From: Greg Kroah-Hartman <gre...@linuxfoundation.org>

diff --git a/Makefile b/Makefile
index 7a233c641906..be5eac0a12d3 100644
--- a/Makefile
+++ b/Makefile
@@ -1,6 +1,6 @@
 VERSION = 4
 PATCHLEVEL = 9
-SUBLEVEL = 261
+SUBLEVEL = 262
 EXTRAVERSION =
 NAME = Roaring Lionus
 
diff --git a/arch/alpha/include/asm/uaccess.h b/arch/alpha/include/asm/uaccess.h
index 94f587535dee..181254a20a2a 100644
--- a/arch/alpha/include/asm/uaccess.h
+++ b/arch/alpha/include/asm/uaccess.h
@@ -341,45 +341,17 @@ __asm__ __volatile__("1: stb %r2,%1\n"                    
        \
  * Complex access routines
  */
 
-/* This little bit of silliness is to get the GP loaded for a function
-   that ordinarily wouldn't.  Otherwise we could have it done by the macro
-   directly, which can be optimized the linker.  */
-#ifdef MODULE
-#define __module_address(sym)          "r"(sym),
-#define __module_call(ra, arg, sym)    "jsr $" #ra ",(%" #arg ")," #sym
-#else
-#define __module_address(sym)
-#define __module_call(ra, arg, sym)    "bsr $" #ra "," #sym " !samegp"
-#endif
-
-extern void __copy_user(void);
-
-extern inline long
-__copy_tofrom_user_nocheck(void *to, const void *from, long len)
-{
-       register void * __cu_to __asm__("$6") = to;
-       register const void * __cu_from __asm__("$7") = from;
-       register long __cu_len __asm__("$0") = len;
-
-       __asm__ __volatile__(
-               __module_call(28, 3, __copy_user)
-               : "=r" (__cu_len), "=r" (__cu_from), "=r" (__cu_to)
-               : __module_address(__copy_user)
-                 "0" (__cu_len), "1" (__cu_from), "2" (__cu_to)
-               : "$1", "$2", "$3", "$4", "$5", "$28", "memory");
-
-       return __cu_len;
-}
+extern long __copy_user(void *to, const void *from, long len);
 
-#define __copy_to_user(to, from, n)                                    \
-({                                                                     \
-       __chk_user_ptr(to);                                             \
-       __copy_tofrom_user_nocheck((__force void *)(to), (from), (n));  \
+#define __copy_to_user(to, from, n)                    \
+({                                                     \
+       __chk_user_ptr(to);                             \
+       __copy_user((__force void *)(to), (from), (n)); \
 })
-#define __copy_from_user(to, from, n)                                  \
-({                                                                     \
-       __chk_user_ptr(from);                                           \
-       __copy_tofrom_user_nocheck((to), (__force void *)(from), (n));  \
+#define __copy_from_user(to, from, n)                  \
+({                                                     \
+       __chk_user_ptr(from);                           \
+       __copy_user((to), (__force void *)(from), (n)); \
 })
 
 #define __copy_to_user_inatomic __copy_to_user
@@ -389,7 +361,7 @@ extern inline long
 copy_to_user(void __user *to, const void *from, long n)
 {
        if (likely(__access_ok((unsigned long)to, n, get_fs())))
-               n = __copy_tofrom_user_nocheck((__force void *)to, from, n);
+               n = __copy_user((__force void *)to, from, n);
        return n;
 }
 
@@ -404,21 +376,7 @@ copy_from_user(void *to, const void __user *from, long n)
        return res;
 }
 
-extern void __do_clear_user(void);
-
-extern inline long
-__clear_user(void __user *to, long len)
-{
-       register void __user * __cl_to __asm__("$6") = to;
-       register long __cl_len __asm__("$0") = len;
-       __asm__ __volatile__(
-               __module_call(28, 2, __do_clear_user)
-               : "=r"(__cl_len), "=r"(__cl_to)
-               : __module_address(__do_clear_user)
-                 "0"(__cl_len), "1"(__cl_to)
-               : "$1", "$2", "$3", "$4", "$5", "$28", "memory");
-       return __cl_len;
-}
+extern long __clear_user(void __user *to, long len);
 
 extern inline long
 clear_user(void __user *to, long len)
@@ -428,9 +386,6 @@ clear_user(void __user *to, long len)
        return len;
 }
 
