diff --git a/Documentation/arm/kernel_mode_neon.txt 
b/Documentation/arm/kernel_mode_neon.txt
index 525452726d31..b9e060c5b61e 100644
--- a/Documentation/arm/kernel_mode_neon.txt
+++ b/Documentation/arm/kernel_mode_neon.txt
@@ -6,7 +6,7 @@ TL;DR summary
 * Use only NEON instructions, or VFP instructions that don't rely on support
   code
 * Isolate your NEON code in a separate compilation unit, and compile it with
-  '-mfpu=neon -mfloat-abi=softfp'
+  '-march=armv7-a -mfpu=neon -mfloat-abi=softfp'
 * Put kernel_neon_begin() and kernel_neon_end() calls around the calls into 
your
   NEON code
 * Don't sleep in your NEON code, and be aware that it will be executed with
@@ -87,7 +87,7 @@ instructions appearing in unexpected places if no special 
care is taken.
 Therefore, the recommended and only supported way of using NEON/VFP in the
 kernel is by adhering to the following rules:
 * isolate the NEON code in a separate compilation unit and compile it with
-  '-mfpu=neon -mfloat-abi=softfp';
+  '-march=armv7-a -mfpu=neon -mfloat-abi=softfp';
 * issue the calls to kernel_neon_begin(), kernel_neon_end() as well as the 
calls
   into the unit containing the NEON code from a compilation unit which is *not*
   built with the GCC flag '-mfpu=neon' set.
diff --git a/Makefile b/Makefile
index 22513956c009..c2e8362de950 100644
--- a/Makefile
+++ b/Makefile
@@ -1,6 +1,6 @@
 VERSION = 3
 PATCHLEVEL = 18
-SUBLEVEL = 138
+SUBLEVEL = 139
 EXTRAVERSION =
 NAME = Diseased Newt
 
diff --git a/arch/arm/kernel/unwind.c b/arch/arm/kernel/unwind.c
index cbb85c5fabf9..5184fe85d167 100644
--- a/arch/arm/kernel/unwind.c
+++ b/arch/arm/kernel/unwind.c
@@ -93,7 +93,7 @@ extern const struct unwind_idx __start_unwind_idx[];
 static const struct unwind_idx *__origin_unwind_idx;
 extern const struct unwind_idx __stop_unwind_idx[];
 
-static DEFINE_SPINLOCK(unwind_lock);
+static DEFINE_RAW_SPINLOCK(unwind_lock);
 static LIST_HEAD(unwind_tables);
 
 /* Convert a prel31 symbol to an absolute address */
@@ -201,7 +201,7 @@ static const struct unwind_idx *unwind_find_idx(unsigned 
long addr)
                /* module unwind tables */
                struct unwind_table *table;
 
-               spin_lock_irqsave(&unwind_lock, flags);
+               raw_spin_lock_irqsave(&unwind_lock, flags);
                list_for_each_entry(table, &unwind_tables, list) {
                        if (addr >= table->begin_addr &&
                            addr < table->end_addr) {
@@ -213,7 +213,7 @@ static const struct unwind_idx *unwind_find_idx(unsigned 
long addr)
                                break;
                        }
                }
-               spin_unlock_irqrestore(&unwind_lock, flags);
+               raw_spin_unlock_irqrestore(&unwind_lock, flags);
        }
 
        pr_debug("%s: idx = %p\n", __func__, idx);
@@ -530,9 +530,9 @@ struct unwind_table *unwind_table_add(unsigned long start, 
unsigned long size,
        tab->begin_addr = text_addr;
        tab->end_addr = text_addr + text_size;
 
-       spin_lock_irqsave(&unwind_lock, flags);
+       raw_spin_lock_irqsave(&unwind_lock, flags);
        list_add_tail(&tab->list, &unwind_tables);
-       spin_unlock_irqrestore(&unwind_lock, flags);
+       raw_spin_unlock_irqrestore(&unwind_lock, flags);
 
        return tab;
 }
@@ -544,9 +544,9 @@ void unwind_table_del(struct unwind_table *tab)
        if (!tab)
                return;
 
-       spin_lock_irqsave(&unwind_lock, flags);
+       raw_spin_lock_irqsave(&unwind_lock, flags);
        list_del(&tab->list);
-       spin_unlock_irqrestore(&unwind_lock, flags);
+       raw_spin_unlock_irqrestore(&unwind_lock, flags);
 
        kfree(tab);
 }
diff --git a/arch/arm/lib/Makefile b/arch/arm/lib/Makefile
index 0573faab96ad..830b2ddcc346 100644
--- a/arch/arm/lib/Makefile
+++ b/arch/arm/lib/Makefile
@@ -46,7 +46,7 @@ $(obj)/csumpartialcopy.o:     $(obj)/csumpartialcopygeneric.S
 $(obj)/csumpartialcopyuser.o:  $(obj)/csumpartialcopygeneric.S
 
 ifeq ($(CONFIG_KERNEL_MODE_NEON),y)
-  NEON_FLAGS                   := -mfloat-abi=softfp -mfpu=neon
+  NEON_FLAGS                   := -march=armv7-a -mfloat-abi=softfp -mfpu=neon
   CFLAGS_xor-neon.o            += $(NEON_FLAGS)
   obj-$(CONFIG_XOR_BLOCKS)     += xor-neon.o
 endif
diff --git a/arch/arm/lib/xor-neon.c b/arch/arm/lib/xor-neon.c
index 2c40aeab3eaa..c691b901092f 100644
--- a/arch/arm/lib/xor-neon.c
+++ b/arch/arm/lib/xor-neon.c
@@ -14,7 +14,7 @@
 MODULE_LICENSE("GPL");
 
 #ifndef __ARM_NEON__
-#error You should compile this file with '-mfloat-abi=softfp -mfpu=neon'
+#error You should compile this file with '-march=armv7-a -mfloat-abi=softfp 
-mfpu=neon'
 #endif
 
 /*
diff --git a/arch/arm/plat-samsung/Kconfig b/arch/arm/plat-samsung/Kconfig
index 9bd2776e7d05..2c3cf321f933 100644
--- a/arch/arm/plat-samsung/Kconfig
+++ b/arch/arm/plat-samsung/Kconfig
@@ -287,7 +287,7 @@ config S3C_PM_DEBUG_LED_SMDK
 
 config SAMSUNG_PM_CHECK
        bool "S3C2410 PM Suspend Memory CRC"
-       depends on PM
+       depends on PM && (PLAT_S3C24XX || ARCH_S3C64XX || ARCH_S5PV210)
        select CRC32
        help
          Enable the PM code's memory area checksum over sleep. This option
diff --git a/arch/arm64/include/asm/futex.h b/arch/arm64/include/asm/futex.h
index 49d057eb93d6..f7fda38d7183 100644
--- a/arch/arm64/include/asm/futex.h
+++ b/arch/arm64/include/asm/futex.h
@@ -26,8 +26,8 @@
        asm volatile(                                                   \
 "1:    ldxr    %w1, %2\n"                                              \
        insn "\n"                                                       \
-"2:    stlxr   %w3, %w0, %2\n"                                         \
-"      cbnz    %w3, 1b\n"                                              \
+"2:    stlxr   %w0, %w3, %2\n"                                         \
+"      cbnz    %w0, 1b\n"                                              \
 "      dmb     ish\n"                                                  \
 "3:\n"                                                                 \
 "      .pushsection .fixup,\"ax\"\n"                                   \
@@ -62,23 +62,23 @@ futex_atomic_op_inuser(unsigned int encoded_op, u32 __user 
*uaddr)
 
        switch (op) {
        case FUTEX_OP_SET:
-               __futex_atomic_op("mov  %w0, %w4",
+               __futex_atomic_op("mov  %w3, %w4",
                                  ret, oldval, uaddr, tmp, oparg);
                break;
        case FUTEX_OP_ADD:
-               __futex_atomic_op("add  %w0, %w1, %w4",
+               __futex_atomic_op("add  %w3, %w1, %w4",
                                  ret, oldval, uaddr, tmp, oparg);
                break;
        case FUTEX_OP_OR:
-               __futex_atomic_op("orr  %w0, %w1, %w4",
+               __futex_atomic_op("orr  %w3, %w1, %w4",
                                  ret, oldval, uaddr, tmp, oparg);
                break;
        case FUTEX_OP_ANDN:
-               __futex_atomic_op("and  %w0, %w1, %w4",
+               __futex_atomic_op("and  %w3, %w1, %w4",
                                  ret, oldval, uaddr, tmp, ~oparg);
                break;
        case FUTEX_OP_XOR:
-               __futex_atomic_op("eor  %w0, %w1, %w4",
+               __futex_atomic_op("eor  %w3, %w1, %w4",
                                  ret, oldval, uaddr, tmp, oparg);
                break;
        default:
diff --git a/arch/x86/include/asm/xen/hypercall.h 
b/arch/x86/include/asm/xen/hypercall.h
index ca08a27b90b3..6e1e86781d90 100644
--- a/arch/x86/include/asm/xen/hypercall.h
+++ b/arch/x86/include/asm/xen/hypercall.h
@@ -213,6 +213,9 @@ privcmd_call(unsigned call,
        __HYPERCALL_DECLS;
        __HYPERCALL_5ARG(a1, a2, a3, a4, a5);
 
+       if (call >= PAGE_SIZE / sizeof(hypercall_page[0]))
+               return -EINVAL;
+
        asm volatile("call *%[call]"
                     : __HYPERCALL_5PARAM
                     : [call] "a" (&hypercall_page[call])
diff --git a/arch/x86/kernel/cpu/cyrix.c b/arch/x86/kernel/cpu/cyrix.c
index aaf152e79637..0007827196a4 100644
--- a/arch/x86/kernel/cpu/cyrix.c
+++ b/arch/x86/kernel/cpu/cyrix.c
@@ -120,7 +120,7 @@ static void set_cx86_reorder(void)
        setCx86(CX86_CCR3, (ccr3 & 0x0f) | 0x10); /* enable MAPEN */
 
        /* Load/Store Serialize to mem access disable (=reorder it) */
-       setCx86_old(CX86_PCR0, getCx86_old(CX86_PCR0) & ~0x80);
+       setCx86(CX86_PCR0, getCx86(CX86_PCR0) & ~0x80);
        /* set load/store serialize from 1GB to 4GB */
        ccr3 |= 0xe0;
        setCx86(CX86_CCR3, ccr3);
@@ -131,11 +131,11 @@ static void set_cx86_memwb(void)
        printk(KERN_INFO "Enable Memory-Write-back mode on Cyrix/NSC 
processor.\n");
 
        /* CCR2 bit 2: unlock NW bit */
-       setCx86_old(CX86_CCR2, getCx86_old(CX86_CCR2) & ~0x04);
+       setCx86(CX86_CCR2, getCx86(CX86_CCR2) & ~0x04);
        /* set 'Not Write-through' */
        write_cr0(read_cr0() | X86_CR0_NW);
        /* CCR2 bit 2: lock NW bit and set WT1 */
-       setCx86_old(CX86_CCR2, getCx86_old(CX86_CCR2) | 0x14);
+       setCx86(CX86_CCR2, getCx86(CX86_CCR2) | 0x14);
 }
 
 /*
@@ -149,14 +149,14 @@ static void geode_configure(void)
        local_irq_save(flags);
 
        /* Suspend on halt power saving and enable #SUSP pin */
-       setCx86_old(CX86_CCR2, getCx86_old(CX86_CCR2) | 0x88);
+       setCx86(CX86_CCR2, getCx86(CX86_CCR2) | 0x88);
 
        ccr3 = getCx86(CX86_CCR3);
        setCx86(CX86_CCR3, (ccr3 & 0x0f) | 0x10);       /* enable MAPEN */
 
 
        /* FPU fast, DTE cache, Mem bypass */
-       setCx86_old(CX86_CCR4, getCx86_old(CX86_CCR4) | 0x38);
+       setCx86(CX86_CCR4, getCx86(CX86_CCR4) | 0x38);
        setCx86(CX86_CCR3, ccr3);                       /* disable MAPEN */
 
        set_cx86_memwb();
@@ -291,7 +291,7 @@ static void init_cyrix(struct cpuinfo_x86 *c)
                /* GXm supports extended cpuid levels 'ala' AMD */
                if (c->cpuid_level == 2) {
                        /* Enable cxMMX extensions (GX1 Datasheet 54) */
-                       setCx86_old(CX86_CCR7, getCx86_old(CX86_CCR7) | 1);
+                       setCx86(CX86_CCR7, getCx86(CX86_CCR7) | 1);
 
                        /*
                         * GXm : 0x30 ... 0x5f GXm  datasheet 51
@@ -314,7 +314,7 @@ static void init_cyrix(struct cpuinfo_x86 *c)
                if (dir1 > 7) {
                        dir0_msn++;  /* M II */
                        /* Enable MMX extensions (App note 108) */
-                       setCx86_old(CX86_CCR7, getCx86_old(CX86_CCR7)|1);
+                       setCx86(CX86_CCR7, getCx86(CX86_CCR7)|1);
                } else {
                        /* A 6x86MX - it has the bug. */
                        set_cpu_bug(c, X86_BUG_COMA);
diff --git a/arch/x86/kernel/hpet.c b/arch/x86/kernel/hpet.c
index 319bcb9372fe..3e9c5725732f 100644
--- a/arch/x86/kernel/hpet.c
+++ b/arch/x86/kernel/hpet.c
@@ -799,6 +799,8 @@ int __init hpet_enable(void)
                return 0;
 
        hpet_set_mapping();
+       if (!hpet_virt_address)
+               return 0;
 
        /*
         * Read the period and check for a sane value:
diff --git a/arch/x86/kernel/kprobes/core.c b/arch/x86/kernel/kprobes/core.c
index 323d122267b2..bb8dd3d3a8af 100644
--- a/arch/x86/kernel/kprobes/core.c
+++ b/arch/x86/kernel/kprobes/core.c
@@ -500,6 +500,7 @@ void arch_prepare_kretprobe(struct kretprobe_instance *ri, 
struct pt_regs *regs)
        unsigned long *sara = stack_addr(regs);
 
        ri->ret_addr = (kprobe_opcode_t *) *sara;
+       ri->fp = sara;
 
        /* Replace the return addr with trampoline addr */
        *sara = (unsigned long) &kretprobe_trampoline;
@@ -701,15 +702,21 @@ __visible __used void *trampoline_handler(struct pt_regs 
*regs)
        unsigned long flags, orig_ret_address = 0;
        unsigned long trampoline_address = (unsigned long)&kretprobe_trampoline;
        kprobe_opcode_t *correct_ret_addr = NULL;
+       void *frame_pointer;
+       bool skipped = false;
 
        INIT_HLIST_HEAD(&empty_rp);
        kretprobe_hash_lock(current, &head, &flags);
        /* fixup registers */
 #ifdef CONFIG_X86_64
        regs->cs = __KERNEL_CS;
+       /* On x86-64, we use pt_regs->sp for return address holder. */
+       frame_pointer = &regs->sp;
 #else
        regs->cs = __KERNEL_CS | get_kernel_rpl();
        regs->gs = 0;
+       /* On x86-32, we use pt_regs->flags for return address holder. */
+       frame_pointer = &regs->flags;
 #endif
        regs->ip = trampoline_address;
        regs->orig_ax = ~0UL;
@@ -731,8 +738,25 @@ __visible __used void *trampoline_handler(struct pt_regs 
*regs)
                if (ri->task != current)
                        /* another task is sharing our hash bucket */
                        continue;
+               /*
+                * Return probes must be pushed on this hash list correct
+                * order (same as return order) so that it can be poped
+                * correctly. However, if we find it is pushed it incorrect
+                * order, this means we find a function which should not be
+                * probed, because the wrong order entry is pushed on the
+                * path of processing other kretprobe itself.
+                */
+               if (ri->fp != frame_pointer) {
+                       if (!skipped)
+                               pr_warn("kretprobe is stacked incorrectly. 
Trying to fixup.\n");
+                       skipped = true;
+                       continue;
+               }
 
                orig_ret_address = (unsigned long)ri->ret_addr;
+               if (skipped)
+                       pr_warn("%ps must be blacklisted because of incorrect 
kretprobe order\n",
+                               ri->rp->kp.addr);
 
                if (orig_ret_address != trampoline_address)
                        /*
@@ -750,6 +774,8 @@ __visible __used void *trampoline_handler(struct pt_regs 
*regs)
                if (ri->task != current)
                        /* another task is sharing our hash bucket */
                        continue;
+               if (ri->fp != frame_pointer)
+                       continue;
 
                orig_ret_address = (unsigned long)ri->ret_addr;
                if (ri->rp && ri->rp->handler) {
diff --git a/arch/x86/kernel/vmlinux.lds.S b/arch/x86/kernel/vmlinux.lds.S
index 49edf2dd3613..1bd47a144db1 100644
--- a/arch/x86/kernel/vmlinux.lds.S
+++ b/arch/x86/kernel/vmlinux.lds.S
@@ -345,7 +345,7 @@ SECTIONS
  * Per-cpu symbols which need to be offset from __per_cpu_load
  * for the boot processor.
  */
-#define INIT_PER_CPU(x) init_per_cpu__##x = x + __per_cpu_load
+#define INIT_PER_CPU(x) init_per_cpu__##x = ABSOLUTE(x) + __per_cpu_load
 INIT_PER_CPU(gdt_page);
 INIT_PER_CPU(irq_stack_union);
 
diff --git a/arch/xtensa/kernel/stacktrace.c b/arch/xtensa/kernel/stacktrace.c
index 7d2c317bd98b..922525c0d25c 100644
--- a/arch/xtensa/kernel/stacktrace.c
+++ b/arch/xtensa/kernel/stacktrace.c
@@ -107,10 +107,14 @@ static int return_address_cb(struct stackframe *frame, 
void *data)
        return 1;
 }
 
