diff --git 
a/Documentation/devicetree/bindings/iio/multiplexer/io-channel-mux.txt 
b/Documentation/devicetree/bindings/iio/multiplexer/io-channel-mux.txt
index c82794002595..89647d714387 100644
--- a/Documentation/devicetree/bindings/iio/multiplexer/io-channel-mux.txt
+++ b/Documentation/devicetree/bindings/iio/multiplexer/io-channel-mux.txt
@@ -21,7 +21,7 @@ controller state. The mux controller state is described in
 
 Example:
        mux: mux-controller {
-               compatible = "mux-gpio";
+               compatible = "gpio-mux";
                #mux-control-cells = <0>;
 
                mux-gpios = <&pioA 0 GPIO_ACTIVE_HIGH>,
diff --git a/Makefile b/Makefile
index c5ee1c10a39c..5b64e1141984 100644
--- a/Makefile
+++ b/Makefile
@@ -1,7 +1,7 @@
 # SPDX-License-Identifier: GPL-2.0
 VERSION = 4
 PATCHLEVEL = 19
-SUBLEVEL = 140
+SUBLEVEL = 141
 EXTRAVERSION =
 NAME = "People's Front"
 
diff --git a/arch/arm64/boot/dts/marvell/armada-3720-espressobin.dts 
b/arch/arm64/boot/dts/marvell/armada-3720-espressobin.dts
index 3ab25ad402b9..6cbdd66921aa 100644
--- a/arch/arm64/boot/dts/marvell/armada-3720-espressobin.dts
+++ b/arch/arm64/boot/dts/marvell/armada-3720-espressobin.dts
@@ -19,6 +19,12 @@
        model = "Globalscale Marvell ESPRESSOBin Board";
        compatible = "globalscale,espressobin", "marvell,armada3720", 
"marvell,armada3710";
 
+       aliases {
+               ethernet0 = &eth0;
+               serial0 = &uart0;
+               serial1 = &uart1;
+       };
+
        chosen {
                stdout-path = "serial0:115200n8";
        };
diff --git a/arch/mips/kernel/topology.c b/arch/mips/kernel/topology.c
index cd3e1f82e1a5..08ad6371fbe0 100644
--- a/arch/mips/kernel/topology.c
+++ b/arch/mips/kernel/topology.c
@@ -20,7 +20,7 @@ static int __init topology_init(void)
        for_each_present_cpu(i) {
                struct cpu *c = &per_cpu(cpu_devices, i);
 
-               c->hotpluggable = 1;
+               c->hotpluggable = !!i;
                ret = register_cpu(c, i);
                if (ret)
                        printk(KERN_WARNING "topology_init: register_cpu %d "
diff --git a/arch/openrisc/kernel/stacktrace.c 
b/arch/openrisc/kernel/stacktrace.c
index 43f140a28bc7..54d38809e22c 100644
--- a/arch/openrisc/kernel/stacktrace.c
+++ b/arch/openrisc/kernel/stacktrace.c
@@ -13,6 +13,7 @@
 #include <linux/export.h>
 #include <linux/sched.h>
 #include <linux/sched/debug.h>
+#include <linux/sched/task_stack.h>
 #include <linux/stacktrace.h>
 
 #include <asm/processor.h>
@@ -68,12 +69,25 @@ void save_stack_trace_tsk(struct task_struct *tsk, struct 
stack_trace *trace)
 {
        unsigned long *sp = NULL;
 
+       if (!try_get_task_stack(tsk))
+               return;
+
        if (tsk == current)
                sp = (unsigned long *) &sp;
-       else
-               sp = (unsigned long *) KSTK_ESP(tsk);
+       else {
+               unsigned long ksp;
+
+               /* Locate stack from kernel context */
+               ksp = task_thread_info(tsk)->ksp;
+               ksp += STACK_FRAME_OVERHEAD;    /* redzone */
+               ksp += sizeof(struct pt_regs);
+
+               sp = (unsigned long *) ksp;
+       }
 
        unwind_stack(trace, sp, save_stack_address_nosched);
+
+       put_task_stack(tsk);
 }
 EXPORT_SYMBOL_GPL(save_stack_trace_tsk);
 
diff --git a/arch/powerpc/include/asm/percpu.h 
b/arch/powerpc/include/asm/percpu.h
index dce863a7635c..8e5b7d0b851c 100644
--- a/arch/powerpc/include/asm/percpu.h
+++ b/arch/powerpc/include/asm/percpu.h
@@ -10,8 +10,6 @@
 
 #ifdef CONFIG_SMP
 
-#include <asm/paca.h>
-
 #define __my_cpu_offset local_paca->data_offset
 
 #endif /* CONFIG_SMP */
@@ -19,4 +17,6 @@
 
 #include <asm-generic/percpu.h>
 
+#include <asm/paca.h>
+
 #endif /* _ASM_POWERPC_PERCPU_H_ */
diff --git a/arch/powerpc/mm/fault.c b/arch/powerpc/mm/fault.c
index 6e0ff8b600ce..eb5252177b66 100644
--- a/arch/powerpc/mm/fault.c
+++ b/arch/powerpc/mm/fault.c
@@ -233,6 +233,9 @@ static bool bad_kernel_fault(bool is_exec, unsigned long 
error_code,
        return is_exec || (address >= TASK_SIZE);
 }
 
+// This comes from 64-bit struct rt_sigframe + __SIGNAL_FRAMESIZE
+#define SIGFRAME_MAX_SIZE      (4096 + 128)
+
 static bool bad_stack_expansion(struct pt_regs *regs, unsigned long address,
                                struct vm_area_struct *vma, unsigned int flags,
                                bool *must_retry)
@@ -240,7 +243,7 @@ static bool bad_stack_expansion(struct pt_regs *regs, 
unsigned long address,
        /*
         * N.B. The POWER/Open ABI allows programs to access up to
         * 288 bytes below the stack pointer.
-        * The kernel signal delivery code writes up to about 1.5kB
+        * The kernel signal delivery code writes a bit over 4KB
         * below the stack pointer (r1) before decrementing it.
         * The exec code can write slightly over 640kB to the stack
         * before setting the user r1.  Thus we allow the stack to
@@ -265,7 +268,7 @@ static bool bad_stack_expansion(struct pt_regs *regs, 
unsigned long address,
                 * between the last mapped region and the stack will
                 * expand the stack rather than segfaulting.
                 */
-               if (address + 2048 >= uregs->gpr[1])
+               if (address + SIGFRAME_MAX_SIZE >= uregs->gpr[1])
                        return false;
 
                if ((flags & FAULT_FLAG_WRITE) && (flags & FAULT_FLAG_USER) &&
diff --git a/arch/powerpc/platforms/pseries/hotplug-memory.c 
b/arch/powerpc/platforms/pseries/hotplug-memory.c
index b168c3742b43..afabe6918619 100644
--- a/arch/powerpc/platforms/pseries/hotplug-memory.c
+++ b/arch/powerpc/platforms/pseries/hotplug-memory.c
@@ -31,7 +31,7 @@ static bool rtas_hp_event;
 unsigned long pseries_memory_block_size(void)
 {
        struct device_node *np;
-       unsigned int memblock_size = MIN_MEMORY_BLOCK_SIZE;
+       u64 memblock_size = MIN_MEMORY_BLOCK_SIZE;
        struct resource r;
 
        np = of_find_node_by_path("/ibm,dynamic-reconfiguration-memory");
diff --git a/arch/sh/boards/mach-landisk/setup.c 
b/arch/sh/boards/mach-landisk/setup.c
index f1147caebacf..af69fb7fef7c 100644
--- a/arch/sh/boards/mach-landisk/setup.c
+++ b/arch/sh/boards/mach-landisk/setup.c
@@ -85,6 +85,9 @@ device_initcall(landisk_devices_setup);
 
 static void __init landisk_setup(char **cmdline_p)
 {
+       /* I/O port identity mapping */
+       __set_io_port_base(0);
+
        /* LED ON */
        __raw_writeb(__raw_readb(PA_LED) | 0x03, PA_LED);
 
diff --git a/arch/x86/kernel/apic/vector.c b/arch/x86/kernel/apic/vector.c
index 99c28c02b7a5..8b7e0b46e86e 100644
--- a/arch/x86/kernel/apic/vector.c
+++ b/arch/x86/kernel/apic/vector.c
@@ -556,6 +556,10 @@ static int x86_vector_alloc_irqs(struct irq_domain 
*domain, unsigned int virq,
                irqd->chip_data = apicd;
                irqd->hwirq = virq + i;
                irqd_set_single_target(irqd);
+
+               /* Don't invoke affinity setter on deactivated interrupts */
+               irqd_set_affinity_on_activate(irqd);
+
                /*
                 * Legacy vectors are already assigned when the IOAPIC
                 * takes them over. They stay on the same vector. This is
diff --git a/arch/xtensa/kernel/perf_event.c b/arch/xtensa/kernel/perf_event.c
index ff1d81385ed7..768e1f7ab871 100644
--- a/arch/xtensa/kernel/perf_event.c
+++ b/arch/xtensa/kernel/perf_event.c
@@ -404,7 +404,7 @@ static struct pmu xtensa_pmu = {
        .read = xtensa_pmu_read,
 };
 
-static int xtensa_pmu_setup(int cpu)
+static int xtensa_pmu_setup(unsigned int cpu)
 {
        unsigned i;
 
diff --git a/drivers/base/dd.c b/drivers/base/dd.c
index caaeb7910a04..0047bbdd43c0 100644
--- a/drivers/base/dd.c
+++ b/drivers/base/dd.c
@@ -792,7 +792,9 @@ static int __device_attach(struct device *dev, bool 
allow_async)
        int ret = 0;
 
        device_lock(dev);
-       if (dev->driver) {
+       if (dev->p->dead) {
+               goto out_unlock;
+       } else if (dev->driver) {
                if (device_is_bound(dev)) {
                        ret = 1;
                        goto out_unlock;
diff --git a/drivers/clk/sirf/clk-atlas6.c b/drivers/clk/sirf/clk-atlas6.c
index 0cd11e6893af..25ed60776560 100644
--- a/drivers/clk/sirf/clk-atlas6.c
+++ b/drivers/clk/sirf/clk-atlas6.c
@@ -136,7 +136,7 @@ static void __init atlas6_clk_init(struct device_node *np)
 
        for (i = pll1; i < maxclk; i++) {
                atlas6_clks[i] = clk_register(NULL, atlas6_clk_hw_array[i]);
-               BUG_ON(!atlas6_clks[i]);
+               BUG_ON(IS_ERR(atlas6_clks[i]));
        }
        clk_register_clkdev(atlas6_clks[cpu], NULL, "cpu");
        clk_register_clkdev(atlas6_clks[io],  NULL, "io");
diff --git a/drivers/gpu/drm/amd/powerplay/smumgr/ci_smumgr.c 
b/drivers/gpu/drm/amd/powerplay/smumgr/ci_smumgr.c
index 083aa71487e8..db87cb8930d2 100644
--- a/drivers/gpu/drm/amd/powerplay/smumgr/ci_smumgr.c
+++ b/drivers/gpu/drm/amd/powerplay/smumgr/ci_smumgr.c
@@ -2723,7 +2723,10 @@ static int ci_initialize_mc_reg_table(struct pp_hwmgr 
*hwmgr)
 
 static bool ci_is_dpm_running(struct pp_hwmgr *hwmgr)
 {
-       return ci_is_smc_ram_running(hwmgr);
+       return (1 == PHM_READ_INDIRECT_FIELD(hwmgr->device,
+                                            CGS_IND_REG__SMC, FEATURE_STATUS,
+                                            VOLTAGE_CONTROLLER_ON))
+               ? true : false;
 }
 
 static int ci_smu_init(struct pp_hwmgr *hwmgr)
diff --git a/drivers/gpu/drm/drm_panel_orientation_quirks.c 
b/drivers/gpu/drm/drm_panel_orientation_quirks.c
index fa5c25d36d3d..652de972c3ae 100644
--- a/drivers/gpu/drm/drm_panel_orientation_quirks.c
+++ b/drivers/gpu/drm/drm_panel_orientation_quirks.c
@@ -107,6 +107,12 @@ static const struct dmi_system_id orientation_data[] = {
                  DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "T101HA"),
                },
                .driver_data = (void *)&lcd800x1280_rightside_up,
+       }, {    /* Asus T103HAF */
+               .matches = {
+                 DMI_EXACT_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."),
+                 DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "T103HAF"),
+               },
+               .driver_data = (void *)&lcd800x1280_rightside_up,
        }, {    /* GPD MicroPC (generic strings, also match on bios date) */
                .matches = {
                  DMI_EXACT_MATCH(DMI_SYS_VENDOR, "Default string"),
diff --git a/drivers/gpu/drm/imx/imx-ldb.c b/drivers/gpu/drm/imx/imx-ldb.c
index 42daa5c9ff8e..221a8cbc57f9 100644
--- a/drivers/gpu/drm/imx/imx-ldb.c
+++ b/drivers/gpu/drm/imx/imx-ldb.c
@@ -311,18 +311,19 @@ static void imx_ldb_encoder_disable(struct drm_encoder 
*encoder)
 {
        struct imx_ldb_channel *imx_ldb_ch = enc_to_imx_ldb_ch(encoder);
        struct imx_ldb *ldb = imx_ldb_ch->ldb;
+       int dual = ldb->ldb_ctrl & LDB_SPLIT_MODE_EN;
        int mux, ret;
 
        drm_panel_disable(imx_ldb_ch->panel);
 
-       if (imx_ldb_ch == &ldb->channel[0])
+       if (imx_ldb_ch == &ldb->channel[0] || dual)
                ldb->ldb_ctrl &= ~LDB_CH0_MODE_EN_MASK;
-       else if (imx_ldb_ch == &ldb->channel[1])
+       if (imx_ldb_ch == &ldb->channel[1] || dual)
                ldb->ldb_ctrl &= ~LDB_CH1_MODE_EN_MASK;
 
        regmap_write(ldb->regmap, IOMUXC_GPR2, ldb->ldb_ctrl);
 
-       if (ldb->ldb_ctrl & LDB_SPLIT_MODE_EN) {
+       if (dual) {
                clk_disable_unprepare(ldb->clk[0]);
                clk_disable_unprepare(ldb->clk[1]);
        }
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c 
b/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c
index 6a712a8d59e9..e486b6517ac5 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c
@@ -2861,7 +2861,7 @@ int vmw_kms_fbdev_init_data(struct vmw_private *dev_priv,
                ++i;
        }
 
-       if (i != unit) {
+       if (&con->head == &dev_priv->dev->mode_config.connector_list) {
                DRM_ERROR("Could not find initial display unit.\n");
                ret = -EINVAL;
                goto out_unlock;
@@ -2885,13 +2885,13 @@ int vmw_kms_fbdev_init_data(struct vmw_private 
*dev_priv,
                        break;
        }
 
-       if (mode->type & DRM_MODE_TYPE_PREFERRED)
-               *p_mode = mode;
-       else {
+       if (&mode->head == &con->modes) {
                WARN_ONCE(true, "Could not find initial preferred mode.\n");
                *p_mode = list_first_entry(&con->modes,
                                           struct drm_display_mode,
                                           head);
+       } else {
+               *p_mode = mode;
        }
 
  out_unlock:
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_ldu.c 
b/drivers/gpu/drm/vmwgfx/vmwgfx_ldu.c
index 723578117191..0743a7311700 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_ldu.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_ldu.c
@@ -79,7 +79,7 @@ static int vmw_ldu_commit_list(struct vmw_private *dev_priv)
        struct vmw_legacy_display_unit *entry;
        struct drm_framebuffer *fb = NULL;
        struct drm_crtc *crtc = NULL;
-       int i = 0;
+       int i;
 
        /* If there is no display topology the host just assumes
         * that the guest will set the same layout as the host.
@@ -90,12 +90,11 @@ static int vmw_ldu_commit_list(struct vmw_private *dev_priv)
                        crtc = &entry->base.crtc;
                        w = max(w, crtc->x + crtc->mode.hdisplay);
                        h = max(h, crtc->y + crtc->mode.vdisplay);
-                       i++;
                }
 
                if (crtc == NULL)
                        return 0;
-               fb = entry->base.crtc.primary->state->fb;
+               fb = crtc->primary->state->fb;
 
                return vmw_kms_write_svga(dev_priv, w, h, fb->pitches[0],
                                          fb->format->cpp[0] * 8,
diff --git a/drivers/gpu/ipu-v3/ipu-image-convert.c 
b/drivers/gpu/ipu-v3/ipu-image-convert.c
index 91653adc41cc..cdaf1d74e31a 100644
--- a/drivers/gpu/ipu-v3/ipu-image-convert.c
+++ b/drivers/gpu/ipu-v3/ipu-image-convert.c
@@ -998,9 +998,10 @@ static irqreturn_t do_irq(struct ipu_image_convert_run 
*run)
        return IRQ_WAKE_THREAD;
 }
 
-static irqreturn_t norotate_irq(int irq, void *data)
+static irqreturn_t eof_irq(int irq, void *data)
 {
        struct ipu_image_convert_chan *chan = data;
+       struct ipu_image_convert_priv *priv = chan->priv;
        struct ipu_image_convert_ctx *ctx;
        struct ipu_image_convert_run *run;
        unsigned long flags;
@@ -1017,45 +1018,26 @@ static irqreturn_t norotate_irq(int irq, void *data)
 
        ctx = run->ctx;
 