-#undef __module_address
-#undef __module_call
-
 #define user_addr_max() \
         (segment_eq(get_fs(), USER_DS) ? TASK_SIZE : ~0UL)
 
diff --git a/arch/alpha/lib/Makefile b/arch/alpha/lib/Makefile
index 59660743237c..a80815960364 100644
--- a/arch/alpha/lib/Makefile
+++ b/arch/alpha/lib/Makefile
@@ -20,12 +20,8 @@ lib-y =      __divqu.o __remqu.o __divlu.o __remlu.o \
        checksum.o \
        csum_partial_copy.o \
        $(ev67-y)strlen.o \
-       $(ev67-y)strcat.o \
-       strcpy.o \
-       $(ev67-y)strncat.o \
-       strncpy.o \
-       $(ev6-y)stxcpy.o \
-       $(ev6-y)stxncpy.o \
+       stycpy.o \
+       styncpy.o \
        $(ev67-y)strchr.o \
        $(ev67-y)strrchr.o \
        $(ev6-y)memchr.o \
@@ -46,11 +42,20 @@ AFLAGS___remqu.o =       -DREM
 AFLAGS___divlu.o = -DDIV       -DINTSIZE
 AFLAGS___remlu.o =       -DREM -DINTSIZE
 
-$(obj)/__divqu.o: $(obj)/$(ev6-y)divide.S
-       $(cmd_as_o_S)
-$(obj)/__remqu.o: $(obj)/$(ev6-y)divide.S
-       $(cmd_as_o_S)
-$(obj)/__divlu.o: $(obj)/$(ev6-y)divide.S
-       $(cmd_as_o_S)
-$(obj)/__remlu.o: $(obj)/$(ev6-y)divide.S
-       $(cmd_as_o_S)
+$(addprefix $(obj)/,__divqu.o __remqu.o __divlu.o __remlu.o): \
+                                               $(src)/$(ev6-y)divide.S FORCE
+       $(call if_changed_rule,as_o_S)
+
+# There are direct branches between {str*cpy,str*cat} and stx*cpy.
+# Ensure the branches are within range by merging these objects.
+
+LDFLAGS_stycpy.o := -r
+LDFLAGS_styncpy.o := -r
+
+$(obj)/stycpy.o: $(obj)/strcpy.o $(obj)/$(ev67-y)strcat.o \
+                $(obj)/$(ev6-y)stxcpy.o FORCE
+       $(call if_changed,ld)
+
+$(obj)/styncpy.o: $(obj)/strncpy.o $(obj)/$(ev67-y)strncat.o \
+                $(obj)/$(ev6-y)stxncpy.o FORCE
+       $(call if_changed,ld)
diff --git a/arch/alpha/lib/clear_user.S b/arch/alpha/lib/clear_user.S
index bf5b931866ba..006f469fef73 100644
--- a/arch/alpha/lib/clear_user.S
+++ b/arch/alpha/lib/clear_user.S
@@ -8,21 +8,6 @@
  * right "bytes left to zero" value (and that it is updated only _after_
  * a successful copy).  There is also some rather minor exception setup
  * stuff.
- *
- * NOTE! This is not directly C-callable, because the calling semantics
- * are different:
- *
- * Inputs:
- *     length in $0
- *     destination address in $6
- *     exception pointer in $7
- *     return address in $28 (exceptions expect it there)
- *
- * Outputs:
- *     bytes left to copy in $0
- *
- * Clobbers:
- *     $1,$2,$3,$4,$5,$6
  */
 #include <asm/export.h>
 
@@ -38,62 +23,63 @@
        .set noreorder
        .align 4
 
-       .globl __do_clear_user
-       .ent __do_clear_user
-       .frame  $30, 0, $28
+       .globl __clear_user
+       .ent __clear_user
+       .frame  $30, 0, $26
        .prologue 0
 
 $loop:
        and     $1, 3, $4       # e0    :
        beq     $4, 1f          # .. e1 :
 
-0:     EX( stq_u $31, 0($6) )  # e0    : zero one word
+0:     EX( stq_u $31, 0($16) ) # e0    : zero one word
        subq    $0, 8, $0       # .. e1 :
        subq    $4, 1, $4       # e0    :
-       addq    $6, 8, $6       # .. e1 :
+       addq    $16, 8, $16     # .. e1 :
        bne     $4, 0b          # e1    :
        unop                    #       :
 
