NOFAIL(realloc(buf->p, buf->size)); + } + strncpy(buf->p + buf->pos, s, len); + buf->pos += len; +diff --git a/sound/soc/codecs/wm8994.c b/sound/soc/codecs/wm8994.c +index 3896523b71e9..f289762cd676 100644 +--- a/sound/soc/codecs/wm8994.c ++++ b/sound/soc/codecs/wm8994.c +@@ -2431,6 +2431,7 @@ static int wm8994_set_dai_sysclk(struct snd_soc_dai *dai, + snd_soc_update_bits(codec, WM8994_POWER_MANAGEMENT_2, + WM8994_OPCLK_ENA, 0); + } ++ break; + + default: + return -EINVAL; +diff --git a/tools/perf/arch/powerpc/util/sym-handling.c b/tools/perf/arch/powerpc/util/sym-handling.c +index 1030a6e504bb..de477a3dc968 100644 +--- a/tools/perf/arch/powerpc/util/sym-handling.c ++++ b/tools/perf/arch/powerpc/util/sym-handling.c +@@ -115,8 +115,10 @@ void arch__post_process_probe_trace_events(struct perf_probe_event *pev, + for (i = 0; i < ntevs; i++) { + tev = &pev->tevs[i]; + map__for_each_symbol(map, sym, tmp) { +- if (map->unmap_ip(map, sym->start) == tev->point.address) ++ if (map->unmap_ip(map, sym->start) == tev->point.address) { + arch__fix_tev_from_maps(pev, tev, map, sym); ++ break; ++ } + } + } + } +diff --git a/tools/testing/selftests/powerpc/harness.c b/tools/testing/selftests/powerpc/harness.c +index 66d31de60b9a..9d7166dfad1e 100644 +--- a/tools/testing/selftests/powerpc/harness.c ++++ b/tools/testing/selftests/powerpc/harness.c +@@ -85,13 +85,13 @@ wait: + return status; + } + +-static void alarm_handler(int signum) ++static void sig_handler(int signum) + { +- /* Jut wake us up from waitpid */ ++ /* Just wake us up from waitpid */ + } + +-static struct sigaction alarm_action = { +- .sa_handler = alarm_handler, ++static struct sigaction sig_action = { ++ .sa_handler = sig_handler, + }; + + void test_harness_set_timeout(uint64_t time) +@@ -106,8 +106,14 @@ int test_harness(int (test_function)(void), char *name) + test_start(name); + test_set_git_version(GIT_VERSION); + +- if (sigaction(SIGALRM, &alarm_action, NULL)) { +- perror("sigaction"); ++ if (sigaction(SIGINT, &sig_action, NULL)) { ++ perror("sigaction (sigint)"); ++ test_error(name); ++ return 1; ++ } ++ ++ if (sigaction(SIGALRM, &sig_action, NULL)) { ++ perror("sigaction (sigalrm)"); + test_error(name); + return 1; + }