-       if (ipu_rot_mode_is_irt(ctx->rot_mode)) {
-               /* this is a rotation operation, just ignore */
-               spin_unlock_irqrestore(&chan->irqlock, flags);
-               return IRQ_HANDLED;
-       }
-
-       ret = do_irq(run);
-out:
-       spin_unlock_irqrestore(&chan->irqlock, flags);
-       return ret;
-}
-
-static irqreturn_t rotate_irq(int irq, void *data)
-{
-       struct ipu_image_convert_chan *chan = data;
-       struct ipu_image_convert_priv *priv = chan->priv;
-       struct ipu_image_convert_ctx *ctx;
-       struct ipu_image_convert_run *run;
-       unsigned long flags;
-       irqreturn_t ret;
-
-       spin_lock_irqsave(&chan->irqlock, flags);
-
-       /* get current run and its context */
-       run = chan->current_run;
-       if (!run) {
+       if (irq == chan->out_eof_irq) {
+               if (ipu_rot_mode_is_irt(ctx->rot_mode)) {
+                       /* this is a rotation op, just ignore */
+                       ret = IRQ_HANDLED;
+                       goto out;
+               }
+       } else if (irq == chan->rot_out_eof_irq) {
+               if (!ipu_rot_mode_is_irt(ctx->rot_mode)) {
+                       /* this was NOT a rotation op, shouldn't happen */
+                       dev_err(priv->ipu->dev,
+                               "Unexpected rotation interrupt\n");
+                       ret = IRQ_HANDLED;
+                       goto out;
+               }
+       } else {
+               dev_err(priv->ipu->dev, "Received unknown irq %d\n", irq);
                ret = IRQ_NONE;
                goto out;
        }
 
-       ctx = run->ctx;
-
-       if (!ipu_rot_mode_is_irt(ctx->rot_mode)) {
-               /* this was NOT a rotation operation, shouldn't happen */
-               dev_err(priv->ipu->dev, "Unexpected rotation interrupt\n");
-               spin_unlock_irqrestore(&chan->irqlock, flags);
-               return IRQ_HANDLED;
-       }
-
        ret = do_irq(run);
 out:
        spin_unlock_irqrestore(&chan->irqlock, flags);
@@ -1148,7 +1130,7 @@ static int get_ipu_resources(struct 
ipu_image_convert_chan *chan)
                                                  chan->out_chan,
                                                  IPU_IRQ_EOF);
 
-       ret = request_threaded_irq(chan->out_eof_irq, norotate_irq, do_bh,
+       ret = request_threaded_irq(chan->out_eof_irq, eof_irq, do_bh,
                                   0, "ipu-ic", chan);
        if (ret < 0) {
                dev_err(priv->ipu->dev, "could not acquire irq %d\n",
@@ -1161,7 +1143,7 @@ static int get_ipu_resources(struct 
ipu_image_convert_chan *chan)
                                                     chan->rotation_out_chan,
                                                     IPU_IRQ_EOF);
 
-       ret = request_threaded_irq(chan->rot_out_eof_irq, rotate_irq, do_bh,
+       ret = request_threaded_irq(chan->rot_out_eof_irq, eof_irq, do_bh,
                                   0, "ipu-ic", chan);
        if (ret < 0) {
                dev_err(priv->ipu->dev, "could not acquire irq %d\n",
diff --git a/drivers/i2c/busses/i2c-rcar.c b/drivers/i2c/busses/i2c-rcar.c
index 6e49e438ef5a..dcdce18fc706 100644
--- a/drivers/i2c/busses/i2c-rcar.c
+++ b/drivers/i2c/busses/i2c-rcar.c
@@ -587,13 +587,14 @@ static bool rcar_i2c_slave_irq(struct rcar_i2c_priv *priv)
                        rcar_i2c_write(priv, ICSIER, SDR | SSR | SAR);
                }
 
-               rcar_i2c_write(priv, ICSSR, ~SAR & 0xff);
+               /* Clear SSR, too, because of old STOPs to other clients than 
us */
+               rcar_i2c_write(priv, ICSSR, ~(SAR | SSR) & 0xff);
        }
 
        /* master sent stop */
        if (ssr_filtered & SSR) {
                i2c_slave_event(priv->slave, I2C_SLAVE_STOP, &value);
-               rcar_i2c_write(priv, ICSIER, SAR | SSR);
+               rcar_i2c_write(priv, ICSIER, SAR);
                rcar_i2c_write(priv, ICSSR, ~SSR & 0xff);
        }
 
@@ -848,7 +849,7 @@ static int rcar_reg_slave(struct i2c_client *slave)
        priv->slave = slave;
        rcar_i2c_write(priv, ICSAR, slave->addr);
        rcar_i2c_write(priv, ICSSR, 0);
-       rcar_i2c_write(priv, ICSIER, SAR | SSR);
+       rcar_i2c_write(priv, ICSIER, SAR);
        rcar_i2c_write(priv, ICSCR, SIE | SDBS);
 
        return 0;
@@ -860,12 +861,14 @@ static int rcar_unreg_slave(struct i2c_client *slave)
 
        WARN_ON(!priv->slave);
 
-       /* disable irqs and ensure none is running before clearing ptr */
+       /* ensure no irq is running before clearing ptr */
+       disable_irq(priv->irq);
        rcar_i2c_write(priv, ICSIER, 0);
-       rcar_i2c_write(priv, ICSCR, 0);
+       rcar_i2c_write(priv, ICSSR, 0);
+       enable_irq(priv->irq);
+       rcar_i2c_write(priv, ICSCR, SDBS);
        rcar_i2c_write(priv, ICSAR, 0); /* Gen2: must be 0 if not using slave */
 
-       synchronize_irq(priv->irq);
        priv->slave = NULL;
 
        pm_runtime_put(rcar_i2c_priv_to_dev(priv));
diff --git a/drivers/iio/dac/ad5592r-base.c b/drivers/iio/dac/ad5592r-base.c
index 095530c233e4..7549abd544c0 100644
--- a/drivers/iio/dac/ad5592r-base.c
+++ b/drivers/iio/dac/ad5592r-base.c
@@ -417,7 +417,7 @@ static int ad5592r_read_raw(struct iio_dev *iio_dev,
                        s64 tmp = *val * (3767897513LL / 25LL);
                        *val = div_s64_rem(tmp, 1000000000LL, val2);
 
-                       ret = IIO_VAL_INT_PLUS_MICRO;
+                       return IIO_VAL_INT_PLUS_MICRO;
                } else {
                        int mult;
 
@@ -448,7 +448,7 @@ static int ad5592r_read_raw(struct iio_dev *iio_dev,
                ret =  IIO_VAL_INT;
                break;
        default:
-               ret = -EINVAL;
+               return -EINVAL;
        }
 
 unlock:
diff --git a/drivers/infiniband/ulp/ipoib/ipoib.h 
b/drivers/infiniband/ulp/ipoib/ipoib.h
index 85267bbf4836..ef1222101705 100644
--- a/drivers/infiniband/ulp/ipoib/ipoib.h
+++ b/drivers/infiniband/ulp/ipoib/ipoib.h
@@ -513,7 +513,7 @@ void ipoib_ib_dev_cleanup(struct net_device *dev);
 
 int ipoib_ib_dev_open_default(struct net_device *dev);
 int ipoib_ib_dev_open(struct net_device *dev);
-int ipoib_ib_dev_stop(struct net_device *dev);
+void ipoib_ib_dev_stop(struct net_device *dev);
 void ipoib_ib_dev_up(struct net_device *dev);
 void ipoib_ib_dev_down(struct net_device *dev);
 int ipoib_ib_dev_stop_default(struct net_device *dev);
diff --git a/drivers/infiniband/ulp/ipoib/ipoib_ib.c 
b/drivers/infiniband/ulp/ipoib/ipoib_ib.c
index 0f2e80f54d33..82b9c5b6e3e6 100644
--- a/drivers/infiniband/ulp/ipoib/ipoib_ib.c
+++ b/drivers/infiniband/ulp/ipoib/ipoib_ib.c
@@ -669,14 +669,13 @@ int ipoib_send(struct net_device *dev, struct sk_buff 
*skb,
        return rc;
 }
 
-static void __ipoib_reap_ah(struct net_device *dev)
+static void ipoib_reap_dead_ahs(struct ipoib_dev_priv *priv)
 {
-       struct ipoib_dev_priv *priv = ipoib_priv(dev);
        struct ipoib_ah *ah, *tah;
        LIST_HEAD(remove_list);
        unsigned long flags;
 
-       netif_tx_lock_bh(dev);
+       netif_tx_lock_bh(priv->dev);
        spin_lock_irqsave(&priv->lock, flags);
 
        list_for_each_entry_safe(ah, tah, &priv->dead_ahs, list)
@@ -687,37 +686,37 @@ static void __ipoib_reap_ah(struct net_device *dev)
                }
 
        spin_unlock_irqrestore(&priv->lock, flags);
-       netif_tx_unlock_bh(dev);
+       netif_tx_unlock_bh(priv->dev);
 }
 
 void ipoib_reap_ah(struct work_struct *work)
 {
        struct ipoib_dev_priv *priv =
                container_of(work, struct ipoib_dev_priv, ah_reap_task.work);
-       struct net_device *dev = priv->dev;
 
-       __ipoib_reap_ah(dev);
+       ipoib_reap_dead_ahs(priv);
 
        if (!test_bit(IPOIB_STOP_REAPER, &priv->flags))
                queue_delayed_work(priv->wq, &priv->ah_reap_task,
                                   round_jiffies_relative(HZ));
 }
 
-static void ipoib_flush_ah(struct net_device *dev)
+static void ipoib_start_ah_reaper(struct ipoib_dev_priv *priv)
 {
-       struct ipoib_dev_priv *priv = ipoib_priv(dev);
-
-       cancel_delayed_work(&priv->ah_reap_task);
-       flush_workqueue(priv->wq);
-       ipoib_reap_ah(&priv->ah_reap_task.work);
+       clear_bit(IPOIB_STOP_REAPER, &priv->flags);
+       queue_delayed_work(priv->wq, &priv->ah_reap_task,
+                          round_jiffies_relative(HZ));
 }
 
-static void ipoib_stop_ah(struct net_device *dev)
+static void ipoib_stop_ah_reaper(struct ipoib_dev_priv *priv)
 {
-       struct ipoib_dev_priv *priv = ipoib_priv(dev);
-
        set_bit(IPOIB_STOP_REAPER, &priv->flags);
-       ipoib_flush_ah(dev);
+       cancel_delayed_work(&priv->ah_reap_task);
+       /*
+        * After ipoib_stop_ah_reaper() we always go through
+        * ipoib_reap_dead_ahs() which ensures the work is really stopped and
+        * does a final flush out of the dead_ah's list
+        */
 }
 
 static int recvs_pending(struct net_device *dev)
@@ -846,18 +845,6 @@ int ipoib_ib_dev_stop_default(struct net_device *dev)
        return 0;
 }
 
-int ipoib_ib_dev_stop(struct net_device *dev)
-{
-       struct ipoib_dev_priv *priv = ipoib_priv(dev);
-
-       priv->rn_ops->ndo_stop(dev);
-
-       clear_bit(IPOIB_FLAG_INITIALIZED, &priv->flags);
-       ipoib_flush_ah(dev);
-
-       return 0;
-}
-
 int ipoib_ib_dev_open_default(struct net_device *dev)
 {
        struct ipoib_dev_priv *priv = ipoib_priv(dev);
@@ -901,10 +888,7 @@ int ipoib_ib_dev_open(struct net_device *dev)
                return -1;
        }
 
-       clear_bit(IPOIB_STOP_REAPER, &priv->flags);
-       queue_delayed_work(priv->wq, &priv->ah_reap_task,
-                          round_jiffies_relative(HZ));
-
+       ipoib_start_ah_reaper(priv);
        if (priv->rn_ops->ndo_open(dev)) {
                pr_warn("%s: Failed to open dev\n", dev->name);
                goto dev_stop;
@@ -915,13 +899,20 @@ int ipoib_ib_dev_open(struct net_device *dev)
        return 0;
 
 dev_stop:
-       set_bit(IPOIB_STOP_REAPER, &priv->flags);
-       cancel_delayed_work(&priv->ah_reap_task);
-       set_bit(IPOIB_FLAG_INITIALIZED, &priv->flags);
-       ipoib_ib_dev_stop(dev);
+       ipoib_stop_ah_reaper(priv);
        return -1;
 }
 
+void ipoib_ib_dev_stop(struct net_device *dev)
+{
+       struct ipoib_dev_priv *priv = ipoib_priv(dev);
+
+       priv->rn_ops->ndo_stop(dev);
+
+       clear_bit(IPOIB_FLAG_INITIALIZED, &priv->flags);
+       ipoib_stop_ah_reaper(priv);
+}
+
 void ipoib_pkey_dev_check_presence(struct net_device *dev)
 {
        struct ipoib_dev_priv *priv = ipoib_priv(dev);
@@ -1232,7 +1223,7 @@ static void __ipoib_ib_dev_flush(struct ipoib_dev_priv 
*priv,
                ipoib_mcast_dev_flush(dev);
                if (oper_up)
                        set_bit(IPOIB_FLAG_OPER_UP, &priv->flags);
-               ipoib_flush_ah(dev);
+               ipoib_reap_dead_ahs(priv);
        }
 
        if (level >= IPOIB_FLUSH_NORMAL)
@@ -1307,7 +1298,7 @@ void ipoib_ib_dev_cleanup(struct net_device *dev)
         * the neighbor garbage collection is stopped and reaped.
         * That should all be done now, so make a final ah flush.
         */
-       ipoib_stop_ah(dev);
+       ipoib_reap_dead_ahs(priv);
 
        clear_bit(IPOIB_PKEY_ASSIGNED, &priv->flags);
 
diff --git a/drivers/infiniband/ulp/ipoib/ipoib_main.c 
b/drivers/infiniband/ulp/ipoib/ipoib_main.c
index 6093e8268583..d0c35eb687ae 100644
--- a/drivers/infiniband/ulp/ipoib/ipoib_main.c
+++ b/drivers/infiniband/ulp/ipoib/ipoib_main.c
@@ -1979,6 +1979,8 @@ static void ipoib_ndo_uninit(struct net_device *dev)
 
        /* no more works over the priv->wq */
        if (priv->wq) {
+               /* See ipoib_mcast_carrier_on_task() */
+               WARN_ON(test_bit(IPOIB_FLAG_OPER_UP, &priv->flags));
                flush_workqueue(priv->wq);
                destroy_workqueue(priv->wq);
                priv->wq = NULL;
diff --git a/drivers/input/mouse/sentelic.c b/drivers/input/mouse/sentelic.c
index 1d6010d463e2..022a8cb58a06 100644
--- a/drivers/input/mouse/sentelic.c
+++ b/drivers/input/mouse/sentelic.c
@@ -454,7 +454,7 @@ static ssize_t fsp_attr_set_setreg(struct psmouse *psmouse, 
void *data,
 
        fsp_reg_write_enable(psmouse, false);
 
-       return count;
+       return retval;
 }
 
 PSMOUSE_DEFINE_WO_ATTR(setreg, S_IWUSR, NULL, fsp_attr_set_setreg);
diff --git a/drivers/iommu/omap-iommu-debug.c b/drivers/iommu/omap-iommu-debug.c
index 50217548c3b8..5ce55fabc9d8 100644
--- a/drivers/iommu/omap-iommu-debug.c
+++ b/drivers/iommu/omap-iommu-debug.c
@@ -101,8 +101,11 @@ static ssize_t debug_read_regs(struct file *file, char 
__user *userbuf,
        mutex_lock(&iommu_debug_lock);
 
        bytes = omap_iommu_dump_ctx(obj, p, count);
+       if (bytes < 0)
+               goto err;
        bytes = simple_read_from_buffer(userbuf, count, ppos, buf, bytes);
 
+err:
        mutex_unlock(&iommu_debug_lock);
        kfree(buf);
 
diff --git a/drivers/irqchip/irq-gic-v3-its.c b/drivers/irqchip/irq-gic-v3-its.c
index fe7d63cdfb1d..d5cc32e80f5e 100644
--- a/drivers/irqchip/irq-gic-v3-its.c
+++ b/drivers/irqchip/irq-gic-v3-its.c
@@ -2458,6 +2458,7 @@ static int its_irq_domain_alloc(struct irq_domain 
*domain, unsigned int virq,
 {
        msi_alloc_info_t *info = args;
        struct its_device *its_dev = info->scratchpad[0].ptr;
+       struct irq_data *irqd;
        irq_hw_number_t hwirq;
        int err;
        int i;
@@ -2473,7 +2474,9 @@ static int its_irq_domain_alloc(struct irq_domain 
*domain, unsigned int virq,
 
                irq_domain_set_hwirq_and_chip(domain, virq + i,
                                              hwirq + i, &its_irq_chip, 
its_dev);
-               irqd_set_single_target(irq_desc_get_irq_data(irq_to_desc(virq + 
i)));
+               irqd = irq_get_irq_data(virq + i);
+               irqd_set_single_target(irqd);
+               irqd_set_affinity_on_activate(irqd);
                pr_debug("ID:%d pID:%d vID:%d\n",
                         (int)(hwirq + i - its_dev->event_map.lpi_base),
                         (int)(hwirq + i), virq + i);
diff --git a/drivers/md/bcache/bcache.h b/drivers/md/bcache/bcache.h
index 2a2f189dd37c..1cc6ae3e058c 100644
--- a/drivers/md/bcache/bcache.h
+++ b/drivers/md/bcache/bcache.h
@@ -264,7 +264,7 @@ struct bcache_device {
 #define BCACHE_DEV_UNLINK_DONE         2
 #define BCACHE_DEV_WB_RUNNING          3
 #define BCACHE_DEV_RATE_DW_RUNNING     4
-       unsigned int            nr_stripes;
+       int                     nr_stripes;
        unsigned int            stripe_size;
        atomic_t                *stripe_sectors_dirty;
        unsigned long           *full_dirty_stripes;
diff --git a/drivers/md/bcache/bset.c b/drivers/md/bcache/bset.c
index 268f1b685084..ec48cf86cab6 100644
--- a/drivers/md/bcache/bset.c
+++ b/drivers/md/bcache/bset.c
@@ -321,7 +321,7 @@ int bch_btree_keys_alloc(struct btree_keys *b,
 
        b->page_order = page_order;
 