+/*
+ * level == 0 is for the return address from the caller of this function,
+ * not from this function itself.
+ */
 unsigned long return_address(unsigned level)
 {
        struct return_addr_data r = {
-               .skip = level + 1,
+               .skip = level,
        };
        walk_stackframe(stack_pointer(NULL), return_address_cb, &r);
        return r.addr;
diff --git a/block/bio.c b/block/bio.c
index 140c45b2b717..0a41e94eda2f 100644
--- a/block/bio.c
+++ b/block/bio.c
@@ -1217,8 +1217,11 @@ struct bio *bio_copy_user_iov(struct request_queue *q,
                        }
                }
 
-               if (bio_add_pc_page(q, bio, page, bytes, offset) < bytes)
+               if (bio_add_pc_page(q, bio, page, bytes, offset) < bytes) {
+                       if (!map_data)
+                               __free_page(page);
                        break;
+               }
 
                len -= bytes;
                offset = 0;
diff --git a/drivers/acpi/sbs.c b/drivers/acpi/sbs.c
index f23179e84128..0c268600a334 100644
--- a/drivers/acpi/sbs.c
+++ b/drivers/acpi/sbs.c
@@ -439,9 +439,13 @@ static int acpi_ac_get_present(struct acpi_sbs *sbs)
 
        /*
         * The spec requires that bit 4 always be 1. If it's not set, assume
-        * that the implementation doesn't support an SBS charger
+        * that the implementation doesn't support an SBS charger.
+        *
+        * And on some MacBooks a status of 0xffff is always returned, no
+        * matter whether the charger is plugged in or not, which is also
+        * wrong, so ignore the SBS charger for those too.
         */
-       if (!((status >> 4) & 0x1))
+       if (!((status >> 4) & 0x1) || status == 0xffff)
                return -ENODEV;
 
        sbs->charger_present = (status >> 15) & 0x1;
diff --git a/drivers/cdrom/cdrom.c b/drivers/cdrom/cdrom.c
index 2bd91d4943e1..f4f93ca4bdad 100644
--- a/drivers/cdrom/cdrom.c
+++ b/drivers/cdrom/cdrom.c
@@ -265,6 +265,7 @@
 /* #define ERRLOGMASK (CD_WARNING|CD_OPEN|CD_COUNT_TRACKS|CD_CLOSE) */
 /* #define ERRLOGMASK 
(CD_WARNING|CD_REG_UNREG|CD_DO_IOCTL|CD_OPEN|CD_CLOSE|CD_COUNT_TRACKS) */
 
+#include <linux/atomic.h>
 #include <linux/module.h>
 #include <linux/fs.h>
 #include <linux/major.h>
@@ -3676,9 +3677,9 @@ static struct ctl_table_header *cdrom_sysctl_header;
 
 static void cdrom_sysctl_register(void)
 {
-       static int initialized;
+       static atomic_t initialized = ATOMIC_INIT(0);
 
-       if (initialized == 1)
+       if (!atomic_add_unless(&initialized, 1, 1))
                return;
 
        cdrom_sysctl_header = register_sysctl_table(cdrom_root_table);
@@ -3689,8 +3690,6 @@ static void cdrom_sysctl_register(void)
        cdrom_sysctl_settings.debug = debug;
        cdrom_sysctl_settings.lock = lockdoor;
        cdrom_sysctl_settings.check = check_media_type;
-
-       initialized = 1;
 }
 
 static void cdrom_sysctl_unregister(void)
diff --git a/drivers/char/Kconfig b/drivers/char/Kconfig
index 68dabd7edd1d..822add2bc226 100644
--- a/drivers/char/Kconfig
+++ b/drivers/char/Kconfig
@@ -380,7 +380,7 @@ config XILINX_HWICAP
 
 config R3964
        tristate "Siemens R3964 line discipline"
-       depends on TTY
+       depends on TTY && BROKEN
        ---help---
          This driver allows synchronous communication with devices using the
          Siemens R3964 packet protocol. Unless you are dealing with special
diff --git a/drivers/char/hpet.c b/drivers/char/hpet.c
index d5d4cd82b9f7..978a782f5e30 100644
--- a/drivers/char/hpet.c
+++ b/drivers/char/hpet.c
@@ -377,7 +377,7 @@ static __init int hpet_mmap_enable(char *str)
        pr_info("HPET mmap %s\n", hpet_mmap_enabled ? "enabled" : "disabled");
        return 1;
 }
-__setup("hpet_mmap", hpet_mmap_enable);
+__setup("hpet_mmap=", hpet_mmap_enable);
 
 static int hpet_mmap(struct file *file, struct vm_area_struct *vma)
 {
diff --git a/drivers/char/hw_random/virtio-rng.c 
b/drivers/char/hw_random/virtio-rng.c
index 72295ea2fd1c..5cdc8c534ad4 100644
--- a/drivers/char/hw_random/virtio-rng.c
+++ b/drivers/char/hw_random/virtio-rng.c
@@ -74,7 +74,7 @@ static int virtio_read(struct hwrng *rng, void *buf, size_t 
size, bool wait)
 
        if (!vi->busy) {
                vi->busy = true;
-               init_completion(&vi->have_data);
+               reinit_completion(&vi->have_data);
                register_buffer(vi, buf, size);
        }
 
diff --git a/drivers/char/tpm/tpm_i2c_atmel.c b/drivers/char/tpm/tpm_i2c_atmel.c
index 503a85ae176c..0ea430cc606f 100644
--- a/drivers/char/tpm/tpm_i2c_atmel.c
+++ b/drivers/char/tpm/tpm_i2c_atmel.c
@@ -65,7 +65,15 @@ static int i2c_atmel_send(struct tpm_chip *chip, u8 *buf, 
size_t len)
        dev_dbg(chip->dev,
                "%s(buf=%*ph len=%0zx) -> sts=%d\n", __func__,
                (int)min_t(size_t, 64, len), buf, len, status);
-       return status;
+
+       if (status < 0)
+               return status;
+
+       /* The upper layer does not support incomplete sends. */
+       if (status != len)
+               return -E2BIG;
+
+       return 0;
 }
 
 static int i2c_atmel_recv(struct tpm_chip *chip, u8 *buf, size_t count)
diff --git a/drivers/crypto/amcc/crypto4xx_alg.c 
b/drivers/crypto/amcc/crypto4xx_alg.c
index 4afca3968773..e3b8bebfdd30 100644
--- a/drivers/crypto/amcc/crypto4xx_alg.c
+++ b/drivers/crypto/amcc/crypto4xx_alg.c
@@ -138,7 +138,8 @@ static int crypto4xx_setkey_aes(struct crypto_ablkcipher 
*cipher,
        sa = (struct dynamic_sa_ctl *) ctx->sa_in;
        ctx->hash_final = 0;
 
-       set_dynamic_sa_command_0(sa, SA_NOT_SAVE_HASH, SA_NOT_SAVE_IV,
+       set_dynamic_sa_command_0(sa, SA_NOT_SAVE_HASH, (cm == CRYPTO_MODE_CBC ?
+                                SA_SAVE_IV : SA_NOT_SAVE_IV),
                                 SA_LOAD_HASH_FROM_SA, SA_LOAD_IV_FROM_STATE,
                                 SA_NO_HEADER_PROC, SA_HASH_ALG_NULL,
                                 SA_CIPHER_ALG_AES, SA_PAD_TYPE_ZERO,
diff --git a/drivers/crypto/amcc/crypto4xx_core.c 
b/drivers/crypto/amcc/crypto4xx_core.c
index 45df1c74fa03..f8fd4f5f0f1a 100644
--- a/drivers/crypto/amcc/crypto4xx_core.c
+++ b/drivers/crypto/amcc/crypto4xx_core.c
@@ -645,6 +645,15 @@ static u32 crypto4xx_ablkcipher_done(struct 
crypto4xx_device *dev,
                addr = dma_map_page(dev->core_dev->device, sg_page(dst),
                                    dst->offset, dst->length, DMA_FROM_DEVICE);
        }
+
+       if (pd_uinfo->sa_va->sa_command_0.bf.save_iv == SA_SAVE_IV) {
+               struct crypto_skcipher *skcipher = crypto_skcipher_reqtfm(req);
+
+               crypto4xx_memcpy_from_le32((u32 *)req->iv,
+                       pd_uinfo->sr_va->save_iv,
+                       crypto_skcipher_ivsize(skcipher));
+       }
+
        crypto4xx_ret_sg_desc(dev, pd_uinfo);
        if (ablk_req->base.complete != NULL)
                ablk_req->base.complete(&ablk_req->base, 0);
diff --git a/drivers/dma/imx-dma.c b/drivers/dma/imx-dma.c
index ddfd8024881e..f0182c5001ad 100644
--- a/drivers/dma/imx-dma.c
+++ b/drivers/dma/imx-dma.c
@@ -291,7 +291,7 @@ static inline int imxdma_sg_next(struct imxdma_desc *d)
        struct scatterlist *sg = d->sg;
        unsigned long now;
 
-       now = min(d->len, sg_dma_len(sg));
+       now = min_t(size_t, d->len, sg_dma_len(sg));
        if (d->len != IMX_DMA_LENGTH_LOOP)
                d->len -= now;
 
diff --git a/drivers/dma/tegra20-apb-dma.c b/drivers/dma/tegra20-apb-dma.c
index 16efa603ff65..8ebc43dbda3c 100644
--- a/drivers/dma/tegra20-apb-dma.c
+++ b/drivers/dma/tegra20-apb-dma.c
@@ -613,7 +613,10 @@ static void handle_cont_sngl_cycle_dma_done(struct 
tegra_dma_channel *tdc,
 
        sgreq = list_first_entry(&tdc->pending_sg_req, typeof(*sgreq), node);
        dma_desc = sgreq->dma_desc;
-       dma_desc->bytes_transferred += sgreq->req_len;
+       /* if we dma for long enough the transfer count will wrap */
+       dma_desc->bytes_transferred =
+               (dma_desc->bytes_transferred + sgreq->req_len) %
+               dma_desc->bytes_requested;
 
        /* Callback need to be call */
        if (!dma_desc->cb_count)
diff --git a/drivers/gpu/drm/drm_dp_mst_topology.c 
b/drivers/gpu/drm/drm_dp_mst_topology.c
index 7113c95f5ad0..e4c8c594ea15 100644
--- a/drivers/gpu/drm/drm_dp_mst_topology.c
+++ b/drivers/gpu/drm/drm_dp_mst_topology.c
@@ -2816,6 +2816,7 @@ static int drm_dp_mst_i2c_xfer(struct i2c_adapter 
*adapter, struct i2c_msg *msgs
                msg.u.i2c_read.transactions[i].i2c_dev_id = msgs[i].addr;
                msg.u.i2c_read.transactions[i].num_bytes = msgs[i].len;
                msg.u.i2c_read.transactions[i].bytes = msgs[i].buf;
+               msg.u.i2c_read.transactions[i].no_stop_bit = !(msgs[i].flags & 
I2C_M_STOP);
        }
        msg.u.i2c_read.read_i2c_device_id = msgs[num - 1].addr;
        msg.u.i2c_read.num_bytes_read = msgs[num - 1].len;
diff --git a/drivers/i2c/i2c-core.c b/drivers/i2c/i2c-core.c
index 7bd1b5cfb8d1..bb4b76f44fc9 100644
--- a/drivers/i2c/i2c-core.c
+++ b/drivers/i2c/i2c-core.c
@@ -2762,16 +2762,16 @@ static s32 i2c_smbus_xfer_emulated(struct i2c_adapter 
*adapter, u16 addr,
                                   the underlying bus driver */
                break;
        case I2C_SMBUS_I2C_BLOCK_DATA:
+               if (data->block[0] > I2C_SMBUS_BLOCK_MAX) {
+                       dev_err(&adapter->dev, "Invalid block %s size %d\n",
+                               read_write == I2C_SMBUS_READ ? "read" : "write",
+                               data->block[0]);
+                       return -EINVAL;
+               }
                if (read_write == I2C_SMBUS_READ) {
                        msg[1].len = data->block[0];
                } else {
                        msg[0].len = data->block[0] + 1;
-                       if (msg[0].len > I2C_SMBUS_BLOCK_MAX + 1) {
-                               dev_err(&adapter->dev,
-                                       "Invalid block write size %d\n",
-                                       data->block[0]);
-                               return -EINVAL;
-                       }
                        for (i = 1; i <= data->block[0]; i++)
                                msgbuf0[i] = data->block[i];
                }
diff --git a/drivers/iio/adc/ad_sigma_delta.c b/drivers/iio/adc/ad_sigma_delta.c
index 22c4c17cd996..a1d072ecb717 100644
--- a/drivers/iio/adc/ad_sigma_delta.c
+++ b/drivers/iio/adc/ad_sigma_delta.c
@@ -121,6 +121,7 @@ static int ad_sd_read_reg_raw(struct ad_sigma_delta 
*sigma_delta,
        if (sigma_delta->info->has_registers) {
                data[0] = reg << sigma_delta->info->addr_shift;
                data[0] |= sigma_delta->info->read_mask;
+               data[0] |= sigma_delta->comm;
                spi_message_add_tail(&t[0], &m);
        }
        spi_message_add_tail(&t[1], &m);
diff --git a/drivers/iio/adc/at91_adc.c b/drivers/iio/adc/at91_adc.c
index dc438141b75b..a4bb40f1e44e 100644
--- a/drivers/iio/adc/at91_adc.c
+++ b/drivers/iio/adc/at91_adc.c
@@ -703,23 +703,29 @@ static int at91_adc_read_raw(struct iio_dev *idev,
                ret = wait_event_interruptible_timeout(st->wq_data_avail,
                                                       st->done,
                                                       msecs_to_jiffies(1000));
-               if (ret == 0)
-                       ret = -ETIMEDOUT;
-               if (ret < 0) {
-                       mutex_unlock(&st->lock);
-                       return ret;
-               }
-
-               *val = st->last_value;
 
+               /* Disable interrupts, regardless if adc conversion was
+                * successful or not
+                */
                at91_adc_writel(st, AT91_ADC_CHDR,
                                AT91_ADC_CH(chan->channel));
                at91_adc_writel(st, AT91_ADC_IDR, BIT(chan->channel));
 
-               st->last_value = 0;
-               st->done = false;
+               if (ret > 0) {
+                       /* a valid conversion took place */
+                       *val = st->last_value;
+                       st->last_value = 0;
+                       st->done = false;
+                       ret = IIO_VAL_INT;
+               } else if (ret == 0) {
+                       /* conversion timeout */
+                       dev_err(&idev->dev, "ADC Channel %d timeout.\n",
+                               chan->channel);
+                       ret = -ETIMEDOUT;
+               }
+
                mutex_unlock(&st->lock);
-               return IIO_VAL_INT;
+               return ret;
 
        case IIO_CHAN_INFO_SCALE:
                *val = st->vref_mv;
diff --git a/drivers/infiniband/hw/mlx4/alias_GUID.c 
b/drivers/infiniband/hw/mlx4/alias_GUID.c
index 0eb141c41416..fb60229bf191 100644
--- a/drivers/infiniband/hw/mlx4/alias_GUID.c
+++ b/drivers/infiniband/hw/mlx4/alias_GUID.c
@@ -579,8 +579,8 @@ void mlx4_ib_destroy_alias_guid_service(struct mlx4_ib_dev 
*dev)
        unsigned long flags;
 
        for (i = 0 ; i < dev->num_ports; i++) {
-               
cancel_delayed_work(&dev->sriov.alias_guid.ports_guid[i].alias_guid_work);
                det = &sriov->alias_guid.ports_guid[i];
+               cancel_delayed_work_sync(&det->alias_guid_work);
                spin_lock_irqsave(&sriov->alias_guid.ag_work_lock, flags);
                while (!list_empty(&det->cb_list)) {
                        cb_ctx = list_entry(det->cb_list.next,
diff --git a/drivers/infiniband/hw/mlx4/cm.c b/drivers/infiniband/hw/mlx4/cm.c
index 56a593e0ae5d..2aedbd18ffbc 100644
--- a/drivers/infiniband/hw/mlx4/cm.c
+++ b/drivers/infiniband/hw/mlx4/cm.c
@@ -39,7 +39,7 @@
 
