commit:     de58b6a2da629184791885f196b0b283ef5d0385
Author:     Alice Ferrazzi <alicef <AT> gentoo <DOT> org>
AuthorDate: Thu Dec  8 13:05:41 2022 +0000
Commit:     Alice Ferrazzi <alicef <AT> gentoo <DOT> org>
CommitDate: Thu Dec  8 13:06:19 2022 +0000
URL:        https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=de58b6a2

Linux patch 4.9.335

Signed-off-by: Alice Ferrazzi <alicef <AT> gentoo.org>

 0000_README              |    4 +
 1334_linux-4.9.335.patch | 1612 ++++++++++++++++++++++++++++++++++++++++++++++
 2 files changed, 1616 insertions(+)

diff --git a/0000_README b/0000_README
index fc3ba448..765995b7 100644
--- a/0000_README
+++ b/0000_README
@@ -1383,6 +1383,10 @@ Patch:  1333_linux-4.9.334.patch
 From:   http://www.kernel.org
 Desc:   Linux 4.9.334
 
+Patch:  1334_linux-4.9.335.patch
+From:   http://www.kernel.org
+Desc:   Linux 4.9.335
+
 Patch:  1500_XATTR_USER_PREFIX.patch
 From:   https://bugs.gentoo.org/show_bug.cgi?id=470644
 Desc:   Support for namespace user.pax.* on tmpfs.

diff --git a/1334_linux-4.9.335.patch b/1334_linux-4.9.335.patch
new file mode 100644
index 00000000..9c5d1072
--- /dev/null
+++ b/1334_linux-4.9.335.patch
@@ -0,0 +1,1612 @@
+diff --git a/Makefile b/Makefile
+index fb1be32eebce1..36aed335c6b9f 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,6 +1,6 @@
+ VERSION = 4
+ PATCHLEVEL = 9
+-SUBLEVEL = 334
++SUBLEVEL = 335
+ EXTRAVERSION =
+ NAME = Roaring Lionus
+ 
+diff --git a/arch/arm/boot/dts/at91sam9g20ek_common.dtsi 
b/arch/arm/boot/dts/at91sam9g20ek_common.dtsi
+index 27847a47c1082..1b326a0a2c92c 100644
+--- a/arch/arm/boot/dts/at91sam9g20ek_common.dtsi
++++ b/arch/arm/boot/dts/at91sam9g20ek_common.dtsi
+@@ -39,6 +39,13 @@
+ 
+                               };
+ 
++                              usb1 {
++                                      pinctrl_usb1_vbus_gpio: usb1_vbus_gpio {
++                                              atmel,pins =
++                                                      <AT91_PIOC 5 
AT91_PERIPH_GPIO AT91_PINCTRL_DEGLITCH>;   /* PC5 GPIO */
++                                      };
++                              };
++
+                               mmc0_slot1 {
+                                       pinctrl_board_mmc0_slot1: 
mmc0_slot1-board {
+                                               atmel,pins =
+@@ -72,6 +79,8 @@
+                       };
+ 
+                       usb1: gadget@fffa4000 {
++                              pinctrl-0 = <&pinctrl_usb1_vbus_gpio>;
++                              pinctrl-names = "default";
+                               atmel,vbus-gpio = <&pioC 5 GPIO_ACTIVE_HIGH>;
+                               status = "okay";
+                       };
+diff --git a/arch/arm/mach-mxs/mach-mxs.c b/arch/arm/mach-mxs/mach-mxs.c
+index e4f21086b42b4..57cb97ff82bc0 100644
+--- a/arch/arm/mach-mxs/mach-mxs.c
++++ b/arch/arm/mach-mxs/mach-mxs.c
+@@ -393,8 +393,10 @@ static void __init mxs_machine_init(void)
+ 
+       root = of_find_node_by_path("/");
+       ret = of_property_read_string(root, "model", &soc_dev_attr->machine);
+-      if (ret)
++      if (ret) {
++              kfree(soc_dev_attr);
+               return;
++      }
+ 
+       soc_dev_attr->family = "Freescale MXS Family";
+       soc_dev_attr->soc_id = mxs_get_soc_id();
+diff --git a/arch/arm64/kernel/cpu_errata.c b/arch/arm64/kernel/cpu_errata.c
+index 17208f1b10a93..ae11af9c8cbde 100644
+--- a/arch/arm64/kernel/cpu_errata.c
++++ b/arch/arm64/kernel/cpu_errata.c
+@@ -125,10 +125,12 @@ static void __install_bp_hardening_cb(bp_hardening_cb_t 
fn,
+               __copy_hyp_vect_bpi(slot, hyp_vecs_start, hyp_vecs_end);
+       }
+ 
+-      __this_cpu_write(bp_hardening_data.hyp_vectors_slot, slot);
+-      __this_cpu_write(bp_hardening_data.fn, fn);
+-      __this_cpu_write(bp_hardening_data.template_start, hyp_vecs_start);
+-      __hardenbp_enab = true;
++      if (fn != __this_cpu_read(bp_hardening_data.fn)) {
++              __this_cpu_write(bp_hardening_data.hyp_vectors_slot, slot);
++              __this_cpu_write(bp_hardening_data.fn, fn);
++              __this_cpu_write(bp_hardening_data.template_start, 
hyp_vecs_start);
++              __hardenbp_enab = true;
++      }
+       spin_unlock(&bp_lock);
+ }
+ #else
+@@ -828,8 +830,11 @@ static void kvm_setup_bhb_slot(const char *hyp_vecs_start)
+               __copy_hyp_vect_bpi(slot, hyp_vecs_start, hyp_vecs_end);
+       }
+ 
+-      __this_cpu_write(bp_hardening_data.hyp_vectors_slot, slot);
+-      __this_cpu_write(bp_hardening_data.template_start, hyp_vecs_start);
++      if (hyp_vecs_start != 
__this_cpu_read(bp_hardening_data.template_start)) {
++              __this_cpu_write(bp_hardening_data.hyp_vectors_slot, slot);
++              __this_cpu_write(bp_hardening_data.template_start,
++                               hyp_vecs_start);
++      }
+       spin_unlock(&bp_lock);
+ }
+ #else
+@@ -871,7 +876,13 @@ void spectre_bhb_enable_mitigation(const struct 
arm64_cpu_capabilities *entry)
+       } else if (spectre_bhb_loop_affected(SCOPE_LOCAL_CPU)) {
+               switch (spectre_bhb_loop_affected(SCOPE_SYSTEM)) {
+               case 8:
+-                      kvm_setup_bhb_slot(__spectre_bhb_loop_k8_start);
++                      /*
++                       * A57/A72-r0 will already have selected the
++                       * spectre-indirect vector, which is sufficient
++                       * for BHB too.
++                       */
++                      if (!__this_cpu_read(bp_hardening_data.fn))
++                              kvm_setup_bhb_slot(__spectre_bhb_loop_k8_start);
+                       break;
+               case 24:
+                       kvm_setup_bhb_slot(__spectre_bhb_loop_k24_start);
+diff --git a/arch/mips/include/asm/fw/fw.h b/arch/mips/include/asm/fw/fw.h
+index d0ef8b4892bbe..d0494ce4b3373 100644
+--- a/arch/mips/include/asm/fw/fw.h
++++ b/arch/mips/include/asm/fw/fw.h
+@@ -26,6 +26,6 @@ extern char *fw_getcmdline(void);
+ extern void fw_meminit(void);
+ extern char *fw_getenv(char *name);
+ extern unsigned long fw_getenvl(char *name);
+-extern void fw_init_early_console(char port);
++extern void fw_init_early_console(void);
+ 
+ #endif /* __ASM_FW_H_ */
+diff --git a/arch/mips/pic32/pic32mzda/early_console.c 
b/arch/mips/pic32/pic32mzda/early_console.c
+index d7b783463fac1..4933c53370597 100644
+--- a/arch/mips/pic32/pic32mzda/early_console.c
++++ b/arch/mips/pic32/pic32mzda/early_console.c
+@@ -34,7 +34,7 @@
+ #define U_BRG(x)      (UART_BASE(x) + 0x40)
+ 
+ static void __iomem *uart_base;
+-static char console_port = -1;
++static int console_port = -1;
+ 
+ static int __init configure_uart_pins(int port)
+ {
+@@ -54,7 +54,7 @@ static int __init configure_uart_pins(int port)
+       return 0;
+ }
+ 
+-static void __init configure_uart(char port, int baud)
++static void __init configure_uart(int port, int baud)
+ {
+       u32 pbclk;
+ 
+@@ -67,7 +67,7 @@ static void __init configure_uart(char port, int baud)
+                    uart_base + PIC32_SET(U_STA(port)));
+ }
+ 
+-static void __init setup_early_console(char port, int baud)
++static void __init setup_early_console(int port, int baud)
+ {
+       if (configure_uart_pins(port))
+               return;
+@@ -137,16 +137,15 @@ _out:
+       return baud;
+ }
+ 
+-void __init fw_init_early_console(char port)
++void __init fw_init_early_console(void)
+ {
+       char *arch_cmdline = pic32_getcmdline();
+-      int baud = -1;
++      int baud, port;
+ 
+       uart_base = ioremap_nocache(PIC32_BASE_UART, 0xc00);
+ 
+       baud = get_baud_from_cmdline(arch_cmdline);
+-      if (port == -1)
+-              port = get_port_from_cmdline(arch_cmdline);
++      port = get_port_from_cmdline(arch_cmdline);
+ 
+       if (port == -1)
+               port = EARLY_CONSOLE_PORT;
+diff --git a/arch/mips/pic32/pic32mzda/init.c 
b/arch/mips/pic32/pic32mzda/init.c
+index 406c6c5cec29b..cf2625551b458 100644
+--- a/arch/mips/pic32/pic32mzda/init.c
++++ b/arch/mips/pic32/pic32mzda/init.c
+@@ -68,7 +68,7 @@ void __init plat_mem_setup(void)
+               strlcpy(arcs_cmdline, boot_command_line, COMMAND_LINE_SIZE);
+ 
+ #ifdef CONFIG_EARLY_PRINTK
+-      fw_init_early_console(-1);
++      fw_init_early_console();