-       t->data = (void *) __get_free_pages(gfp, b->page_order);
+       t->data = (void *) __get_free_pages(__GFP_COMP|gfp, b->page_order);
        if (!t->data)
                goto err;
 
diff --git a/drivers/md/bcache/btree.c b/drivers/md/bcache/btree.c
index 38a8f8d2a908..d320574b9a4c 100644
--- a/drivers/md/bcache/btree.c
+++ b/drivers/md/bcache/btree.c
@@ -830,7 +830,7 @@ int bch_btree_cache_alloc(struct cache_set *c)
        mutex_init(&c->verify_lock);
 
        c->verify_ondisk = (void *)
-               __get_free_pages(GFP_KERNEL, ilog2(bucket_pages(c)));
+               __get_free_pages(GFP_KERNEL|__GFP_COMP, ilog2(bucket_pages(c)));
 
        c->verify_data = mca_bucket_alloc(c, &ZERO_KEY, GFP_KERNEL);
 
diff --git a/drivers/md/bcache/journal.c b/drivers/md/bcache/journal.c
index 7bb15cddca5e..182c2b7bd960 100644
--- a/drivers/md/bcache/journal.c
+++ b/drivers/md/bcache/journal.c
@@ -864,8 +864,8 @@ int bch_journal_alloc(struct cache_set *c)
        j->w[1].c = c;
 
        if (!(init_fifo(&j->pin, JOURNAL_PIN, GFP_KERNEL)) ||
-           !(j->w[0].data = (void *) __get_free_pages(GFP_KERNEL, JSET_BITS)) 
||
-           !(j->w[1].data = (void *) __get_free_pages(GFP_KERNEL, JSET_BITS)))
+           !(j->w[0].data = (void *) __get_free_pages(GFP_KERNEL|__GFP_COMP, 
JSET_BITS)) ||
+           !(j->w[1].data = (void *) __get_free_pages(GFP_KERNEL|__GFP_COMP, 
JSET_BITS)))
                return -ENOMEM;
 
        return 0;
diff --git a/drivers/md/bcache/super.c b/drivers/md/bcache/super.c
index 46ad0bf18e1f..825bfde10c69 100644
--- a/drivers/md/bcache/super.c
+++ b/drivers/md/bcache/super.c
@@ -1693,7 +1693,7 @@ void bch_cache_set_unregister(struct cache_set *c)
 }
 
 #define alloc_bucket_pages(gfp, c)                     \
-       ((void *) __get_free_pages(__GFP_ZERO|gfp, ilog2(bucket_pages(c))))
+       ((void *) __get_free_pages(__GFP_ZERO|__GFP_COMP|gfp, 
ilog2(bucket_pages(c))))
 
 struct cache_set *bch_cache_set_alloc(struct cache_sb *sb)
 {
diff --git a/drivers/md/bcache/writeback.c b/drivers/md/bcache/writeback.c
index b5fc3c6c7178..aa58833fb012 100644
--- a/drivers/md/bcache/writeback.c
+++ b/drivers/md/bcache/writeback.c
@@ -506,15 +506,19 @@ void bcache_dev_sectors_dirty_add(struct cache_set *c, 
unsigned int inode,
                                  uint64_t offset, int nr_sectors)
 {
        struct bcache_device *d = c->devices[inode];
-       unsigned int stripe_offset, stripe, sectors_dirty;
+       unsigned int stripe_offset, sectors_dirty;
+       int stripe;
 
        if (!d)
                return;
 
+       stripe = offset_to_stripe(d, offset);
+       if (stripe < 0)
+               return;
+
        if (UUID_FLASH_ONLY(&c->uuids[inode]))
                atomic_long_add(nr_sectors, &c->flash_dev_dirty_sectors);
 
-       stripe = offset_to_stripe(d, offset);
        stripe_offset = offset & (d->stripe_size - 1);
 
        while (nr_sectors) {
@@ -554,12 +558,12 @@ static bool dirty_pred(struct keybuf *buf, struct bkey *k)
 static void refill_full_stripes(struct cached_dev *dc)
 {
        struct keybuf *buf = &dc->writeback_keys;
-       unsigned int start_stripe, stripe, next_stripe;
+       unsigned int start_stripe, next_stripe;
+       int stripe;
        bool wrapped = false;
 
        stripe = offset_to_stripe(&dc->disk, KEY_OFFSET(&buf->last_scanned));
-
-       if (stripe >= dc->disk.nr_stripes)
+       if (stripe < 0)
                stripe = 0;
 
        start_stripe = stripe;
diff --git a/drivers/md/bcache/writeback.h b/drivers/md/bcache/writeback.h
index e75dc33339f6..b902e574c5c4 100644
--- a/drivers/md/bcache/writeback.h
+++ b/drivers/md/bcache/writeback.h
@@ -28,10 +28,22 @@ static inline uint64_t bcache_dev_sectors_dirty(struct 
bcache_device *d)
        return ret;
 }
 
-static inline unsigned int offset_to_stripe(struct bcache_device *d,
+static inline int offset_to_stripe(struct bcache_device *d,
                                        uint64_t offset)
 {
        do_div(offset, d->stripe_size);
+
+       /* d->nr_stripes is in range [1, INT_MAX] */
+       if (unlikely(offset >= d->nr_stripes)) {
+               pr_err("Invalid stripe %llu (>= nr_stripes %d).\n",
+                       offset, d->nr_stripes);
+               return -EINVAL;
+       }
+
+       /*
+        * Here offset is definitly smaller than INT_MAX,
+        * return it as int will never overflow.
+        */
        return offset;
 }
 
@@ -39,7 +51,10 @@ static inline bool bcache_dev_stripe_dirty(struct cached_dev 
*dc,
                                           uint64_t offset,
                                           unsigned int nr_sectors)
 {
-       unsigned int stripe = offset_to_stripe(&dc->disk, offset);
+       int stripe = offset_to_stripe(&dc->disk, offset);
+
+       if (stripe < 0)
+               return false;
 
        while (1) {
                if (atomic_read(dc->disk.stripe_sectors_dirty + stripe))
diff --git a/drivers/md/dm-rq.c b/drivers/md/dm-rq.c
index 4d36373e1c0f..9fde174ce396 100644
--- a/drivers/md/dm-rq.c
+++ b/drivers/md/dm-rq.c
@@ -95,9 +95,6 @@ static void dm_old_stop_queue(struct request_queue *q)
 
 static void dm_mq_stop_queue(struct request_queue *q)
 {
-       if (blk_mq_queue_stopped(q))
-               return;
-
        blk_mq_quiesce_queue(q);
 }
 
diff --git a/drivers/md/raid5.c b/drivers/md/raid5.c
index 01021382131b..d91154d65455 100644
--- a/drivers/md/raid5.c
+++ b/drivers/md/raid5.c
@@ -3596,6 +3596,7 @@ static int need_this_block(struct stripe_head *sh, struct 
stripe_head_state *s,
         * is missing/faulty, then we need to read everything we can.
         */
        if (sh->raid_conf->level != 6 &&
+           sh->raid_conf->rmw_level != PARITY_DISABLE_RMW &&
            sh->sector < sh->raid_conf->mddev->recovery_cp)
                /* reconstruct-write isn't being forced */
                return 0;
@@ -4832,7 +4833,7 @@ static void handle_stripe(struct stripe_head *sh)
         * or to load a block that is being partially written.
         */
        if (s.to_read || s.non_overwrite
-           || (conf->level == 6 && s.to_write && s.failed)
+           || (s.to_write && s.failed)
            || (s.syncing && (s.uptodate + s.compute < disks))
            || s.replacing
            || s.expanding)
diff --git a/drivers/media/platform/rockchip/rga/rga-hw.c 
b/drivers/media/platform/rockchip/rga/rga-hw.c
index 96d1b1b3fe8e..681de42f12e9 100644
--- a/drivers/media/platform/rockchip/rga/rga-hw.c
+++ b/drivers/media/platform/rockchip/rga/rga-hw.c
@@ -208,22 +208,25 @@ static void rga_cmd_set_trans_info(struct rga_ctx *ctx)
        dst_info.data.format = ctx->out.fmt->hw_format;
        dst_info.data.swap = ctx->out.fmt->color_swap;
 
-       if (ctx->in.fmt->hw_format >= RGA_COLOR_FMT_YUV422SP) {
-               if (ctx->out.fmt->hw_format < RGA_COLOR_FMT_YUV422SP) {
-                       switch (ctx->in.colorspace) {
-                       case V4L2_COLORSPACE_REC709:
-                               src_info.data.csc_mode =
-                                       RGA_SRC_CSC_MODE_BT709_R0;
-                               break;
-                       default:
-                               src_info.data.csc_mode =
-                                       RGA_SRC_CSC_MODE_BT601_R0;
-                               break;
-                       }
+       /*
+        * CSC mode must only be set when the colorspace families differ between
+        * input and output. It must remain unset (zeroed) if both are the same.
+        */
+
+       if (RGA_COLOR_FMT_IS_YUV(ctx->in.fmt->hw_format) &&
+           RGA_COLOR_FMT_IS_RGB(ctx->out.fmt->hw_format)) {
+               switch (ctx->in.colorspace) {
+               case V4L2_COLORSPACE_REC709:
+                       src_info.data.csc_mode = RGA_SRC_CSC_MODE_BT709_R0;
+                       break;
+               default:
+                       src_info.data.csc_mode = RGA_SRC_CSC_MODE_BT601_R0;
+                       break;
                }
        }
 
-       if (ctx->out.fmt->hw_format >= RGA_COLOR_FMT_YUV422SP) {
+       if (RGA_COLOR_FMT_IS_RGB(ctx->in.fmt->hw_format) &&
+           RGA_COLOR_FMT_IS_YUV(ctx->out.fmt->hw_format)) {
                switch (ctx->out.colorspace) {
                case V4L2_COLORSPACE_REC709:
                        dst_info.data.csc_mode = RGA_SRC_CSC_MODE_BT709_R0;
diff --git a/drivers/media/platform/rockchip/rga/rga-hw.h 
b/drivers/media/platform/rockchip/rga/rga-hw.h
index ca3c204abe42..3e4b70eb9ced 100644
--- a/drivers/media/platform/rockchip/rga/rga-hw.h
+++ b/drivers/media/platform/rockchip/rga/rga-hw.h
@@ -103,6 +103,11 @@
 #define RGA_COLOR_FMT_CP_8BPP 15
 #define RGA_COLOR_FMT_MASK 15
 
+#define RGA_COLOR_FMT_IS_YUV(fmt) \
+       (((fmt) >= RGA_COLOR_FMT_YUV422SP) && ((fmt) < RGA_COLOR_FMT_CP_1BPP))
+#define RGA_COLOR_FMT_IS_RGB(fmt) \
+       ((fmt) < RGA_COLOR_FMT_YUV422SP)
+
 #define RGA_COLOR_NONE_SWAP 0
 #define RGA_COLOR_RB_SWAP 1
 #define RGA_COLOR_ALPHA_SWAP 2
diff --git a/drivers/media/platform/vsp1/vsp1_dl.c 
b/drivers/media/platform/vsp1/vsp1_dl.c
index a5634ca85a31..a07caf981e15 100644
--- a/drivers/media/platform/vsp1/vsp1_dl.c
+++ b/drivers/media/platform/vsp1/vsp1_dl.c
@@ -431,6 +431,8 @@ vsp1_dl_cmd_pool_create(struct vsp1_device *vsp1, enum 
vsp1_extcmd_type type,
        if (!pool)
                return NULL;
 
+       pool->vsp1 = vsp1;
+
        spin_lock_init(&pool->lock);
        INIT_LIST_HEAD(&pool->free);
 
diff --git a/drivers/mfd/arizona-core.c b/drivers/mfd/arizona-core.c
index a4403a57ddc8..09acaa2cf74a 100644
--- a/drivers/mfd/arizona-core.c
+++ b/drivers/mfd/arizona-core.c
@@ -1433,6 +1433,15 @@ int arizona_dev_init(struct arizona *arizona)
        arizona_irq_exit(arizona);
 err_pm:
        pm_runtime_disable(arizona->dev);
+
+       switch (arizona->pdata.clk32k_src) {
+       case ARIZONA_32KZ_MCLK1:
+       case ARIZONA_32KZ_MCLK2:
+               arizona_clk32k_disable(arizona);
+               break;
+       default:
+               break;
+       }
 err_reset:
        arizona_enable_reset(arizona);
        regulator_disable(arizona->dcvdd);
@@ -1455,6 +1464,15 @@ int arizona_dev_exit(struct arizona *arizona)
        regulator_disable(arizona->dcvdd);
        regulator_put(arizona->dcvdd);
 
+       switch (arizona->pdata.clk32k_src) {
+       case ARIZONA_32KZ_MCLK1:
+       case ARIZONA_32KZ_MCLK2:
+               arizona_clk32k_disable(arizona);
+               break;
+       default:
+               break;
+       }
+
        mfd_remove_devices(arizona->dev);
        arizona_free_irq(arizona, ARIZONA_IRQ_UNDERCLOCKED, arizona);
        arizona_free_irq(arizona, ARIZONA_IRQ_OVERCLOCKED, arizona);
diff --git a/drivers/mfd/dln2.c b/drivers/mfd/dln2.c
index 6ea0dd37b453..fe614ba5fec9 100644
--- a/drivers/mfd/dln2.c
+++ b/drivers/mfd/dln2.c
@@ -290,7 +290,11 @@ static void dln2_rx(struct urb *urb)
        len = urb->actual_length - sizeof(struct dln2_header);
 
        if (handle == DLN2_HANDLE_EVENT) {
+               unsigned long flags;
+
+               spin_lock_irqsave(&dln2->event_cb_lock, flags);
                dln2_run_event_callbacks(dln2, id, echo, data, len);
+               spin_unlock_irqrestore(&dln2->event_cb_lock, flags);
        } else {
                /* URB will be re-submitted in _dln2_transfer (free_rx_slot) */
                if (dln2_transfer_complete(dln2, urb, handle, echo))
diff --git a/drivers/mmc/host/renesas_sdhi_internal_dmac.c 
b/drivers/mmc/host/renesas_sdhi_internal_dmac.c
index 382172fb3da8..74eea8247490 100644
--- a/drivers/mmc/host/renesas_sdhi_internal_dmac.c
+++ b/drivers/mmc/host/renesas_sdhi_internal_dmac.c
@@ -222,15 +222,12 @@ static void 
renesas_sdhi_internal_dmac_issue_tasklet_fn(unsigned long arg)
                                            DTRAN_CTRL_DM_START);
 }
 
-static void renesas_sdhi_internal_dmac_complete_tasklet_fn(unsigned long arg)
+static bool renesas_sdhi_internal_dmac_complete(struct tmio_mmc_host *host)
 {
-       struct tmio_mmc_host *host = (struct tmio_mmc_host *)arg;
        enum dma_data_direction dir;
 
-       spin_lock_irq(&host->lock);
-
        if (!host->data)
-               goto out;
+               return false;
 
        if (host->data->flags & MMC_DATA_READ)
                dir = DMA_FROM_DEVICE;
@@ -243,6 +240,17 @@ static void 
renesas_sdhi_internal_dmac_complete_tasklet_fn(unsigned long arg)
        if (dir == DMA_FROM_DEVICE)
                clear_bit(SDHI_INTERNAL_DMAC_RX_IN_USE, &global_flags);
 
+       return true;
+}
+
+static void renesas_sdhi_internal_dmac_complete_tasklet_fn(unsigned long arg)
+{
+       struct tmio_mmc_host *host = (struct tmio_mmc_host *)arg;
+
+       spin_lock_irq(&host->lock);
+       if (!renesas_sdhi_internal_dmac_complete(host))
+               goto out;
+
        tmio_mmc_do_data_irq(host);
 out:
        spin_unlock_irq(&host->lock);
diff --git a/drivers/net/ethernet/qualcomm/emac/emac.c 
b/drivers/net/ethernet/qualcomm/emac/emac.c
index 2a0cbc535a2e..19673ed929e6 100644
--- a/drivers/net/ethernet/qualcomm/emac/emac.c
+++ b/drivers/net/ethernet/qualcomm/emac/emac.c
@@ -493,13 +493,24 @@ static int emac_clks_phase1_init(struct platform_device 
*pdev,
 
        ret = clk_prepare_enable(adpt->clk[EMAC_CLK_CFG_AHB]);
        if (ret)
-               return ret;
+               goto disable_clk_axi;
 
        ret = clk_set_rate(adpt->clk[EMAC_CLK_HIGH_SPEED], 19200000);
        if (ret)
-               return ret;
+               goto disable_clk_cfg_ahb;
+
+       ret = clk_prepare_enable(adpt->clk[EMAC_CLK_HIGH_SPEED]);
+       if (ret)
+               goto disable_clk_cfg_ahb;
 
-       return clk_prepare_enable(adpt->clk[EMAC_CLK_HIGH_SPEED]);
+       return 0;
+
+disable_clk_cfg_ahb:
+       clk_disable_unprepare(adpt->clk[EMAC_CLK_CFG_AHB]);
+disable_clk_axi:
+       clk_disable_unprepare(adpt->clk[EMAC_CLK_AXI]);
+
+       return ret;
 }
 