 #include "mlx4_ib.h"
 
-#define CM_CLEANUP_CACHE_TIMEOUT  (5 * HZ)
+#define CM_CLEANUP_CACHE_TIMEOUT  (30 * HZ)
 
 struct id_map_entry {
        struct rb_node node;
diff --git a/drivers/iommu/dmar.c b/drivers/iommu/dmar.c
index 6b78e131f6dd..f6a42ea14ef1 100644
--- a/drivers/iommu/dmar.c
+++ b/drivers/iommu/dmar.c
@@ -134,7 +134,7 @@ dmar_alloc_pci_notify_info(struct pci_dev *dev, unsigned 
long event)
                for (tmp = dev; tmp; tmp = tmp->bus->self)
                        level++;
 
-       size = sizeof(*info) + level * sizeof(struct acpi_dmar_pci_path);
+       size = sizeof(*info) + level * sizeof(info->path[0]);
        if (size <= sizeof(dmar_pci_notify_info_buf)) {
                info = (struct dmar_pci_notify_info *)dmar_pci_notify_info_buf;
        } else {
diff --git a/drivers/iommu/intel-iommu.c b/drivers/iommu/intel-iommu.c
index 2068cb59f7ed..b1966269f26a 100644
--- a/drivers/iommu/intel-iommu.c
+++ b/drivers/iommu/intel-iommu.c
@@ -1402,6 +1402,9 @@ static void iommu_disable_protect_mem_regions(struct 
intel_iommu *iommu)
        u32 pmen;
        unsigned long flags;
 
+       if (!cap_plmr(iommu->cap) && !cap_phmr(iommu->cap))
+               return;
+
        raw_spin_lock_irqsave(&iommu->register_lock, flags);
        pmen = readl(iommu->reg + DMAR_PMEN_REG);
        pmen &= ~DMA_PMEN_EPM;
diff --git a/drivers/leds/leds-lp55xx-common.c 
b/drivers/leds/leds-lp55xx-common.c
index 77c26bc32eed..a038f1128446 100644
--- a/drivers/leds/leds-lp55xx-common.c
+++ b/drivers/leds/leds-lp55xx-common.c
@@ -200,7 +200,7 @@ static void lp55xx_firmware_loaded(const struct firmware 
*fw, void *context)
 
        if (!fw) {
                dev_err(dev, "firmware request failed\n");
-               goto out;
+               return;
        }
 
        /* handling firmware data is chip dependent */
@@ -213,9 +213,9 @@ static void lp55xx_firmware_loaded(const struct firmware 
*fw, void *context)
 
        mutex_unlock(&chip->lock);
 
-out:
        /* firmware should be released for other channel use */
        release_firmware(chip->fw);
+       chip->fw = NULL;
 }
 
 static int lp55xx_request_firmware(struct lp55xx_chip *chip)
diff --git a/drivers/md/bcache/sysfs.c b/drivers/md/bcache/sysfs.c
index 5a5c1f1bd8a5..463ce6757338 100644
--- a/drivers/md/bcache/sysfs.c
+++ b/drivers/md/bcache/sysfs.c
@@ -215,7 +215,9 @@ STORE(__cached_dev)
        d_strtoul(writeback_rate_d_term);
        d_strtoul_nonzero(writeback_rate_p_term_inverse);
 
-       d_strtoi_h(sequential_cutoff);
+       sysfs_strtoul_clamp(sequential_cutoff,
+                           dc->sequential_cutoff,
+                           0, UINT_MAX);
        d_strtoi_h(readahead);
 
        if (attr == &sysfs_clear_stats)
@@ -645,8 +647,17 @@ STORE(__bch_cache_set)
                c->error_limit = strtoul_or_return(buf) << IO_ERROR_SHIFT;
 
        /* See count_io_errors() for why 88 */
-       if (attr == &sysfs_io_error_halflife)
-               c->error_decay = strtoul_or_return(buf) / 88;
+       if (attr == &sysfs_io_error_halflife) {
+               unsigned long v = 0;
+               ssize_t ret;
+
+               ret = strtoul_safe_clamp(buf, v, 0, UINT_MAX);
+               if (!ret) {
+                       c->error_decay = v / 88;
+                       return size;
+               }
+               return ret;
+       }
 
        sysfs_strtoul(journal_delay_ms,         c->journal_delay_ms);
        sysfs_strtoul(verify,                   c->verify);
diff --git a/drivers/md/bcache/sysfs.h b/drivers/md/bcache/sysfs.h
index 0526fe92a683..e7a3c12aa66f 100644
--- a/drivers/md/bcache/sysfs.h
+++ b/drivers/md/bcache/sysfs.h
@@ -80,9 +80,16 @@ do {                                                         
        \
 
 #define sysfs_strtoul_clamp(file, var, min, max)                       \
 do {                                                                   \
-       if (attr == &sysfs_ ## file)                                    \
-               return strtoul_safe_clamp(buf, var, min, max)           \
-                       ?: (ssize_t) size;                              \
+       if (attr == &sysfs_ ## file) {                                  \
+               unsigned long v = 0;                                    \
+               ssize_t ret;                                            \
+               ret = strtoul_safe_clamp(buf, v, min, max);             \
+               if (!ret) {                                             \
+                       var = v;                                        \
+                       return size;                                    \
+               }                                                       \
+               return ret;                                             \
+       }                                                               \
 } while (0)
 
 #define strtoul_or_return(cp)                                          \
diff --git a/drivers/md/dm-thin.c b/drivers/md/dm-thin.c
index 936c57b57539..c50f144bdbcf 100644
--- a/drivers/md/dm-thin.c
+++ b/drivers/md/dm-thin.c
@@ -2560,6 +2560,13 @@ static int pool_ctr(struct dm_target *ti, unsigned argc, 
char **argv)
        as.argc = argc;
        as.argv = argv;
 
+       /* make sure metadata and data are different devices */
+       if (!strcmp(argv[0], argv[1])) {
+               ti->error = "Error setting metadata or data device";
+               r = -EINVAL;
+               goto out_unlock;
+       }
+
        /*
         * Set default pool features.
         */
@@ -3386,6 +3393,12 @@ static int thin_ctr(struct dm_target *ti, unsigned argc, 
char **argv)
        tc->sort_bio_list = RB_ROOT;
 
        if (argc == 3) {
+               if (!strcmp(argv[0], argv[2])) {
+                       ti->error = "Error setting origin device";
+                       r = -EINVAL;
+                       goto bad_origin_dev;
+               }
+
                r = dm_get_device(ti, argv[2], FMODE_READ, &origin_dev);
                if (r) {
                        ti->error = "Error opening origin device";
diff --git a/drivers/media/i2c/soc_camera/mt9m111.c 
b/drivers/media/i2c/soc_camera/mt9m111.c
index b51e8562e775..1ee437e9cfcb 100644
--- a/drivers/media/i2c/soc_camera/mt9m111.c
+++ b/drivers/media/i2c/soc_camera/mt9m111.c
@@ -983,6 +983,8 @@ static int mt9m111_probe(struct i2c_client *client,
        mt9m111->rect.top       = MT9M111_MIN_DARK_ROWS;
        mt9m111->rect.width     = MT9M111_MAX_WIDTH;
        mt9m111->rect.height    = MT9M111_MAX_HEIGHT;
+       mt9m111->width          = mt9m111->rect.width;
+       mt9m111->height         = mt9m111->rect.height;
        mt9m111->fmt            = &mt9m111_colour_fmts[0];
        mt9m111->lastpage       = -1;
        mutex_init(&mt9m111->power_lock);
diff --git a/drivers/media/platform/s5p-jpeg/jpeg-core.c 
b/drivers/media/platform/s5p-jpeg/jpeg-core.c
index 6fcc7f072ace..480266e01037 100644
--- a/drivers/media/platform/s5p-jpeg/jpeg-core.c
+++ b/drivers/media/platform/s5p-jpeg/jpeg-core.c
@@ -1011,13 +1011,16 @@ static int s5p_jpeg_querycap(struct file *file, void 
*priv,
        return 0;
 }
 
-static int enum_fmt(struct s5p_jpeg_fmt *sjpeg_formats, int n,
+static int enum_fmt(struct s5p_jpeg_ctx *ctx,
+                   struct s5p_jpeg_fmt *sjpeg_formats, int n,
                    struct v4l2_fmtdesc *f, u32 type)
 {
        int i, num = 0;
+       unsigned int fmt_ver_flag = ctx->jpeg->variant->fmt_ver_flag;
 
        for (i = 0; i < n; ++i) {
-               if (sjpeg_formats[i].flags & type) {
+               if (sjpeg_formats[i].flags & type &&
+                   sjpeg_formats[i].flags & fmt_ver_flag) {
                        /* index-th format of type type found ? */
                        if (num == f->index)
                                break;
@@ -1043,11 +1046,11 @@ static int s5p_jpeg_enum_fmt_vid_cap(struct file *file, 
void *priv,
        struct s5p_jpeg_ctx *ctx = fh_to_ctx(priv);
 
        if (ctx->mode == S5P_JPEG_ENCODE)
-               return enum_fmt(sjpeg_formats, SJPEG_NUM_FORMATS, f,
+               return enum_fmt(ctx, sjpeg_formats, SJPEG_NUM_FORMATS, f,
                                SJPEG_FMT_FLAG_ENC_CAPTURE);
 
-       return enum_fmt(sjpeg_formats, SJPEG_NUM_FORMATS, f,
-                                       SJPEG_FMT_FLAG_DEC_CAPTURE);
+       return enum_fmt(ctx, sjpeg_formats, SJPEG_NUM_FORMATS, f,
+                       SJPEG_FMT_FLAG_DEC_CAPTURE);
 }
 
 static int s5p_jpeg_enum_fmt_vid_out(struct file *file, void *priv,
@@ -1056,11 +1059,11 @@ static int s5p_jpeg_enum_fmt_vid_out(struct file *file, 
void *priv,
        struct s5p_jpeg_ctx *ctx = fh_to_ctx(priv);
 
        if (ctx->mode == S5P_JPEG_ENCODE)
-               return enum_fmt(sjpeg_formats, SJPEG_NUM_FORMATS, f,
+               return enum_fmt(ctx, sjpeg_formats, SJPEG_NUM_FORMATS, f,
                                SJPEG_FMT_FLAG_ENC_OUTPUT);
 
-       return enum_fmt(sjpeg_formats, SJPEG_NUM_FORMATS, f,
-                                       SJPEG_FMT_FLAG_DEC_OUTPUT);
+       return enum_fmt(ctx, sjpeg_formats, SJPEG_NUM_FORMATS, f,
+                       SJPEG_FMT_FLAG_DEC_OUTPUT);
 }
 
 static struct s5p_jpeg_q_data *get_q_data(struct s5p_jpeg_ctx *ctx,
diff --git a/drivers/mmc/host/davinci_mmc.c b/drivers/mmc/host/davinci_mmc.c
index 5d4c5e0fba2f..7e154a8213e2 100644
--- a/drivers/mmc/host/davinci_mmc.c
+++ b/drivers/mmc/host/davinci_mmc.c
@@ -1147,7 +1147,7 @@ static inline void mmc_davinci_cpufreq_deregister(struct 
mmc_davinci_host *host)
 {
 }
 #endif
-static void __init init_mmcsd_host(struct mmc_davinci_host *host)
+static void init_mmcsd_host(struct mmc_davinci_host *host)
 {
 
        mmc_davinci_reset_ctrl(host, 1);
diff --git a/drivers/mmc/host/omap.c b/drivers/mmc/host/omap.c
index 11e5bfedab70..b9f4f39f9359 100644
--- a/drivers/mmc/host/omap.c
+++ b/drivers/mmc/host/omap.c
@@ -921,7 +921,7 @@ static inline void set_cmd_timeout(struct mmc_omap_host 
*host, struct mmc_reques
        reg &= ~(1 << 5);
        OMAP_MMC_WRITE(host, SDIO, reg);
        /* Set maximum timeout */
-       OMAP_MMC_WRITE(host, CTO, 0xff);
+       OMAP_MMC_WRITE(host, CTO, 0xfd);
 }
 
 static inline void set_data_timeout(struct mmc_omap_host *host, struct 
mmc_request *req)
diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c
index 126ce5e24fc1..3e4713eedc6e 100644
--- a/drivers/net/bonding/bond_main.c
+++ b/drivers/net/bonding/bond_main.c
@@ -2958,8 +2958,12 @@ static int bond_netdev_event(struct notifier_block *this,
                return NOTIFY_DONE;
 
        if (event_dev->flags & IFF_MASTER) {
+               int ret;
+
                netdev_dbg(event_dev, "IFF_MASTER\n");
-               return bond_master_netdev_event(event, event_dev);
+               ret = bond_master_netdev_event(event, event_dev);
+               if (ret != NOTIFY_DONE)
+                       return ret;
        }
 
        if (event_dev->flags & IFF_SLAVE) {
diff --git a/drivers/net/ethernet/intel/e1000e/netdev.c 
b/drivers/net/ethernet/intel/e1000e/netdev.c
index 0beeebdc0c01..ef5699103ec2 100644
--- a/drivers/net/ethernet/intel/e1000e/netdev.c
+++ b/drivers/net/ethernet/intel/e1000e/netdev.c
@@ -2132,7 +2132,7 @@ static int e1000_request_msix(struct e1000_adapter 
*adapter)
        if (strlen(netdev->name) < (IFNAMSIZ - 5))
                snprintf(adapter->rx_ring->name,
                         sizeof(adapter->rx_ring->name) - 1,
-                        "%s-rx-0", netdev->name);
+                        "%.14s-rx-0", netdev->name);
        else
                memcpy(adapter->rx_ring->name, netdev->name, IFNAMSIZ);
        err = request_irq(adapter->msix_entries[vector].vector,
@@ -2148,7 +2148,7 @@ static int e1000_request_msix(struct e1000_adapter 
*adapter)
        if (strlen(netdev->name) < (IFNAMSIZ - 5))
                snprintf(adapter->tx_ring->name,
                         sizeof(adapter->tx_ring->name) - 1,
-                        "%s-tx-0", netdev->name);
+                        "%.14s-tx-0", netdev->name);
        else
                memcpy(adapter->tx_ring->name, netdev->name, IFNAMSIZ);
        err = request_irq(adapter->msix_entries[vector].vector,
diff --git a/drivers/net/usb/qmi_wwan.c b/drivers/net/usb/qmi_wwan.c
index becfc0f5a107..6dd2bd0b1d9c 100644
--- a/drivers/net/usb/qmi_wwan.c
+++ b/drivers/net/usb/qmi_wwan.c
@@ -759,6 +759,7 @@ static const struct usb_device_id products[] = {
        {QMI_FIXED_INTF(0x19d2, 0x2002, 4)},    /* ZTE (Vodafone) K3765-Z */
        {QMI_FIXED_INTF(0x2001, 0x7e19, 4)},    /* D-Link DWM-221 B1 */
        {QMI_FIXED_INTF(0x2001, 0x7e35, 4)},    /* D-Link DWM-222 */
+       {QMI_FIXED_INTF(0x2020, 0x2031, 4)},    /* Olicard 600 */
        {QMI_FIXED_INTF(0x2020, 0x2033, 4)},    /* BroadMobi BM806U */
        {QMI_FIXED_INTF(0x0f3d, 0x68a2, 8)},    /* Sierra Wireless MC7700 */
        {QMI_FIXED_INTF(0x114f, 0x68a2, 8)},    /* Sierra Wireless MC7750 */
diff --git a/drivers/net/wireless/rsi/rsi_common.h 
b/drivers/net/wireless/rsi/rsi_common.h
index d3fbe33d2324..a13f08fd8690 100644
--- a/drivers/net/wireless/rsi/rsi_common.h
+++ b/drivers/net/wireless/rsi/rsi_common.h
@@ -75,7 +75,6 @@ static inline int rsi_kill_thread(struct rsi_thread *handle)
        atomic_inc(&handle->thread_done);
        rsi_set_event(&handle->event);
 