+ #endif
+       pic32_config_init();
+ }
+diff --git a/arch/nios2/boot/Makefile b/arch/nios2/boot/Makefile
+index c899876320df3..76dce0a438a65 100644
+--- a/arch/nios2/boot/Makefile
++++ b/arch/nios2/boot/Makefile
+@@ -20,7 +20,7 @@ $(obj)/vmlinux.bin: vmlinux FORCE
+ $(obj)/vmlinux.gz: $(obj)/vmlinux.bin FORCE
+       $(call if_changed,gzip)
+ 
+-$(obj)/vmImage: $(obj)/vmlinux.gz
++$(obj)/vmImage: $(obj)/vmlinux.gz FORCE
+       $(call if_changed,uimage)
+       @$(kecho) 'Kernel: $@ is ready'
+ 
+diff --git a/arch/s390/kernel/crash_dump.c b/arch/s390/kernel/crash_dump.c
+index 167135294ca51..d246cb23e3418 100644
+--- a/arch/s390/kernel/crash_dump.c
++++ b/arch/s390/kernel/crash_dump.c
+@@ -42,7 +42,7 @@ struct save_area {
+       u64 fprs[16];
+       u32 fpc;
+       u32 prefix;
+-      u64 todpreg;
++      u32 todpreg;
+       u64 timer;
+       u64 todcmp;
+       u64 vxrs_low[16];
+diff --git a/arch/x86/include/asm/cpufeatures.h 
b/arch/x86/include/asm/cpufeatures.h
+index a033fa5c596d4..429e6fc5069fb 100644
+--- a/arch/x86/include/asm/cpufeatures.h
++++ b/arch/x86/include/asm/cpufeatures.h
+@@ -196,6 +196,7 @@
+ #define X86_FEATURE_FENCE_SWAPGS_KERNEL       ( 7*32+11) /* "" LFENCE in 
kernel entry SWAPGS path */
+ #define X86_FEATURE_RETPOLINE ( 7*32+12) /* "" Generic Retpoline mitigation 
for Spectre variant 2 */
+ #define X86_FEATURE_RETPOLINE_LFENCE  ( 7*32+13) /* "" Use LFENCE for Spectre 
variant 2 */
++#define X86_FEATURE_MSR_TSX_CTRL      ( 7*32+14) /* "" MSR IA32_TSX_CTRL 
(Intel) implemented */
+ 
+ #define X86_FEATURE_MSR_SPEC_CTRL ( 7*32+16) /* "" MSR SPEC_CTRL is 
implemented */
+ #define X86_FEATURE_SSBD      ( 7*32+17) /* Speculative Store Bypass Disable 
*/
+diff --git a/arch/x86/kernel/cpu/tsx.c b/arch/x86/kernel/cpu/tsx.c
+index 032509adf9de9..88a553ee77042 100644
+--- a/arch/x86/kernel/cpu/tsx.c
++++ b/arch/x86/kernel/cpu/tsx.c
+@@ -55,24 +55,6 @@ void tsx_enable(void)
+       wrmsrl(MSR_IA32_TSX_CTRL, tsx);
+ }
+ 
+-static bool __init tsx_ctrl_is_supported(void)
+-{
+-      u64 ia32_cap = x86_read_arch_cap_msr();
+-
+-      /*
+-       * TSX is controlled via MSR_IA32_TSX_CTRL.  However, support for this
+-       * MSR is enumerated by ARCH_CAP_TSX_MSR bit in 
MSR_IA32_ARCH_CAPABILITIES.
+-       *
+-       * TSX control (aka MSR_IA32_TSX_CTRL) is only available after a
+-       * microcode update on CPUs that have their MSR_IA32_ARCH_CAPABILITIES
+-       * bit MDS_NO=1. CPUs with MDS_NO=0 are not planned to get
+-       * MSR_IA32_TSX_CTRL support even after a microcode update. Thus,
+-       * tsx= cmdline requests will do nothing on CPUs without
+-       * MSR_IA32_TSX_CTRL support.
+-       */
+-      return !!(ia32_cap & ARCH_CAP_TSX_CTRL_MSR);
+-}
+-
+ static enum tsx_ctrl_states x86_get_tsx_auto_mode(void)
+ {
+       if (boot_cpu_has_bug(X86_BUG_TAA))
+@@ -86,9 +68,22 @@ void __init tsx_init(void)
+       char arg[5] = {};
+       int ret;
+ 
+-      if (!tsx_ctrl_is_supported())
++      /*
++       * TSX is controlled via MSR_IA32_TSX_CTRL.  However, support for this
++       * MSR is enumerated by ARCH_CAP_TSX_MSR bit in 
MSR_IA32_ARCH_CAPABILITIES.
++       *
++       * TSX control (aka MSR_IA32_TSX_CTRL) is only available after a
++       * microcode update on CPUs that have their MSR_IA32_ARCH_CAPABILITIES
++       * bit MDS_NO=1. CPUs with MDS_NO=0 are not planned to get
++       * MSR_IA32_TSX_CTRL support even after a microcode update. Thus,
++       * tsx= cmdline requests will do nothing on CPUs without
++       * MSR_IA32_TSX_CTRL support.
++       */
++      if (!(x86_read_arch_cap_msr() & ARCH_CAP_TSX_CTRL_MSR))
+               return;
+ 
++      setup_force_cpu_cap(X86_FEATURE_MSR_TSX_CTRL);
++
+       ret = cmdline_find_option(boot_command_line, "tsx", arg, sizeof(arg));
+       if (ret >= 0) {
+               if (!strcmp(arg, "on")) {
+diff --git a/arch/x86/mm/ioremap.c b/arch/x86/mm/ioremap.c
+index ecae9ac216fad..696fd6fdc107d 100644
+--- a/arch/x86/mm/ioremap.c
++++ b/arch/x86/mm/ioremap.c
+@@ -126,9 +126,15 @@ static void __iomem *__ioremap_caller(resource_size_t 
phys_addr,
+        * Mappings have to be page-aligned
+        */
+       offset = phys_addr & ~PAGE_MASK;
+-      phys_addr &= PHYSICAL_PAGE_MASK;
++      phys_addr &= PAGE_MASK;
+       size = PAGE_ALIGN(last_addr+1) - phys_addr;
+ 
++      /*
++       * Mask out any bits not part of the actual physical
++       * address, like memory encryption bits.
++       */
++      phys_addr &= PHYSICAL_PAGE_MASK;
++
+       retval = reserve_memtype(phys_addr, (u64)phys_addr + size,
+                                               pcm, &new_pcm);
+       if (retval) {
+diff --git a/arch/x86/power/cpu.c b/arch/x86/power/cpu.c
+index 4c073926ab931..2f32cdba589ae 100644
+--- a/arch/x86/power/cpu.c
++++ b/arch/x86/power/cpu.c
+@@ -520,16 +520,23 @@ static int pm_cpu_check(const struct x86_cpu_id *c)
+ 
+ static void pm_save_spec_msr(void)
+ {
+-      u32 spec_msr_id[] = {
+-              MSR_IA32_SPEC_CTRL,
+-              MSR_IA32_TSX_CTRL,
+-              MSR_TSX_FORCE_ABORT,
+-              MSR_IA32_MCU_OPT_CTRL,
+-              MSR_AMD64_LS_CFG,
+-              MSR_AMD64_DE_CFG,
++      struct msr_enumeration {
++              u32 msr_no;
++              u32 feature;
++      } msr_enum[] = {
++              { MSR_IA32_SPEC_CTRL,    X86_FEATURE_MSR_SPEC_CTRL },
++              { MSR_IA32_TSX_CTRL,     X86_FEATURE_MSR_TSX_CTRL },
++              { MSR_TSX_FORCE_ABORT,   X86_FEATURE_TSX_FORCE_ABORT },
++              { MSR_IA32_MCU_OPT_CTRL, X86_FEATURE_SRBDS_CTRL },
++              { MSR_AMD64_LS_CFG,      X86_FEATURE_LS_CFG_SSBD },
++              { MSR_AMD64_DE_CFG,      X86_FEATURE_LFENCE_RDTSC },
+       };
++      int i;
+ 
+-      msr_build_context(spec_msr_id, ARRAY_SIZE(spec_msr_id));
++      for (i = 0; i < ARRAY_SIZE(msr_enum); i++) {
++              if (boot_cpu_has(msr_enum[i].feature))
++                      msr_build_context(&msr_enum[i].msr_no, 1);
++      }
+ }
+ 
+ static int pm_check_save_msr(void)
+diff --git a/drivers/bus/sunxi-rsb.c b/drivers/bus/sunxi-rsb.c
+index ce5b976a88568..bf323b540c032 100644
+--- a/drivers/bus/sunxi-rsb.c
++++ b/drivers/bus/sunxi-rsb.c
+@@ -268,6 +268,9 @@ EXPORT_SYMBOL_GPL(sunxi_rsb_driver_register);
+ /* common code that starts a transfer */
+ static int _sunxi_rsb_run_xfer(struct sunxi_rsb *rsb)
+ {
++      u32 int_mask, status;
++      bool timeout;
++
+       if (readl(rsb->regs + RSB_CTRL) & RSB_CTRL_START_TRANS) {
+               dev_dbg(rsb->dev, "RSB transfer still in progress\n");
+               return -EBUSY;
+@@ -275,13 +278,23 @@ static int _sunxi_rsb_run_xfer(struct sunxi_rsb *rsb)
+ 
+       reinit_completion(&rsb->complete);
+ 
+-      writel(RSB_INTS_LOAD_BSY | RSB_INTS_TRANS_ERR | RSB_INTS_TRANS_OVER,
+-             rsb->regs + RSB_INTE);
++      int_mask = RSB_INTS_LOAD_BSY | RSB_INTS_TRANS_ERR | RSB_INTS_TRANS_OVER;
++      writel(int_mask, rsb->regs + RSB_INTE);
+       writel(RSB_CTRL_START_TRANS | RSB_CTRL_GLOBAL_INT_ENB,
+              rsb->regs + RSB_CTRL);
+ 
+-      if (!wait_for_completion_io_timeout(&rsb->complete,
+-                                          msecs_to_jiffies(100))) {
++      if (irqs_disabled()) {
++              timeout = readl_poll_timeout_atomic(rsb->regs + RSB_INTS,
++                                                  status, (status & int_mask),
++                                                  10, 100000);
++              writel(status, rsb->regs + RSB_INTS);
++      } else {
++              timeout = !wait_for_completion_io_timeout(&rsb->complete,
++                                                        
msecs_to_jiffies(100));
++              status = rsb->status;
++      }
++
++      if (timeout) {
+               dev_dbg(rsb->dev, "RSB timeout\n");
+ 
+               /* abort the transfer */
+@@ -293,18 +306,18 @@ static int _sunxi_rsb_run_xfer(struct sunxi_rsb *rsb)
+               return -ETIMEDOUT;
+       }
+ 
+-      if (rsb->status & RSB_INTS_LOAD_BSY) {
++      if (status & RSB_INTS_LOAD_BSY) {
+               dev_dbg(rsb->dev, "RSB busy\n");
+               return -EBUSY;
+       }
+ 
+-      if (rsb->status & RSB_INTS_TRANS_ERR) {
+-              if (rsb->status & RSB_INTS_TRANS_ERR_ACK) {