 /* Enable clocks; needs emac_clks_phase1_init to be called before */
diff --git a/drivers/net/ethernet/stmicro/stmmac/dwmac-ipq806x.c 
b/drivers/net/ethernet/stmicro/stmmac/dwmac-ipq806x.c
index 4d75158c64b2..826626e870d5 100644
--- a/drivers/net/ethernet/stmicro/stmmac/dwmac-ipq806x.c
+++ b/drivers/net/ethernet/stmicro/stmmac/dwmac-ipq806x.c
@@ -350,6 +350,7 @@ static int ipq806x_gmac_probe(struct platform_device *pdev)
        plat_dat->has_gmac = true;
        plat_dat->bsp_priv = gmac;
        plat_dat->fix_mac_speed = ipq806x_gmac_fix_mac_speed;
+       plat_dat->multicast_filter_bins = 0;
 
        err = stmmac_dvr_probe(&pdev->dev, plat_dat, &stmmac_res);
        if (err)
diff --git a/drivers/net/ethernet/stmicro/stmmac/dwmac1000_core.c 
b/drivers/net/ethernet/stmicro/stmmac/dwmac1000_core.c
index e4e9a7591efe..4d617ba11ecb 100644
--- a/drivers/net/ethernet/stmicro/stmmac/dwmac1000_core.c
+++ b/drivers/net/ethernet/stmicro/stmmac/dwmac1000_core.c
@@ -176,6 +176,9 @@ static void dwmac1000_set_filter(struct mac_device_info *hw,
                value = GMAC_FRAME_FILTER_PR;
        } else if (dev->flags & IFF_ALLMULTI) {
                value = GMAC_FRAME_FILTER_PM;   /* pass all multi */
+       } else if (!netdev_mc_empty(dev) && (mcbitslog2 == 0)) {
+               /* Fall back to all multicast if we've no filter */
+               value = GMAC_FRAME_FILTER_PM;
        } else if (!netdev_mc_empty(dev)) {
                struct netdev_hw_addr *ha;
 
diff --git a/drivers/pci/bus.c b/drivers/pci/bus.c
index 5cb40b2518f9..87a2829dffd4 100644
--- a/drivers/pci/bus.c
+++ b/drivers/pci/bus.c
@@ -323,12 +323,8 @@ void pci_bus_add_device(struct pci_dev *dev)
 
        dev->match_driver = true;
        retval = device_attach(&dev->dev);
-       if (retval < 0 && retval != -EPROBE_DEFER) {
+       if (retval < 0 && retval != -EPROBE_DEFER)
                pci_warn(dev, "device attach failed (%d)\n", retval);
-               pci_proc_detach_device(dev);
-               pci_remove_sysfs_dev_files(dev);
-               return;
-       }
 
        pci_dev_assign_added(dev, true);
 }
diff --git a/drivers/pci/controller/dwc/pcie-qcom.c 
b/drivers/pci/controller/dwc/pcie-qcom.c
index e292801fff7f..1bdac298a943 100644
--- a/drivers/pci/controller/dwc/pcie-qcom.c
+++ b/drivers/pci/controller/dwc/pcie-qcom.c
@@ -45,7 +45,13 @@
 #define PCIE_CAP_CPL_TIMEOUT_DISABLE           0x10
 
 #define PCIE20_PARF_PHY_CTRL                   0x40
+#define PHY_CTRL_PHY_TX0_TERM_OFFSET_MASK      GENMASK(20, 16)
+#define PHY_CTRL_PHY_TX0_TERM_OFFSET(x)                ((x) << 16)
+
 #define PCIE20_PARF_PHY_REFCLK                 0x4C
+#define PHY_REFCLK_SSP_EN                      BIT(16)
+#define PHY_REFCLK_USE_PAD                     BIT(12)
+
 #define PCIE20_PARF_DBI_BASE_ADDR              0x168
 #define PCIE20_PARF_SLV_ADDR_SPACE_SIZE                0x16C
 #define PCIE20_PARF_MHI_CLOCK_RESET_CTRL       0x174
@@ -76,6 +82,18 @@
 #define DBI_RO_WR_EN                           1
 
 #define PERST_DELAY_US                         1000
+/* PARF registers */
+#define PCIE20_PARF_PCS_DEEMPH                 0x34
+#define PCS_DEEMPH_TX_DEEMPH_GEN1(x)           ((x) << 16)
+#define PCS_DEEMPH_TX_DEEMPH_GEN2_3_5DB(x)     ((x) << 8)
+#define PCS_DEEMPH_TX_DEEMPH_GEN2_6DB(x)       ((x) << 0)
+
+#define PCIE20_PARF_PCS_SWING                  0x38
+#define PCS_SWING_TX_SWING_FULL(x)             ((x) << 8)
+#define PCS_SWING_TX_SWING_LOW(x)              ((x) << 0)
+
+#define PCIE20_PARF_CONFIG_BITS                0x50
+#define PHY_RX0_EQ(x)                          ((x) << 24)
 
 #define PCIE20_v3_PARF_SLV_ADDR_SPACE_SIZE     0x358
 #define SLV_ADDR_SPACE_SZ                      0x10000000
@@ -275,6 +293,7 @@ static int qcom_pcie_init_2_1_0(struct qcom_pcie *pcie)
        struct qcom_pcie_resources_2_1_0 *res = &pcie->res.v2_1_0;
        struct dw_pcie *pci = pcie->pci;
        struct device *dev = pci->dev;
+       struct device_node *node = dev->of_node;
        u32 val;
        int ret;
 
@@ -319,9 +338,29 @@ static int qcom_pcie_init_2_1_0(struct qcom_pcie *pcie)
        val &= ~BIT(0);
        writel(val, pcie->parf + PCIE20_PARF_PHY_CTRL);
 
+       if (of_device_is_compatible(node, "qcom,pcie-ipq8064")) {
+               writel(PCS_DEEMPH_TX_DEEMPH_GEN1(24) |
+                              PCS_DEEMPH_TX_DEEMPH_GEN2_3_5DB(24) |
+                              PCS_DEEMPH_TX_DEEMPH_GEN2_6DB(34),
+                      pcie->parf + PCIE20_PARF_PCS_DEEMPH);
+               writel(PCS_SWING_TX_SWING_FULL(120) |
+                              PCS_SWING_TX_SWING_LOW(120),
+                      pcie->parf + PCIE20_PARF_PCS_SWING);
+               writel(PHY_RX0_EQ(4), pcie->parf + PCIE20_PARF_CONFIG_BITS);
+       }
+
+       if (of_device_is_compatible(node, "qcom,pcie-ipq8064")) {
+               /* set TX termination offset */
+               val = readl(pcie->parf + PCIE20_PARF_PHY_CTRL);
+               val &= ~PHY_CTRL_PHY_TX0_TERM_OFFSET_MASK;
+               val |= PHY_CTRL_PHY_TX0_TERM_OFFSET(7);
+               writel(val, pcie->parf + PCIE20_PARF_PHY_CTRL);
+       }
+
        /* enable external reference clock */
        val = readl(pcie->parf + PCIE20_PARF_PHY_REFCLK);
-       val |= BIT(16);
+       val &= ~PHY_REFCLK_USE_PAD;
+       val |= PHY_REFCLK_SSP_EN;
        writel(val, pcie->parf + PCIE20_PARF_PHY_REFCLK);
 
        ret = reset_control_deassert(res->phy_reset);
diff --git a/drivers/pci/hotplug/acpiphp_glue.c 
b/drivers/pci/hotplug/acpiphp_glue.c
index c94c13525447..be35bbfa6968 100644
--- a/drivers/pci/hotplug/acpiphp_glue.c
+++ b/drivers/pci/hotplug/acpiphp_glue.c
@@ -122,13 +122,21 @@ static struct acpiphp_context 
*acpiphp_grab_context(struct acpi_device *adev)
        struct acpiphp_context *context;
 
        acpi_lock_hp_context();
+
        context = acpiphp_get_context(adev);
-       if (!context || context->func.parent->is_going_away) {
-               acpi_unlock_hp_context();
-               return NULL;
+       if (!context)
+               goto unlock;
+
+       if (context->func.parent->is_going_away) {
+               acpiphp_put_context(context);
+               context = NULL;
+               goto unlock;
        }
+
        get_bridge(context->func.parent);
        acpiphp_put_context(context);
+
+unlock:
        acpi_unlock_hp_context();
        return context;
 }
diff --git a/drivers/pci/probe.c b/drivers/pci/probe.c
index cbc0d8da7483..9a5b6a8e2502 100644
--- a/drivers/pci/probe.c
+++ b/drivers/pci/probe.c
@@ -348,6 +348,57 @@ static void pci_read_bases(struct pci_dev *dev, unsigned 
int howmany, int rom)
        }
 }
 
+static void pci_read_bridge_windows(struct pci_dev *bridge)
+{
+       u16 io;
+       u32 pmem, tmp;
+
+       pci_read_config_word(bridge, PCI_IO_BASE, &io);
+       if (!io) {
+               pci_write_config_word(bridge, PCI_IO_BASE, 0xe0f0);
+               pci_read_config_word(bridge, PCI_IO_BASE, &io);
+               pci_write_config_word(bridge, PCI_IO_BASE, 0x0);
+       }
+       if (io)
+               bridge->io_window = 1;
+
+       /*
+        * DECchip 21050 pass 2 errata: the bridge may miss an address
+        * disconnect boundary by one PCI data phase.  Workaround: do not
+        * use prefetching on this device.
+        */
+       if (bridge->vendor == PCI_VENDOR_ID_DEC && bridge->device == 0x0001)
+               return;
+
+       pci_read_config_dword(bridge, PCI_PREF_MEMORY_BASE, &pmem);
+       if (!pmem) {
+               pci_write_config_dword(bridge, PCI_PREF_MEMORY_BASE,
+                                              0xffe0fff0);
+               pci_read_config_dword(bridge, PCI_PREF_MEMORY_BASE, &pmem);
+               pci_write_config_dword(bridge, PCI_PREF_MEMORY_BASE, 0x0);
+       }
+       if (!pmem)
+               return;
+
+       bridge->pref_window = 1;
+
+       if ((pmem & PCI_PREF_RANGE_TYPE_MASK) == PCI_PREF_RANGE_TYPE_64) {
+
+               /*
+                * Bridge claims to have a 64-bit prefetchable memory
+                * window; verify that the upper bits are actually
+                * writable.
+                */
+               pci_read_config_dword(bridge, PCI_PREF_BASE_UPPER32, &pmem);
+               pci_write_config_dword(bridge, PCI_PREF_BASE_UPPER32,
+                                      0xffffffff);
+               pci_read_config_dword(bridge, PCI_PREF_BASE_UPPER32, &tmp);
+               pci_write_config_dword(bridge, PCI_PREF_BASE_UPPER32, pmem);
+               if (tmp)
+                       bridge->pref_64_window = 1;
+       }
+}
+
 static void pci_read_bridge_io(struct pci_bus *child)
 {
        struct pci_dev *dev = child->self;
@@ -1712,6 +1763,7 @@ int pci_setup_device(struct pci_dev *dev)
                pci_read_irq(dev);
                dev->transparent = ((dev->class & 0xff) == 1);
                pci_read_bases(dev, 2, PCI_ROM_ADDRESS1);
+               pci_read_bridge_windows(dev);
                set_pcie_hotplug_bridge(dev);
                pos = pci_find_capability(dev, PCI_CAP_ID_SSVID);
                if (pos) {
diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c
index 9129ccd593d1..af2149632102 100644
--- a/drivers/pci/quirks.c
+++ b/drivers/pci/quirks.c
@@ -5068,7 +5068,8 @@ DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_SERVERWORKS, 
0x0422, quirk_no_ext_tags);
  */
 static void quirk_amd_harvest_no_ats(struct pci_dev *pdev)
 {
-       if (pdev->device == 0x7340 && pdev->revision != 0xc5)
+       if ((pdev->device == 0x7312 && pdev->revision != 0x00) ||
+           (pdev->device == 0x7340 && pdev->revision != 0xc5))
                return;
 
        pci_info(pdev, "disabling ATS\n");
@@ -5079,6 +5080,8 @@ static void quirk_amd_harvest_no_ats(struct pci_dev *pdev)
 DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_ATI, 0x98e4, quirk_amd_harvest_no_ats);
 /* AMD Iceland dGPU */
 DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_ATI, 0x6900, quirk_amd_harvest_no_ats);
+/* AMD Navi10 dGPU */
+DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_ATI, 0x7312, quirk_amd_harvest_no_ats);
 /* AMD Navi14 dGPU */
 DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_ATI, 0x7340, quirk_amd_harvest_no_ats);
 #endif /* CONFIG_PCI_ATS */
diff --git a/drivers/pci/setup-bus.c b/drivers/pci/setup-bus.c
index 8e5b00a420a5..87c8190de622 100644
--- a/drivers/pci/setup-bus.c
+++ b/drivers/pci/setup-bus.c
@@ -735,58 +735,21 @@ int pci_claim_bridge_resource(struct pci_dev *bridge, int 
i)
    base/limit registers must be read-only and read as 0. */
 static void pci_bridge_check_ranges(struct pci_bus *bus)
 {
-       u16 io;
-       u32 pmem;
        struct pci_dev *bridge = bus->self;
-       struct resource *b_res;
+       struct resource *b_res = &bridge->resource[PCI_BRIDGE_RESOURCES];
 
-       b_res = &bridge->resource[PCI_BRIDGE_RESOURCES];
        b_res[1].flags |= IORESOURCE_MEM;
 
-       pci_read_config_word(bridge, PCI_IO_BASE, &io);
-       if (!io) {
-               pci_write_config_word(bridge, PCI_IO_BASE, 0xe0f0);
-               pci_read_config_word(bridge, PCI_IO_BASE, &io);
-               pci_write_config_word(bridge, PCI_IO_BASE, 0x0);
-       }
-       if (io)
+       if (bridge->io_window)
                b_res[0].flags |= IORESOURCE_IO;
 
-       /*  DECchip 21050 pass 2 errata: the bridge may miss an address
-           disconnect boundary by one PCI data phase.
-           Workaround: do not use prefetching on this device. */
-       if (bridge->vendor == PCI_VENDOR_ID_DEC && bridge->device == 0x0001)
-               return;
-
-       pci_read_config_dword(bridge, PCI_PREF_MEMORY_BASE, &pmem);
-       if (!pmem) {
-               pci_write_config_dword(bridge, PCI_PREF_MEMORY_BASE,
-                                              0xffe0fff0);
-               pci_read_config_dword(bridge, PCI_PREF_MEMORY_BASE, &pmem);
-               pci_write_config_dword(bridge, PCI_PREF_MEMORY_BASE, 0x0);
-       }
-       if (pmem) {
+       if (bridge->pref_window) {
                b_res[2].flags |= IORESOURCE_MEM | IORESOURCE_PREFETCH;
-               if ((pmem & PCI_PREF_RANGE_TYPE_MASK) ==
-                   PCI_PREF_RANGE_TYPE_64) {
+               if (bridge->pref_64_window) {
                        b_res[2].flags |= IORESOURCE_MEM_64;
                        b_res[2].flags |= PCI_PREF_RANGE_TYPE_64;
                }
        }
-
-       /* double check if bridge does support 64 bit pref */
-       if (b_res[2].flags & IORESOURCE_MEM_64) {
-               u32 mem_base_hi, tmp;
-               pci_read_config_dword(bridge, PCI_PREF_BASE_UPPER32,
-                                        &mem_base_hi);
-               pci_write_config_dword(bridge, PCI_PREF_BASE_UPPER32,
-                                              0xffffffff);
-               pci_read_config_dword(bridge, PCI_PREF_BASE_UPPER32, &tmp);
-               if (!tmp)
-                       b_res[2].flags &= ~IORESOURCE_MEM_64;
-               pci_write_config_dword(bridge, PCI_PREF_BASE_UPPER32,
-                                      mem_base_hi);
-       }
 }
 
 /* Helper function for sizing routines: find first available
diff --git a/drivers/pwm/pwm-bcm-iproc.c b/drivers/pwm/pwm-bcm-iproc.c
index 31b01035d0ab..8cfba3614e60 100644
--- a/drivers/pwm/pwm-bcm-iproc.c
+++ b/drivers/pwm/pwm-bcm-iproc.c
@@ -85,8 +85,6 @@ static void iproc_pwmc_get_state(struct pwm_chip *chip, 
struct pwm_device *pwm,
        u64 tmp, multi, rate;
        u32 value, prescale;
 
-       rate = clk_get_rate(ip->clk);
-
        value = readl(ip->base + IPROC_PWM_CTRL_OFFSET);
 
        if (value & BIT(IPROC_PWM_CTRL_EN_SHIFT(pwm->hwpwm)))
@@ -99,6 +97,13 @@ static void iproc_pwmc_get_state(struct pwm_chip *chip, 
struct pwm_device *pwm,
        else
                state->polarity = PWM_POLARITY_INVERSED;
 
+       rate = clk_get_rate(ip->clk);
+       if (rate == 0) {
+               state->period = 0;
+               state->duty_cycle = 0;
+               return;
+       }
+
        value = readl(ip->base + IPROC_PWM_PRESCALE_OFFSET);
        prescale = value >> IPROC_PWM_PRESCALE_SHIFT(pwm->hwpwm);
        prescale &= IPROC_PWM_PRESCALE_MAX;
diff --git a/drivers/remoteproc/qcom_q6v5.c b/drivers/remoteproc/qcom_q6v5.c
index 0d33e3079f0d..ef61cb709acd 100644
--- a/drivers/remoteproc/qcom_q6v5.c
+++ b/drivers/remoteproc/qcom_q6v5.c
@@ -151,6 +151,8 @@ int qcom_q6v5_request_stop(struct qcom_q6v5 *q6v5)
 {
        int ret;
 