-       wait_for_completion(&handle->completion);
        return kthread_stop(handle->task);
 }
 
diff --git a/drivers/net/wireless/ti/wlcore/main.c 
b/drivers/net/wireless/ti/wlcore/main.c
index 575c8f6d4009..16b69b026f8f 100644
--- a/drivers/net/wireless/ti/wlcore/main.c
+++ b/drivers/net/wireless/ti/wlcore/main.c
@@ -1110,8 +1110,11 @@ static int wl12xx_chip_wakeup(struct wl1271 *wl, bool 
plt)
                goto out;
 
        ret = wl12xx_fetch_firmware(wl, plt);
-       if (ret < 0)
-               goto out;
+       if (ret < 0) {
+               kfree(wl->fw_status);
+               kfree(wl->raw_fw_status);
+               kfree(wl->tx_res_if);
+       }
 
 out:
        return ret;
diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c
index 0b75b47a5329..e5bc350df3d2 100644
--- a/drivers/pci/quirks.c
+++ b/drivers/pci/quirks.c
@@ -3565,6 +3565,8 @@ DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_MARVELL_EXT, 
0x9128,
 /* https://bugzilla.kernel.org/show_bug.cgi?id=42679#c14 */
 DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_MARVELL_EXT, 0x9130,
                         quirk_dma_func1_alias);
+DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_MARVELL_EXT, 0x9170,
+                        quirk_dma_func1_alias);
 /* https://bugzilla.kernel.org/show_bug.cgi?id=42679#c47 + c57 */
 DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_MARVELL_EXT, 0x9172,
                         quirk_dma_func1_alias);
diff --git a/drivers/scsi/megaraid/megaraid_sas_base.c 
b/drivers/scsi/megaraid/megaraid_sas_base.c
index 1ff0ece87644..24cc8786ff06 100644
--- a/drivers/scsi/megaraid/megaraid_sas_base.c
+++ b/drivers/scsi/megaraid/megaraid_sas_base.c
@@ -3743,6 +3743,7 @@ int megasas_alloc_cmds(struct megasas_instance *instance)
        if (megasas_create_frame_pool(instance)) {
                printk(KERN_DEBUG "megasas: Error creating frame DMA pool\n");
                megasas_free_cmds(instance);
+               return -ENOMEM;
        }
 
        return 0;
diff --git a/drivers/scsi/scsi_scan.c b/drivers/scsi/scsi_scan.c
index 3386e72ba7e4..156ee22462e6 100644
--- a/drivers/scsi/scsi_scan.c
+++ b/drivers/scsi/scsi_scan.c
@@ -229,7 +229,7 @@ static struct scsi_device *scsi_alloc_sdev(struct 
scsi_target *starget,
        extern void scsi_requeue_run_queue(struct work_struct *work);
 
        sdev = kzalloc(sizeof(*sdev) + shost->transportt->device_size,
-                      GFP_ATOMIC);
+                      GFP_KERNEL);
        if (!sdev)
                goto out;
 
@@ -791,7 +791,7 @@ static int scsi_add_lun(struct scsi_device *sdev, unsigned 
char *inq_result,
         */
        sdev->inquiry = kmemdup(inq_result,
                                max_t(size_t, sdev->inquiry_len, 36),
-                               GFP_ATOMIC);
+                               GFP_KERNEL);
        if (sdev->inquiry == NULL)
                return SCSI_SCAN_NO_RESPONSE;
 
@@ -1083,7 +1083,7 @@ static int scsi_probe_and_add_lun(struct scsi_target 
*starget,
        if (!sdev)
                goto out;
 
-       result = kmalloc(result_len, GFP_ATOMIC |
+       result = kmalloc(result_len, GFP_KERNEL |
                        ((shost->unchecked_isa_dma) ? __GFP_DMA : 0));
        if (!result)
                goto out_free_sdev;
diff --git a/drivers/staging/comedi/drivers/ni_usb6501.c 
b/drivers/staging/comedi/drivers/ni_usb6501.c
index df7ada8611f4..276240afc5a9 100644
--- a/drivers/staging/comedi/drivers/ni_usb6501.c
+++ b/drivers/staging/comedi/drivers/ni_usb6501.c
@@ -478,10 +478,8 @@ static int ni6501_alloc_usb_buffers(struct comedi_device 
*dev)
 
        size = le16_to_cpu(devpriv->ep_tx->wMaxPacketSize);
        devpriv->usb_tx_buf = kzalloc(size, GFP_KERNEL);
-       if (!devpriv->usb_tx_buf) {
-               kfree(devpriv->usb_rx_buf);
+       if (!devpriv->usb_tx_buf)
                return -ENOMEM;
-       }
 
        return 0;
 }
diff --git a/drivers/staging/comedi/drivers/vmk80xx.c 
b/drivers/staging/comedi/drivers/vmk80xx.c
index 71003416edcf..6c743bbf520a 100644
--- a/drivers/staging/comedi/drivers/vmk80xx.c
+++ b/drivers/staging/comedi/drivers/vmk80xx.c
@@ -757,10 +757,8 @@ static int vmk80xx_alloc_usb_buffers(struct comedi_device 
*dev)
 
        size = le16_to_cpu(devpriv->ep_tx->wMaxPacketSize);
        devpriv->usb_tx_buf = kzalloc(size, GFP_KERNEL);
-       if (!devpriv->usb_tx_buf) {
-               kfree(devpriv->usb_rx_buf);
+       if (!devpriv->usb_tx_buf)
                return -ENOMEM;
-       }
 
        return 0;
 }
@@ -872,6 +870,8 @@ static int vmk80xx_auto_attach(struct comedi_device *dev,
 
        devpriv->model = boardinfo->model;
 
+       sema_init(&devpriv->limit_sem, 8);
+
        ret = vmk80xx_find_usb_endpoints(dev);
        if (ret)
                return ret;
@@ -880,8 +880,6 @@ static int vmk80xx_auto_attach(struct comedi_device *dev,
        if (ret)
                return ret;
 
-       sema_init(&devpriv->limit_sem, 8);
-
        usb_set_intfdata(intf, devpriv);
 
        if (devpriv->model == VMK8061_MODEL) {
diff --git a/drivers/thermal/int340x_thermal/int3400_thermal.c 
b/drivers/thermal/int340x_thermal/int3400_thermal.c
index edc1cce117ba..7b96b20e939a 100644
--- a/drivers/thermal/int340x_thermal/int3400_thermal.c
+++ b/drivers/thermal/int340x_thermal/int3400_thermal.c
@@ -208,10 +208,9 @@ static int int3400_thermal_probe(struct platform_device 
*pdev)
 
        platform_set_drvdata(pdev, priv);
 
-       if (priv->uuid_bitmap & 1 << INT3400_THERMAL_PASSIVE_1) {
-               int3400_thermal_ops.get_mode = int3400_thermal_get_mode;
-               int3400_thermal_ops.set_mode = int3400_thermal_set_mode;
-       }
+       int3400_thermal_ops.get_mode = int3400_thermal_get_mode;
+       int3400_thermal_ops.set_mode = int3400_thermal_set_mode;
+
        priv->thermal = thermal_zone_device_register("INT3400 Thermal", 0, 0,
                                                priv, &int3400_thermal_ops,
                                                &int3400_thermal_params, 0, 0);
diff --git a/drivers/tty/Kconfig b/drivers/tty/Kconfig
index b24aa010f68c..f3c702d8afa8 100644
--- a/drivers/tty/Kconfig
+++ b/drivers/tty/Kconfig
@@ -419,4 +419,27 @@ config DA_CONSOLE
        help
          This enables a console on a Dash channel.
 
+config LDISC_AUTOLOAD
+       bool "Automatically load TTY Line Disciplines"
+       default y
+       help
+         Historically the kernel has always automatically loaded any
+         line discipline that is in a kernel module when a user asks
+         for it to be loaded with the TIOCSETD ioctl, or through other
+         means.  This is not always the best thing to do on systems
+         where you know you will not be using some of the more
+         "ancient" line disciplines, so prevent the kernel from doing
+         this unless the request is coming from a process with the
+         CAP_SYS_MODULE permissions.
+
+         Say 'Y' here if you trust your userspace users to do the right
+         thing, or if you have only provided the line disciplines that
+         you know you will be using, or if you wish to continue to use
+         the traditional method of on-demand loading of these modules
+         by any user.
+
+         This functionality can be changed at runtime with the
+         dev.tty.ldisc_autoload sysctl, this configuration option will
+         only set the default value of this functionality.
+
 endif # TTY
diff --git a/drivers/tty/serial/xilinx_uartps.c 
b/drivers/tty/serial/xilinx_uartps.c
index df28ef14382b..892446cc28fa 100644
--- a/drivers/tty/serial/xilinx_uartps.c
+++ b/drivers/tty/serial/xilinx_uartps.c
@@ -1120,7 +1120,7 @@ static void cdns_uart_console_write(struct console *co, 
const char *s,
  *
  * Return: 0 on success, negative errno otherwise.
  */
-static int __init cdns_uart_console_setup(struct console *co, char *options)
+static int cdns_uart_console_setup(struct console *co, char *options)
 {
        struct uart_port *port = &cdns_uart_port[co->index];
        int baud = 9600;
diff --git a/drivers/tty/tty_buffer.c b/drivers/tty/tty_buffer.c
index 0d3fc2dae23a..50616c949e8e 100644
--- a/drivers/tty/tty_buffer.c
+++ b/drivers/tty/tty_buffer.c
@@ -25,7 +25,7 @@
  * Byte threshold to limit memory consumption for flip buffers.
  * The actual memory limit is > 2x this amount.
  */
-#define TTYB_DEFAULT_MEM_LIMIT 65536
+#define TTYB_DEFAULT_MEM_LIMIT (640 * 1024UL)
 
 /*
  * We default to dicing tty buffer allocations to this many characters
diff --git a/drivers/tty/tty_io.c b/drivers/tty/tty_io.c
index 33e81b7e2a5a..7b308d2b83a7 100644
--- a/drivers/tty/tty_io.c
+++ b/drivers/tty/tty_io.c
@@ -492,6 +492,8 @@ static const struct file_operations hung_up_tty_fops = {
 static DEFINE_SPINLOCK(redirect_lock);
 static struct file *redirect;
 
+extern void tty_sysctl_init(void);
+
 /**
  *     tty_wakeup      -       request more data
  *     @tty: terminal
@@ -3625,6 +3627,7 @@ void console_sysfs_notify(void)
  */
 int __init tty_init(void)
 {
+       tty_sysctl_init();
        cdev_init(&tty_cdev, &tty_fops);
        if (cdev_add(&tty_cdev, MKDEV(TTYAUX_MAJOR, 0), 1) ||
            register_chrdev_region(MKDEV(TTYAUX_MAJOR, 0), 1, "/dev/tty") < 0)
diff --git a/drivers/tty/tty_ldisc.c b/drivers/tty/tty_ldisc.c
index 6572db5a1c79..6a34d7d0d45c 100644
--- a/drivers/tty/tty_ldisc.c
+++ b/drivers/tty/tty_ldisc.c
@@ -151,6 +151,13 @@ static void put_ldops(struct tty_ldisc_ops *ldops)
  *             takes tty_ldiscs_lock to guard against ldisc races
  */
 
+#if defined(CONFIG_LDISC_AUTOLOAD)
+       #define INITIAL_AUTOLOAD_STATE  1
+#else
+       #define INITIAL_AUTOLOAD_STATE  0
+#endif
+static int tty_ldisc_autoload = INITIAL_AUTOLOAD_STATE;
+
 static struct tty_ldisc *tty_ldisc_get(struct tty_struct *tty, int disc)
 {
        struct tty_ldisc *ld;
@@ -165,6 +172,8 @@ static struct tty_ldisc *tty_ldisc_get(struct tty_struct 
*tty, int disc)
         */
        ldops = get_ldops(disc);
        if (IS_ERR(ldops)) {
+               if (!capable(CAP_SYS_MODULE) && !tty_ldisc_autoload)
+                       return ERR_PTR(-EPERM);
                request_module("tty-ldisc-%d", disc);
                ldops = get_ldops(disc);
                if (IS_ERR(ldops))
@@ -831,3 +840,41 @@ void tty_ldisc_begin(void)
        /* Setup the default TTY line discipline. */
        (void) tty_register_ldisc(N_TTY, &tty_ldisc_N_TTY);
 }
+
+static int zero;
+static int one = 1;
+static struct ctl_table tty_table[] = {
+       {
+               .procname       = "ldisc_autoload",
+               .data           = &tty_ldisc_autoload,
+               .maxlen         = sizeof(tty_ldisc_autoload),
+               .mode           = 0644,
+               .proc_handler   = proc_dointvec,
+               .extra1         = &zero,
+               .extra2         = &one,
+       },
+       { }
+};
+
+static struct ctl_table tty_dir_table[] = {
+       {
+               .procname       = "tty",
+               .mode           = 0555,
+               .child          = tty_table,
+       },
+       { }
+};
+
+static struct ctl_table tty_root_table[] = {
+       {
+               .procname       = "dev",
+               .mode           = 0555,
+               .child          = tty_dir_table,
+       },
+       { }
+};
+
+void tty_sysctl_init(void)
+{
+       register_sysctl_table(tty_root_table);
+}
diff --git a/drivers/video/fbdev/core/fbmem.c b/drivers/video/fbdev/core/fbmem.c
index ea2bd6208a2f..9eae191728d2 100644
--- a/drivers/video/fbdev/core/fbmem.c
+++ b/drivers/video/fbdev/core/fbmem.c
@@ -425,6 +425,9 @@ static void fb_do_show_logo(struct fb_info *info, struct 
fb_image *image,
 {
        unsigned int x;
 
+       if (image->width > info->var.xres || image->height > info->var.yres)
+               return;
+
        if (rotate == FB_ROTATE_UR) {
                for (x = 0;
                     x < num && image->dx + image->width <= info->var.xres;
diff --git a/fs/9p/v9fs.c b/fs/9p/v9fs.c
index 6894b085f0ee..4f02d1db6e27 100644
--- a/fs/9p/v9fs.c
+++ b/fs/9p/v9fs.c
@@ -59,6 +59,8 @@ enum {
        Opt_cache_loose, Opt_fscache, Opt_mmap,
        /* Access options */
        Opt_access, Opt_posixacl,
+       /* Lock timeout option */
+       Opt_locktimeout,
        /* Error token */
        Opt_err
 };
@@ -78,6 +80,7 @@ static const match_table_t tokens = {
        {Opt_cachetag, "cachetag=%s"},
        {Opt_access, "access=%s"},
        {Opt_posixacl, "posixacl"},
+       {Opt_locktimeout, "locktimeout=%u"},
        {Opt_err, NULL}
 };
 
@@ -126,6 +129,7 @@ static int v9fs_parse_options(struct v9fs_session_info 
*v9ses, char *opts)
 #ifdef CONFIG_9P_FSCACHE
        v9ses->cachetag = NULL;
 #endif
+       v9ses->session_lock_timeout = P9_LOCK_TIMEOUT;
 
        if (!opts)
                return 0;
@@ -298,6 +302,23 @@ static int v9fs_parse_options(struct v9fs_session_info 
*v9ses, char *opts)
 #endif
                        break;
 
+               case Opt_locktimeout:
+                       r = match_int(&args[0], &option);
+                       if (r < 0) {
+                               p9_debug(P9_DEBUG_ERROR,
+                                        "integer field, but no integer?\n");
+                               ret = r;
+                               continue;
+                       }
+                       if (option < 1) {
+                               p9_debug(P9_DEBUG_ERROR,
+                                        "locktimeout must be a greater than 
zero integer.\n");
+                               ret = -EINVAL;
+                               continue;
+                       }
+                       v9ses->session_lock_timeout = (long)option * HZ;
+                       break;
+
                default:
                        continue;
                }
diff --git a/fs/9p/v9fs.h b/fs/9p/v9fs.h
index 099c7712631c..5e748e716b36 100644
--- a/fs/9p/v9fs.h
+++ b/fs/9p/v9fs.h
@@ -117,6 +117,7 @@ struct v9fs_session_info {
        struct list_head slist; /* list of sessions registered with v9fs */
        struct backing_dev_info bdi;
        struct rw_semaphore rename_sem;
+       long session_lock_timeout; /* retry interval for blocking locks */
 };
 
 /* cache_validity flags */
diff --git a/fs/9p/vfs_dir.c b/fs/9p/vfs_dir.c
index cfe4cf6486af..fa7d1c3536e6 100644
--- a/fs/9p/vfs_dir.c
+++ b/fs/9p/vfs_dir.c
@@ -104,7 +104,6 @@ static int v9fs_dir_readdir(struct file *file, struct 
dir_context *ctx)
        int err = 0;
        struct p9_fid *fid;
        int buflen;
-       int reclen = 0;
        struct p9_rdir *rdir;
 
        p9_debug(P9_DEBUG_VFS, "name %pD\n", file);
@@ -129,11 +128,10 @@ static int v9fs_dir_readdir(struct file *file, struct 
dir_context *ctx)
                while (rdir->head < rdir->tail) {
                        err = p9stat_read(fid->clnt, rdir->buf + rdir->head,
                                          rdir->tail - rdir->head, &st);
-                       if (err) {
+                       if (err <= 0) {
                                p9_debug(P9_DEBUG_VFS, "returned %d\n", err);
                                return -EIO;
                        }
-                       reclen = st.size+2;
 
                        over = !dir_emit(ctx, st.name, strlen(st.name),
                                         v9fs_qid2ino(&st.qid), dt_type(&st));
@@ -141,8 +139,8 @@ static int v9fs_dir_readdir(struct file *file, struct 
dir_context *ctx)
                        if (over)
                                return 0;
 