 1:     bic     $1, 3, $1       # e0    :
        beq     $1, $tail       # .. e1 :
 
-2:     EX( stq_u $31, 0($6) )  # e0    : zero four words
+2:     EX( stq_u $31, 0($16) ) # e0    : zero four words
        subq    $0, 8, $0       # .. e1 :
-       EX( stq_u $31, 8($6) )  # e0    :
+       EX( stq_u $31, 8($16) ) # e0    :
        subq    $0, 8, $0       # .. e1 :
-       EX( stq_u $31, 16($6) ) # e0    :
+       EX( stq_u $31, 16($16) )        # e0    :
        subq    $0, 8, $0       # .. e1 :
-       EX( stq_u $31, 24($6) ) # e0    :
+       EX( stq_u $31, 24($16) )        # e0    :
        subq    $0, 8, $0       # .. e1 :
        subq    $1, 4, $1       # e0    :
-       addq    $6, 32, $6      # .. e1 :
+       addq    $16, 32, $16    # .. e1 :
        bne     $1, 2b          # e1    :
 
 $tail:
        bne     $2, 1f          # e1    : is there a tail to do?
-       ret     $31, ($28), 1   # .. e1 :
+       ret     $31, ($26), 1   # .. e1 :
 
-1:     EX( ldq_u $5, 0($6) )   # e0    :
+1:     EX( ldq_u $5, 0($16) )  # e0    :
        clr     $0              # .. e1 :
        nop                     # e1    :
        mskqh   $5, $0, $5      # e0    :
-       EX( stq_u $5, 0($6) )   # e0    :
-       ret     $31, ($28), 1   # .. e1 :
+       EX( stq_u $5, 0($16) )  # e0    :
+       ret     $31, ($26), 1   # .. e1 :
 
-__do_clear_user:
-       and     $6, 7, $4       # e0    : find dest misalignment
+__clear_user:
+       and     $17, $17, $0
+       and     $16, 7, $4      # e0    : find dest misalignment
        beq     $0, $zerolength # .. e1 :
        addq    $0, $4, $1      # e0    : bias counter
        and     $1, 7, $2       # e1    : number of bytes in tail
        srl     $1, 3, $1       # e0    :
        beq     $4, $loop       # .. e1 :
 
-       EX( ldq_u $5, 0($6) )   # e0    : load dst word to mask back in
+       EX( ldq_u $5, 0($16) )  # e0    : load dst word to mask back in
        beq     $1, $oneword    # .. e1 : sub-word store?
 
-       mskql   $5, $6, $5      # e0    : take care of misaligned head
-       addq    $6, 8, $6       # .. e1 :
-       EX( stq_u $5, -8($6) )  # e0    :
+       mskql   $5, $16, $5     # e0    : take care of misaligned head
+       addq    $16, 8, $16     # .. e1 :
+       EX( stq_u $5, -8($16) ) # e0    :
        addq    $0, $4, $0      # .. e1 : bytes left -= 8 - misalignment
        subq    $1, 1, $1       # e0    :
        subq    $0, 8, $0       # .. e1 :
@@ -101,15 +87,15 @@ __do_clear_user:
        unop                    #       :
 
 $oneword:
-       mskql   $5, $6, $4      # e0    :
+       mskql   $5, $16, $4     # e0    :
        mskqh   $5, $2, $5      # e0    :
        or      $5, $4, $5      # e1    :
-       EX( stq_u $5, 0($6) )   # e0    :
+       EX( stq_u $5, 0($16) )  # e0    :
        clr     $0              # .. e1 :
 
 $zerolength:
 $exception:
-       ret     $31, ($28), 1   # .. e1 :
+       ret     $31, ($26), 1   # .. e1 :
 