+       q6v5->running = false;
+
        qcom_smem_state_update_bits(q6v5->state,
                                    BIT(q6v5->stop_bit), BIT(q6v5->stop_bit));
 
diff --git a/drivers/scsi/lpfc/lpfc_nvmet.c b/drivers/scsi/lpfc/lpfc_nvmet.c
index 768eba8c111d..5bc33817568e 100644
--- a/drivers/scsi/lpfc/lpfc_nvmet.c
+++ b/drivers/scsi/lpfc/lpfc_nvmet.c
@@ -1712,7 +1712,7 @@ lpfc_nvmet_destroy_targetport(struct lpfc_hba *phba)
                }
                tgtp->tport_unreg_cmp = &tport_unreg_cmp;
                nvmet_fc_unregister_targetport(phba->targetport);
-               if (!wait_for_completion_timeout(tgtp->tport_unreg_cmp,
+               if (!wait_for_completion_timeout(&tport_unreg_cmp,
                                        msecs_to_jiffies(LPFC_NVMET_WAIT_TMO)))
                        lpfc_printf_log(phba, KERN_ERR, LOG_NVME,
                                        "6179 Unreg targetport %p timeout "
diff --git a/drivers/usb/serial/ftdi_sio.c b/drivers/usb/serial/ftdi_sio.c
index 3c0f38cd3a5a..ce9cc1f90b05 100644
--- a/drivers/usb/serial/ftdi_sio.c
+++ b/drivers/usb/serial/ftdi_sio.c
@@ -2037,12 +2037,11 @@ static int ftdi_prepare_write_buffer(struct 
usb_serial_port *port,
 #define FTDI_RS_ERR_MASK (FTDI_RS_BI | FTDI_RS_PE | FTDI_RS_FE | FTDI_RS_OE)
 
 static int ftdi_process_packet(struct usb_serial_port *port,
-               struct ftdi_private *priv, char *packet, int len)
+               struct ftdi_private *priv, unsigned char *buf, int len)
 {
+       unsigned char status;
        int i;
-       char status;
        char flag;
-       char *ch;
 
        if (len < 2) {
                dev_dbg(&port->dev, "malformed packet\n");
@@ -2052,7 +2051,7 @@ static int ftdi_process_packet(struct usb_serial_port 
*port,
        /* Compare new line status to the old one, signal if different/
           N.B. packet may be processed more than once, but differences
           are only processed once.  */
-       status = packet[0] & FTDI_STATUS_B0_MASK;
+       status = buf[0] & FTDI_STATUS_B0_MASK;
        if (status != priv->prev_status) {
                char diff_status = status ^ priv->prev_status;
 
@@ -2078,13 +2077,12 @@ static int ftdi_process_packet(struct usb_serial_port 
*port,
        }
 
        /* save if the transmitter is empty or not */
-       if (packet[1] & FTDI_RS_TEMT)
+       if (buf[1] & FTDI_RS_TEMT)
                priv->transmit_empty = 1;
        else
                priv->transmit_empty = 0;
 
-       len -= 2;
-       if (!len)
+       if (len == 2)
                return 0;       /* status only */
 
        /*
@@ -2092,40 +2090,41 @@ static int ftdi_process_packet(struct usb_serial_port 
*port,
         * data payload to avoid over-reporting.
         */
        flag = TTY_NORMAL;
-       if (packet[1] & FTDI_RS_ERR_MASK) {
+       if (buf[1] & FTDI_RS_ERR_MASK) {
                /* Break takes precedence over parity, which takes precedence
                 * over framing errors */
-               if (packet[1] & FTDI_RS_BI) {
+               if (buf[1] & FTDI_RS_BI) {
                        flag = TTY_BREAK;
                        port->icount.brk++;
                        usb_serial_handle_break(port);
-               } else if (packet[1] & FTDI_RS_PE) {
+               } else if (buf[1] & FTDI_RS_PE) {
                        flag = TTY_PARITY;
                        port->icount.parity++;
-               } else if (packet[1] & FTDI_RS_FE) {
+               } else if (buf[1] & FTDI_RS_FE) {
                        flag = TTY_FRAME;
                        port->icount.frame++;
                }
                /* Overrun is special, not associated with a char */
-               if (packet[1] & FTDI_RS_OE) {
+               if (buf[1] & FTDI_RS_OE) {
                        port->icount.overrun++;
                        tty_insert_flip_char(&port->port, 0, TTY_OVERRUN);
                }
        }
 
-       port->icount.rx += len;
-       ch = packet + 2;
+       port->icount.rx += len - 2;
 
        if (port->port.console && port->sysrq) {
-               for (i = 0; i < len; i++, ch++) {
-                       if (!usb_serial_handle_sysrq_char(port, *ch))
-                               tty_insert_flip_char(&port->port, *ch, flag);
+               for (i = 2; i < len; i++) {
+                       if (usb_serial_handle_sysrq_char(port, buf[i]))
+                               continue;
+                       tty_insert_flip_char(&port->port, buf[i], flag);
                }
        } else {
-               tty_insert_flip_string_fixed_flag(&port->port, ch, flag, len);
+               tty_insert_flip_string_fixed_flag(&port->port, buf + 2, flag,
+                               len - 2);
        }
 
-       return len;
+       return len - 2;
 }
 
 static void ftdi_process_read_urb(struct urb *urb)
diff --git a/drivers/watchdog/f71808e_wdt.c b/drivers/watchdog/f71808e_wdt.c
index 9a1c761258ce..5d0ea419070d 100644
--- a/drivers/watchdog/f71808e_wdt.c
+++ b/drivers/watchdog/f71808e_wdt.c
@@ -688,9 +688,9 @@ static int __init watchdog_init(int sioaddr)
         * into the module have been registered yet.
         */
        watchdog.sioaddr = sioaddr;
-       watchdog.ident.options = WDIOC_SETTIMEOUT
-                               | WDIOF_MAGICCLOSE
-                               | WDIOF_KEEPALIVEPING;
+       watchdog.ident.options = WDIOF_MAGICCLOSE
+                               | WDIOF_KEEPALIVEPING
+                               | WDIOF_CARDRESET;
 
        snprintf(watchdog.ident.identity,
                sizeof(watchdog.ident.identity), "%s watchdog",
@@ -704,6 +704,13 @@ static int __init watchdog_init(int sioaddr)
        wdt_conf = superio_inb(sioaddr, F71808FG_REG_WDT_CONF);
        watchdog.caused_reboot = wdt_conf & BIT(F71808FG_FLAG_WDTMOUT_STS);
 
+       /*
+        * We don't want WDTMOUT_STS to stick around till regular reboot.
+        * Write 1 to the bit to clear it to zero.
+        */
+       superio_outb(sioaddr, F71808FG_REG_WDT_CONF,
+                    wdt_conf | BIT(F71808FG_FLAG_WDTMOUT_STS));
+
        superio_exit(sioaddr);
 
        err = watchdog_set_timeout(timeout);
diff --git a/drivers/watchdog/watchdog_dev.c b/drivers/watchdog/watchdog_dev.c
index 10b2090f3e5e..1c322caecf7f 100644
--- a/drivers/watchdog/watchdog_dev.c
+++ b/drivers/watchdog/watchdog_dev.c
@@ -947,6 +947,15 @@ static int watchdog_cdev_register(struct watchdog_device 
*wdd)
        if (IS_ERR_OR_NULL(watchdog_kworker))
                return -ENODEV;
 
+       device_initialize(&wd_data->dev);
+       wd_data->dev.devt = MKDEV(MAJOR(watchdog_devt), wdd->id);
+       wd_data->dev.class = &watchdog_class;
+       wd_data->dev.parent = wdd->parent;
+       wd_data->dev.groups = wdd->groups;
+       wd_data->dev.release = watchdog_core_data_release;
+       dev_set_drvdata(&wd_data->dev, wdd);
+       dev_set_name(&wd_data->dev, "watchdog%d", wdd->id);
+
        kthread_init_work(&wd_data->work, watchdog_ping_work);
        hrtimer_init(&wd_data->timer, CLOCK_MONOTONIC, HRTIMER_MODE_REL);
        wd_data->timer.function = watchdog_timer_expired;
@@ -967,15 +976,6 @@ static int watchdog_cdev_register(struct watchdog_device 
*wdd)
                }
        }
 
-       device_initialize(&wd_data->dev);
-       wd_data->dev.devt = MKDEV(MAJOR(watchdog_devt), wdd->id);
-       wd_data->dev.class = &watchdog_class;
-       wd_data->dev.parent = wdd->parent;
-       wd_data->dev.groups = wdd->groups;
-       wd_data->dev.release = watchdog_core_data_release;
-       dev_set_drvdata(&wd_data->dev, wdd);
-       dev_set_name(&wd_data->dev, "watchdog%d", wdd->id);
-
        /* Fill in the data structures */
        cdev_init(&wd_data->cdev, &watchdog_fops);
 
diff --git a/fs/btrfs/disk-io.c b/fs/btrfs/disk-io.c
index 9740f7b5d4fb..3130844e219c 100644
--- a/fs/btrfs/disk-io.c
+++ b/fs/btrfs/disk-io.c
@@ -1500,9 +1500,16 @@ int btrfs_init_fs_root(struct btrfs_root *root)
        spin_lock_init(&root->ino_cache_lock);
        init_waitqueue_head(&root->ino_cache_wait);
 
-       ret = get_anon_bdev(&root->anon_dev);
-       if (ret)
-               goto fail;
+       /*
+        * Don't assign anonymous block device to roots that are not exposed to
+        * userspace, the id pool is limited to 1M
+        */
+       if (is_fstree(root->root_key.objectid) &&
+           btrfs_root_refs(&root->root_item) > 0) {
+               ret = get_anon_bdev(&root->anon_dev);
+               if (ret)
+                       goto fail;
+       }
 
        mutex_lock(&root->objectid_mutex);
        ret = btrfs_find_highest_objectid(root,
diff --git a/fs/btrfs/free-space-cache.c b/fs/btrfs/free-space-cache.c
index c9965e89097f..4c65305fd418 100644
--- a/fs/btrfs/free-space-cache.c
+++ b/fs/btrfs/free-space-cache.c
@@ -2169,7 +2169,7 @@ static int insert_into_bitmap(struct btrfs_free_space_ctl 
*ctl,
 static bool try_merge_free_space(struct btrfs_free_space_ctl *ctl,
                          struct btrfs_free_space *info, bool update_stat)
 {
-       struct btrfs_free_space *left_info;
+       struct btrfs_free_space *left_info = NULL;
        struct btrfs_free_space *right_info;
        bool merged = false;
        u64 offset = info->offset;
@@ -2184,7 +2184,7 @@ static bool try_merge_free_space(struct 
btrfs_free_space_ctl *ctl,
        if (right_info && rb_prev(&right_info->offset_index))
                left_info = rb_entry(rb_prev(&right_info->offset_index),
                                     struct btrfs_free_space, offset_index);
-       else
+       else if (!right_info)
                left_info = tree_search_offset(ctl, offset - 1, 0, 0);
 
        if (right_info && !right_info->bitmap) {
diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c
index 7befb7c12bd3..1656ef0e959f 100644
--- a/fs/btrfs/inode.c
+++ b/fs/btrfs/inode.c
@@ -4458,6 +4458,8 @@ int btrfs_delete_subvolume(struct inode *dir, struct 
dentry *dentry)
                }
        }
 
+       free_anon_bdev(dest->anon_dev);
+       dest->anon_dev = 0;
 out_end_trans:
        trans->block_rsv = NULL;
        trans->bytes_reserved = 0;
@@ -7012,7 +7014,7 @@ struct extent_map *btrfs_get_extent(struct btrfs_inode 
*inode,
            found_type == BTRFS_FILE_EXTENT_PREALLOC) {
                /* Only regular file could have regular/prealloc extent */
                if (!S_ISREG(inode->vfs_inode.i_mode)) {
-                       ret = -EUCLEAN;
+                       err = -EUCLEAN;
                        btrfs_crit(fs_info,
                "regular/prealloc extent found for non-regular inode %llu",
                                   btrfs_ino(inode));
diff --git a/fs/btrfs/ref-verify.c b/fs/btrfs/ref-verify.c
index dbc685ca017f..5dec52bd2897 100644
--- a/fs/btrfs/ref-verify.c
+++ b/fs/btrfs/ref-verify.c
@@ -297,6 +297,8 @@ static struct block_entry *add_block_entry(struct 
btrfs_fs_info *fs_info,
                        exist_re = insert_root_entry(&exist->roots, re);
                        if (exist_re)
                                kfree(re);
+               } else {
+                       kfree(re);
                }
                kfree(be);
                return exist;
diff --git a/fs/btrfs/super.c b/fs/btrfs/super.c
index 6a5b16a119ed..ed539496089f 100644
--- a/fs/btrfs/super.c
+++ b/fs/btrfs/super.c
@@ -432,6 +432,7 @@ int btrfs_parse_options(struct btrfs_fs_info *info, char 
*options,
        char *compress_type;
        bool compress_force = false;
        enum btrfs_compression_type saved_compress_type;
+       int saved_compress_level;
        bool saved_compress_force;
        int no_compress = 0;
 
@@ -514,6 +515,7 @@ int btrfs_parse_options(struct btrfs_fs_info *info, char 
*options,
                                info->compress_type : BTRFS_COMPRESS_NONE;
                        saved_compress_force =
                                btrfs_test_opt(info, FORCE_COMPRESS);
+                       saved_compress_level = info->compress_level;
                        if (token == Opt_compress ||
                            token == Opt_compress_force ||
                            strncmp(args[0].from, "zlib", 4) == 0) {
@@ -552,6 +554,8 @@ int btrfs_parse_options(struct btrfs_fs_info *info, char 
*options,
                                no_compress = 0;
                        } else if (strncmp(args[0].from, "no", 2) == 0) {
                                compress_type = "no";
+                               info->compress_level = 0;
+                               info->compress_type = 0;
                                btrfs_clear_opt(info->mount_opt, COMPRESS);
                                btrfs_clear_opt(info->mount_opt, 
FORCE_COMPRESS);
                                compress_force = false;
@@ -572,11 +576,11 @@ int btrfs_parse_options(struct btrfs_fs_info *info, char 
*options,
                                 */
                                btrfs_clear_opt(info->mount_opt, 
FORCE_COMPRESS);
                        }
-                       if ((btrfs_test_opt(info, COMPRESS) &&
-                            (info->compress_type != saved_compress_type ||
-                             compress_force != saved_compress_force)) ||
-                           (!btrfs_test_opt(info, COMPRESS) &&
-                            no_compress == 1)) {
+                       if (no_compress == 1) {
+                               btrfs_info(info, "use no compression");
+                       } else if ((info->compress_type != saved_compress_type) 
||
+                                  (compress_force != saved_compress_force) ||
+                                  (info->compress_level != 
saved_compress_level)) {
                                btrfs_info(info, "%s %s compression, level %d",
                                           (compress_force) ? "force" : "use",
                                           compress_type, info->compress_level);
@@ -2314,9 +2318,7 @@ static int btrfs_unfreeze(struct super_block *sb)
 static int btrfs_show_devname(struct seq_file *m, struct dentry *root)
 {
        struct btrfs_fs_info *fs_info = btrfs_sb(root->d_sb);
-       struct btrfs_fs_devices *cur_devices;
        struct btrfs_device *dev, *first_dev = NULL;
-       struct list_head *head;
 
        /*
         * Lightweight locking of the devices. We should not need
@@ -2326,18 +2328,13 @@ static int btrfs_show_devname(struct seq_file *m, 
struct dentry *root)
         * least until until the rcu_read_unlock.
         */
        rcu_read_lock();
-       cur_devices = fs_info->fs_devices;
-       while (cur_devices) {
-               head = &cur_devices->devices;
-               list_for_each_entry_rcu(dev, head, dev_list) {
-                       if (test_bit(BTRFS_DEV_STATE_MISSING, &dev->dev_state))
-                               continue;
-                       if (!dev->name)
-                               continue;
-                       if (!first_dev || dev->devid < first_dev->devid)
-                               first_dev = dev;
-               }
-               cur_devices = cur_devices->seed;
+       list_for_each_entry_rcu(dev, &fs_info->fs_devices->devices, dev_list) {
+               if (test_bit(BTRFS_DEV_STATE_MISSING, &dev->dev_state))
+                       continue;
+               if (!dev->name)
+                       continue;
+               if (!first_dev || dev->devid < first_dev->devid)
+                       first_dev = dev;
        }
 
        if (first_dev)
diff --git a/fs/btrfs/tree-log.c b/fs/btrfs/tree-log.c
index 928ac2c4899e..090315f4ac78 100644
--- a/fs/btrfs/tree-log.c
+++ b/fs/btrfs/tree-log.c
@@ -3988,11 +3988,8 @@ static noinline int copy_items(struct btrfs_trans_handle 
*trans,
                                                fs_info->csum_root,
                                                ds + cs, ds + cs + cl - 1,
                                                &ordered_sums, 0);
-                               if (ret) {
-                                       btrfs_release_path(dst_path);
-                                       kfree(ins_data);
-                                       return ret;
-                               }
+                               if (ret)
+                                       break;
                        }
                }
        }
@@ -4005,7 +4002,6 @@ static noinline int copy_items(struct btrfs_trans_handle 
*trans,
         * we have to do this after the loop above to avoid changing the
         * log tree while trying to change the log tree.
         */
-       ret = 0;
        while (!list_empty(&ordered_sums)) {
                struct btrfs_ordered_sum *sums = list_entry(ordered_sums.next,
                                                   struct btrfs_ordered_sum,
diff --git a/fs/btrfs/volumes.c b/fs/btrfs/volumes.c
index e0ba1e9ddcdf..4abb2a155ac5 100644
--- a/fs/btrfs/volumes.c
+++ b/fs/btrfs/volumes.c
@@ -155,7 +155,9 @@ static int __btrfs_map_block(struct btrfs_fs_info *fs_info,
  *
  * global::fs_devs - add, remove, updates to the global list
  *
- * does not protect: manipulation of the fs_devices::devices list!
+ * does not protect: manipulation of the fs_devices::devices list in general
+ * but in mount context it could be used to exclude list modifications by eg.
+ * scan ioctl
  *
  * btrfs_device::name - renames (write side), read is RCU
  *
@@ -168,6 +170,9 @@ static int __btrfs_map_block(struct btrfs_fs_info *fs_info,
  * may be used to exclude some operations from running concurrently without any
  * modifications to the list (see write_all_supers)
  *
+ * Is not required at mount and close times, because our device list is
+ * protected by the uuid_mutex at that point.
+ *
  * balance_mutex
  * -------------
  * protects balance structures (status, state) and context accessed from
@@ -656,6 +661,11 @@ static void btrfs_free_stale_devices(const char *path,
        }
 }
 