++      if (status & RSB_INTS_TRANS_ERR) {
++              if (status & RSB_INTS_TRANS_ERR_ACK) {
+                       dev_dbg(rsb->dev, "RSB slave nack\n");
+                       return -EINVAL;
+               }
+ 
+-              if (rsb->status & RSB_INTS_TRANS_ERR_DATA) {
++              if (status & RSB_INTS_TRANS_ERR_DATA) {
+                       dev_dbg(rsb->dev, "RSB transfer data error\n");
+                       return -EIO;
+               }
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_gem.c 
b/drivers/gpu/drm/amd/amdgpu/amdgpu_gem.c
+index d5e4748e33001..bc83a95c3645a 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_gem.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_gem.c
+@@ -278,11 +278,9 @@ int amdgpu_gem_userptr_ioctl(struct drm_device *dev, void 
*data,
+       if (r)
+               goto release_object;
+ 
+-      if (args->flags & AMDGPU_GEM_USERPTR_REGISTER) {
+-              r = amdgpu_mn_register(bo, args->addr);
+-              if (r)
+-                      goto release_object;
+-      }
++      r = amdgpu_mn_register(bo, args->addr);
++      if (r)
++              goto release_object;
+ 
+       if (args->flags & AMDGPU_GEM_USERPTR_VALIDATE) {
+               down_read(&current->mm->mmap_sem);
+diff --git a/drivers/hwmon/coretemp.c b/drivers/hwmon/coretemp.c
+index be1e380fa1c34..7e796d68e23ab 100644
+--- a/drivers/hwmon/coretemp.c
++++ b/drivers/hwmon/coretemp.c
+@@ -256,10 +256,13 @@ static int adjust_tjmax(struct cpuinfo_x86 *c, u32 id, 
struct device *dev)
+        */
+       if (host_bridge && host_bridge->vendor == PCI_VENDOR_ID_INTEL) {
+               for (i = 0; i < ARRAY_SIZE(tjmax_pci_table); i++) {
+-                      if (host_bridge->device == tjmax_pci_table[i].device)
++                      if (host_bridge->device == tjmax_pci_table[i].device) {
++                              pci_dev_put(host_bridge);
+                               return tjmax_pci_table[i].tjmax;
++                      }
+               }
+       }
++      pci_dev_put(host_bridge);
+ 
+       for (i = 0; i < ARRAY_SIZE(tjmax_table); i++) {
+               if (strstr(c->x86_model_id, tjmax_table[i].id))
+@@ -557,6 +560,10 @@ static void coretemp_remove_core(struct platform_data 
*pdata,
+ {
+       struct temp_data *tdata = pdata->core_data[indx];
+ 
++      /* if we errored on add then this is already gone */
++      if (!tdata)
++              return;
++
+       /* Remove the sysfs attributes */
+       sysfs_remove_group(&pdata->hwmon_dev->kobj, &tdata->attr_group);
+ 
+diff --git a/drivers/hwmon/i5500_temp.c b/drivers/hwmon/i5500_temp.c
+index 3e3ccbf18b4ef..0064249fcc373 100644
+--- a/drivers/hwmon/i5500_temp.c
++++ b/drivers/hwmon/i5500_temp.c
+@@ -117,7 +117,7 @@ static int i5500_temp_probe(struct pci_dev *pdev,
+       u32 tstimer;
+       s8 tsfsc;
+ 
+-      err = pci_enable_device(pdev);
++      err = pcim_enable_device(pdev);
+       if (err) {
+               dev_err(&pdev->dev, "Failed to enable device\n");
+               return err;
+diff --git a/drivers/hwmon/ibmpex.c b/drivers/hwmon/ibmpex.c
+index 21b9c72f16bd7..26a8987813712 100644
+--- a/drivers/hwmon/ibmpex.c
++++ b/drivers/hwmon/ibmpex.c
+@@ -517,6 +517,7 @@ static void ibmpex_register_bmc(int iface, struct device 
*dev)
+       return;
+ 
+ out_register:
++      list_del(&data->list);
+       hwmon_device_unregister(data->hwmon_dev);
+ out_user:
+       ipmi_destroy_user(data->user);
+diff --git a/drivers/iio/health/afe4403.c b/drivers/iio/health/afe4403.c
+index 2f07c4d1398cd..4756e9645f7da 100644
+--- a/drivers/iio/health/afe4403.c
++++ b/drivers/iio/health/afe4403.c
+@@ -253,14 +253,14 @@ static int afe4403_read_raw(struct iio_dev *indio_dev,
+                           int *val, int *val2, long mask)
+ {
+       struct afe4403_data *afe = iio_priv(indio_dev);
+-      unsigned int reg = afe4403_channel_values[chan->address];
+-      unsigned int field = afe4403_channel_leds[chan->address];
++      unsigned int reg, field;
+       int ret;
+ 
+       switch (chan->type) {
+       case IIO_INTENSITY:
+               switch (mask) {
+               case IIO_CHAN_INFO_RAW:
++                      reg = afe4403_channel_values[chan->address];
+                       ret = afe4403_read(afe, reg, val);
+                       if (ret)
+                               return ret;
+@@ -270,6 +270,7 @@ static int afe4403_read_raw(struct iio_dev *indio_dev,
+       case IIO_CURRENT:
+               switch (mask) {
+               case IIO_CHAN_INFO_RAW:
++                      field = afe4403_channel_leds[chan->address];
+                       ret = regmap_field_read(afe->fields[field], val);
+                       if (ret)
+                               return ret;
+diff --git a/drivers/iio/health/afe4404.c b/drivers/iio/health/afe4404.c
+index 5e256b11ac877..29a906411bd87 100644
+--- a/drivers/iio/health/afe4404.c
++++ b/drivers/iio/health/afe4404.c
+@@ -258,20 +258,20 @@ static int afe4404_read_raw(struct iio_dev *indio_dev,
+                           int *val, int *val2, long mask)
+ {
+       struct afe4404_data *afe = iio_priv(indio_dev);
+-      unsigned int value_reg = afe4404_channel_values[chan->address];
+-      unsigned int led_field = afe4404_channel_leds[chan->address];
+-      unsigned int offdac_field = afe4404_channel_offdacs[chan->address];
++      unsigned int value_reg, led_field, offdac_field;
+       int ret;
+ 
+       switch (chan->type) {
+       case IIO_INTENSITY:
+               switch (mask) {
+               case IIO_CHAN_INFO_RAW:
++                      value_reg = afe4404_channel_values[chan->address];
+                       ret = regmap_read(afe->regmap, value_reg, val);
+                       if (ret)
+                               return ret;
+                       return IIO_VAL_INT;
+               case IIO_CHAN_INFO_OFFSET:
++                      offdac_field = afe4404_channel_offdacs[chan->address];
+                       ret = regmap_field_read(afe->fields[offdac_field], val);
+                       if (ret)
+                               return ret;
+@@ -281,6 +281,7 @@ static int afe4404_read_raw(struct iio_dev *indio_dev,
+       case IIO_CURRENT:
+               switch (mask) {
+               case IIO_CHAN_INFO_RAW:
++                      led_field = afe4404_channel_leds[chan->address];
+                       ret = regmap_field_read(afe->fields[led_field], val);
+                       if (ret)
+                               return ret;
+@@ -303,19 +304,20 @@ static int afe4404_write_raw(struct iio_dev *indio_dev,
+                            int val, int val2, long mask)
+ {
+       struct afe4404_data *afe = iio_priv(indio_dev);
+-      unsigned int led_field = afe4404_channel_leds[chan->address];
+-      unsigned int offdac_field = afe4404_channel_offdacs[chan->address];
++      unsigned int led_field, offdac_field;
+ 
+       switch (chan->type) {
+       case IIO_INTENSITY:
+               switch (mask) {
+               case IIO_CHAN_INFO_OFFSET:
++                      offdac_field = afe4404_channel_offdacs[chan->address];
+                       return regmap_field_write(afe->fields[offdac_field], 
val);
+               }
+               break;
+       case IIO_CURRENT:
+               switch (mask) {
+               case IIO_CHAN_INFO_RAW:
++                      led_field = afe4404_channel_leds[chan->address];
+                       return regmap_field_write(afe->fields[led_field], val);
+               }
+               break;
+diff --git a/drivers/iio/industrialio-sw-trigger.c 
b/drivers/iio/industrialio-sw-trigger.c
+index 8d24fb159cc92..bae2d7734343a 100644
+--- a/drivers/iio/industrialio-sw-trigger.c
++++ b/drivers/iio/industrialio-sw-trigger.c
+@@ -61,8 +61,12 @@ int iio_register_sw_trigger_type(struct iio_sw_trigger_type 
*t)
+ 
+       t->group = configfs_register_default_group(iio_triggers_group, t->name,
+                                               &iio_trigger_type_group_type);
+-      if (IS_ERR(t->group))
++      if (IS_ERR(t->group)) {
++              mutex_lock(&iio_trigger_types_lock);
++              list_del(&t->list);
++              mutex_unlock(&iio_trigger_types_lock);
+               ret = PTR_ERR(t->group);
++      }