-                       rdir->head += reclen;
-                       ctx->pos += reclen;
+                       rdir->head += err;
+                       ctx->pos += err;
                }
        }
 }
diff --git a/fs/9p/vfs_file.c b/fs/9p/vfs_file.c
index 5594505e6e73..1d32409e5a19 100644
--- a/fs/9p/vfs_file.c
+++ b/fs/9p/vfs_file.c
@@ -152,6 +152,7 @@ static int v9fs_file_do_lock(struct file *filp, int cmd, 
struct file_lock *fl)
        uint8_t status;
        int res = 0;
        unsigned char fl_type;
+       struct v9fs_session_info *v9ses;
 
        fid = filp->private_data;
        BUG_ON(fid == NULL);
@@ -187,6 +188,8 @@ static int v9fs_file_do_lock(struct file *filp, int cmd, 
struct file_lock *fl)
        if (IS_SETLKW(cmd))
                flock.flags = P9_LOCK_FLAGS_BLOCK;
 
+       v9ses = v9fs_inode2v9ses(file_inode(filp));
+
        /*
         * if its a blocked request and we get P9_LOCK_BLOCKED as the status
         * for lock request, keep on trying
@@ -200,7 +203,8 @@ static int v9fs_file_do_lock(struct file *filp, int cmd, 
struct file_lock *fl)
                        break;
                if (status == P9_LOCK_BLOCKED && !IS_SETLKW(cmd))
                        break;
-               if (schedule_timeout_interruptible(P9_LOCK_TIMEOUT) != 0)
+               if (schedule_timeout_interruptible(v9ses->session_lock_timeout)
+                               != 0)
                        break;
        }
 
diff --git a/fs/binfmt_elf.c b/fs/binfmt_elf.c
index c3b57886b5bc..f82aebce97d0 100644
--- a/fs/binfmt_elf.c
+++ b/fs/binfmt_elf.c
@@ -734,6 +734,7 @@ static int load_elf_binary(struct linux_binprm *bprm)
                current->flags |= PF_RANDOMIZE;
 
        setup_new_exec(bprm);
+       install_exec_creds(bprm);
 
        /* Do this so that we can load the interpreter, if need be.  We will
           change some of these later */
@@ -935,7 +936,6 @@ static int load_elf_binary(struct linux_binprm *bprm)
                goto out;
 #endif /* ARCH_HAS_SETUP_ADDITIONAL_PAGES */
 
-       install_exec_creds(bprm);
        retval = create_elf_tables(bprm, &loc->elf_ex,
                          load_addr, interp_load_addr);
        if (retval < 0)
diff --git a/fs/buffer.c b/fs/buffer.c
index 20805db2c987..47b42e8ddca2 100644
--- a/fs/buffer.c
+++ b/fs/buffer.c
@@ -2986,6 +2986,13 @@ void guard_bio_eod(int rw, struct bio *bio)
        /* Uhhuh. We've got a bio that straddles the device size! */
        truncated_bytes = bio->bi_iter.bi_size - (maxsector << 9);
 
+       /*
+        * The bio contains more than one segment which spans EOD, just return
+        * and let IO layer turn it into an EIO
+        */
+       if (truncated_bytes > bvec->bv_len)
+               return;
+
        /* Truncate the bio.. */
        bio->bi_iter.bi_size -= truncated_bytes;
        bvec->bv_len -= truncated_bytes;
diff --git a/fs/cifs/cifs_dfs_ref.c b/fs/cifs/cifs_dfs_ref.c
index b8602f199815..71263ea90810 100644
--- a/fs/cifs/cifs_dfs_ref.c
+++ b/fs/cifs/cifs_dfs_ref.c
@@ -265,9 +265,9 @@ static void dump_referral(const struct dfs_info3_param *ref)
 {
        cifs_dbg(FYI, "DFS: ref path: %s\n", ref->path_name);
        cifs_dbg(FYI, "DFS: node path: %s\n", ref->node_name);
-       cifs_dbg(FYI, "DFS: fl: %hd, srv_type: %hd\n",
+       cifs_dbg(FYI, "DFS: fl: %d, srv_type: %d\n",
                 ref->flags, ref->server_type);
-       cifs_dbg(FYI, "DFS: ref_flags: %hd, path_consumed: %hd\n",
+       cifs_dbg(FYI, "DFS: ref_flags: %d, path_consumed: %d\n",
                 ref->ref_flag, ref->path_consumed);
 }
 
diff --git a/fs/cifs/connect.c b/fs/cifs/connect.c
index 7d4c2bf2fea2..f5f5aab3457f 100644
--- a/fs/cifs/connect.c
+++ b/fs/cifs/connect.c
@@ -1186,6 +1186,11 @@ cifs_parse_devname(const char *devname, struct smb_vol 
*vol)
        const char *delims = "/\\";
        size_t len;
 
+       if (unlikely(!devname || !*devname)) {
+               cifs_dbg(VFS, "Device name not specified.\n");
+               return -EINVAL;
+       }
+
        /* make sure we have a valid UNC double delimiter prefix */
        len = strspn(devname, delims);
        if (len != 2)
diff --git a/fs/cifs/smb1ops.c b/fs/cifs/smb1ops.c
index b0f973b2b189..2a43aa6d8e87 100644
--- a/fs/cifs/smb1ops.c
+++ b/fs/cifs/smb1ops.c
@@ -305,7 +305,7 @@ coalesce_t2(char *second_buf, struct smb_hdr *target_hdr)
        remaining = tgt_total_cnt - total_in_tgt;
 
        if (remaining < 0) {
-               cifs_dbg(FYI, "Server sent too much data. tgt_total_cnt=%hu 
total_in_tgt=%hu\n",
+               cifs_dbg(FYI, "Server sent too much data. tgt_total_cnt=%hu 
total_in_tgt=%u\n",
                         tgt_total_cnt, total_in_tgt);
                return -EPROTO;
        }
diff --git a/fs/cifs/smb2maperror.c b/fs/cifs/smb2maperror.c
index 98c25b969ab8..7e93d5706bf6 100644
--- a/fs/cifs/smb2maperror.c
+++ b/fs/cifs/smb2maperror.c
@@ -1034,7 +1034,8 @@ static const struct status_to_posix_error 
smb2_error_map_table[] = {
        {STATUS_UNFINISHED_CONTEXT_DELETED, -EIO,
        "STATUS_UNFINISHED_CONTEXT_DELETED"},
        {STATUS_NO_TGT_REPLY, -EIO, "STATUS_NO_TGT_REPLY"},
-       {STATUS_OBJECTID_NOT_FOUND, -EIO, "STATUS_OBJECTID_NOT_FOUND"},
+       /* Note that ENOATTTR and ENODATA are the same errno */
+       {STATUS_OBJECTID_NOT_FOUND, -ENODATA, "STATUS_OBJECTID_NOT_FOUND"},
        {STATUS_NO_IP_ADDRESSES, -EIO, "STATUS_NO_IP_ADDRESSES"},
        {STATUS_WRONG_CREDENTIAL_HANDLE, -EIO,
        "STATUS_WRONG_CREDENTIAL_HANDLE"},
diff --git a/fs/ext4/indirect.c b/fs/ext4/indirect.c
index b6e262b86566..e0690ba57756 100644
--- a/fs/ext4/indirect.c
+++ b/fs/ext4/indirect.c
@@ -1312,6 +1312,7 @@ int ext4_ind_remove_space(handle_t *handle, struct inode 
*inode,
        ext4_lblk_t offsets[4], offsets2[4];
        Indirect chain[4], chain2[4];
        Indirect *partial, *partial2;
+       Indirect *p = NULL, *p2 = NULL;
        ext4_lblk_t max_block;
        __le32 nr = 0, nr2 = 0;
        int n = 0, n2 = 0;
@@ -1353,7 +1354,7 @@ int ext4_ind_remove_space(handle_t *handle, struct inode 
*inode,
                }
 
 
-               partial = ext4_find_shared(inode, n, offsets, chain, &nr);
+               partial = p = ext4_find_shared(inode, n, offsets, chain, &nr);
                if (nr) {
                        if (partial == chain) {
                                /* Shared branch grows from the inode */
@@ -1378,13 +1379,11 @@ int ext4_ind_remove_space(handle_t *handle, struct 
inode *inode,
                                partial->p + 1,
                                (__le32 *)partial->bh->b_data+addr_per_block,
                                (chain+n-1) - partial);
-                       BUFFER_TRACE(partial->bh, "call brelse");
-                       brelse(partial->bh);
                        partial--;
                }
 
 end_range:
-               partial2 = ext4_find_shared(inode, n2, offsets2, chain2, &nr2);
+               partial2 = p2 = ext4_find_shared(inode, n2, offsets2, chain2, 
&nr2);
                if (nr2) {
                        if (partial2 == chain2) {
                                /*
@@ -1414,16 +1413,14 @@ end_range:
                                           (__le32 *)partial2->bh->b_data,
                                           partial2->p,
                                           (chain2+n2-1) - partial2);
-                       BUFFER_TRACE(partial2->bh, "call brelse");
-                       brelse(partial2->bh);
                        partial2--;
                }
                goto do_indirects;
        }
 
        /* Punch happened within the same level (n == n2) */
-       partial = ext4_find_shared(inode, n, offsets, chain, &nr);
-       partial2 = ext4_find_shared(inode, n2, offsets2, chain2, &nr2);
+       partial = p = ext4_find_shared(inode, n, offsets, chain, &nr);
+       partial2 = p2 = ext4_find_shared(inode, n2, offsets2, chain2, &nr2);
 
        /* Free top, but only if partial2 isn't its subtree. */
        if (nr) {
@@ -1480,15 +1477,7 @@ end_range:
                                           partial->p + 1,
                                           partial2->p,
                                           (chain+n-1) - partial);
-                       while (partial > chain) {
-                               BUFFER_TRACE(partial->bh, "call brelse");
-                               brelse(partial->bh);
-                       }
-                       while (partial2 > chain2) {
-                               BUFFER_TRACE(partial2->bh, "call brelse");
-                               brelse(partial2->bh);
-                       }
-                       return 0;
+                       goto cleanup;
                }
 
                /*
@@ -1503,8 +1492,6 @@ end_range:
                                           partial->p + 1,
                                           (__le32 
*)partial->bh->b_data+addr_per_block,
                                           (chain+n-1) - partial);
-                       BUFFER_TRACE(partial->bh, "call brelse");
-                       brelse(partial->bh);
                        partial--;
                }
                if (partial2 > chain2 && depth2 <= depth) {
@@ -1512,11 +1499,21 @@ end_range:
                                           (__le32 *)partial2->bh->b_data,
                                           partial2->p,
                                           (chain2+n2-1) - partial2);
-                       BUFFER_TRACE(partial2->bh, "call brelse");
-                       brelse(partial2->bh);
                        partial2--;
                }
        }
+
+cleanup:
+       while (p && p > chain) {
+               BUFFER_TRACE(p->bh, "call brelse");
+               brelse(p->bh);
+               p--;
+       }
+       while (p2 && p2 > chain2) {
+               BUFFER_TRACE(p2->bh, "call brelse");
+               brelse(p2->bh);
+               p2--;
+       }
        return 0;
 
 do_indirects:
@@ -1524,7 +1521,7 @@ do_indirects:
        switch (offsets[0]) {
        default:
                if (++n >= n2)
-                       return 0;
+                       break;
                nr = i_data[EXT4_IND_BLOCK];
                if (nr) {
                        ext4_free_branches(handle, inode, NULL, &nr, &nr+1, 1);
@@ -1532,7 +1529,7 @@ do_indirects:
                }
        case EXT4_IND_BLOCK:
                if (++n >= n2)
-                       return 0;
+                       break;
                nr = i_data[EXT4_DIND_BLOCK];
                if (nr) {
                        ext4_free_branches(handle, inode, NULL, &nr, &nr+1, 2);
@@ -1540,7 +1537,7 @@ do_indirects:
                }
        case EXT4_DIND_BLOCK:
                if (++n >= n2)
-                       return 0;
+                       break;
                nr = i_data[EXT4_TIND_BLOCK];
                if (nr) {
                        ext4_free_branches(handle, inode, NULL, &nr, &nr+1, 3);
@@ -1549,5 +1546,5 @@ do_indirects:
        case EXT4_TIND_BLOCK:
                ;
        }
-       return 0;
+       goto cleanup;
 }
diff --git a/fs/ext4/resize.c b/fs/ext4/resize.c
index 96372539dc06..196b9d3fa3b9 100644
--- a/fs/ext4/resize.c
+++ b/fs/ext4/resize.c
@@ -2042,6 +2042,10 @@ out:
                free_flex_gd(flex_gd);
        if (resize_inode != NULL)
                iput(resize_inode);
-       ext4_msg(sb, KERN_INFO, "resized filesystem to %llu", n_blocks_count);
+       if (err)
+               ext4_warning(sb, "error (%d) occurred during "
+                            "file system resize", err);
+       ext4_msg(sb, KERN_INFO, "resized filesystem to %llu",
+                ext4_blocks_count(es));
        return err;
 }
diff --git a/fs/ocfs2/cluster/nodemanager.c b/fs/ocfs2/cluster/nodemanager.c
index 441c84e169e6..059414bb19dc 100644
--- a/fs/ocfs2/cluster/nodemanager.c
+++ b/fs/ocfs2/cluster/nodemanager.c
@@ -721,13 +721,15 @@ static void o2nm_node_group_drop_item(struct config_group 
*group,
        struct o2nm_node *node = to_o2nm_node(item);
        struct o2nm_cluster *cluster = 
to_o2nm_cluster(group->cg_item.ci_parent);
 
-       o2net_disconnect_node(node);
+       if (cluster->cl_nodes[node->nd_num] == node) {
+               o2net_disconnect_node(node);
 
-       if (cluster->cl_has_local &&
-           (cluster->cl_local_node == node->nd_num)) {
-               cluster->cl_has_local = 0;
-               cluster->cl_local_node = O2NM_INVALID_NODE_NUM;
-               o2net_stop_listening(node);
+               if (cluster->cl_has_local &&
+                   (cluster->cl_local_node == node->nd_num)) {
+                       cluster->cl_has_local = 0;
+                       cluster->cl_local_node = O2NM_INVALID_NODE_NUM;
+                       o2net_stop_listening(node);
+               }
        }
 
        /* XXX call into net to stop this node from trading messages */
diff --git a/include/linux/atalk.h b/include/linux/atalk.h
index 73fd8b7e9534..af43ed404ff4 100644
--- a/include/linux/atalk.h
+++ b/include/linux/atalk.h
@@ -150,19 +150,29 @@ extern int sysctl_aarp_retransmit_limit;
 extern int sysctl_aarp_resolve_time;
 
 #ifdef CONFIG_SYSCTL
-extern void atalk_register_sysctl(void);
+extern int atalk_register_sysctl(void);
 extern void atalk_unregister_sysctl(void);
 #else
-#define atalk_register_sysctl()                do { } while(0)
-#define atalk_unregister_sysctl()      do { } while(0)
+static inline int atalk_register_sysctl(void)
+{
+       return 0;
+}
+static inline void atalk_unregister_sysctl(void)
+{
+}
 #endif
 
 #ifdef CONFIG_PROC_FS
 extern int atalk_proc_init(void);
 extern void atalk_proc_exit(void);
 #else
-#define atalk_proc_init()      ({ 0; })
-#define atalk_proc_exit()      do { } while(0)
+static inline int atalk_proc_init(void)
+{
+       return 0;
+}
+static inline void atalk_proc_exit(void)
+{
+}
 #endif /* CONFIG_PROC_FS */
 