+/*
+ * This is only used on mount, and we are protected from competing things
+ * messing with our fs_devices by the uuid_mutex, thus we do not need the
+ * fs_devices->device_list_mutex here.
+ */
 static int btrfs_open_one_device(struct btrfs_fs_devices *fs_devices,
                        struct btrfs_device *device, fmode_t flags,
                        void *holder)
@@ -1153,8 +1163,14 @@ int btrfs_open_devices(struct btrfs_fs_devices 
*fs_devices,
        int ret;
 
        lockdep_assert_held(&uuid_mutex);
+       /*
+        * The device_list_mutex cannot be taken here in case opening the
+        * underlying device takes further locks like bd_mutex.
+        *
+        * We also don't need the lock here as this is called during mount and
+        * exclusion is provided by uuid_mutex
+        */
 
-       mutex_lock(&fs_devices->device_list_mutex);
        if (fs_devices->opened) {
                fs_devices->opened++;
                ret = 0;
@@ -1162,7 +1178,6 @@ int btrfs_open_devices(struct btrfs_fs_devices 
*fs_devices,
                list_sort(NULL, &fs_devices->devices, devid_cmp);
                ret = open_fs_devices(fs_devices, flags, holder);
        }
-       mutex_unlock(&fs_devices->device_list_mutex);
 
        return ret;
 }
diff --git a/fs/cifs/smb2misc.c b/fs/cifs/smb2misc.c
index 14265b4bbcc0..2fc96f7923ee 100644
--- a/fs/cifs/smb2misc.c
+++ b/fs/cifs/smb2misc.c
@@ -509,15 +509,31 @@ cifs_ses_oplock_break(struct work_struct *work)
        kfree(lw);
 }
 
+static void
+smb2_queue_pending_open_break(struct tcon_link *tlink, __u8 *lease_key,
+                             __le32 new_lease_state)
+{
+       struct smb2_lease_break_work *lw;
+
+       lw = kmalloc(sizeof(struct smb2_lease_break_work), GFP_KERNEL);
+       if (!lw) {
+               cifs_put_tlink(tlink);
+               return;
+       }
+
+       INIT_WORK(&lw->lease_break, cifs_ses_oplock_break);
+       lw->tlink = tlink;
+       lw->lease_state = new_lease_state;
+       memcpy(lw->lease_key, lease_key, SMB2_LEASE_KEY_SIZE);
+       queue_work(cifsiod_wq, &lw->lease_break);
+}
+
 static bool
-smb2_tcon_has_lease(struct cifs_tcon *tcon, struct smb2_lease_break *rsp,
-                   struct smb2_lease_break_work *lw)
+smb2_tcon_has_lease(struct cifs_tcon *tcon, struct smb2_lease_break *rsp)
 {
-       bool found;
        __u8 lease_state;
        struct list_head *tmp;
        struct cifsFileInfo *cfile;
-       struct cifs_pending_open *open;
        struct cifsInodeInfo *cinode;
        int ack_req = le32_to_cpu(rsp->Flags &
                                  SMB2_NOTIFY_BREAK_LEASE_FLAG_ACK_REQUIRED);
@@ -556,22 +572,29 @@ smb2_tcon_has_lease(struct cifs_tcon *tcon, struct 
smb2_lease_break *rsp,
                                  &cinode->flags);
 
                cifs_queue_oplock_break(cfile);
-               kfree(lw);
                return true;
        }
 
-       found = false;
+       return false;
+}
+
+static struct cifs_pending_open *
+smb2_tcon_find_pending_open_lease(struct cifs_tcon *tcon,
+                                 struct smb2_lease_break *rsp)
+{
+       __u8 lease_state = le32_to_cpu(rsp->NewLeaseState);
+       int ack_req = le32_to_cpu(rsp->Flags &
+                                 SMB2_NOTIFY_BREAK_LEASE_FLAG_ACK_REQUIRED);
+       struct cifs_pending_open *open;
+       struct cifs_pending_open *found = NULL;
+
        list_for_each_entry(open, &tcon->pending_opens, olist) {
                if (memcmp(open->lease_key, rsp->LeaseKey,
                           SMB2_LEASE_KEY_SIZE))
                        continue;
 
                if (!found && ack_req) {
-                       found = true;
-                       memcpy(lw->lease_key, open->lease_key,
-                              SMB2_LEASE_KEY_SIZE);
-                       lw->tlink = cifs_get_tlink(open->tlink);
-                       queue_work(cifsiod_wq, &lw->lease_break);
+                       found = open;
                }
 
                cifs_dbg(FYI, "found in the pending open list\n");
@@ -592,14 +615,7 @@ smb2_is_valid_lease_break(char *buffer)
        struct TCP_Server_Info *server;
        struct cifs_ses *ses;
        struct cifs_tcon *tcon;
-       struct smb2_lease_break_work *lw;
-
-       lw = kmalloc(sizeof(struct smb2_lease_break_work), GFP_KERNEL);
-       if (!lw)
-               return false;
-
-       INIT_WORK(&lw->lease_break, cifs_ses_oplock_break);
-       lw->lease_state = rsp->NewLeaseState;
+       struct cifs_pending_open *open;
 
        cifs_dbg(FYI, "Checking for lease break\n");
 
@@ -617,11 +633,27 @@ smb2_is_valid_lease_break(char *buffer)
                                spin_lock(&tcon->open_file_lock);
                                cifs_stats_inc(
                                    &tcon->stats.cifs_stats.num_oplock_brks);
-                               if (smb2_tcon_has_lease(tcon, rsp, lw)) {
+                               if (smb2_tcon_has_lease(tcon, rsp)) {
                                        spin_unlock(&tcon->open_file_lock);
                                        spin_unlock(&cifs_tcp_ses_lock);
                                        return true;
                                }
+                               open = smb2_tcon_find_pending_open_lease(tcon,
+                                                                        rsp);
+                               if (open) {
+                                       __u8 lease_key[SMB2_LEASE_KEY_SIZE];
+                                       struct tcon_link *tlink;
+
+                                       tlink = cifs_get_tlink(open->tlink);
+                                       memcpy(lease_key, open->lease_key,
+                                              SMB2_LEASE_KEY_SIZE);
+                                       spin_unlock(&tcon->open_file_lock);
+                                       spin_unlock(&cifs_tcp_ses_lock);
+                                       smb2_queue_pending_open_break(tlink,
+                                                                     lease_key,
+                                                                     
rsp->NewLeaseState);
+                                       return true;
+                               }
                                spin_unlock(&tcon->open_file_lock);
 
                                if (tcon->crfid.is_valid &&
@@ -639,7 +671,6 @@ smb2_is_valid_lease_break(char *buffer)
                }
        }
        spin_unlock(&cifs_tcp_ses_lock);
-       kfree(lw);
        cifs_dbg(FYI, "Can not process lease break - no lease matched\n");
        return false;
 }
diff --git a/fs/cifs/smb2pdu.c b/fs/cifs/smb2pdu.c
index e2d2b749c8f3..379ac8caa29a 100644
--- a/fs/cifs/smb2pdu.c
+++ b/fs/cifs/smb2pdu.c
@@ -1132,6 +1132,8 @@ SMB2_auth_kerberos(struct SMB2_sess_data *sess_data)
        spnego_key = cifs_get_spnego_key(ses);
        if (IS_ERR(spnego_key)) {
                rc = PTR_ERR(spnego_key);
+               if (rc == -ENOKEY)
+                       cifs_dbg(VFS, "Verify user has a krb5 ticket and 
keyutils is installed\n");
                spnego_key = NULL;
                goto out;
        }
diff --git a/fs/ext2/ialloc.c b/fs/ext2/ialloc.c
index 5c3d7b7e4975..d8a03b1afbc3 100644
--- a/fs/ext2/ialloc.c
+++ b/fs/ext2/ialloc.c
@@ -80,6 +80,7 @@ static void ext2_release_inode(struct super_block *sb, int 
group, int dir)
        if (dir)
                le16_add_cpu(&desc->bg_used_dirs_count, -1);
        spin_unlock(sb_bgl_lock(EXT2_SB(sb), group));
+       percpu_counter_inc(&EXT2_SB(sb)->s_freeinodes_counter);
        if (dir)
                percpu_counter_dec(&EXT2_SB(sb)->s_dirs_counter);
        mark_buffer_dirty(bh);
@@ -531,7 +532,7 @@ struct inode *ext2_new_inode(struct inode *dir, umode_t 
mode,
                goto fail;
        }
 
-       percpu_counter_add(&sbi->s_freeinodes_counter, -1);
+       percpu_counter_dec(&sbi->s_freeinodes_counter);
        if (S_ISDIR(mode))
                percpu_counter_inc(&sbi->s_dirs_counter);
 
diff --git a/fs/minix/inode.c b/fs/minix/inode.c
index 4f994de46e6b..03fe8bac36cf 100644
--- a/fs/minix/inode.c
+++ b/fs/minix/inode.c
@@ -155,8 +155,10 @@ static int minix_remount (struct super_block * sb, int * 
flags, char * data)
        return 0;
 }
 
-static bool minix_check_superblock(struct minix_sb_info *sbi)
+static bool minix_check_superblock(struct super_block *sb)
 {
+       struct minix_sb_info *sbi = minix_sb(sb);
+
        if (sbi->s_imap_blocks == 0 || sbi->s_zmap_blocks == 0)
                return false;
 
@@ -166,7 +168,7 @@ static bool minix_check_superblock(struct minix_sb_info 
*sbi)
         * of indirect blocks which places the limit well above U32_MAX.
         */
        if (sbi->s_version == MINIX_V1 &&
-           sbi->s_max_size > (7 + 512 + 512*512) * BLOCK_SIZE)
+           sb->s_maxbytes > (7 + 512 + 512*512) * BLOCK_SIZE)
                return false;
 
        return true;
@@ -207,7 +209,7 @@ static int minix_fill_super(struct super_block *s, void 
*data, int silent)
        sbi->s_zmap_blocks = ms->s_zmap_blocks;
        sbi->s_firstdatazone = ms->s_firstdatazone;
        sbi->s_log_zone_size = ms->s_log_zone_size;
-       sbi->s_max_size = ms->s_max_size;
+       s->s_maxbytes = ms->s_max_size;
        s->s_magic = ms->s_magic;
        if (s->s_magic == MINIX_SUPER_MAGIC) {
                sbi->s_version = MINIX_V1;
@@ -238,7 +240,7 @@ static int minix_fill_super(struct super_block *s, void 
*data, int silent)
                sbi->s_zmap_blocks = m3s->s_zmap_blocks;
                sbi->s_firstdatazone = m3s->s_firstdatazone;
                sbi->s_log_zone_size = m3s->s_log_zone_size;
-               sbi->s_max_size = m3s->s_max_size;
+               s->s_maxbytes = m3s->s_max_size;
                sbi->s_ninodes = m3s->s_ninodes;
                sbi->s_nzones = m3s->s_zones;
                sbi->s_dirsize = 64;
@@ -250,7 +252,7 @@ static int minix_fill_super(struct super_block *s, void 
*data, int silent)
        } else
                goto out_no_fs;
 
-       if (!minix_check_superblock(sbi))
+       if (!minix_check_superblock(s))
                goto out_illegal_sb;
 
        /*
diff --git a/fs/minix/itree_v1.c b/fs/minix/itree_v1.c
index 046cc96ee7ad..1fed906042aa 100644
--- a/fs/minix/itree_v1.c
+++ b/fs/minix/itree_v1.c
@@ -29,12 +29,12 @@ static int block_to_path(struct inode * inode, long block, 
int offsets[DEPTH])
        if (block < 0) {
                printk("MINIX-fs: block_to_path: block %ld < 0 on dev %pg\n",
                        block, inode->i_sb->s_bdev);
-       } else if (block >= (minix_sb(inode->i_sb)->s_max_size/BLOCK_SIZE)) {
-               if (printk_ratelimit())
-                       printk("MINIX-fs: block_to_path: "
-                              "block %ld too big on dev %pg\n",
-                               block, inode->i_sb->s_bdev);
-       } else if (block < 7) {
+               return 0;
+       }
+       if ((u64)block * BLOCK_SIZE >= inode->i_sb->s_maxbytes)
+               return 0;
+
+       if (block < 7) {
                offsets[n++] = block;
        } else if ((block -= 7) < 512) {
                offsets[n++] = 7;
diff --git a/fs/minix/itree_v2.c b/fs/minix/itree_v2.c
index f7fc7ecccccc..9d00f31a2d9d 100644
--- a/fs/minix/itree_v2.c
+++ b/fs/minix/itree_v2.c
@@ -32,13 +32,12 @@ static int block_to_path(struct inode * inode, long block, 
int offsets[DEPTH])
        if (block < 0) {
                printk("MINIX-fs: block_to_path: block %ld < 0 on dev %pg\n",
                        block, sb->s_bdev);
-       } else if ((u64)block * (u64)sb->s_blocksize >=
-                       minix_sb(sb)->s_max_size) {
-               if (printk_ratelimit())
-                       printk("MINIX-fs: block_to_path: "
-                              "block %ld too big on dev %pg\n",
-                               block, sb->s_bdev);
-       } else if (block < DIRCOUNT) {
+               return 0;
+       }
+       if ((u64)block * (u64)sb->s_blocksize >= sb->s_maxbytes)
+               return 0;
+
+       if (block < DIRCOUNT) {
                offsets[n++] = block;
        } else if ((block -= DIRCOUNT) < INDIRCOUNT(sb)) {
                offsets[n++] = DIRCOUNT;
diff --git a/fs/minix/minix.h b/fs/minix/minix.h
index df081e8afcc3..168d45d3de73 100644
--- a/fs/minix/minix.h
+++ b/fs/minix/minix.h
@@ -32,7 +32,6 @@ struct minix_sb_info {
        unsigned long s_zmap_blocks;
        unsigned long s_firstdatazone;
        unsigned long s_log_zone_size;
-       unsigned long s_max_size;
        int s_dirsize;
        int s_namelen;
        struct buffer_head ** s_imap;
diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c
index 05cb68ca1ba1..1ef75b1deffa 100644
--- a/fs/nfs/nfs4proc.c
+++ b/fs/nfs/nfs4proc.c
@@ -5603,8 +5603,6 @@ static int _nfs4_get_security_label(struct inode *inode, 
void *buf,
                return ret;
        if (!(fattr.valid & NFS_ATTR_FATTR_V4_SECURITY_LABEL))
                return -ENOENT;
-       if (buflen < label.len)
-               return -ERANGE;
        return 0;
 }
 
diff --git a/fs/nfs/nfs4xdr.c b/fs/nfs/nfs4xdr.c
index c4cf0192d7bb..0a5cae8f8aff 100644
--- a/fs/nfs/nfs4xdr.c
+++ b/fs/nfs/nfs4xdr.c
@@ -4280,7 +4280,11 @@ static int decode_attr_security_label(struct xdr_stream 
*xdr, uint32_t *bitmap,
                        goto out_overflow;
                if (len < NFS4_MAXLABELLEN) {
                        if (label) {
-                               memcpy(label->label, p, len);
+                               if (label->len) {
+                                       if (label->len < len)
+                                               return -ERANGE;
+                                       memcpy(label->label, p, len);
+                               }
                                label->len = len;
                                label->pi = pi;
                                label->lfs = lfs;
diff --git a/fs/ocfs2/ocfs2.h b/fs/ocfs2/ocfs2.h
index 231933618300..b9f62d29355b 100644
--- a/fs/ocfs2/ocfs2.h
+++ b/fs/ocfs2/ocfs2.h
@@ -338,8 +338,8 @@ struct ocfs2_super
        spinlock_t osb_lock;
        u32 s_next_generation;
        unsigned long osb_flags;
-       s16 s_inode_steal_slot;
-       s16 s_meta_steal_slot;
+       u16 s_inode_steal_slot;
+       u16 s_meta_steal_slot;
        atomic_t s_num_inodes_stolen;
        atomic_t s_num_meta_stolen;
 
diff --git a/fs/ocfs2/suballoc.c b/fs/ocfs2/suballoc.c
index 15a89c513da2..0230b4ece0f0 100644
--- a/fs/ocfs2/suballoc.c
+++ b/fs/ocfs2/suballoc.c
@@ -893,9 +893,9 @@ static void __ocfs2_set_steal_slot(struct ocfs2_super *osb, 
int slot, int type)
 {
        spin_lock(&osb->osb_lock);
        if (type == INODE_ALLOC_SYSTEM_INODE)
-               osb->s_inode_steal_slot = slot;
+               osb->s_inode_steal_slot = (u16)slot;
        else if (type == EXTENT_ALLOC_SYSTEM_INODE)
-               osb->s_meta_steal_slot = slot;
+               osb->s_meta_steal_slot = (u16)slot;
        spin_unlock(&osb->osb_lock);
 }
 
diff --git a/fs/ocfs2/super.c b/fs/ocfs2/super.c
index 3415e0b09398..2658d91c1f7b 100644
--- a/fs/ocfs2/super.c
+++ b/fs/ocfs2/super.c
@@ -92,7 +92,7 @@ struct mount_options
        unsigned long   commit_interval;
        unsigned long   mount_opt;
        unsigned int    atime_quantum;
-       signed short    slot;
+       unsigned short  slot;
        int             localalloc_opt;
        unsigned int    resv_level;
        int             dir_resv_level;
@@ -1384,7 +1384,7 @@ static int ocfs2_parse_options(struct super_block *sb,
                                goto bail;
                        }
                        if (option)
-                               mopt->slot = (s16)option;
+                               mopt->slot = (u16)option;
                        break;
                case Opt_commit:
                        if (match_int(&args[0], &option)) {
diff --git a/fs/ufs/super.c b/fs/ufs/super.c
index a4e07e910f1b..6e59e45d7bfb 100644
--- a/fs/ufs/super.c
+++ b/fs/ufs/super.c
@@ -100,7 +100,7 @@ static struct inode *ufs_nfs_get_inode(struct super_block 
*sb, u64 ino, u32 gene
        struct ufs_sb_private_info *uspi = UFS_SB(sb)->s_uspi;
        struct inode *inode;
 