+ 
+       return ret;
+ }
+diff --git a/drivers/iio/light/apds9960.c b/drivers/iio/light/apds9960.c
+index a4304edc3e0fa..bf2946c6371ae 100644
+--- a/drivers/iio/light/apds9960.c
++++ b/drivers/iio/light/apds9960.c
+@@ -63,9 +63,6 @@
+ #define APDS9960_REG_CONTROL_PGAIN_MASK_SHIFT 2
+ 
+ #define APDS9960_REG_CONFIG_2 0x90
+-#define APDS9960_REG_CONFIG_2_GGAIN_MASK      0x60
+-#define APDS9960_REG_CONFIG_2_GGAIN_MASK_SHIFT        5
+-
+ #define APDS9960_REG_ID               0x92
+ 
+ #define APDS9960_REG_STATUS   0x93
+@@ -86,6 +83,9 @@
+ #define APDS9960_REG_GCONF_1_GFIFO_THRES_MASK_SHIFT   6
+ 
+ #define APDS9960_REG_GCONF_2  0xa3
++#define APDS9960_REG_GCONF_2_GGAIN_MASK                       0x60
++#define APDS9960_REG_GCONF_2_GGAIN_MASK_SHIFT         5
++
+ #define APDS9960_REG_GOFFSET_U        0xa4
+ #define APDS9960_REG_GOFFSET_D        0xa5
+ #define APDS9960_REG_GPULSE   0xa6
+@@ -404,9 +404,9 @@ static int apds9960_set_pxs_gain(struct apds9960_data 
*data, int val)
+                       }
+ 
+                       ret = regmap_update_bits(data->regmap,
+-                              APDS9960_REG_CONFIG_2,
+-                              APDS9960_REG_CONFIG_2_GGAIN_MASK,
+-                              idx << APDS9960_REG_CONFIG_2_GGAIN_MASK_SHIFT);
++                              APDS9960_REG_GCONF_2,
++                              APDS9960_REG_GCONF_2_GGAIN_MASK,
++                              idx << APDS9960_REG_GCONF_2_GGAIN_MASK_SHIFT);
+                       if (!ret)
+                               data->pxs_gain = idx;
+                       mutex_unlock(&data->lock);
+diff --git a/drivers/iommu/dmar.c b/drivers/iommu/dmar.c
+index d8b8cf36de312..fb03616f9aded 100644
+--- a/drivers/iommu/dmar.c
++++ b/drivers/iommu/dmar.c
+@@ -803,6 +803,7 @@ int __init dmar_dev_scope_init(void)
+                       info = dmar_alloc_pci_notify_info(dev,
+                                       BUS_NOTIFY_ADD_DEVICE);
+                       if (!info) {
++                              pci_dev_put(dev);
+                               return dmar_dev_scope_status;
+                       } else {
+                               dmar_pci_bus_add_dev(info);
+diff --git a/drivers/net/can/cc770/cc770_isa.c 
b/drivers/net/can/cc770/cc770_isa.c
+index e0d15711e9ac2..8df613bc3be38 100644
+--- a/drivers/net/can/cc770/cc770_isa.c
++++ b/drivers/net/can/cc770/cc770_isa.c
+@@ -272,22 +272,24 @@ static int cc770_isa_probe(struct platform_device *pdev)
+       if (err) {
+               dev_err(&pdev->dev,
+                       "couldn't register device (err=%d)\n", err);
+-              goto exit_unmap;
++              goto exit_free;
+       }
+ 
+       dev_info(&pdev->dev, "device registered (reg_base=0x%p, irq=%d)\n",
+                priv->reg_base, dev->irq);
+       return 0;
+ 
+- exit_unmap:
++exit_free:
++      free_cc770dev(dev);
++exit_unmap:
+       if (mem[idx])
+               iounmap(base);
+- exit_release:
++exit_release:
+       if (mem[idx])
+               release_mem_region(mem[idx], iosize);
+       else
+               release_region(port[idx], iosize);
+- exit:
++exit:
+       return err;
+ }
+ 
+diff --git a/drivers/net/can/sja1000/sja1000_isa.c 
b/drivers/net/can/sja1000/sja1000_isa.c
+index e97e6d35b3000..5187fdabdca9e 100644
+--- a/drivers/net/can/sja1000/sja1000_isa.c
++++ b/drivers/net/can/sja1000/sja1000_isa.c
+@@ -213,22 +213,24 @@ static int sja1000_isa_probe(struct platform_device 
*pdev)
+       if (err) {
+               dev_err(&pdev->dev, "registering %s failed (err=%d)\n",
+                       DRV_NAME, err);
+-              goto exit_unmap;
++              goto exit_free;
+       }
+ 
+       dev_info(&pdev->dev, "%s device registered (reg_base=0x%p, irq=%d)\n",
+                DRV_NAME, priv->reg_base, dev->irq);
+       return 0;
+ 
+- exit_unmap:
++exit_free:
++      free_sja1000dev(dev);
++exit_unmap:
+       if (mem[idx])
+               iounmap(base);
+- exit_release:
++exit_release:
+       if (mem[idx])
+               release_mem_region(mem[idx], iosize);
+       else
+               release_region(port[idx], iosize);
+- exit:
++exit:
+       return err;
+ }
+ 
+diff --git a/drivers/net/ethernet/cavium/thunder/thunder_bgx.c 
b/drivers/net/ethernet/cavium/thunder/thunder_bgx.c
+index e858b1af788d5..0a58e55f86133 100644
+--- a/drivers/net/ethernet/cavium/thunder/thunder_bgx.c
++++ b/drivers/net/ethernet/cavium/thunder/thunder_bgx.c
+@@ -1183,8 +1183,10 @@ static acpi_status bgx_acpi_match_id(acpi_handle 
handle, u32 lvl,
+               return AE_OK;
+       }
+ 
+-      if (strncmp(string.pointer, bgx_sel, 4))
++      if (strncmp(string.pointer, bgx_sel, 4)) {
++              kfree(string.pointer);
+               return AE_OK;
++      }
+ 
+       acpi_walk_namespace(ACPI_TYPE_DEVICE, handle, 1,
+                           bgx_acpi_register_phy, NULL, bgx, NULL);
+diff --git a/drivers/net/ethernet/mellanox/mlx4/qp.c 
b/drivers/net/ethernet/mellanox/mlx4/qp.c
+index 71578d48efbc3..54026043b5e25 100644
+--- a/drivers/net/ethernet/mellanox/mlx4/qp.c
++++ b/drivers/net/ethernet/mellanox/mlx4/qp.c
+@@ -696,7 +696,8 @@ static int mlx4_create_zones(struct mlx4_dev *dev,
+                       err = mlx4_bitmap_init(*bitmap + k, 1,
+                                              MLX4_QP_TABLE_RAW_ETH_SIZE - 1, 
0,
+                                              0);
+-                      mlx4_bitmap_alloc_range(*bitmap + k, 1, 1, 0);
++                      if (!err)
++                              mlx4_bitmap_alloc_range(*bitmap + k, 1, 1, 0);
+               }
+ 
+               if (err)
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/cmd.c 
b/drivers/net/ethernet/mellanox/mlx5/core/cmd.c
+index b6113620cb1aa..043eec677b2cd 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/cmd.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/cmd.c
+@@ -1293,8 +1293,8 @@ static ssize_t outlen_write(struct file *filp, const 
char __user *buf,
+               return -EFAULT;
+ 
+       err = sscanf(outlen_str, "%d", &outlen);
+-      if (err < 0)
+-              return err;
++      if (err != 1)
++              return -EINVAL;
+ 
+       ptr = kzalloc(outlen, GFP_KERNEL);
+       if (!ptr)
+diff --git a/drivers/net/ethernet/oki-semi/pch_gbe/pch_gbe_main.c 
b/drivers/net/ethernet/oki-semi/pch_gbe/pch_gbe_main.c
+index cd59577a0c921..ca6c4e7254cdc 100644
+--- a/drivers/net/ethernet/oki-semi/pch_gbe/pch_gbe_main.c
++++ b/drivers/net/ethernet/oki-semi/pch_gbe/pch_gbe_main.c
+@@ -1221,6 +1221,7 @@ static void pch_gbe_tx_queue(struct pch_gbe_adapter 
*adapter,
+               buffer_info->dma = 0;
+               buffer_info->time_stamp = 0;
+               tx_ring->next_to_use = ring_num;
++              dev_kfree_skb_any(skb);
+               return;
+       }
+       buffer_info->mapped = true;
+diff --git a/drivers/net/ethernet/qlogic/qla3xxx.c 
b/drivers/net/ethernet/qlogic/qla3xxx.c
+index e62e3a9d52490..4ad4fb832a4ac 100644
+--- a/drivers/net/ethernet/qlogic/qla3xxx.c
++++ b/drivers/net/ethernet/qlogic/qla3xxx.c
+@@ -2472,6 +2472,7 @@ static netdev_tx_t ql3xxx_send(struct sk_buff *skb,
+                                            skb_shinfo(skb)->nr_frags);
+       if (tx_cb->seg_count == -1) {
+               netdev_err(ndev, "%s: invalid segment count!\n", __func__);
++              dev_kfree_skb_any(skb);
+               return NETDEV_TX_OK;
+       }
+ 
+diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_hw.c 
b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_hw.c
+index 59b77bb891475..1134060b69622 100644
+--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_hw.c
++++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_hw.c
+@@ -2992,7 +2992,7 @@ static void qlcnic_83xx_recover_driver_lock(struct 
qlcnic_adapter *adapter)
+               QLCWRX(adapter->ahw, QLC_83XX_RECOVER_DRV_LOCK, val);
+               dev_info(&adapter->pdev->dev,
+                        "%s: lock recovery initiated\n", __func__);
+-              msleep(QLC_83XX_DRV_LOCK_RECOVERY_DELAY);
++              mdelay(QLC_83XX_DRV_LOCK_RECOVERY_DELAY);
+               val = QLCRDX(adapter->ahw, QLC_83XX_RECOVER_DRV_LOCK);
+               id = ((val >> 2) & 0xF);
+               if (id == adapter->portnum) {