 #endif /* __LINUX_ATALK_H__ */
diff --git a/include/linux/kprobes.h b/include/linux/kprobes.h
index 8c0ff78ff45a..83fac3e091c2 100644
--- a/include/linux/kprobes.h
+++ b/include/linux/kprobes.h
@@ -197,6 +197,7 @@ struct kretprobe_instance {
        struct kretprobe *rp;
        kprobe_opcode_t *ret_addr;
        struct task_struct *task;
+       void *fp;
        char data[0];
 };
 
diff --git a/include/linux/ring_buffer.h b/include/linux/ring_buffer.h
index 4daa5069cbdb..561f79803c13 100644
--- a/include/linux/ring_buffer.h
+++ b/include/linux/ring_buffer.h
@@ -125,7 +125,7 @@ ring_buffer_consume(struct ring_buffer *buffer, int cpu, 
u64 *ts,
                    unsigned long *lost_events);
 
 struct ring_buffer_iter *
-ring_buffer_read_prepare(struct ring_buffer *buffer, int cpu);
+ring_buffer_read_prepare(struct ring_buffer *buffer, int cpu, gfp_t flags);
 void ring_buffer_read_prepare_sync(void);
 void ring_buffer_read_start(struct ring_buffer_iter *iter);
 void ring_buffer_read_finish(struct ring_buffer_iter *iter);
diff --git a/include/linux/string.h b/include/linux/string.h
index b29098d154c3..8d904d8eb978 100644
--- a/include/linux/string.h
+++ b/include/linux/string.h
@@ -26,7 +26,7 @@ extern char * strncpy(char *,const char *, __kernel_size_t);
 size_t strlcpy(char *, const char *, size_t);
 #endif
 #ifndef __HAVE_ARCH_STRSCPY
-ssize_t __must_check strscpy(char *, const char *, size_t);
+ssize_t strscpy(char *, const char *, size_t);
 #endif
 #ifndef __HAVE_ARCH_STRCAT
 extern char * strcat(char *, const char *);
@@ -113,6 +113,9 @@ extern void * memscan(void *,int,__kernel_size_t);
 #ifndef __HAVE_ARCH_MEMCMP
 extern int memcmp(const void *,const void *,__kernel_size_t);
 #endif
+#ifndef __HAVE_ARCH_BCMP
+extern int bcmp(const void *,const void *,__kernel_size_t);
+#endif
 #ifndef __HAVE_ARCH_MEMCHR
 extern void * memchr(const void *,int,__kernel_size_t);
 #endif
diff --git a/include/linux/swap.h b/include/linux/swap.h
index 1dc0e886227d..054cddb52482 100644
--- a/include/linux/swap.h
+++ b/include/linux/swap.h
@@ -143,9 +143,9 @@ struct swap_extent {
 /*
  * Max bad pages in the new format..
  */
-#define __swapoffset(x) ((unsigned long)&((union swap_header *)0)->x)
 #define MAX_SWAP_BADPAGES \
-       ((__swapoffset(magic.magic) - __swapoffset(info.badpages)) / 
sizeof(int))
+       ((offsetof(union swap_header, magic.magic) - \
+         offsetof(union swap_header, info.badpages)) / sizeof(int))
 
 enum {
        SWP_USED        = (1 << 0),     /* is slot in swap_info[] used? */
diff --git a/include/net/net_namespace.h b/include/net/net_namespace.h
index 7c9518bf0453..209d33a0f752 100644
--- a/include/net/net_namespace.h
+++ b/include/net/net_namespace.h
@@ -54,6 +54,8 @@ struct net {
 #endif
        spinlock_t              rules_mod_lock;
 
+       u32                     hash_mix;
+
        struct list_head        list;           /* list of network namespaces */
        struct list_head        cleanup_list;   /* namespaces on death row */
        struct list_head        exit_list;      /* Use only net_mutex */
diff --git a/include/net/netns/hash.h b/include/net/netns/hash.h
index c06ac58ca107..31441b7f5799 100644
--- a/include/net/netns/hash.h
+++ b/include/net/netns/hash.h
@@ -1,21 +1,10 @@
 #ifndef __NET_NS_HASH_H__
 #define __NET_NS_HASH_H__
 
-#include <asm/cache.h>
-
-struct net;
+#include <net/net_namespace.h>
 
 static inline unsigned int net_hash_mix(struct net *net)
 {
-#ifdef CONFIG_NET_NS
-       /*
-        * shift this right to eliminate bits, that are
-        * always zeroed
-        */
-
-       return (unsigned)(((unsigned long)net) >> L1_CACHE_SHIFT);
-#else
-       return 0;
-#endif
+       return net->hash_mix;
 }
 #endif
diff --git a/kernel/events/core.c b/kernel/events/core.c
index fd8dea2b36ec..41d83a9aacaf 100644
--- a/kernel/events/core.c
+++ b/kernel/events/core.c
@@ -5533,6 +5533,7 @@ static void perf_event_mmap_output(struct perf_event 
*event,
        struct perf_output_handle handle;
        struct perf_sample_data sample;
        int size = mmap_event->event_id.header.size;
+       u32 type = mmap_event->event_id.header.type;
        int ret;
 
        if (!perf_event_mmap_match(event, data))
@@ -5576,6 +5577,7 @@ static void perf_event_mmap_output(struct perf_event 
*event,
        perf_output_end(&handle);
 out:
        mmap_event->event_id.header.size = size;
+       mmap_event->event_id.header.type = type;
 }
 
 static void perf_event_mmap_event(struct perf_mmap_event *mmap_event)
diff --git a/kernel/kprobes.c b/kernel/kprobes.c
index 6f315921eeaf..d3e0e5f9b9e2 100644
--- a/kernel/kprobes.c
+++ b/kernel/kprobes.c
@@ -668,7 +668,6 @@ static void unoptimize_kprobe(struct kprobe *p, bool force)
 static int reuse_unused_kprobe(struct kprobe *ap)
 {
        struct optimized_kprobe *op;
-       int ret;
 
        BUG_ON(!kprobe_unused(ap));
        /*
@@ -682,9 +681,8 @@ static int reuse_unused_kprobe(struct kprobe *ap)
        /* Enable the probe again */
        ap->flags &= ~KPROBE_FLAG_DISABLED;
        /* Optimize it again (remove from op->list) */
-       ret = kprobe_optready(ap);
-       if (ret)
-               return ret;
+       if (!kprobe_optready(ap))
+               return -EINVAL;
 
        optimize_kprobe(ap);
        return 0;
diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c
index 1874245abfb6..9020fbe8d785 100644
--- a/kernel/sched/fair.c
+++ b/kernel/sched/fair.c
@@ -3771,6 +3771,8 @@ static enum hrtimer_restart sched_cfs_slack_timer(struct 
hrtimer *timer)
        return HRTIMER_NORESTART;
 }
 
+extern const u64 max_cfs_quota_period;
+
 static enum hrtimer_restart sched_cfs_period_timer(struct hrtimer *timer)
 {
        struct cfs_bandwidth *cfs_b =
@@ -3778,6 +3780,7 @@ static enum hrtimer_restart sched_cfs_period_timer(struct 
hrtimer *timer)
        ktime_t now;
        int overrun;
        int idle = 0;
+       int count = 0;
 
        raw_spin_lock(&cfs_b->lock);
        for (;;) {
@@ -3787,6 +3790,28 @@ static enum hrtimer_restart 
sched_cfs_period_timer(struct hrtimer *timer)
                if (!overrun)
                        break;
 
+               if (++count > 3) {
+                       u64 new, old = ktime_to_ns(cfs_b->period);
+
+                       new = (old * 147) / 128; /* ~115% */
+                       new = min(new, max_cfs_quota_period);
+
+                       cfs_b->period = ns_to_ktime(new);
+
+                       /* since max is 1s, this is limited to 1e9^2, which 
fits in u64 */
+                       cfs_b->quota *= new;
+                       cfs_b->quota = div64_u64(cfs_b->quota, old);
+
+                       pr_warn_ratelimited(
+        "cfs_period_timer[cpu%d]: period too short, scaling up (new 
cfs_period_us %lld, cfs_quota_us = %lld)\n",
+                               smp_processor_id(),
+                               div_u64(new, NSEC_PER_USEC),
+                                div_u64(cfs_b->quota, NSEC_PER_USEC));
+
+                       /* reset count so we don't come right back in here */
+                       count = 0;
+               }
+
                idle = do_sched_cfs_period_timer(cfs_b, overrun);
        }
        raw_spin_unlock(&cfs_b->lock);
@@ -5617,10 +5642,10 @@ static void update_cfs_rq_h_load(struct cfs_rq *cfs_rq)
        if (cfs_rq->last_h_load_update == now)
                return;
 
-       cfs_rq->h_load_next = NULL;
+       WRITE_ONCE(cfs_rq->h_load_next, NULL);
        for_each_sched_entity(se) {
                cfs_rq = cfs_rq_of(se);
-               cfs_rq->h_load_next = se;
+               WRITE_ONCE(cfs_rq->h_load_next, se);
                if (cfs_rq->last_h_load_update == now)
                        break;
        }
@@ -5630,7 +5655,7 @@ static void update_cfs_rq_h_load(struct cfs_rq *cfs_rq)
                cfs_rq->last_h_load_update = now;
        }
 
-       while ((se = cfs_rq->h_load_next) != NULL) {
+       while ((se = READ_ONCE(cfs_rq->h_load_next)) != NULL) {
                load = cfs_rq->h_load;
                load = div64_ul(load * se->avg.load_avg_contrib,
                                cfs_rq->runnable_load_avg + 1);
diff --git a/kernel/sysctl.c b/kernel/sysctl.c
index 27f8aa765493..6b7e80ab9178 100644
--- a/kernel/sysctl.c
+++ b/kernel/sysctl.c
@@ -124,7 +124,9 @@ static int zero;
 static int __maybe_unused one = 1;
 static int __maybe_unused two = 2;
 static int __maybe_unused four = 4;
+static unsigned long zero_ul;
 static unsigned long one_ul = 1;
+static unsigned long long_max = LONG_MAX;
 static int one_hundred = 100;
 #ifdef CONFIG_PRINTK
 static int ten_thousand = 10000;
@@ -1521,6 +1523,8 @@ static struct ctl_table fs_table[] = {
                .maxlen         = sizeof(files_stat.max_files),
                .mode           = 0644,
                .proc_handler   = proc_doulongvec_minmax,
+               .extra1         = &zero_ul,
+               .extra2         = &long_max,
        },
        {
                .procname       = "nr_open",
diff --git a/kernel/trace/ring_buffer.c b/kernel/trace/ring_buffer.c
index d2b609412c3a..173ff025ea75 100644
--- a/kernel/trace/ring_buffer.c
+++ b/kernel/trace/ring_buffer.c
@@ -4039,6 +4039,7 @@ EXPORT_SYMBOL_GPL(ring_buffer_consume);
  * ring_buffer_read_prepare - Prepare for a non consuming read of the buffer
  * @buffer: The ring buffer to read from
  * @cpu: The cpu buffer to iterate over
+ * @flags: gfp flags to use for memory allocation
  *
  * This performs the initial preparations necessary to iterate
  * through the buffer.  Memory is allocated, buffer recording
@@ -4056,7 +4057,7 @@ EXPORT_SYMBOL_GPL(ring_buffer_consume);
  * This overall must be paired with ring_buffer_read_finish.
  */
 struct ring_buffer_iter *
-ring_buffer_read_prepare(struct ring_buffer *buffer, int cpu)
+ring_buffer_read_prepare(struct ring_buffer *buffer, int cpu, gfp_t flags)
 {
        struct ring_buffer_per_cpu *cpu_buffer;
        struct ring_buffer_iter *iter;
@@ -4064,7 +4065,7 @@ ring_buffer_read_prepare(struct ring_buffer *buffer, int 
cpu)
        if (!cpumask_test_cpu(cpu, buffer->cpumask))
                return NULL;
 
-       iter = kmalloc(sizeof(*iter), GFP_KERNEL);
+       iter = kmalloc(sizeof(*iter), flags);
        if (!iter)
                return NULL;
 
diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c
index 69af9a1b1031..934c1a1813dd 100644
--- a/kernel/trace/trace.c
+++ b/kernel/trace/trace.c
@@ -3047,7 +3047,8 @@ __tracing_open(struct inode *inode, struct file *file, 
bool snapshot)
        if (iter->cpu_file == RING_BUFFER_ALL_CPUS) {
                for_each_tracing_cpu(cpu) {
                        iter->buffer_iter[cpu] =
-                               
ring_buffer_read_prepare(iter->trace_buffer->buffer, cpu);
+                               
ring_buffer_read_prepare(iter->trace_buffer->buffer,
+                                                        cpu, GFP_KERNEL);
                }
                ring_buffer_read_prepare_sync();
                for_each_tracing_cpu(cpu) {
@@ -3057,7 +3058,8 @@ __tracing_open(struct inode *inode, struct file *file, 
bool snapshot)
        } else {
                cpu = iter->cpu_file;
                iter->buffer_iter[cpu] =
-                       ring_buffer_read_prepare(iter->trace_buffer->buffer, 
cpu);
+                       ring_buffer_read_prepare(iter->trace_buffer->buffer,
+                                                cpu, GFP_KERNEL);
                ring_buffer_read_prepare_sync();
                ring_buffer_read_start(iter->buffer_iter[cpu]);
                tracing_iter_reset(iter, cpu);
diff --git a/kernel/trace/trace_kdb.c b/kernel/trace/trace_kdb.c
index bd90e1b06088..ebbf28492573 100644
--- a/kernel/trace/trace_kdb.c
+++ b/kernel/trace/trace_kdb.c
@@ -46,14 +46,16 @@ static void ftrace_dump_buf(int skip_lines, long cpu_file)
        if (cpu_file == RING_BUFFER_ALL_CPUS) {
                for_each_tracing_cpu(cpu) {
                        iter.buffer_iter[cpu] =
-                       ring_buffer_read_prepare(iter.trace_buffer->buffer, 
cpu);
+                       ring_buffer_read_prepare(iter.trace_buffer->buffer,
+                                                cpu, GFP_ATOMIC);
                        ring_buffer_read_start(iter.buffer_iter[cpu]);
                        tracing_iter_reset(&iter, cpu);
                }
        } else {
                iter.cpu_file = cpu_file;
                iter.buffer_iter[cpu_file] =
-                       ring_buffer_read_prepare(iter.trace_buffer->buffer, 
cpu_file);
+                       ring_buffer_read_prepare(iter.trace_buffer->buffer,
+                                                cpu_file, GFP_ATOMIC);
                ring_buffer_read_start(iter.buffer_iter[cpu_file]);
                tracing_iter_reset(&iter, cpu_file);
        }
diff --git a/lib/bsearch.c b/lib/bsearch.c
index e33c179089db..d50048446b77 100644
--- a/lib/bsearch.c
+++ b/lib/bsearch.c
@@ -11,6 +11,7 @@
 
 #include <linux/export.h>
 #include <linux/bsearch.h>
+#include <linux/kprobes.h>
 
 /*
  * bsearch - binary search an array of elements
@@ -51,3 +52,4 @@ void *bsearch(const void *key, const void *base, size_t num, 
size_t size,
        return NULL;
 }
 EXPORT_SYMBOL(bsearch);
+NOKPROBE_SYMBOL(bsearch);
diff --git a/lib/div64.c b/lib/div64.c
index 4382ad77777e..ce76dc3d674e 100644
--- a/lib/div64.c
+++ b/lib/div64.c
@@ -100,7 +100,7 @@ u64 div64_u64_rem(u64 dividend, u64 divisor, u64 *remainder)
                quot = div_u64_rem(dividend, divisor, &rem32);
                *remainder = rem32;
        } else {
-               int n = 1 + fls(high);
+               int n = fls(high);
                quot = div_u64(dividend >> n, divisor >> n);
 
                if (quot != 0)
@@ -138,7 +138,7 @@ u64 div64_u64(u64 dividend, u64 divisor)
        if (high == 0) {
                quot = div_u64(dividend, divisor);
        } else {
-               int n = 1 + fls(high);
+               int n = fls(high);
                quot = div_u64(dividend >> n, divisor >> n);
 
                if (quot != 0)
diff --git a/lib/raid6/Makefile b/lib/raid6/Makefile
index c7dab0645554..1c3330dc5eab 100644
--- a/lib/raid6/Makefile
+++ b/lib/raid6/Makefile
@@ -23,7 +23,7 @@ endif
 ifeq ($(CONFIG_KERNEL_MODE_NEON),y)
 NEON_FLAGS := -ffreestanding
 ifeq ($(ARCH),arm)
-NEON_FLAGS += -mfloat-abi=softfp -mfpu=neon
+NEON_FLAGS += -march=armv7-a -mfloat-abi=softfp -mfpu=neon
 endif
 ifeq ($(ARCH),arm64)
 CFLAGS_REMOVE_neon1.o += -mgeneral-regs-only
diff --git a/lib/string.c b/lib/string.c
index de4bf3778958..63be6c2d4551 100644
--- a/lib/string.c
+++ b/lib/string.c
@@ -778,6 +778,26 @@ __visible int memcmp(const void *cs, const void *ct, 
size_t count)
 EXPORT_SYMBOL(memcmp);
 #endif
 
+#ifndef __HAVE_ARCH_BCMP
+/**
+ * bcmp - returns 0 if and only if the buffers have identical contents.
+ * @a: pointer to first buffer.
+ * @b: pointer to second buffer.
+ * @len: size of buffers.
+ *
+ * The sign or magnitude of a non-zero return value has no particular
+ * meaning, and architectures may implement their own more efficient bcmp(). So
+ * while this particular implementation is a simple (tail) call to memcmp, do
+ * not rely on anything but whether the return value is zero or non-zero.
+ */
+#undef bcmp
+int bcmp(const void *a, const void *b, size_t len)
+{
+       return memcmp(a, b, len);
+}
+EXPORT_SYMBOL(bcmp);
+#endif
+
 #ifndef __HAVE_ARCH_MEMSCAN
 /**
  * memscan - Find a character in an area of memory.
diff --git a/mm/cma.c b/mm/cma.c
index 7d266e393c44..1f4a7e076a5c 100644
--- a/mm/cma.c
+++ b/mm/cma.c
@@ -340,12 +340,14 @@ int __init cma_declare_contiguous(phys_addr_t base,
 
        ret = cma_init_reserved_mem(base, size, order_per_bit, res_cma);
        if (ret)
-               goto err;
+               goto free_mem;
 
        pr_info("Reserved %ld MiB at %pa\n", (unsigned long)size / SZ_1M,
                &base);
        return 0;
 