-       if (ino < UFS_ROOTINO || ino > uspi->s_ncg * uspi->s_ipg)
+       if (ino < UFS_ROOTINO || ino > (u64)uspi->s_ncg * uspi->s_ipg)
                return ERR_PTR(-ESTALE);
 
        inode = ufs_iget(sb, ino);
diff --git a/include/linux/intel-iommu.h b/include/linux/intel-iommu.h
index b1b4411b4c6b..539f4a84412f 100644
--- a/include/linux/intel-iommu.h
+++ b/include/linux/intel-iommu.h
@@ -308,8 +308,8 @@ enum {
 
 #define QI_DEV_EIOTLB_ADDR(a)  ((u64)(a) & VTD_PAGE_MASK)
 #define QI_DEV_EIOTLB_SIZE     (((u64)1) << 11)
-#define QI_DEV_EIOTLB_GLOB(g)  ((u64)g)
-#define QI_DEV_EIOTLB_PASID(p) (((u64)p) << 32)
+#define QI_DEV_EIOTLB_GLOB(g)  ((u64)(g) & 0x1)
+#define QI_DEV_EIOTLB_PASID(p) ((u64)((p) & 0xfffff) << 32)
 #define QI_DEV_EIOTLB_SID(sid) ((u64)((sid) & 0xffff) << 16)
 #define QI_DEV_EIOTLB_QDEP(qd) ((u64)((qd) & 0x1f) << 4)
 #define QI_DEV_EIOTLB_PFSID(pfsid) (((u64)(pfsid & 0xf) << 12) | \
diff --git a/include/linux/irq.h b/include/linux/irq.h
index 6ecaf056ab63..a042faefb9b7 100644
--- a/include/linux/irq.h
+++ b/include/linux/irq.h
@@ -210,6 +210,8 @@ struct irq_data {
  * IRQD_CAN_RESERVE            - Can use reservation mode
  * IRQD_MSI_NOMASK_QUIRK       - Non-maskable MSI quirk for affinity change
  *                               required
+ * IRQD_AFFINITY_ON_ACTIVATE   - Affinity is set on activation. Don't call
+ *                               irq_chip::irq_set_affinity() when deactivated.
  */
 enum {
        IRQD_TRIGGER_MASK               = 0xf,
@@ -233,6 +235,7 @@ enum {
        IRQD_DEFAULT_TRIGGER_SET        = (1 << 25),
        IRQD_CAN_RESERVE                = (1 << 26),
        IRQD_MSI_NOMASK_QUIRK           = (1 << 27),
+       IRQD_AFFINITY_ON_ACTIVATE       = (1 << 29),
 };
 
 #define __irqd_to_state(d) ACCESS_PRIVATE((d)->common, state_use_accessors)
@@ -407,6 +410,16 @@ static inline bool irqd_msi_nomask_quirk(struct irq_data 
*d)
        return __irqd_to_state(d) & IRQD_MSI_NOMASK_QUIRK;
 }
 
+static inline void irqd_set_affinity_on_activate(struct irq_data *d)
+{
+       __irqd_to_state(d) |= IRQD_AFFINITY_ON_ACTIVATE;
+}
+
+static inline bool irqd_affinity_on_activate(struct irq_data *d)
+{
+       return __irqd_to_state(d) & IRQD_AFFINITY_ON_ACTIVATE;
+}
+
 #undef __irqd_to_state
 
 static inline irq_hw_number_t irqd_to_hwirq(struct irq_data *d)
diff --git a/include/linux/pci.h b/include/linux/pci.h
index b1f297f4b7b0..2517492dd185 100644
--- a/include/linux/pci.h
+++ b/include/linux/pci.h
@@ -373,6 +373,9 @@ struct pci_dev {
        bool            match_driver;           /* Skip attaching driver */
 
        unsigned int    transparent:1;          /* Subtractive decode bridge */
+       unsigned int    io_window:1;            /* Bridge has I/O window */
+       unsigned int    pref_window:1;          /* Bridge has pref mem window */
+       unsigned int    pref_64_window:1;       /* Pref mem window is 64-bit */
        unsigned int    multifunction:1;        /* Multi-function device */
 
        unsigned int    is_busmaster:1;         /* Is busmaster */
diff --git a/include/net/sock.h b/include/net/sock.h
index e2df102e669e..77f36257cac9 100644
--- a/include/net/sock.h
+++ b/include/net/sock.h
@@ -845,6 +845,8 @@ static inline int sk_memalloc_socks(void)
 {
        return static_branch_unlikely(&memalloc_socks_key);
 }
+
+void __receive_sock(struct file *file);
 #else
 
 static inline int sk_memalloc_socks(void)
@@ -852,6 +854,8 @@ static inline int sk_memalloc_socks(void)
        return 0;
 }
 
+static inline void __receive_sock(struct file *file)
+{ }
 #endif
 
 static inline gfp_t sk_gfp_mask(const struct sock *sk, gfp_t gfp_mask)
diff --git a/kernel/irq/manage.c b/kernel/irq/manage.c
index 025fcd029f83..3b66c77670d9 100644
--- a/kernel/irq/manage.c
+++ b/kernel/irq/manage.c
@@ -280,12 +280,16 @@ static bool irq_set_affinity_deactivated(struct irq_data 
*data,
        struct irq_desc *desc = irq_data_to_desc(data);
 
        /*
+        * Handle irq chips which can handle affinity only in activated
+        * state correctly
+        *
         * If the interrupt is not yet activated, just store the affinity
         * mask and do not call the chip driver at all. On activation the
         * driver has to make sure anyway that the interrupt is in a
         * useable state so startup works.
         */
-       if (!IS_ENABLED(CONFIG_IRQ_DOMAIN_HIERARCHY) || irqd_is_activated(data))
+       if (!IS_ENABLED(CONFIG_IRQ_DOMAIN_HIERARCHY) ||
+           irqd_is_activated(data) || !irqd_affinity_on_activate(data))
                return false;
 
        cpumask_copy(desc->irq_common_data.affinity, mask);
diff --git a/kernel/kprobes.c b/kernel/kprobes.c
index 178327a75e73..eb4bffe6d764 100644
--- a/kernel/kprobes.c
+++ b/kernel/kprobes.c
@@ -2077,6 +2077,13 @@ static void kill_kprobe(struct kprobe *p)
         * the original probed function (which will be freed soon) any more.
         */
        arch_remove_kprobe(p);
+
+       /*
+        * The module is going away. We should disarm the kprobe which
+        * is using ftrace.
+        */
+       if (kprobe_ftrace(p))
+               disarm_kprobe_ftrace(p);
 }
 
 /* Disable one kprobe */
diff --git a/kernel/module.c b/kernel/module.c
index ae8e7a1fa74a..d05e1bfdd355 100644
--- a/kernel/module.c
+++ b/kernel/module.c
@@ -1461,18 +1461,34 @@ struct module_sect_attrs {
        struct module_sect_attr attrs[0];
 };
 
+#define MODULE_SECT_READ_SIZE (3 /* "0x", "\n" */ + (BITS_PER_LONG / 4))
 static ssize_t module_sect_read(struct file *file, struct kobject *kobj,
                                struct bin_attribute *battr,
                                char *buf, loff_t pos, size_t count)
 {
        struct module_sect_attr *sattr =
                container_of(battr, struct module_sect_attr, battr);
+       char bounce[MODULE_SECT_READ_SIZE + 1];
+       size_t wrote;
 
        if (pos != 0)
                return -EINVAL;
 
-       return sprintf(buf, "0x%px\n",
-                      kallsyms_show_value(file->f_cred) ? (void 
*)sattr->address : NULL);
+       /*
+        * Since we're a binary read handler, we must account for the
+        * trailing NUL byte that sprintf will write: if "buf" is
+        * too small to hold the NUL, or the NUL is exactly the last
+        * byte, the read will look like it got truncated by one byte.
+        * Since there is no way to ask sprintf nicely to not write
+        * the NUL, we have to use a bounce buffer.
+        */
+       wrote = scnprintf(bounce, sizeof(bounce), "0x%px\n",
+                        kallsyms_show_value(file->f_cred)
+                               ? (void *)sattr->address : NULL);
+       count = min(count, wrote);
+       memcpy(buf, bounce, count);
+
+       return count;
 }
 
 static void free_sect_attrs(struct module_sect_attrs *sect_attrs)
@@ -1521,7 +1537,7 @@ static void add_sect_attrs(struct module *mod, const 
struct load_info *info)
                        goto out;
                sect_attrs->nsections++;
                sattr->battr.read = module_sect_read;
-               sattr->battr.size = 3 /* "0x", "\n" */ + (BITS_PER_LONG / 4);
+               sattr->battr.size = MODULE_SECT_READ_SIZE;
                sattr->battr.attr.mode = 0400;
                *(gattr++) = &(sattr++)->battr;
        }
diff --git a/kernel/trace/ftrace.c b/kernel/trace/ftrace.c
index 0c379cd40bea..70f7743c1672 100644
--- a/kernel/trace/ftrace.c
+++ b/kernel/trace/ftrace.c
@@ -5665,8 +5665,11 @@ static int referenced_filters(struct dyn_ftrace *rec)
        int cnt = 0;
 
        for (ops = ftrace_ops_list; ops != &ftrace_list_end; ops = ops->next) {
-               if (ops_references_rec(ops, rec))
-                   cnt++;
+               if (ops_references_rec(ops, rec)) {
+                       cnt++;
+                       if (ops->flags & FTRACE_OPS_FL_SAVE_REGS)
+                               rec->flags |= FTRACE_FL_REGS;
+               }
        }
 
        return cnt;
@@ -5843,8 +5846,8 @@ void ftrace_module_enable(struct module *mod)
                if (ftrace_start_up)
                        cnt += referenced_filters(rec);
 
-               /* This clears FTRACE_FL_DISABLED */
-               rec->flags = cnt;
+               rec->flags &= ~FTRACE_FL_DISABLED;
+               rec->flags += cnt;
 
                if (ftrace_start_up && cnt) {
                        int failed = __ftrace_replace_code(rec, 1);
@@ -6447,12 +6450,12 @@ void ftrace_pid_follow_fork(struct trace_array *tr, 
bool enable)
        if (enable) {
                
register_trace_sched_process_fork(ftrace_pid_follow_sched_process_fork,
                                                  tr);
-               
register_trace_sched_process_exit(ftrace_pid_follow_sched_process_exit,
+               
register_trace_sched_process_free(ftrace_pid_follow_sched_process_exit,
                                                  tr);
        } else {
                
unregister_trace_sched_process_fork(ftrace_pid_follow_sched_process_fork,
                                                    tr);
-               
unregister_trace_sched_process_exit(ftrace_pid_follow_sched_process_exit,
+               
unregister_trace_sched_process_free(ftrace_pid_follow_sched_process_exit,
                                                    tr);
        }
 }
diff --git a/kernel/trace/trace_events.c b/kernel/trace/trace_events.c
index ec340e1cbffc..27726121d332 100644
--- a/kernel/trace/trace_events.c
+++ b/kernel/trace/trace_events.c
@@ -534,12 +534,12 @@ void trace_event_follow_fork(struct trace_array *tr, bool 
enable)
        if (enable) {
                
register_trace_prio_sched_process_fork(event_filter_pid_sched_process_fork,
                                                       tr, INT_MIN);
-               
register_trace_prio_sched_process_exit(event_filter_pid_sched_process_exit,
+               
register_trace_prio_sched_process_free(event_filter_pid_sched_process_exit,
                                                       tr, INT_MAX);
        } else {
                
unregister_trace_sched_process_fork(event_filter_pid_sched_process_fork,
                                                    tr);
-               
unregister_trace_sched_process_exit(event_filter_pid_sched_process_exit,
+               
unregister_trace_sched_process_free(event_filter_pid_sched_process_exit,
                                                    tr);
        }
 }
diff --git a/kernel/trace/trace_hwlat.c b/kernel/trace/trace_hwlat.c
index 8030e24dbf14..568918fae8d4 100644
--- a/kernel/trace/trace_hwlat.c
+++ b/kernel/trace/trace_hwlat.c
@@ -270,6 +270,7 @@ static bool disable_migrate;
 static void move_to_next_cpu(void)
 {
        struct cpumask *current_mask = &save_cpumask;
+       struct trace_array *tr = hwlat_trace;
        int next_cpu;
 
        if (disable_migrate)
@@ -283,7 +284,7 @@ static void move_to_next_cpu(void)
                goto disable;
 
        get_online_cpus();
-       cpumask_and(current_mask, cpu_online_mask, tracing_buffer_mask);
+       cpumask_and(current_mask, cpu_online_mask, tr->tracing_cpumask);
        next_cpu = cpumask_next(smp_processor_id(), current_mask);
        put_online_cpus();
 
@@ -360,7 +361,7 @@ static int start_kthread(struct trace_array *tr)
        /* Just pick the first CPU on first iteration */
        current_mask = &save_cpumask;
        get_online_cpus();
-       cpumask_and(current_mask, cpu_online_mask, tracing_buffer_mask);
+       cpumask_and(current_mask, cpu_online_mask, tr->tracing_cpumask);
        put_online_cpus();
        next_cpu = cpumask_first(current_mask);
 
diff --git a/lib/test_kmod.c b/lib/test_kmod.c
index 9cf77628fc91..87a0cc750ea2 100644
--- a/lib/test_kmod.c
+++ b/lib/test_kmod.c
@@ -745,7 +745,7 @@ static int trigger_config_run_type(struct kmod_test_device 
*test_dev,
                break;
        case TEST_KMOD_FS_TYPE:
                kfree_const(config->test_fs);
-               config->test_driver = NULL;
+               config->test_fs = NULL;
                copied = config_copy_test_fs(config, test_str,
                                             strlen(test_str));
                break;
diff --git a/mm/khugepaged.c b/mm/khugepaged.c
index ecefdba4b0dd..483c4573695a 100644
--- a/mm/khugepaged.c
+++ b/mm/khugepaged.c
@@ -1251,6 +1251,7 @@ static void collect_mm_slot(struct mm_slot *mm_slot)
 static void retract_page_tables(struct address_space *mapping, pgoff_t pgoff)
 {
        struct vm_area_struct *vma;
+       struct mm_struct *mm;
        unsigned long addr;
        pmd_t *pmd, _pmd;
 