+@@ -3028,7 +3028,7 @@ int qlcnic_83xx_lock_driver(struct qlcnic_adapter 
*adapter)
+               if (status)
+                       break;
+ 
+-              msleep(QLC_83XX_DRV_LOCK_WAIT_DELAY);
++              mdelay(QLC_83XX_DRV_LOCK_WAIT_DELAY);
+               i++;
+ 
+               if (i == 1)
+diff --git a/drivers/net/ethernet/renesas/ravb_main.c 
b/drivers/net/ethernet/renesas/ravb_main.c
+index 5452fe4bf12ad..2bebf39fe0479 100644
+--- a/drivers/net/ethernet/renesas/ravb_main.c
++++ b/drivers/net/ethernet/renesas/ravb_main.c
+@@ -2183,6 +2183,7 @@ static int __maybe_unused ravb_resume(struct device *dev)
+               ret = ravb_open(ndev);
+               if (ret < 0)
+                       return ret;
++              ravb_set_rx_mode(ndev);
+               netif_device_attach(ndev);
+       }
+ 
+diff --git a/drivers/net/ntb_netdev.c b/drivers/net/ntb_netdev.c
+index 03009f1becddc..bd6c19ceab30a 100644
+--- a/drivers/net/ntb_netdev.c
++++ b/drivers/net/ntb_netdev.c
+@@ -500,7 +500,14 @@ static int __init ntb_netdev_init_module(void)
+       rc = ntb_transport_register_client_dev(KBUILD_MODNAME);
+       if (rc)
+               return rc;
+-      return ntb_transport_register_client(&ntb_netdev_client);
++
++      rc = ntb_transport_register_client(&ntb_netdev_client);
++      if (rc) {
++              ntb_transport_unregister_client_dev(KBUILD_MODNAME);
++              return rc;
++      }
++
++      return 0;
+ }
+ module_init(ntb_netdev_init_module);
+ 
+diff --git a/drivers/net/phy/phy_device.c b/drivers/net/phy/phy_device.c
+index a3ba95e96695e..90dbf1b2a33a5 100644
+--- a/drivers/net/phy/phy_device.c
++++ b/drivers/net/phy/phy_device.c
+@@ -948,6 +948,7 @@ error:
+ 
+ error_module_put:
+       module_put(d->driver->owner);
++      d->driver = NULL;
+ error_put_device:
+       put_device(d);
+       if (ndev_owner != bus->owner)
+diff --git a/drivers/net/usb/qmi_wwan.c b/drivers/net/usb/qmi_wwan.c
+index 547693118606d..62eb45a819e76 100644
+--- a/drivers/net/usb/qmi_wwan.c
++++ b/drivers/net/usb/qmi_wwan.c
+@@ -926,6 +926,7 @@ static const struct usb_device_id products[] = {
+       {QMI_FIXED_INTF(0x2357, 0x0201, 4)},    /* TP-LINK HSUPA Modem MA180 */
+       {QMI_FIXED_INTF(0x2357, 0x9000, 4)},    /* TP-LINK MA260 */
+       {QMI_QUIRK_SET_DTR(0x1bc7, 0x1031, 3)}, /* Telit LE910C1-EUX */
++      {QMI_QUIRK_SET_DTR(0x1bc7, 0x103a, 0)}, /* Telit LE910C4-WWX */
+       {QMI_QUIRK_SET_DTR(0x1bc7, 0x1040, 2)}, /* Telit LE922A */
+       {QMI_QUIRK_SET_DTR(0x1bc7, 0x1050, 2)}, /* Telit FN980 */
+       {QMI_QUIRK_SET_DTR(0x1bc7, 0x1060, 2)}, /* Telit LN920 */
+diff --git a/drivers/net/wireless/mac80211_hwsim.c 
b/drivers/net/wireless/mac80211_hwsim.c
+index 70251c703c9ea..53e0fec274a42 100644
+--- a/drivers/net/wireless/mac80211_hwsim.c
++++ b/drivers/net/wireless/mac80211_hwsim.c
+@@ -671,6 +671,7 @@ static void hwsim_send_nullfunc(struct mac80211_hwsim_data 
*data, u8 *mac,
+       struct hwsim_vif_priv *vp = (void *)vif->drv_priv;
+       struct sk_buff *skb;
+       struct ieee80211_hdr *hdr;
++      struct ieee80211_tx_info *cb;
+ 
+       if (!vp->assoc)
+               return;
+@@ -691,6 +692,10 @@ static void hwsim_send_nullfunc(struct 
mac80211_hwsim_data *data, u8 *mac,
+       memcpy(hdr->addr2, mac, ETH_ALEN);
+       memcpy(hdr->addr3, vp->bssid, ETH_ALEN);
+ 
++      cb = IEEE80211_SKB_CB(skb);
++      cb->control.rates[0].count = 1;
++      cb->control.rates[1].idx = -1;
++
+       rcu_read_lock();
+       mac80211_hwsim_tx_frame(data->hw, skb,
+                               rcu_dereference(vif->chanctx_conf)->def.chan);
+diff --git a/drivers/nfc/st-nci/se.c b/drivers/nfc/st-nci/se.c
+index 85df2e0093109..b1d23b35aac4f 100644
+--- a/drivers/nfc/st-nci/se.c
++++ b/drivers/nfc/st-nci/se.c
+@@ -338,7 +338,7 @@ static int st_nci_hci_connectivity_event_received(struct 
nci_dev *ndev,
+                * AID          81      5 to 16
+                * PARAMETERS   82      0 to 255
+                */
+-              if (skb->len < NFC_MIN_AID_LENGTH + 2 &&
++              if (skb->len < NFC_MIN_AID_LENGTH + 2 ||
+                   skb->data[0] != NFC_EVT_TRANSACTION_AID_TAG)
+                       return -EPROTO;
+ 
+@@ -352,8 +352,10 @@ static int st_nci_hci_connectivity_event_received(struct 
nci_dev *ndev,
+ 
+               /* Check next byte is PARAMETERS tag (82) */
+               if (skb->data[transaction->aid_len + 2] !=
+-                  NFC_EVT_TRANSACTION_PARAMS_TAG)
++                  NFC_EVT_TRANSACTION_PARAMS_TAG) {
++                      devm_kfree(dev, transaction);
+                       return -EPROTO;
++              }
+ 
+               transaction->params_len = skb->data[transaction->aid_len + 3];
+               memcpy(transaction->params, skb->data +
+diff --git a/drivers/pinctrl/pinctrl-single.c 
b/drivers/pinctrl/pinctrl-single.c
+index 01f42090cd036..d2180bf2da95c 100644
+--- a/drivers/pinctrl/pinctrl-single.c
++++ b/drivers/pinctrl/pinctrl-single.c
+@@ -812,7 +812,7 @@ static int pcs_allocate_pin_table(struct pcs_device *pcs)
+ 
+       mux_bytes = pcs->width / BITS_PER_BYTE;
+ 
+-      if (pcs->bits_per_mux) {
++      if (pcs->bits_per_mux && pcs->fmask) {
+               pcs->bits_per_pin = fls(pcs->fmask);
+               nr_pins = (pcs->size * BITS_PER_BYTE) / pcs->bits_per_pin;
+               num_pins_in_register = pcs->width / pcs->bits_per_pin;
+diff --git a/drivers/platform/x86/asus-wmi.c b/drivers/platform/x86/asus-wmi.c
+index 4ae758c3d8ba5..9f6e462c57fee 100644
+--- a/drivers/platform/x86/asus-wmi.c
++++ b/drivers/platform/x86/asus-wmi.c
+@@ -1111,6 +1111,8 @@ static void asus_wmi_set_xusb2pr(struct asus_wmi *asus)
+       pci_write_config_dword(xhci_pdev, USB_INTEL_XUSB2PR,
+                               cpu_to_le32(ports_available));
+ 
++      pci_dev_put(xhci_pdev);
++
+       pr_info("set USB_INTEL_XUSB2PR old: 0x%04x, new: 0x%04x\n",
+                       orig_ports_available, ports_available);
+ }
+diff --git a/drivers/tty/serial/8250/8250_omap.c 
b/drivers/tty/serial/8250/8250_omap.c
+index d5962162c5906..b37e6619af9c6 100644
+--- a/drivers/tty/serial/8250/8250_omap.c
++++ b/drivers/tty/serial/8250/8250_omap.c
+@@ -242,6 +242,7 @@ static void omap8250_restore_regs(struct uart_8250_port 
*up)
+ {
+       struct omap8250_priv *priv = up->port.private_data;
+       struct uart_8250_dma    *dma = up->dma;
++      u8 mcr = serial8250_in_MCR(up);
+ 
+       if (dma && dma->tx_running) {
+               /*
+@@ -258,7 +259,7 @@ static void omap8250_restore_regs(struct uart_8250_port 
*up)
+       serial_out(up, UART_EFR, UART_EFR_ECB);
+ 
+       serial_out(up, UART_LCR, UART_LCR_CONF_MODE_A);
+-      serial8250_out_MCR(up, UART_MCR_TCRTLR);
++      serial8250_out_MCR(up, mcr | UART_MCR_TCRTLR);
+       serial_out(up, UART_FCR, up->fcr);
+ 
+       omap8250_update_scr(up, priv);
+@@ -274,7 +275,8 @@ static void omap8250_restore_regs(struct uart_8250_port 
*up)
+       serial_out(up, UART_LCR, 0);
+ 
+       /* drop TCR + TLR access, we setup XON/XOFF later */
+-      serial8250_out_MCR(up, up->mcr);
++      serial8250_out_MCR(up, mcr);
++
+       serial_out(up, UART_IER, up->ier);
+ 
+       serial_out(up, UART_LCR, UART_LCR_CONF_MODE_B);
+@@ -583,7 +585,6 @@ static int omap_8250_startup(struct uart_port *port)
+ 
+       pm_runtime_get_sync(port->dev);
+ 
+-      up->mcr = 0;
+       serial_out(up, UART_FCR, UART_FCR_CLEAR_RCVR | UART_FCR_CLEAR_XMIT);
+ 
+       serial_out(up, UART_LCR, UART_LCR_WLEN8);
+diff --git a/drivers/video/fbdev/pm2fb.c b/drivers/video/fbdev/pm2fb.c
+index 50b569d047b10..9b32b9fc44a5c 100644
+--- a/drivers/video/fbdev/pm2fb.c
++++ b/drivers/video/fbdev/pm2fb.c
+@@ -619,11 +619,6 @@ static int pm2fb_check_var(struct fb_var_screeninfo *var, 
struct fb_info *info)
+               return -EINVAL;
+       }
+ 
+-      if (!var->pixclock) {
+-              DPRINTK("pixclock is zero\n");
+-              return -EINVAL;
+-      }
+-
+       if (PICOS2KHZ(var->pixclock) > PM2_MAX_PIXCLOCK) {
+               DPRINTK("pixclock too high (%ldKHz)\n",
+                       PICOS2KHZ(var->pixclock));
+diff --git a/drivers/xen/platform-pci.c b/drivers/xen/platform-pci.c
+index cf9666680c8c0..20365b01c36b9 100644