+free_mem:
+       memblock_free(base, size);
 err:
        pr_err("Failed to reserve %ld MiB\n", (unsigned long)size / SZ_1M);
        return ret;
diff --git a/mm/slab.c b/mm/slab.c
index 208b24a4d423..f29925d7a52e 100644
--- a/mm/slab.c
+++ b/mm/slab.c
@@ -659,14 +659,6 @@ static void start_cpu_timer(int cpu)
 
 static void init_arraycache(struct array_cache *ac, int limit, int batch)
 {
-       /*
-        * The array_cache structures contain pointers to free object.
-        * However, when such objects are allocated or transferred to another
-        * cache the pointers are not cleared and they could be counted as
-        * valid references during a kmemleak scan. Therefore, kmemleak must
-        * not scan such objects.
-        */
-       kmemleak_no_scan(ac);
        if (ac) {
                ac->avail = 0;
                ac->limit = limit;
@@ -682,6 +674,14 @@ static struct array_cache *alloc_arraycache(int node, int 
entries,
        struct array_cache *ac = NULL;
 
        ac = kmalloc_node(memsize, gfp, node);
+       /*
+        * The array_cache structures contain pointers to free object.
+        * However, when such objects are allocated or transferred to another
+        * cache the pointers are not cleared and they could be counted as
+        * valid references during a kmemleak scan. Therefore, kmemleak must
+        * not scan such objects.
+        */
+       kmemleak_no_scan(ac);
        init_arraycache(ac, entries, batchcount);
        return ac;
 }
@@ -870,6 +870,7 @@ static struct alien_cache *__alloc_alien_cache(int node, 
int entries,
 
        alc = kmalloc_node(memsize, gfp, node);
        if (alc) {
+               kmemleak_no_scan(alc);
                init_arraycache(&alc->ac, entries, batch);
                spin_lock_init(&alc->lock);
        }
diff --git a/mm/vmalloc.c b/mm/vmalloc.c
index 33920fc41d6b..fbb00e0d4c56 100644
--- a/mm/vmalloc.c
+++ b/mm/vmalloc.c
@@ -439,7 +439,11 @@ nocache:
        }
 
 found:
-       if (addr + size > vend)
+       /*
+        * Check also calculated address against the vstart,
+        * because it can be 0 because of big align request.
+        */
+       if (addr + size > vend || addr < vstart)
                goto overflow;
 
        va->va_start = addr;
diff --git a/net/9p/protocol.c b/net/9p/protocol.c
index bceb6999614f..66613837b287 100644
--- a/net/9p/protocol.c
+++ b/net/9p/protocol.c
@@ -578,9 +578,10 @@ int p9stat_read(struct p9_client *clnt, char *buf, int 
len, struct p9_wstat *st)
        if (ret) {
                p9_debug(P9_DEBUG_9P, "<<< p9stat_read failed: %d\n", ret);
                trace_9p_protocol_dump(clnt, &fake_pdu);
+               return ret;
        }
 
-       return ret;
+       return fake_pdu.offset;
 }
 EXPORT_SYMBOL(p9stat_read);
 
diff --git a/net/appletalk/atalk_proc.c b/net/appletalk/atalk_proc.c
index af46bc49e1e9..b5f84f428aa6 100644
--- a/net/appletalk/atalk_proc.c
+++ b/net/appletalk/atalk_proc.c
@@ -293,7 +293,7 @@ out_interface:
        goto out;
 }
 
-void __exit atalk_proc_exit(void)
+void atalk_proc_exit(void)
 {
        remove_proc_entry("interface", atalk_proc_dir);
        remove_proc_entry("route", atalk_proc_dir);
diff --git a/net/appletalk/ddp.c b/net/appletalk/ddp.c
index c00897f65a31..276a09d7c537 100644
--- a/net/appletalk/ddp.c
+++ b/net/appletalk/ddp.c
@@ -1913,12 +1913,16 @@ static const char atalk_err_snap[] __initconst =
 /* Called by proto.c on kernel start up */
 static int __init atalk_init(void)
 {
-       int rc = proto_register(&ddp_proto, 0);
+       int rc;
 
-       if (rc != 0)
+       rc = proto_register(&ddp_proto, 0);
+       if (rc)
                goto out;
 
-       (void)sock_register(&atalk_family_ops);
+       rc = sock_register(&atalk_family_ops);
+       if (rc)
+               goto out_proto;
+
        ddp_dl = register_snap_client(ddp_snap_id, atalk_rcv);
        if (!ddp_dl)
                printk(atalk_err_snap);
@@ -1926,12 +1930,33 @@ static int __init atalk_init(void)
        dev_add_pack(&ltalk_packet_type);
        dev_add_pack(&ppptalk_packet_type);
 
-       register_netdevice_notifier(&ddp_notifier);
+       rc = register_netdevice_notifier(&ddp_notifier);
+       if (rc)
+               goto out_sock;
+
        aarp_proto_init();
-       atalk_proc_init();
-       atalk_register_sysctl();
+       rc = atalk_proc_init();
+       if (rc)
+               goto out_aarp;
+
+       rc = atalk_register_sysctl();
+       if (rc)
+               goto out_proc;
 out:
        return rc;
+out_proc:
+       atalk_proc_exit();
+out_aarp:
+       aarp_cleanup_module();
+       unregister_netdevice_notifier(&ddp_notifier);
+out_sock:
+       dev_remove_pack(&ppptalk_packet_type);
+       dev_remove_pack(&ltalk_packet_type);
+       unregister_snap_client(ddp_dl);
+       sock_unregister(PF_APPLETALK);
+out_proto:
+       proto_unregister(&ddp_proto);
+       goto out;
 }
 module_init(atalk_init);
 
diff --git a/net/appletalk/sysctl_net_atalk.c b/net/appletalk/sysctl_net_atalk.c
index ebb864361f7a..4e6042e0fcac 100644
--- a/net/appletalk/sysctl_net_atalk.c
+++ b/net/appletalk/sysctl_net_atalk.c
@@ -44,9 +44,12 @@ static struct ctl_table atalk_table[] = {
 
 static struct ctl_table_header *atalk_table_header;
 
-void atalk_register_sysctl(void)
+int __init atalk_register_sysctl(void)
 {
        atalk_table_header = register_net_sysctl(&init_net, "net/appletalk", 
atalk_table);
+       if (!atalk_table_header)
+               return -ENOMEM;
+       return 0;
 }
 
 void atalk_unregister_sysctl(void)
diff --git a/net/bridge/br_multicast.c b/net/bridge/br_multicast.c
index c08f510fce30..75bfe05ca473 100644
--- a/net/bridge/br_multicast.c
+++ b/net/bridge/br_multicast.c
@@ -2023,7 +2023,8 @@ static void br_multicast_start_querier(struct net_bridge 
*br,
 
        __br_multicast_open(br, query);
 
-       list_for_each_entry(port, &br->port_list, list) {
+       rcu_read_lock();
+       list_for_each_entry_rcu(port, &br->port_list, list) {
                if (port->state == BR_STATE_DISABLED ||
                    port->state == BR_STATE_BLOCKING)
                        continue;
@@ -2035,6 +2036,7 @@ static void br_multicast_start_querier(struct net_bridge 
*br,
                        br_multicast_enable(&port->ip6_own_query);
 #endif
        }
+       rcu_read_unlock();
 }
 
 int br_multicast_toggle(struct net_bridge *br, unsigned long val)
diff --git a/net/core/ethtool.c b/net/core/ethtool.c
index 14bb1583947e..2a467d653bbe 100644
--- a/net/core/ethtool.c
+++ b/net/core/ethtool.c
@@ -1257,17 +1257,22 @@ static int ethtool_get_strings(struct net_device *dev, 
void __user *useraddr)
 
        gstrings.len = ret;
 
-       data = kcalloc(gstrings.len, ETH_GSTRING_LEN, GFP_USER);
-       if (!data)
-               return -ENOMEM;
+       if (gstrings.len) {
+               data = kcalloc(gstrings.len, ETH_GSTRING_LEN, GFP_USER);
+               if (!data)
+                       return -ENOMEM;
 
-       __ethtool_get_strings(dev, gstrings.string_set, data);
+               __ethtool_get_strings(dev, gstrings.string_set, data);
+       } else {
+               data = NULL;
+       }
 
        ret = -EFAULT;
        if (copy_to_user(useraddr, &gstrings, sizeof(gstrings)))
                goto out;
        useraddr += sizeof(gstrings);
-       if (copy_to_user(useraddr, data, gstrings.len * ETH_GSTRING_LEN))
+       if (gstrings.len &&
+           copy_to_user(useraddr, data, gstrings.len * ETH_GSTRING_LEN))
                goto out;
        ret = 0;
 
@@ -1355,17 +1360,21 @@ static int ethtool_get_stats(struct net_device *dev, 
void __user *useraddr)
                return -EFAULT;
 
        stats.n_stats = n_stats;
-       data = kmalloc(n_stats * sizeof(u64), GFP_USER);
-       if (!data)
-               return -ENOMEM;
+       if (n_stats) {
+               data = kmalloc(n_stats * sizeof(u64), GFP_USER);
+               if (!data)
+                       return -ENOMEM;
 
-       ops->get_ethtool_stats(dev, &stats, data);
+               ops->get_ethtool_stats(dev, &stats, data);
+       } else {
+               data = NULL;
+       }
 
        ret = -EFAULT;
        if (copy_to_user(useraddr, &stats, sizeof(stats)))
                goto out;
        useraddr += sizeof(stats);
-       if (copy_to_user(useraddr, data, stats.n_stats * sizeof(u64)))
+       if (n_stats && copy_to_user(useraddr, data, n_stats * sizeof(u64)))
                goto out;
        ret = 0;
 
diff --git a/net/core/net_namespace.c b/net/core/net_namespace.c
index a81693f9753c..3f55c2bcadad 100644
--- a/net/core/net_namespace.c
+++ b/net/core/net_namespace.c
@@ -156,6 +156,7 @@ static __net_init int setup_net(struct net *net, struct 
user_namespace *user_ns)
 
        atomic_set(&net->count, 1);
        atomic_set(&net->passive, 1);
+       get_random_bytes(&net->hash_mix, sizeof(u32));
        net->dev_base_seq = 1;
        net->user_ns = user_ns;
 
diff --git a/net/ipv4/route.c b/net/ipv4/route.c
index ede610a4abc8..b53385c18dce 100644
--- a/net/ipv4/route.c
+++ b/net/ipv4/route.c
@@ -488,13 +488,15 @@ EXPORT_SYMBOL(ip_idents_reserve);
 void __ip_select_ident(struct iphdr *iph, int segs)
 {
        static u32 ip_idents_hashrnd __read_mostly;
+       static u32 ip_idents_hashrnd_extra __read_mostly;
        u32 hash, id;
 
        net_get_random_once(&ip_idents_hashrnd, sizeof(ip_idents_hashrnd));
+       net_get_random_once(&ip_idents_hashrnd_extra, 
sizeof(ip_idents_hashrnd_extra));
 
        hash = jhash_3words((__force u32)iph->daddr,
                            (__force u32)iph->saddr,
-                           iph->protocol,
+                           iph->protocol ^ ip_idents_hashrnd_extra,
                            ip_idents_hashrnd);
        id = ip_idents_reserve(hash, segs);
        iph->id = htons(id);
@@ -1148,9 +1150,23 @@ static struct dst_entry *ipv4_dst_check(struct dst_entry 
*dst, u32 cookie)
 
 static void ipv4_link_failure(struct sk_buff *skb)
 {
+       struct ip_options opt;
        struct rtable *rt;
+       int res;
+
+       /* Recompile ip options since IPCB may not be valid anymore.
+        */
+       memset(&opt, 0, sizeof(opt));
+       opt.optlen = ip_hdr(skb)->ihl*4 - sizeof(struct iphdr);
+
+       rcu_read_lock();
+       res = __ip_options_compile(dev_net(skb->dev), &opt, skb, NULL);
+       rcu_read_unlock();
+
+       if (res)
+               return;
 
-       icmp_send(skb, ICMP_DEST_UNREACH, ICMP_HOST_UNREACH, 0);
+       __icmp_send(skb, ICMP_DEST_UNREACH, ICMP_HOST_UNREACH, 0, &opt);
 
        rt = skb_rtable(skb);
        if (rt)
diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
index f8364cfd2cdb..39b7cb5d4d9a 100644
--- a/net/ipv4/tcp_input.c
+++ b/net/ipv4/tcp_input.c
@@ -358,11 +358,12 @@ static int __tcp_grow_window(const struct sock *sk, const 
struct sk_buff *skb)
 static void tcp_grow_window(struct sock *sk, const struct sk_buff *skb)
 {
        struct tcp_sock *tp = tcp_sk(sk);
+       int room;
+
+       room = min_t(int, tp->window_clamp, tcp_space(sk)) - tp->rcv_ssthresh;
 
        /* Check #1 */
-       if (tp->rcv_ssthresh < tp->window_clamp &&
-           (int)tp->rcv_ssthresh < tcp_space(sk) &&
-           !sk_under_memory_pressure(sk)) {
+       if (room > 0 && !sk_under_memory_pressure(sk)) {
                int incr;
 
                /* Check #2. Increase window, if skb with such overhead
@@ -375,8 +376,7 @@ static void tcp_grow_window(struct sock *sk, const struct 
sk_buff *skb)
 
                if (incr) {
                        incr = max_t(int, incr, 2 * skb->len);
-                       tp->rcv_ssthresh = min(tp->rcv_ssthresh + incr,
-                                              tp->window_clamp);
+                       tp->rcv_ssthresh += min(room, incr);
                        inet_csk(sk)->icsk_ack.quick |= 1;
                }
        }
diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c
index 2b69a4b965ed..c3cef2d5c020 100644
--- a/net/ipv6/ip6_output.c
+++ b/net/ipv6/ip6_output.c
@@ -546,12 +546,15 @@ static void ip6_copy_metadata(struct sk_buff *to, struct 
sk_buff *from)
 static void ipv6_select_ident(struct frag_hdr *fhdr, struct rt6_info *rt)
 {
        static u32 ip6_idents_hashrnd __read_mostly;
+       static u32 ip6_idents_hashrnd_extra __read_mostly;
        u32 hash, id;
 
        net_get_random_once(&ip6_idents_hashrnd, sizeof(ip6_idents_hashrnd));
+       net_get_random_once(&ip6_idents_hashrnd_extra, 
sizeof(ip6_idents_hashrnd_extra));
 
        hash = __ipv6_addr_jhash(&rt->rt6i_dst.addr, ip6_idents_hashrnd);
        hash = __ipv6_addr_jhash(&rt->rt6i_src.addr, hash);
+       hash = jhash_1word(hash, ip6_idents_hashrnd_extra);
 
        id = ip_idents_reserve(hash, 1);
        fhdr->identification = htonl(id);
diff --git a/net/ipv6/ip6_tunnel.c b/net/ipv6/ip6_tunnel.c
index cc827e2d83e1..e7e97c13671a 100644
--- a/net/ipv6/ip6_tunnel.c
+++ b/net/ipv6/ip6_tunnel.c
@@ -638,7 +638,7 @@ ip4ip6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
                                           IPPROTO_IPIP,
                                           RT_TOS(eiph->tos), 0);
                if (IS_ERR(rt) ||
-                   rt->dst.dev->type != ARPHRD_TUNNEL) {
+                   rt->dst.dev->type != ARPHRD_TUNNEL6) {
                        if (!IS_ERR(rt))
                                ip_rt_put(rt);
                        goto out;
@@ -648,7 +648,7 @@ ip4ip6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
                ip_rt_put(rt);
                if (ip_route_input(skb2, eiph->daddr, eiph->saddr, eiph->tos,
                                   skb2->dev) ||
-                   skb_dst(skb2)->dev->type != ARPHRD_TUNNEL)
+                   skb_dst(skb2)->dev->type != ARPHRD_TUNNEL6)
                        goto out;
        }
 
diff --git a/net/openvswitch/flow_netlink.c b/net/openvswitch/flow_netlink.c
index b5133dc56466..a49d92d0eb91 100644
--- a/net/openvswitch/flow_netlink.c
+++ b/net/openvswitch/flow_netlink.c
@@ -1261,14 +1261,14 @@ static struct nlattr *reserve_sfa_size(struct 
sw_flow_actions **sfa,
 
        struct sw_flow_actions *acts;
        int new_acts_size;
-       int req_size = NLA_ALIGN(attr_len);
+       size_t req_size = NLA_ALIGN(attr_len);
        int next_offset = offsetof(struct sw_flow_actions, actions) +
                                        (*sfa)->actions_len;
 
        if (req_size <= (ksize(*sfa) - next_offset))
                goto out;
 