-       .end __do_clear_user
-       EXPORT_SYMBOL(__do_clear_user)
+       .end __clear_user
+       EXPORT_SYMBOL(__clear_user)
diff --git a/arch/alpha/lib/copy_user.S b/arch/alpha/lib/copy_user.S
index 509f62b65311..159f1b7e6e49 100644
--- a/arch/alpha/lib/copy_user.S
+++ b/arch/alpha/lib/copy_user.S
@@ -9,21 +9,6 @@
  * contains the right "bytes left to copy" value (and that it is updated
  * only _after_ a successful copy). There is also some rather minor
  * exception setup stuff..
- *
- * NOTE! This is not directly C-callable, because the calling semantics are
- * different:
- *
- * Inputs:
- *     length in $0
- *     destination address in $6
- *     source address in $7
- *     return address in $28
- *
- * Outputs:
- *     bytes left to copy in $0
- *
- * Clobbers:
- *     $1,$2,$3,$4,$5,$6,$7
  */
 
 #include <asm/export.h>
@@ -49,58 +34,59 @@
        .ent __copy_user
 __copy_user:
        .prologue 0
-       and $6,7,$3
+       and $18,$18,$0
+       and $16,7,$3
        beq $0,$35
        beq $3,$36
        subq $3,8,$3
        .align 4
 $37:
-       EXI( ldq_u $1,0($7) )
-       EXO( ldq_u $2,0($6) )
-       extbl $1,$7,$1
-       mskbl $2,$6,$2
-       insbl $1,$6,$1
+       EXI( ldq_u $1,0($17) )
+       EXO( ldq_u $2,0($16) )
+       extbl $1,$17,$1
+       mskbl $2,$16,$2
+       insbl $1,$16,$1
        addq $3,1,$3
        bis $1,$2,$1
-       EXO( stq_u $1,0($6) )
+       EXO( stq_u $1,0($16) )
        subq $0,1,$0
-       addq $6,1,$6
-       addq $7,1,$7
+       addq $16,1,$16
+       addq $17,1,$17
        beq $0,$41
        bne $3,$37
 $36:
-       and $7,7,$1
+       and $17,7,$1
        bic $0,7,$4
        beq $1,$43
        beq $4,$48
-       EXI( ldq_u $3,0($7) )
+       EXI( ldq_u $3,0($17) )
        .align 4
 $50:
-       EXI( ldq_u $2,8($7) )
+       EXI( ldq_u $2,8($17) )
        subq $4,8,$4
-       extql $3,$7,$3
-       extqh $2,$7,$1
+       extql $3,$17,$3
+       extqh $2,$17,$1
        bis $3,$1,$1
-       EXO( stq $1,0($6) )
-       addq $7,8,$7
+       EXO( stq $1,0($16) )
+       addq $17,8,$17
        subq $0,8,$0
-       addq $6,8,$6
+       addq $16,8,$16
        bis $2,$2,$3
        bne $4,$50
 $48:
        beq $0,$41
        .align 4
 $57:
-       EXI( ldq_u $1,0($7) )
-       EXO( ldq_u $2,0($6) )
-       extbl $1,$7,$1
-       mskbl $2,$6,$2
-       insbl $1,$6,$1
+       EXI( ldq_u $1,0($17) )
+       EXO( ldq_u $2,0($16) )
+       extbl $1,$17,$1
+       mskbl $2,$16,$2
+       insbl $1,$16,$1
        bis $1,$2,$1
-       EXO( stq_u $1,0($6) )
+       EXO( stq_u $1,0($16) )
        subq $0,1,$0
-       addq $6,1,$6
-       addq $7,1,$7
+       addq $16,1,$16
+       addq $17,1,$17
        bne $0,$57
        br $31,$41
        .align 4
@@ -108,27 +94,27 @@ $43:
        beq $4,$65
        .align 4
 $66:
-       EXI( ldq $1,0($7) )
+       EXI( ldq $1,0($17) )
        subq $4,8,$4
-       EXO( stq $1,0($6) )
-       addq $7,8,$7
+       EXO( stq $1,0($16) )
+       addq $17,8,$17
        subq $0,8,$0
-       addq $6,8,$6
+       addq $16,8,$16
        bne $4,$66
 $65:
        beq $0,$41
-       EXI( ldq $2,0($7) )
-       EXO( ldq $1,0($6) )
+       EXI( ldq $2,0($17) )
+       EXO( ldq $1,0($16) )
        mskql $2,$0,$2
        mskqh $1,$0,$1
        bis $2,$1,$2
-       EXO( stq $2,0($6) )
+       EXO( stq $2,0($16) )
        bis $31,$31,$0
 $41:
 $35:
 $exitin:
 $exitout:
-       ret $31,($28),1
+       ret $31,($26),1
 