+--- a/drivers/xen/platform-pci.c
++++ b/drivers/xen/platform-pci.c
+@@ -149,7 +149,7 @@ static int platform_pci_probe(struct pci_dev *pdev,
+               if (ret) {
+                       dev_warn(&pdev->dev, "Unable to set the evtchn callback 
"
+                                        "err=%d\n", ret);
+-                      goto out;
++                      goto irq_out;
+               }
+       }
+ 
+@@ -157,7 +157,7 @@ static int platform_pci_probe(struct pci_dev *pdev,
+       grant_frames = alloc_xen_mmio(PAGE_SIZE * max_nr_gframes);
+       ret = gnttab_setup_auto_xlat_frames(grant_frames);
+       if (ret)
+-              goto out;
++              goto irq_out;
+       ret = gnttab_init();
+       if (ret)
+               goto grant_out;
+@@ -165,6 +165,9 @@ static int platform_pci_probe(struct pci_dev *pdev,
+       return 0;
+ grant_out:
+       gnttab_free_auto_xlat_frames();
++irq_out:
++      if (!xen_have_vector_callback)
++              free_irq(pdev->irq, pdev);
+ out:
+       pci_release_region(pdev, 0);
+ mem_out:
+diff --git a/fs/btrfs/qgroup.c b/fs/btrfs/qgroup.c
+index d6795c6fdd666..a13a83ec6202c 100644
+--- a/fs/btrfs/qgroup.c
++++ b/fs/btrfs/qgroup.c
+@@ -1990,14 +1990,7 @@ int btrfs_qgroup_inherit(struct btrfs_trans_handle 
*trans,
+               dstgroup->rsv_rfer = inherit->lim.rsv_rfer;
+               dstgroup->rsv_excl = inherit->lim.rsv_excl;
+ 
+-              ret = update_qgroup_limit_item(trans, quota_root, dstgroup);
+-              if (ret) {
+-                      fs_info->qgroup_flags |= 
BTRFS_QGROUP_STATUS_FLAG_INCONSISTENT;
+-                      btrfs_info(fs_info,
+-                                 "unable to update quota limit for %llu",
+-                                 dstgroup->qgroupid);
+-                      goto unlock;
+-              }
++              qgroup_dirty(fs_info, dstgroup);
+       }
+ 
+       if (srcid) {
+diff --git a/fs/nilfs2/dat.c b/fs/nilfs2/dat.c
+index dffedb2f88179..275d40b033f91 100644
+--- a/fs/nilfs2/dat.c
++++ b/fs/nilfs2/dat.c
+@@ -120,6 +120,13 @@ static void nilfs_dat_commit_free(struct inode *dat,
+       kunmap_atomic(kaddr);
+ 
+       nilfs_dat_commit_entry(dat, req);
++
++      if (unlikely(req->pr_desc_bh == NULL || req->pr_bitmap_bh == NULL)) {
++              nilfs_error(dat->i_sb,
++                          "state inconsistency probably due to duplicate use 
of vblocknr = %llu",
++                          (unsigned long long)req->pr_entry_nr);
++              return;
++      }
+       nilfs_palloc_commit_free_entry(dat, req);
+ }
+ 
+diff --git a/fs/nilfs2/sufile.c b/fs/nilfs2/sufile.c
+index 1541a1e9221a5..14769684946e7 100644
+--- a/fs/nilfs2/sufile.c
++++ b/fs/nilfs2/sufile.c
+@@ -507,14 +507,22 @@ void nilfs_sufile_do_free(struct inode *sufile, __u64 
segnum,
+ int nilfs_sufile_mark_dirty(struct inode *sufile, __u64 segnum)
+ {
+       struct buffer_head *bh;
++      void *kaddr;
++      struct nilfs_segment_usage *su;
+       int ret;
+ 
++      down_write(&NILFS_MDT(sufile)->mi_sem);
+       ret = nilfs_sufile_get_segment_usage_block(sufile, segnum, 0, &bh);
+       if (!ret) {
+               mark_buffer_dirty(bh);
+               nilfs_mdt_mark_dirty(sufile);
++              kaddr = kmap_atomic(bh->b_page);
++              su = nilfs_sufile_block_get_segment_usage(sufile, segnum, bh, 
kaddr);
++              nilfs_segment_usage_set_dirty(su);
++              kunmap_atomic(kaddr);
+               brelse(bh);
+       }
++      up_write(&NILFS_MDT(sufile)->mi_sem);
+       return ret;
+ }
+ 
+diff --git a/include/uapi/linux/audit.h b/include/uapi/linux/audit.h
+index 208df7b44e90f..d7ac6b9be18e2 100644
+--- a/include/uapi/linux/audit.h
++++ b/include/uapi/linux/audit.h
+@@ -170,7 +170,7 @@
+ #define AUDIT_MAX_KEY_LEN  256
+ #define AUDIT_BITMASK_SIZE 64
+ #define AUDIT_WORD(nr) ((__u32)((nr)/32))
+-#define AUDIT_BIT(nr)  (1 << ((nr) - AUDIT_WORD(nr)*32))
++#define AUDIT_BIT(nr)  (1U << ((nr) - AUDIT_WORD(nr)*32))
+ 
+ #define AUDIT_SYSCALL_CLASSES 16
+ #define AUDIT_CLASS_DIR_WRITE 0
+diff --git a/kernel/sysctl.c b/kernel/sysctl.c
+index 184d462339e65..9890f93a56fbd 100644
+--- a/kernel/sysctl.c
++++ b/kernel/sysctl.c
+@@ -2041,13 +2041,14 @@ int proc_dostring(struct ctl_table *table, int write,
+                              (char __user *)buffer, lenp, ppos);
+ }
+ 
+-static size_t proc_skip_spaces(char **buf)
++static void proc_skip_spaces(char **buf, size_t *size)
+ {
+-      size_t ret;
+-      char *tmp = skip_spaces(*buf);
+-      ret = tmp - *buf;
+-      *buf = tmp;
+-      return ret;
++      while (*size) {
++              if (!isspace(**buf))
++                      break;
++              (*size)--;
++              (*buf)++;
++      }
+ }
+ 
+ static void proc_skip_char(char **buf, size_t *size, const char v)
+@@ -2081,13 +2082,12 @@ static int proc_get_long(char **buf, size_t *size,
+                         unsigned long *val, bool *neg,
+                         const char *perm_tr, unsigned perm_tr_len, char *tr)
+ {
+-      int len;
+       char *p, tmp[TMPBUFLEN];
++      ssize_t len = *size;
+ 
+-      if (!*size)
++      if (len <= 0)
+               return -EINVAL;
+ 
+-      len = *size;
+       if (len > TMPBUFLEN - 1)
+               len = TMPBUFLEN - 1;
+ 
+@@ -2261,7 +2261,7 @@ static int __do_proc_dointvec(void *tbl_data, struct 
ctl_table *table,
+               bool neg;
+ 
+               if (write) {
+-                      left -= proc_skip_spaces(&p);
++                      proc_skip_spaces(&p, &left);
+ 
+                       if (!left)
+                               break;
+@@ -2292,7 +2292,7 @@ static int __do_proc_dointvec(void *tbl_data, struct 
ctl_table *table,
+       if (!write && !first && left && !err)
+               err = proc_put_char(&buffer, &left, '\n');
+       if (write && !err && left)
+-              left -= proc_skip_spaces(&p);
++              proc_skip_spaces(&p, &left);
+       if (write) {
+               kfree(kbuf);
+               if (first)
+@@ -2544,7 +2544,7 @@ static int __do_proc_doulongvec_minmax(void *data, 
struct ctl_table *table, int
+               if (write) {
+                       bool neg;
+ 
+-                      left -= proc_skip_spaces(&p);
++                      proc_skip_spaces(&p, &left);
+                       if (!left)
+                               break;
+ 
+@@ -2577,7 +2577,7 @@ static int __do_proc_doulongvec_minmax(void *data, 
struct ctl_table *table, int
+       if (!write && !first && left && !err)
+               err = proc_put_char(&buffer, &left, '\n');
+       if (write && !err)
+-              left -= proc_skip_spaces(&p);
++              proc_skip_spaces(&p, &left);
+       if (write) {
+               kfree(kbuf);
+               if (first)
+diff --git a/mm/frame_vector.c b/mm/frame_vector.c
+index d73eed0443f69..aa5526e62c5e6 100644
+--- a/mm/frame_vector.c
++++ b/mm/frame_vector.c
+@@ -36,7 +36,6 @@ int get_vaddr_frames(unsigned long start, unsigned int 
nr_frames,
+       struct mm_struct *mm = current->mm;
+       struct vm_area_struct *vma;
+       int ret = 0;
+-      int err;
+       int locked;
+ 
+       if (nr_frames == 0)
+@@ -71,32 +70,14 @@ int get_vaddr_frames(unsigned long start, unsigned int 
nr_frames,
+               vec->is_pfns = false;
+               ret = get_user_pages_locked(start, nr_frames,
+                       gup_flags, (struct page **)(vec->ptrs), &locked);
+-              goto out;
++              if (likely(ret > 0))
++                      goto out;
+       }
+ 
+-      vec->got_ref = false;
+-      vec->is_pfns = true;
+-      do {
+-              unsigned long *nums = frame_vector_pfns(vec);
+-
+-              while (ret < nr_frames && start + PAGE_SIZE <= vma->vm_end) {
+-                      err = follow_pfn(vma, start, &nums[ret]);
+-                      if (err) {
+-                              if (ret == 0)
+-                                      ret = err;
+-                              goto out;
+-                      }
+-                      start += PAGE_SIZE;
+-                      ret++;
+-              }
+-              /*
+-               * We stop if we have enough pages or if VMA doesn't completely
+-               * cover the tail page.