-       new_acts_size = ksize(*sfa) * 2;
+       new_acts_size = max(next_offset + req_size, ksize(*sfa) * 2);
 
        if (new_acts_size > MAX_ACTIONS_BUFSIZE) {
                if ((MAX_ACTIONS_BUFSIZE - next_offset) < req_size)
diff --git a/net/sctp/protocol.c b/net/sctp/protocol.c
index 79c1a65bb636..8146c09f0ed6 100644
--- a/net/sctp/protocol.c
+++ b/net/sctp/protocol.c
@@ -578,6 +578,7 @@ out:
 static int sctp_v4_addr_to_user(struct sctp_sock *sp, union sctp_addr *addr)
 {
        /* No address mapping for V4 sockets */
+       memset(addr->v4.sin_zero, 0, sizeof(addr->v4.sin_zero));
        return sizeof(struct sockaddr_in);
 }
 
diff --git a/security/device_cgroup.c b/security/device_cgroup.c
index 188c1d26393b..dc071be564f9 100644
--- a/security/device_cgroup.c
+++ b/security/device_cgroup.c
@@ -568,7 +568,7 @@ static int propagate_exception(struct dev_cgroup 
*devcg_root,
                    devcg->behavior == DEVCG_DEFAULT_ALLOW) {
                        rc = dev_exception_add(devcg, ex);
                        if (rc)
-                               break;
+                               return rc;
                } else {
                        /*
                         * in the other possible cases:
diff --git a/sound/core/init.c b/sound/core/init.c
index 7bdfd19e24a8..e0d04b91d561 100644
--- a/sound/core/init.c
+++ b/sound/core/init.c
@@ -389,14 +389,7 @@ int snd_card_disconnect(struct snd_card *card)
        card->shutdown = 1;
        spin_unlock(&card->files_lock);
 
-       /* phase 1: disable fops (user space) operations for ALSA API */
-       mutex_lock(&snd_card_mutex);
-       snd_cards[card->number] = NULL;
-       clear_bit(card->number, snd_cards_lock);
-       mutex_unlock(&snd_card_mutex);
-       
-       /* phase 2: replace file->f_op with special dummy operations */
-       
+       /* replace file->f_op with special dummy operations */
        spin_lock(&card->files_lock);
        list_for_each_entry(mfile, &card->files_list, list) {
                /* it's critical part, use endless loop */
@@ -412,7 +405,7 @@ int snd_card_disconnect(struct snd_card *card)
        }
        spin_unlock(&card->files_lock); 
 
-       /* phase 3: notify all connected devices about disconnection */
+       /* notify all connected devices about disconnection */
        /* at this point, they cannot respond to any calls except release() */
 
 #if IS_ENABLED(CONFIG_SND_MIXER_OSS)
@@ -430,6 +423,13 @@ int snd_card_disconnect(struct snd_card *card)
                device_del(&card->card_dev);
                card->registered = false;
        }
+
+       /* disable fops (user space) operations for ALSA API */
+       mutex_lock(&snd_card_mutex);
+       snd_cards[card->number] = NULL;
+       clear_bit(card->number, snd_cards_lock);
+       mutex_unlock(&snd_card_mutex);
+
 #ifdef CONFIG_PM
        wake_up(&card->power_sleep);
 #endif
diff --git a/sound/core/pcm_native.c b/sound/core/pcm_native.c
index a79edb3e8284..29a088e03657 100644
--- a/sound/core/pcm_native.c
+++ b/sound/core/pcm_native.c
@@ -1315,6 +1315,14 @@ int snd_pcm_suspend_all(struct snd_pcm *pcm)
                        /* FIXME: the open/close code should lock this as well 
*/
                        if (substream->runtime == NULL)
                                continue;
+
+                       /*
+                        * Skip BE dai link PCM's that are internal and may
+                        * not have their substream ops set.
+                        */
+                       if (!substream->ops)
+                               continue;
+
                        err = snd_pcm_suspend(substream);
                        if (err < 0 && err != -EBUSY)
                                return err;
diff --git a/sound/core/seq/seq_clientmgr.c b/sound/core/seq/seq_clientmgr.c
index b813ecc6322d..686e577912be 100644
--- a/sound/core/seq/seq_clientmgr.c
+++ b/sound/core/seq/seq_clientmgr.c
@@ -1249,7 +1249,7 @@ static int snd_seq_ioctl_set_client_info(struct 
snd_seq_client *client,
 
        /* fill the info fields */
        if (client_info.name[0])
-               strlcpy(client->name, client_info.name, sizeof(client->name));
+               strscpy(client->name, client_info.name, sizeof(client->name));
 
        client->filter = client_info.filter;
        client->event_lost = client_info.event_lost;
@@ -1564,7 +1564,7 @@ static int snd_seq_ioctl_create_queue(struct 
snd_seq_client *client,
        /* set queue name */
        if (! info.name[0])
                snprintf(info.name, sizeof(info.name), "Queue-%d", q->queue);
-       strlcpy(q->name, info.name, sizeof(q->name));
+       strscpy(q->name, info.name, sizeof(q->name));
        queuefree(q);
 
        if (copy_to_user(arg, &info, sizeof(info)))
@@ -1642,7 +1642,7 @@ static int snd_seq_ioctl_set_queue_info(struct 
snd_seq_client *client,
                queuefree(q);
                return -EPERM;
        }
-       strlcpy(q->name, info.name, sizeof(q->name));
+       strscpy(q->name, info.name, sizeof(q->name));
        queuefree(q);
 
        return 0;
diff --git a/sound/drivers/opl3/opl3_voice.h b/sound/drivers/opl3/opl3_voice.h
index a371c075ac87..e26702559f61 100644
--- a/sound/drivers/opl3/opl3_voice.h
+++ b/sound/drivers/opl3/opl3_voice.h
@@ -41,7 +41,7 @@ void snd_opl3_timer_func(unsigned long data);
 
 /* Prototypes for opl3_drums.c */
 void snd_opl3_load_drums(struct snd_opl3 *opl3);
-void snd_opl3_drum_switch(struct snd_opl3 *opl3, int note, int on_off, int 
vel, struct snd_midi_channel *chan);
+void snd_opl3_drum_switch(struct snd_opl3 *opl3, int note, int vel, int 
on_off, struct snd_midi_channel *chan);
 
 /* Prototypes for opl3_oss.c */
 #ifdef CONFIG_SND_SEQUENCER_OSS
diff --git a/sound/isa/sb/sb8.c b/sound/isa/sb/sb8.c
index 6c32b3aa34af..938262d3aa7b 100644
--- a/sound/isa/sb/sb8.c
+++ b/sound/isa/sb/sb8.c
@@ -111,6 +111,10 @@ static int snd_sb8_probe(struct device *pdev, unsigned int 
dev)
 
        /* block the 0x388 port to avoid PnP conflicts */
        acard->fm_res = request_region(0x388, 4, "SoundBlaster FM");
+       if (!acard->fm_res) {
+               err = -EBUSY;
+               goto _err;
+       }
 
        if (port[dev] != SNDRV_AUTO_PORT) {
                if ((err = snd_sbdsp_create(card, port[dev], irq[dev],
diff --git a/sound/pci/echoaudio/echoaudio.c b/sound/pci/echoaudio/echoaudio.c
index 3a1fe2c79b4a..c07bf03a07bc 100644
--- a/sound/pci/echoaudio/echoaudio.c
+++ b/sound/pci/echoaudio/echoaudio.c
@@ -1990,6 +1990,11 @@ static int snd_echo_create(struct snd_card *card,
        }
        chip->dsp_registers = (volatile u32 __iomem *)
                ioremap_nocache(chip->dsp_registers_phys, sz);
+       if (!chip->dsp_registers) {
+               dev_err(chip->card->dev, "ioremap failed\n");
+               snd_echo_free(chip);
+               return -ENOMEM;
+       }
 
        if (request_irq(pci->irq, snd_echo_interrupt, IRQF_SHARED,
                        KBUILD_MODNAME, chip)) {
diff --git a/sound/soc/fsl/fsl_esai.c b/sound/soc/fsl/fsl_esai.c
index 03c79bb42c87..57ef8c4ade36 100644
--- a/sound/soc/fsl/fsl_esai.c
+++ b/sound/soc/fsl/fsl_esai.c
@@ -57,6 +57,8 @@ struct fsl_esai {
        u32 fifo_depth;
        u32 slot_width;
        u32 slots;
+       u32 tx_mask;
+       u32 rx_mask;
        u32 hck_rate[2];
        u32 sck_rate[2];
        bool hck_dir[2];
@@ -357,21 +359,13 @@ static int fsl_esai_set_dai_tdm_slot(struct snd_soc_dai 
*dai, u32 tx_mask,
        regmap_update_bits(esai_priv->regmap, REG_ESAI_TCCR,
                           ESAI_xCCR_xDC_MASK, ESAI_xCCR_xDC(slots));
 
-       regmap_update_bits(esai_priv->regmap, REG_ESAI_TSMA,
-                          ESAI_xSMA_xS_MASK, ESAI_xSMA_xS(tx_mask));
-       regmap_update_bits(esai_priv->regmap, REG_ESAI_TSMB,
-                          ESAI_xSMB_xS_MASK, ESAI_xSMB_xS(tx_mask));
-
        regmap_update_bits(esai_priv->regmap, REG_ESAI_RCCR,
                           ESAI_xCCR_xDC_MASK, ESAI_xCCR_xDC(slots));
 
-       regmap_update_bits(esai_priv->regmap, REG_ESAI_RSMA,
-                          ESAI_xSMA_xS_MASK, ESAI_xSMA_xS(rx_mask));
-       regmap_update_bits(esai_priv->regmap, REG_ESAI_RSMB,
-                          ESAI_xSMB_xS_MASK, ESAI_xSMB_xS(rx_mask));
-
        esai_priv->slot_width = slot_width;
        esai_priv->slots = slots;
+       esai_priv->tx_mask = tx_mask;
+       esai_priv->rx_mask = rx_mask;
 
        return 0;
 }
@@ -577,6 +571,7 @@ static int fsl_esai_trigger(struct snd_pcm_substream 
*substream, int cmd,
        bool tx = substream->stream == SNDRV_PCM_STREAM_PLAYBACK;
        u8 i, channels = substream->runtime->channels;
        u32 pins = DIV_ROUND_UP(channels, esai_priv->slots);
+       u32 mask;
 
        switch (cmd) {
        case SNDRV_PCM_TRIGGER_START:
@@ -589,15 +584,38 @@ static int fsl_esai_trigger(struct snd_pcm_substream 
*substream, int cmd,
                for (i = 0; tx && i < channels; i++)
                        regmap_write(esai_priv->regmap, REG_ESAI_ETDR, 0x0);
 
+               /*
+                * When set the TE/RE in the end of enablement flow, there
+                * will be channel swap issue for multi data line case.
+                * In order to workaround this issue, we switch the bit
+                * enablement sequence to below sequence
+                * 1) clear the xSMB & xSMA: which is done in probe and
+                *                           stop state.
+                * 2) set TE/RE
+                * 3) set xSMB
+                * 4) set xSMA:  xSMA is the last one in this flow, which
+                *               will trigger esai to start.
+                */
                regmap_update_bits(esai_priv->regmap, REG_ESAI_xCR(tx),
                                   tx ? ESAI_xCR_TE_MASK : ESAI_xCR_RE_MASK,
                                   tx ? ESAI_xCR_TE(pins) : ESAI_xCR_RE(pins));
+               mask = tx ? esai_priv->tx_mask : esai_priv->rx_mask;
+
+               regmap_update_bits(esai_priv->regmap, REG_ESAI_xSMB(tx),
+                                  ESAI_xSMB_xS_MASK, ESAI_xSMB_xS(mask));
+               regmap_update_bits(esai_priv->regmap, REG_ESAI_xSMA(tx),
+                                  ESAI_xSMA_xS_MASK, ESAI_xSMA_xS(mask));
+
                break;
        case SNDRV_PCM_TRIGGER_SUSPEND:
        case SNDRV_PCM_TRIGGER_STOP:
        case SNDRV_PCM_TRIGGER_PAUSE_PUSH:
                regmap_update_bits(esai_priv->regmap, REG_ESAI_xCR(tx),
                                   tx ? ESAI_xCR_TE_MASK : ESAI_xCR_RE_MASK, 0);
+               regmap_update_bits(esai_priv->regmap, REG_ESAI_xSMA(tx),
+                                  ESAI_xSMA_xS_MASK, 0);
+               regmap_update_bits(esai_priv->regmap, REG_ESAI_xSMB(tx),
+                                  ESAI_xSMB_xS_MASK, 0);
 
                /* Disable and reset FIFO */
                regmap_update_bits(esai_priv->regmap, REG_ESAI_xFCR(tx),
@@ -838,6 +856,15 @@ static int fsl_esai_probe(struct platform_device *pdev)
                return ret;
        }
 
+       esai_priv->tx_mask = 0xFFFFFFFF;
+       esai_priv->rx_mask = 0xFFFFFFFF;
+
+       /* Clear the TSMA, TSMB, RSMA, RSMB */
+       regmap_write(esai_priv->regmap, REG_ESAI_TSMA, 0);
+       regmap_write(esai_priv->regmap, REG_ESAI_TSMB, 0);
+       regmap_write(esai_priv->regmap, REG_ESAI_RSMA, 0);
+       regmap_write(esai_priv->regmap, REG_ESAI_RSMB, 0);
+
        ret = devm_snd_soc_register_component(&pdev->dev, &fsl_esai_component,
                                              &fsl_esai_dai, 1);
        if (ret) {
diff --git a/sound/soc/fsl/imx-sgtl5000.c b/sound/soc/fsl/imx-sgtl5000.c
index 1cb22dd034eb..110f3cf361af 100644
--- a/sound/soc/fsl/imx-sgtl5000.c
+++ b/sound/soc/fsl/imx-sgtl5000.c
@@ -115,6 +115,7 @@ static int imx_sgtl5000_probe(struct platform_device *pdev)
                ret = -EPROBE_DEFER;
                goto fail;
        }
+       put_device(&ssi_pdev->dev);
        codec_dev = of_find_i2c_device_by_node(codec_np);
        if (!codec_dev) {
                dev_err(&pdev->dev, "failed to find codec platform device\n");
diff --git a/tools/lib/traceevent/event-parse.c 
b/tools/lib/traceevent/event-parse.c
index 0c81ca7d18cd..84374e313e3f 100644
--- a/tools/lib/traceevent/event-parse.c
+++ b/tools/lib/traceevent/event-parse.c
@@ -2283,7 +2283,7 @@ static int arg_num_eval(struct print_arg *arg, long long 
*val)
 static char *arg_eval (struct print_arg *arg)
 {
        long long val;
-       static char buf[20];
+       static char buf[24];
 
        switch (arg->type) {
        case PRINT_ATOM:
diff --git a/tools/perf/builtin-top.c b/tools/perf/builtin-top.c
index c5b9c3f01d85..ea02883c3405 100644
--- a/tools/perf/builtin-top.c
+++ b/tools/perf/builtin-top.c
@@ -1256,8 +1256,9 @@ int cmd_top(int argc, const char **argv, const char 
*prefix __maybe_unused)
        symbol_conf.priv_size = sizeof(struct annotation);
 
        symbol_conf.try_vmlinux_path = (symbol_conf.vmlinux_name == NULL);
-       if (symbol__init(NULL) < 0)
-               return -1;
+       status = symbol__init(NULL);
+       if (status < 0)
+               goto out_delete_evlist;
 
        sort__setup_elide(stdout);
 
diff --git a/tools/perf/tests/evsel-tp-sched.c 
b/tools/perf/tests/evsel-tp-sched.c
index 5ce11eac4dd3..959bdb4a79ad 100644
--- a/tools/perf/tests/evsel-tp-sched.c
+++ b/tools/perf/tests/evsel-tp-sched.c
@@ -78,5 +78,6 @@ int test__perf_evsel__tp_sched_test(void)
        if (perf_evsel__test_field(evsel, "target_cpu", 4, true))
                ret = -1;
 
+       perf_evsel__delete(evsel);
        return ret;
 }
diff --git a/tools/power/x86/turbostat/turbostat.c 
b/tools/power/x86/turbostat/turbostat.c
index f771e09eef33..06e1bf9bf1a8 100644
--- a/tools/power/x86/turbostat/turbostat.c
+++ b/tools/power/x86/turbostat/turbostat.c
@@ -2347,6 +2347,9 @@ int fork_it(char **argv)
                signal(SIGQUIT, SIG_IGN);
                if (waitpid(child_pid, &status, 0) == -1)
                        err(status, "waitpid");
+
+               if (WIFEXITED(status))
+                       status = WEXITSTATUS(status);
        }
        /*
         * n.b. fork_it() does not check for errors from for_all_cpus()

Reply via email to