@@ -1264,7 +1265,8 @@ static void retract_page_tables(struct address_space 
*mapping, pgoff_t pgoff)
                        continue;
                if (vma->vm_end < addr + HPAGE_PMD_SIZE)
                        continue;
-               pmd = mm_find_pmd(vma->vm_mm, addr);
+               mm = vma->vm_mm;
+               pmd = mm_find_pmd(mm, addr);
                if (!pmd)
                        continue;
                /*
@@ -1273,14 +1275,16 @@ static void retract_page_tables(struct address_space 
*mapping, pgoff_t pgoff)
                 * re-fault. Not ideal, but it's more important to not disturb
                 * the system too much.
                 */
-               if (down_write_trylock(&vma->vm_mm->mmap_sem)) {
-                       spinlock_t *ptl = pmd_lock(vma->vm_mm, pmd);
-                       /* assume page table is clear */
-                       _pmd = pmdp_collapse_flush(vma, addr, pmd);
-                       spin_unlock(ptl);
-                       up_write(&vma->vm_mm->mmap_sem);
-                       mm_dec_nr_ptes(vma->vm_mm);
-                       pte_free(vma->vm_mm, pmd_pgtable(_pmd));
+               if (down_write_trylock(&mm->mmap_sem)) {
+                       if (!khugepaged_test_exit(mm)) {
+                               spinlock_t *ptl = pmd_lock(mm, pmd);
+                               /* assume page table is clear */
+                               _pmd = pmdp_collapse_flush(vma, addr, pmd);
+                               spin_unlock(ptl);
+                               mm_dec_nr_ptes(mm);
+                               pte_free(mm, pmd_pgtable(_pmd));
+                       }
+                       up_write(&mm->mmap_sem);
                }
        }
        i_mmap_unlock_write(mapping);
diff --git a/mm/page_counter.c b/mm/page_counter.c
index de31470655f6..147ff99187b8 100644
--- a/mm/page_counter.c
+++ b/mm/page_counter.c
@@ -77,7 +77,7 @@ void page_counter_charge(struct page_counter *counter, 
unsigned long nr_pages)
                long new;
 
                new = atomic_long_add_return(nr_pages, &c->usage);
-               propagate_protected_usage(counter, new);
+               propagate_protected_usage(c, new);
                /*
                 * This is indeed racy, but we can live with some
                 * inaccuracy in the watermark.
@@ -121,7 +121,7 @@ bool page_counter_try_charge(struct page_counter *counter,
                new = atomic_long_add_return(nr_pages, &c->usage);
                if (new > c->max) {
                        atomic_long_sub(nr_pages, &c->usage);
-                       propagate_protected_usage(counter, new);
+                       propagate_protected_usage(c, new);
                        /*
                         * This is racy, but we can live with some
                         * inaccuracy in the failcnt.
@@ -130,7 +130,7 @@ bool page_counter_try_charge(struct page_counter *counter,
                        *fail = c;
                        goto failed;
                }
-               propagate_protected_usage(counter, new);
+               propagate_protected_usage(c, new);
                /*
                 * Just like with failcnt, we can live with some
                 * inaccuracy in the watermark.
diff --git a/net/compat.c b/net/compat.c
index 3c4b0283b29a..2a8c7cb5f06a 100644
--- a/net/compat.c
+++ b/net/compat.c
@@ -289,6 +289,7 @@ void scm_detach_fds_compat(struct msghdr *kmsg, struct 
scm_cookie *scm)
                        break;
                }
                /* Bump the usage count and install the file. */
+               __receive_sock(fp[i]);
                fd_install(new_fd, get_file(fp[i]));
        }
 
diff --git a/net/core/sock.c b/net/core/sock.c
index 6c3b031b6ad6..e6cbe137cb6f 100644
--- a/net/core/sock.c
+++ b/net/core/sock.c
@@ -2636,6 +2636,27 @@ int sock_no_mmap(struct file *file, struct socket *sock, 
struct vm_area_struct *
 }
 EXPORT_SYMBOL(sock_no_mmap);
 
+/*
+ * When a file is received (via SCM_RIGHTS, etc), we must bump the
+ * various sock-based usage counts.
+ */
+void __receive_sock(struct file *file)
+{
+       struct socket *sock;
+       int error;
+
+       /*
+        * The resulting value of "error" is ignored here since we only
+        * need to take action when the file is a socket and testing
+        * "sock" for NULL is sufficient.
+        */
+       sock = sock_from_file(file, &error);
+       if (sock) {
+               sock_update_netprioidx(&sock->sk->sk_cgrp_data);
+               sock_update_classid(&sock->sk->sk_cgrp_data);
+       }
+}
+
 ssize_t sock_no_sendpage(struct socket *sock, struct page *page, int offset, 
size_t size, int flags)
 {
        ssize_t res;
diff --git a/net/mac80211/sta_info.c b/net/mac80211/sta_info.c
index ec2e83272f9d..2a82d438991b 100644
--- a/net/mac80211/sta_info.c
+++ b/net/mac80211/sta_info.c
@@ -979,7 +979,7 @@ static void __sta_info_destroy_part2(struct sta_info *sta)
        might_sleep();
        lockdep_assert_held(&local->sta_mtx);
 
-       while (sta->sta_state == IEEE80211_STA_AUTHORIZED) {
+       if (sta->sta_state == IEEE80211_STA_AUTHORIZED) {
                ret = sta_info_move_state(sta, IEEE80211_STA_ASSOC);
                WARN_ON_ONCE(ret);
        }
diff --git a/sound/pci/echoaudio/echoaudio.c b/sound/pci/echoaudio/echoaudio.c
index 3ef2b27ebbe8..f32c55ffffc7 100644
--- a/sound/pci/echoaudio/echoaudio.c
+++ b/sound/pci/echoaudio/echoaudio.c
@@ -2216,7 +2216,6 @@ static int snd_echo_resume(struct device *dev)
        if (err < 0) {
                kfree(commpage_bak);
                dev_err(dev, "resume init_hw err=%d\n", err);
-               snd_echo_free(chip);
                return err;
        }
 
@@ -2243,7 +2242,6 @@ static int snd_echo_resume(struct device *dev)
        if (request_irq(pci->irq, snd_echo_interrupt, IRQF_SHARED,
                        KBUILD_MODNAME, chip)) {
                dev_err(chip->card->dev, "cannot grab irq\n");
-               snd_echo_free(chip);
                return -EBUSY;
        }
        chip->irq = pci->irq;
diff --git a/tools/build/Makefile.feature b/tools/build/Makefile.feature
index 42a787856cd8..7c17f17ea2cd 100644
--- a/tools/build/Makefile.feature
+++ b/tools/build/Makefile.feature
@@ -7,7 +7,7 @@ endif
 
 feature_check = $(eval $(feature_check_code))
 define feature_check_code
-  feature-$(1) := $(shell $(MAKE) OUTPUT=$(OUTPUT_FEATURES) 
CFLAGS="$(EXTRA_CFLAGS) $(FEATURE_CHECK_CFLAGS-$(1))" 
CXXFLAGS="$(EXTRA_CXXFLAGS) $(FEATURE_CHECK_CXXFLAGS-$(1))" LDFLAGS="$(LDFLAGS) 
$(FEATURE_CHECK_LDFLAGS-$(1))" -C $(feature_dir) $(OUTPUT_FEATURES)test-$1.bin 
>/dev/null 2>/dev/null && echo 1 || echo 0)
+  feature-$(1) := $(shell $(MAKE) OUTPUT=$(OUTPUT_FEATURES) CC="$(CC)" 
CXX="$(CXX)" CFLAGS="$(EXTRA_CFLAGS) $(FEATURE_CHECK_CFLAGS-$(1))" 
CXXFLAGS="$(EXTRA_CXXFLAGS) $(FEATURE_CHECK_CXXFLAGS-$(1))" LDFLAGS="$(LDFLAGS) 
$(FEATURE_CHECK_LDFLAGS-$(1))" -C $(feature_dir) $(OUTPUT_FEATURES)test-$1.bin 
>/dev/null 2>/dev/null && echo 1 || echo 0)
 endef
 
 feature_set = $(eval $(feature_set_code))
diff --git a/tools/build/feature/Makefile b/tools/build/feature/Makefile
index bf8a8ebcca1e..c4845b66b9ba 100644
--- a/tools/build/feature/Makefile
+++ b/tools/build/feature/Makefile
@@ -62,8 +62,6 @@ FILES=                                          \
 
 FILES := $(addprefix $(OUTPUT),$(FILES))
 
-CC ?= $(CROSS_COMPILE)gcc
-CXX ?= $(CROSS_COMPILE)g++
 PKG_CONFIG ?= $(CROSS_COMPILE)pkg-config
 LLVM_CONFIG ?= llvm-config
 
diff --git a/tools/perf/bench/mem-functions.c b/tools/perf/bench/mem-functions.c
index 0251dd348124..4864fc67d01b 100644
--- a/tools/perf/bench/mem-functions.c
+++ b/tools/perf/bench/mem-functions.c
@@ -222,12 +222,8 @@ static int bench_mem_common(int argc, const char **argv, 
struct bench_mem_info *
        return 0;
 }
 
-static u64 do_memcpy_cycles(const struct function *r, size_t size, void *src, 
void *dst)
+static void memcpy_prefault(memcpy_t fn, size_t size, void *src, void *dst)
 {
-       u64 cycle_start = 0ULL, cycle_end = 0ULL;
-       memcpy_t fn = r->fn.memcpy;
-       int i;
-
        /* Make sure to always prefault zero pages even if MMAP_THRESH is 
crossed: */
        memset(src, 0, size);
 
@@ -236,6 +232,15 @@ static u64 do_memcpy_cycles(const struct function *r, 
size_t size, void *src, vo
         * to not measure page fault overhead:
         */
        fn(dst, src, size);
+}
+
+static u64 do_memcpy_cycles(const struct function *r, size_t size, void *src, 
void *dst)
+{
+       u64 cycle_start = 0ULL, cycle_end = 0ULL;
+       memcpy_t fn = r->fn.memcpy;
+       int i;
+
+       memcpy_prefault(fn, size, src, dst);
 
        cycle_start = get_cycles();
        for (i = 0; i < nr_loops; ++i)
@@ -251,11 +256,7 @@ static double do_memcpy_gettimeofday(const struct function 
*r, size_t size, void
        memcpy_t fn = r->fn.memcpy;
        int i;
 
-       /*
-        * We prefault the freshly allocated memory range here,
-        * to not measure page fault overhead:
-        */
-       fn(dst, src, size);
+       memcpy_prefault(fn, size, src, dst);
 
        BUG_ON(gettimeofday(&tv_start, NULL));
        for (i = 0; i < nr_loops; ++i)
diff --git a/tools/perf/util/intel-pt-decoder/intel-pt-decoder.c 
b/tools/perf/util/intel-pt-decoder/intel-pt-decoder.c
index 4357141c7c92..6522b6513895 100644
--- a/tools/perf/util/intel-pt-decoder/intel-pt-decoder.c
+++ b/tools/perf/util/intel-pt-decoder/intel-pt-decoder.c
@@ -1129,6 +1129,7 @@ static int intel_pt_walk_fup(struct intel_pt_decoder 
*decoder)
                        return 0;
                if (err == -EAGAIN ||
                    intel_pt_fup_with_nlip(decoder, &intel_pt_insn, ip, err)) {
+                       decoder->pkt_state = INTEL_PT_STATE_IN_SYNC;
                        if (intel_pt_fup_event(decoder))
                                return 0;
                        return -EAGAIN;
@@ -1780,17 +1781,13 @@ static int intel_pt_walk_trace(struct intel_pt_decoder 
*decoder)
                        }
                        if (decoder->set_fup_mwait)
                                no_tip = true;
+                       if (no_tip)
+                               decoder->pkt_state = INTEL_PT_STATE_FUP_NO_TIP;
+                       else
+                               decoder->pkt_state = INTEL_PT_STATE_FUP;
                        err = intel_pt_walk_fup(decoder);
-                       if (err != -EAGAIN) {
-                               if (err)
-                                       return err;
-                               if (no_tip)
-                                       decoder->pkt_state =
-                                               INTEL_PT_STATE_FUP_NO_TIP;
-                               else
-                                       decoder->pkt_state = INTEL_PT_STATE_FUP;
-                               return 0;
-                       }
+                       if (err != -EAGAIN)
+                               return err;
                        if (no_tip) {
                                no_tip = false;
                                break;
@@ -2375,15 +2372,11 @@ const struct intel_pt_state *intel_pt_decode(struct 
intel_pt_decoder *decoder)
                        err = intel_pt_walk_tip(decoder);
                        break;
                case INTEL_PT_STATE_FUP:
-                       decoder->pkt_state = INTEL_PT_STATE_IN_SYNC;
                        err = intel_pt_walk_fup(decoder);
                        if (err == -EAGAIN)
                                err = intel_pt_walk_fup_tip(decoder);
-                       else if (!err)
-                               decoder->pkt_state = INTEL_PT_STATE_FUP;
                        break;
                case INTEL_PT_STATE_FUP_NO_TIP:
-                       decoder->pkt_state = INTEL_PT_STATE_IN_SYNC;
                        err = intel_pt_walk_fup(decoder);
                        if (err == -EAGAIN)
                                err = intel_pt_walk_trace(decoder);
diff --git a/tools/testing/selftests/powerpc/ptrace/ptrace-pkey.c 
b/tools/testing/selftests/powerpc/ptrace/ptrace-pkey.c
index bdbbbe8431e0..3694613f418f 100644
--- a/tools/testing/selftests/powerpc/ptrace/ptrace-pkey.c
+++ b/tools/testing/selftests/powerpc/ptrace/ptrace-pkey.c
@@ -44,7 +44,7 @@ struct shared_info {
        unsigned long amr2;
 
        /* AMR value that ptrace should refuse to write to the child. */
-       unsigned long amr3;
+       unsigned long invalid_amr;
 
        /* IAMR value the parent expects to read from the child. */
        unsigned long expected_iamr;
@@ -57,8 +57,8 @@ struct shared_info {
         * (even though they're valid ones) because userspace doesn't have
         * access to those registers.
         */
-       unsigned long new_iamr;
-       unsigned long new_uamor;
+       unsigned long invalid_iamr;
+       unsigned long invalid_uamor;
 };
 
 static int sys_pkey_alloc(unsigned long flags, unsigned long 
init_access_rights)
@@ -66,11 +66,6 @@ static int sys_pkey_alloc(unsigned long flags, unsigned long 
init_access_rights)
        return syscall(__NR_pkey_alloc, flags, init_access_rights);
 }
 
-static int sys_pkey_free(int pkey)
-{
-       return syscall(__NR_pkey_free, pkey);
-}
-
 static int child(struct shared_info *info)
 {
        unsigned long reg;
@@ -100,28 +95,32 @@ static int child(struct shared_info *info)
 
        info->amr1 |= 3ul << pkeyshift(pkey1);
        info->amr2 |= 3ul << pkeyshift(pkey2);
-       info->amr3 |= info->amr2 | 3ul << pkeyshift(pkey3);
+       /*
+        * invalid amr value where we try to force write
+        * things which are deined by a uamor setting.
+        */
+       info->invalid_amr = info->amr2 | (~0x0UL & ~info->expected_uamor);
 
+       /*
+        * if PKEY_DISABLE_EXECUTE succeeded we should update the expected_iamr
+        */
        if (disable_execute)
                info->expected_iamr |= 1ul << pkeyshift(pkey1);
        else
                info->expected_iamr &= ~(1ul << pkeyshift(pkey1));
 
-       info->expected_iamr &= ~(1ul << pkeyshift(pkey2) | 1ul << 
pkeyshift(pkey3));
-
-       info->expected_uamor |= 3ul << pkeyshift(pkey1) |
-                               3ul << pkeyshift(pkey2);
-       info->new_iamr |= 1ul << pkeyshift(pkey1) | 1ul << pkeyshift(pkey2);
-       info->new_uamor |= 3ul << pkeyshift(pkey1);
+       /*
+        * We allocated pkey2 and pkey 3 above. Clear the IAMR bits.
+        */
+       info->expected_iamr &= ~(1ul << pkeyshift(pkey2));
+       info->expected_iamr &= ~(1ul << pkeyshift(pkey3));
 
        /*
-        * We won't use pkey3. We just want a plausible but invalid key to test
-        * whether ptrace will let us write to AMR bits we are not supposed to.
-        *
-        * This also tests whether the kernel restores the UAMOR permissions
-        * after a key is freed.
+        * Create an IAMR value different from expected value.
+        * Kernel will reject an IAMR and UAMOR change.
         */
-       sys_pkey_free(pkey3);
+       info->invalid_iamr = info->expected_iamr | (1ul << pkeyshift(pkey1) | 
1ul << pkeyshift(pkey2));
+       info->invalid_uamor = info->expected_uamor & ~(0x3ul << 
pkeyshift(pkey1));
 
        printf("%-30s AMR: %016lx pkey1: %d pkey2: %d pkey3: %d\n",
               user_write, info->amr1, pkey1, pkey2, pkey3);
@@ -196,9 +195,9 @@ static int parent(struct shared_info *info, pid_t pid)
        PARENT_SKIP_IF_UNSUPPORTED(ret, &info->child_sync);
        PARENT_FAIL_IF(ret, &info->child_sync);
 
-       info->amr1 = info->amr2 = info->amr3 = regs[0];
-       info->expected_iamr = info->new_iamr = regs[1];
-       info->expected_uamor = info->new_uamor = regs[2];
+       info->amr1 = info->amr2 = regs[0];
+       info->expected_iamr = regs[1];
+       info->expected_uamor = regs[2];
 
        /* Wake up child so that it can set itself up. */
        ret = prod_child(&info->child_sync);
@@ -234,10 +233,10 @@ static int parent(struct shared_info *info, pid_t pid)
                return ret;
 
        /* Write invalid AMR value in child. */
-       ret = ptrace_write_regs(pid, NT_PPC_PKEY, &info->amr3, 1);
+       ret = ptrace_write_regs(pid, NT_PPC_PKEY, &info->invalid_amr, 1);
        PARENT_FAIL_IF(ret, &info->child_sync);
 
-       printf("%-30s AMR: %016lx\n", ptrace_write_running, info->amr3);
+       printf("%-30s AMR: %016lx\n", ptrace_write_running, info->invalid_amr);
 
        /* Wake up child so that it can verify it didn't change. */
        ret = prod_child(&info->child_sync);
@@ -249,7 +248,7 @@ static int parent(struct shared_info *info, pid_t pid)
 
        /* Try to write to IAMR. */
        regs[0] = info->amr1;
-       regs[1] = info->new_iamr;
+       regs[1] = info->invalid_iamr;
        ret = ptrace_write_regs(pid, NT_PPC_PKEY, regs, 2);
        PARENT_FAIL_IF(!ret, &info->child_sync);
 
@@ -257,7 +256,7 @@ static int parent(struct shared_info *info, pid_t pid)
               ptrace_write_running, regs[0], regs[1]);
 
        /* Try to write to IAMR and UAMOR. */
-       regs[2] = info->new_uamor;
+       regs[2] = info->invalid_uamor;
        ret = ptrace_write_regs(pid, NT_PPC_PKEY, regs, 3);
        PARENT_FAIL_IF(!ret, &info->child_sync);
 
  • Linux 4.19.141 Greg Kroah-Hartman
    • Re: Linux 4.19.141 Greg Kroah-Hartman

Reply via email to