+-               */
+-              if (ret >= nr_frames || start < vma->vm_end)
+-                      break;
+-              vma = find_vma_intersection(mm, start, start + 1);
+-      } while (vma && vma->vm_flags & (VM_IO | VM_PFNMAP));
++      /* This used to (racily) return non-refcounted pfns. Let people know */
++      WARN_ONCE(1, "get_vaddr_frames() cannot follow VM_IO mapping");
++      vec->nr_frames = 0;
++
+ out:
+       if (locked)
+               up_read(&mm->mmap_sem);
+diff --git a/net/9p/trans_fd.c b/net/9p/trans_fd.c
+index a7973bd56a400..7e484f5b140cf 100644
+--- a/net/9p/trans_fd.c
++++ b/net/9p/trans_fd.c
+@@ -210,9 +210,11 @@ static void p9_conn_cancel(struct p9_conn *m, int err)
+ 
+       list_for_each_entry_safe(req, rtmp, &m->req_list, req_list) {
+               list_move(&req->req_list, &cancel_list);
++              req->status = REQ_STATUS_ERROR;
+       }
+       list_for_each_entry_safe(req, rtmp, &m->unsent_req_list, req_list) {
+               list_move(&req->req_list, &cancel_list);
++              req->status = REQ_STATUS_ERROR;
+       }
+ 
+       spin_unlock(&m->client->lock);
+@@ -849,8 +851,10 @@ static int p9_socket_open(struct p9_client *client, 
struct socket *csocket)
+       struct file *file;
+ 
+       p = kzalloc(sizeof(struct p9_trans_fd), GFP_KERNEL);
+-      if (!p)
++      if (!p) {
++              sock_release(csocket);
+               return -ENOMEM;
++      }
+ 
+       csocket->sk->sk_allocation = GFP_NOIO;
+       file = sock_alloc_file(csocket, 0, NULL);
+diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c
+index c230f89e7238c..5e7fb30b2320f 100644
+--- a/net/bluetooth/l2cap_core.c
++++ b/net/bluetooth/l2cap_core.c
+@@ -5543,6 +5543,19 @@ static int l2cap_le_connect_req(struct l2cap_conn *conn,
+       BT_DBG("psm 0x%2.2x scid 0x%4.4x mtu %u mps %u", __le16_to_cpu(psm),
+              scid, mtu, mps);
+ 
++      /* BLUETOOTH CORE SPECIFICATION Version 5.3 | Vol 3, Part A
++       * page 1059:
++       *
++       * Valid range: 0x0001-0x00ff
++       *
++       * Table 4.15: L2CAP_LE_CREDIT_BASED_CONNECTION_REQ SPSM ranges
++       */
++      if (!psm || __le16_to_cpu(psm) > L2CAP_PSM_LE_DYN_END) {
++              result = L2CAP_CR_BAD_PSM;
++              chan = NULL;
++              goto response;
++      }
++
+       /* Check if we have socket listening on psm */
+       pchan = l2cap_global_chan_by_psm(BT_LISTEN, psm, &conn->hcon->src,
+                                        &conn->hcon->dst, LE_LINK);
+diff --git a/net/hsr/hsr_forward.c b/net/hsr/hsr_forward.c
+index 04b5450c5a557..adfb497606785 100644
+--- a/net/hsr/hsr_forward.c
++++ b/net/hsr/hsr_forward.c
+@@ -207,17 +207,18 @@ static void hsr_deliver_master(struct sk_buff *skb, 
struct net_device *dev,
+                              struct hsr_node *node_src)
+ {
+       bool was_multicast_frame;
+-      int res;
++      int res, recv_len;
+ 
+       was_multicast_frame = (skb->pkt_type == PACKET_MULTICAST);
+       hsr_addr_subst_source(node_src, skb);
+       skb_pull(skb, ETH_HLEN);
++      recv_len = skb->len;
+       res = netif_rx(skb);
+       if (res == NET_RX_DROP) {
+               dev->stats.rx_dropped++;
+       } else {
+               dev->stats.rx_packets++;
+-              dev->stats.rx_bytes += skb->len;
++              dev->stats.rx_bytes += recv_len;
+               if (was_multicast_frame)
+                       dev->stats.multicast++;
+       }
+diff --git a/net/ipv4/Kconfig b/net/ipv4/Kconfig
+index 4d265d4a0dbe2..29be5bcbe7ac1 100644
+--- a/net/ipv4/Kconfig
++++ b/net/ipv4/Kconfig
+@@ -371,6 +371,16 @@ config INET_IPCOMP
+ 
+         If unsure, say Y.
+ 
++config INET_TABLE_PERTURB_ORDER
++      int "INET: Source port perturbation table size (as power of 2)" if 
EXPERT
++      default 16
++      help
++        Source port perturbation table size (as power of 2) for
++        RFC 6056 3.3.4.  Algorithm 4: Double-Hash Port Selection Algorithm.
++
++        The default is almost always what you want.
++        Only change this if you know what you are doing.
++
+ config INET_XFRM_TUNNEL
+       tristate
+       select INET_TUNNEL
+diff --git a/net/ipv4/inet_hashtables.c b/net/ipv4/inet_hashtables.c
+index db47e1c407d9a..9958850b6cee9 100644
+--- a/net/ipv4/inet_hashtables.c
++++ b/net/ipv4/inet_hashtables.c
+@@ -541,13 +541,13 @@ EXPORT_SYMBOL_GPL(inet_unhash);
+  * Note that we use 32bit integers (vs RFC 'short integers')
+  * because 2^16 is not a multiple of num_ephemeral and this
+  * property might be used by clever attacker.
++ *
+  * RFC claims using TABLE_LENGTH=10 buckets gives an improvement, though
+- * attacks were since demonstrated, thus we use 65536 instead to really
+- * give more isolation and privacy, at the expense of 256kB of kernel
+- * memory.
++ * attacks were since demonstrated, thus we use 65536 by default instead
++ * to really give more isolation and privacy, at the expense of 256kB
++ * of kernel memory.
+  */
+-#define INET_TABLE_PERTURB_SHIFT 16
+-#define INET_TABLE_PERTURB_SIZE (1 << INET_TABLE_PERTURB_SHIFT)
++#define INET_TABLE_PERTURB_SIZE (1 << CONFIG_INET_TABLE_PERTURB_ORDER)
+ static u32 *table_perturb;
+ 
+ int __inet_hash_connect(struct inet_timewait_death_row *death_row,
+diff --git a/net/ipv6/ipv6_sockglue.c b/net/ipv6/ipv6_sockglue.c
+index 622063438953b..fecbea8d4ec37 100644
+--- a/net/ipv6/ipv6_sockglue.c
++++ b/net/ipv6/ipv6_sockglue.c
+@@ -165,6 +165,12 @@ static int do_ipv6_setsockopt(struct sock *sk, int level, 
int optname,
+               rtnl_lock();
+       lock_sock(sk);
+ 
++      /* Another thread has converted the socket into IPv4 with
++       * IPV6_ADDRFORM concurrently.
++       */
++      if (unlikely(sk->sk_family != AF_INET6))
++              goto unlock;
++
+       switch (optname) {
+ 
+       case IPV6_ADDRFORM:
+@@ -897,6 +903,7 @@ pref_skip_coa:
+               break;
+       }
+ 
++unlock:
+       release_sock(sk);
+       if (needs_rtnl)
+               rtnl_unlock();
+diff --git a/net/ipv6/xfrm6_policy.c b/net/ipv6/xfrm6_policy.c
+index 0c7f27a1725ff..6887922ea828e 100644
+--- a/net/ipv6/xfrm6_policy.c
++++ b/net/ipv6/xfrm6_policy.c
+@@ -419,9 +419,13 @@ int __init xfrm6_init(void)
+       if (ret)
+               goto out_state;
+ 
+-      register_pernet_subsys(&xfrm6_net_ops);
++      ret = register_pernet_subsys(&xfrm6_net_ops);
++      if (ret)
++              goto out_protocol;
+ out:
+       return ret;
++out_protocol:
++      xfrm6_protocol_fini();
+ out_state:
+       xfrm6_state_fini();
+ out_policy:
+diff --git a/net/key/af_key.c b/net/key/af_key.c
+index 88d4a3a02ab72..2bd2ce8ceb804 100644
+--- a/net/key/af_key.c
++++ b/net/key/af_key.c
+@@ -2940,7 +2940,7 @@ static int count_ah_combs(const struct xfrm_tmpl *t)
+                       break;
+               if (!aalg->pfkey_supported)
+                       continue;
+-              if (aalg_tmpl_set(t, aalg) && aalg->available)
++              if (aalg_tmpl_set(t, aalg))
+                       sz += sizeof(struct sadb_comb);
+       }
+       return sz + sizeof(struct sadb_prop);
+@@ -2958,7 +2958,7 @@ static int count_esp_combs(const struct xfrm_tmpl *t)
+               if (!ealg->pfkey_supported)
+                       continue;
+ 
+-              if (!(ealg_tmpl_set(t, ealg) && ealg->available))
++              if (!(ealg_tmpl_set(t, ealg)))
+                       continue;
+ 
+               for (k = 1; ; k++) {
+@@ -2969,16 +2969,17 @@ static int count_esp_combs(const struct xfrm_tmpl *t)
+                       if (!aalg->pfkey_supported)
+                               continue;
+ 
+-                      if (aalg_tmpl_set(t, aalg) && aalg->available)
++                      if (aalg_tmpl_set(t, aalg))
+                               sz += sizeof(struct sadb_comb);
+               }
+       }
+       return sz + sizeof(struct sadb_prop);
+ }
+ 
+-static void dump_ah_combs(struct sk_buff *skb, const struct xfrm_tmpl *t)
++static int dump_ah_combs(struct sk_buff *skb, const struct xfrm_tmpl *t)
+ {
+       struct sadb_prop *p;
++      int sz = 0;
+       int i;
+ 
+       p = (struct sadb_prop*)skb_put(skb, sizeof(struct sadb_prop));
+@@ -3007,13 +3008,17 @@ static void dump_ah_combs(struct sk_buff *skb, const 
struct xfrm_tmpl *t)
+                       c->sadb_comb_soft_addtime = 20*60*60;
+                       c->sadb_comb_hard_usetime = 8*60*60;
+                       c->sadb_comb_soft_usetime = 7*60*60;
++                      sz += sizeof(*c);
+               }
+       }
++
++      return sz + sizeof(*p);
+ }
+ 
+-static void dump_esp_combs(struct sk_buff *skb, const struct xfrm_tmpl *t)
++static int dump_esp_combs(struct sk_buff *skb, const struct xfrm_tmpl *t)
+ {
+       struct sadb_prop *p;
++      int sz = 0;
+       int i, k;
+ 
+       p = (struct sadb_prop*)skb_put(skb, sizeof(struct sadb_prop));
+@@ -3055,8 +3060,11 @@ static void dump_esp_combs(struct sk_buff *skb, const 
struct xfrm_tmpl *t)
+                       c->sadb_comb_soft_addtime = 20*60*60;
+                       c->sadb_comb_hard_usetime = 8*60*60;
+                       c->sadb_comb_soft_usetime = 7*60*60;
++                      sz += sizeof(*c);
+               }
+       }
++
++      return sz + sizeof(*p);
+ }
+ 
+ static int key_notify_policy_expire(struct xfrm_policy *xp, const struct 
km_event *c)
+@@ -3186,6 +3194,7 @@ static int pfkey_send_acquire(struct xfrm_state *x, 
struct xfrm_tmpl *t, struct
+       struct sadb_x_sec_ctx *sec_ctx;
+       struct xfrm_sec_ctx *xfrm_ctx;
+       int ctx_size = 0;
++      int alg_size = 0;
+ 
+       sockaddr_size = pfkey_sockaddr_size(x->props.family);
+       if (!sockaddr_size)
+@@ -3197,16 +3206,16 @@ static int pfkey_send_acquire(struct xfrm_state *x, 
struct xfrm_tmpl *t, struct
+               sizeof(struct sadb_x_policy);
+ 
+       if (x->id.proto == IPPROTO_AH)
+-              size += count_ah_combs(t);
++              alg_size = count_ah_combs(t);
+       else if (x->id.proto == IPPROTO_ESP)
+-              size += count_esp_combs(t);
++              alg_size = count_esp_combs(t);
+ 
+       if ((xfrm_ctx = x->security)) {
+               ctx_size = PFKEY_ALIGN8(xfrm_ctx->ctx_len);
+               size +=  sizeof(struct sadb_x_sec_ctx) + ctx_size;
+       }
+ 
+-      skb =  alloc_skb(size + 16, GFP_ATOMIC);
++      skb =  alloc_skb(size + alg_size + 16, GFP_ATOMIC);
+       if (skb == NULL)
+               return -ENOMEM;
+ 
+@@ -3262,10 +3271,13 @@ static int pfkey_send_acquire(struct xfrm_state *x, 
struct xfrm_tmpl *t, struct
+       pol->sadb_x_policy_priority = xp->priority;
+ 
+       /* Set sadb_comb's. */
++      alg_size = 0;
+       if (x->id.proto == IPPROTO_AH)
+-              dump_ah_combs(skb, t);
++              alg_size = dump_ah_combs(skb, t);
+       else if (x->id.proto == IPPROTO_ESP)
+-              dump_esp_combs(skb, t);
++              alg_size = dump_esp_combs(skb, t);
++
++      hdr->sadb_msg_len += alg_size / 8;
+ 
+       /* security context */
+       if (xfrm_ctx) {
+diff --git a/net/mac80211/mesh_pathtbl.c b/net/mac80211/mesh_pathtbl.c
+index 30a95a2ff196a..78945dc9dcd7b 100644
+--- a/net/mac80211/mesh_pathtbl.c
++++ b/net/mac80211/mesh_pathtbl.c
+@@ -794,7 +794,7 @@ int mesh_path_send_to_gates(struct mesh_path *mpath)
+ void mesh_path_discard_frame(struct ieee80211_sub_if_data *sdata,
+                            struct sk_buff *skb)
+ {
+-      kfree_skb(skb);
++      ieee80211_free_txskb(&sdata->local->hw, skb);
+       sdata->u.mesh.mshstats.dropped_frames_no_route++;
+ }
+ 
+diff --git a/net/nfc/nci/core.c b/net/nfc/nci/core.c
+index df90872fcf908..e7701c36f36ce 100644
+--- a/net/nfc/nci/core.c
++++ b/net/nfc/nci/core.c
+@@ -543,7 +543,7 @@ static int nci_open_device(struct nci_dev *ndev)
+               skb_queue_purge(&ndev->tx_q);
+ 
+               ndev->ops->close(ndev);
+-              ndev->flags = 0;
++              ndev->flags &= BIT(NCI_UNREG);
+       }
+ 
+ done:
+diff --git a/net/nfc/nci/data.c b/net/nfc/nci/data.c
+index b8a295dd15d85..45b654dca6f9c 100644
+--- a/net/nfc/nci/data.c
++++ b/net/nfc/nci/data.c
+@@ -291,8 +291,10 @@ void nci_rx_data_packet(struct nci_dev *ndev, struct 
sk_buff *skb)
+                nci_plen(skb->data));
+ 
+       conn_info = nci_get_conn_info_by_conn_id(ndev, nci_conn_id(skb->data));
+-      if (!conn_info)
++      if (!conn_info) {
++              kfree_skb(skb);
+               return;
++      }
+ 
+       /* strip the nci data header */
+       skb_pull(skb, NCI_DATA_HDR_SIZE);
+diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c
+index 2ae2801dd7bee..c43a4f9404fe1 100644
+--- a/net/packet/af_packet.c
++++ b/net/packet/af_packet.c
+@@ -2207,8 +2207,7 @@ static int tpacket_rcv(struct sk_buff *skb, struct 
net_device *dev,
+       if (skb->ip_summed == CHECKSUM_PARTIAL)
+               status |= TP_STATUS_CSUMNOTREADY;
+       else if (skb->pkt_type != PACKET_OUTGOING &&
+-               (skb->ip_summed == CHECKSUM_COMPLETE ||
+-                skb_csum_unnecessary(skb)))
++               skb_csum_unnecessary(skb))
+               status |= TP_STATUS_CSUM_VALID;
+ 
+       if (snaplen > res)
+@@ -3468,8 +3467,7 @@ static int packet_recvmsg(struct socket *sock, struct 
msghdr *msg, size_t len,
+               if (skb->ip_summed == CHECKSUM_PARTIAL)
+                       aux.tp_status |= TP_STATUS_CSUMNOTREADY;
+               else if (skb->pkt_type != PACKET_OUTGOING &&
+-                       (skb->ip_summed == CHECKSUM_COMPLETE ||
+-                        skb_csum_unnecessary(skb)))
++                       skb_csum_unnecessary(skb))
+                       aux.tp_status |= TP_STATUS_CSUM_VALID;
+ 
+               aux.tp_len = origlen;
+diff --git a/scripts/kconfig/symbol.c b/scripts/kconfig/symbol.c
+index 2432298487fb3..88068bf26cef2 100644
+--- a/scripts/kconfig/symbol.c
++++ b/scripts/kconfig/symbol.c
+@@ -1130,8 +1130,7 @@ static void sym_check_print_recursive(struct symbol 
*last_sym)
+               if (stack->sym == last_sym)
+                       fprintf(stderr, "%s:%d:error: recursive dependency 
detected!\n",
+                               prop->file->name, prop->lineno);
+-                      fprintf(stderr, "For a resolution refer to 
Documentation/kbuild/kconfig-language.txt\n");
+-                      fprintf(stderr, "subsection \"Kconfig recursive 
dependency limitations\"\n");
++
+               if (stack->expr) {
+                       fprintf(stderr, "%s:%d:\tsymbol %s %s value contains 
%s\n",
+                               prop->file->name, prop->lineno,
+@@ -1161,6 +1160,11 @@ static void sym_check_print_recursive(struct symbol 
*last_sym)
+               }
+       }
+ 
++      fprintf(stderr,
++              "For a resolution refer to 
Documentation/kbuild/kconfig-language.txt\n"
++              "subsection \"Kconfig recursive dependency limitations\"\n"
++              "\n");
++
+       if (check_top == &cv_stack)
+               dep_stack_remove();
+ }
+diff --git a/sound/soc/soc-ops.c b/sound/soc/soc-ops.c
+index 4fda8c24be291..5479927391d40 100644
+--- a/sound/soc/soc-ops.c
++++ b/sound/soc/soc-ops.c
+@@ -450,7 +450,7 @@ int snd_soc_put_volsw_sx(struct snd_kcontrol *kcontrol,
+       val = ucontrol->value.integer.value[0];
+       if (mc->platform_max && val > mc->platform_max)
+               return -EINVAL;
+-      if (val > max - min)
++      if (val > max)
+               return -EINVAL;
+       if (val < 0)
+               return -EINVAL;
+diff --git a/tools/vm/slabinfo-gnuplot.sh b/tools/vm/slabinfo-gnuplot.sh
+index 35b039864b778..8983443c535ab 100644
+--- a/tools/vm/slabinfo-gnuplot.sh
++++ b/tools/vm/slabinfo-gnuplot.sh
+@@ -157,7 +157,7 @@ do_preprocess()
+       let lines=3
+       out=`basename "$in"`"-slabs-by-loss"
+       `cat "$in" | grep -A "$lines" 'Slabs sorted by loss' |\
+-              egrep -iv '\-\-|Name|Slabs'\
++              grep -E -iv '\-\-|Name|Slabs'\
+               | awk '{print $1" "$4+$2*$3" "$4}' > "$out"`
+       if [ $? -eq 0 ]; then
+               do_slabs_plotting "$out"
+@@ -166,7 +166,7 @@ do_preprocess()
+       let lines=3
+       out=`basename "$in"`"-slabs-by-size"
+       `cat "$in" | grep -A "$lines" 'Slabs sorted by size' |\
+-              egrep -iv '\-\-|Name|Slabs'\
++              grep -E -iv '\-\-|Name|Slabs'\
+               | awk '{print $1" "$4" "$4-$2*$3}' > "$out"`
+       if [ $? -eq 0 ]; then
+               do_slabs_plotting "$out"

Reply via email to