        .end __copy_user
 EXPORT_SYMBOL(__copy_user)
diff --git a/arch/alpha/lib/ev6-clear_user.S b/arch/alpha/lib/ev6-clear_user.S
index 05bef6b50598..e179e4757ef8 100644
--- a/arch/alpha/lib/ev6-clear_user.S
+++ b/arch/alpha/lib/ev6-clear_user.S
@@ -9,21 +9,6 @@
  * a successful copy).  There is also some rather minor exception setup
  * stuff.
  *
- * NOTE! This is not directly C-callable, because the calling semantics
- * are different:
- *
- * Inputs:
- *     length in $0
- *     destination address in $6
- *     exception pointer in $7
- *     return address in $28 (exceptions expect it there)
- *
- * Outputs:
- *     bytes left to copy in $0
- *
- * Clobbers:
- *     $1,$2,$3,$4,$5,$6
- *
  * Much of the information about 21264 scheduling/coding comes from:
  *     Compiler Writer's Guide for the Alpha 21264
  *     abbreviated as 'CWG' in other comments here
@@ -56,14 +41,15 @@
        .set noreorder
        .align 4
 
-       .globl __do_clear_user
-       .ent __do_clear_user
-       .frame  $30, 0, $28
+       .globl __clear_user
+       .ent __clear_user
+       .frame  $30, 0, $26
        .prologue 0
 
                                # Pipeline info : Slotting & Comments
-__do_clear_user:
-       and     $6, 7, $4       # .. E  .. ..   : find dest head misalignment
+__clear_user:
+       and     $17, $17, $0
+       and     $16, 7, $4      # .. E  .. ..   : find dest head misalignment
        beq     $0, $zerolength # U  .. .. ..   :  U L U L
 
        addq    $0, $4, $1      # .. .. .. E    : bias counter
@@ -75,14 +61,14 @@ __do_clear_user:
 
 /*
  * Head is not aligned.  Write (8 - $4) bytes to head of destination
- * This means $6 is known to be misaligned
+ * This means $16 is known to be misaligned
  */
-       EX( ldq_u $5, 0($6) )   # .. .. .. L    : load dst word to mask back in
+       EX( ldq_u $5, 0($16) )  # .. .. .. L    : load dst word to mask back in
        beq     $1, $onebyte    # .. .. U  ..   : sub-word store?
-       mskql   $5, $6, $5      # .. U  .. ..   : take care of misaligned head
-       addq    $6, 8, $6       # E  .. .. ..   : L U U L
+       mskql   $5, $16, $5     # .. U  .. ..   : take care of misaligned head
+       addq    $16, 8, $16     # E  .. .. ..   : L U U L
 
-       EX( stq_u $5, -8($6) )  # .. .. .. L    :
+       EX( stq_u $5, -8($16) ) # .. .. .. L    :
        subq    $1, 1, $1       # .. .. E  ..   :
        addq    $0, $4, $0      # .. E  .. ..   : bytes left -= 8 - misalignment
        subq    $0, 8, $0       # E  .. .. ..   : U L U L
@@ -93,11 +79,11 @@ __do_clear_user:
  * values upon initial entry to the loop
  * $1 is number of quadwords to clear (zero is a valid value)
  * $2 is number of trailing bytes (0..7) ($2 never used...)
- * $6 is known to be aligned 0mod8
+ * $16 is known to be aligned 0mod8
  */
 $headalign:
        subq    $1, 16, $4      # .. .. .. E    : If < 16, we can not use the 
huge loop
-       and     $6, 0x3f, $2    # .. .. E  ..   : Forward work for huge loop
+       and     $16, 0x3f, $2   # .. .. E  ..   : Forward work for huge loop
        subq    $2, 0x40, $3    # .. E  .. ..   : bias counter (huge loop)
        blt     $4, $trailquad  # U  .. .. ..   : U L U L
 
@@ -114,21 +100,21 @@ $headalign:
        beq     $3, $bigalign   # U  .. .. ..   : U L U L : Aligned 0mod64
 
 $alignmod64:
-       EX( stq_u $31, 0($6) )  # .. .. .. L
+       EX( stq_u $31, 0($16) ) # .. .. .. L
        addq    $3, 8, $3       # .. .. E  ..
        subq    $0, 8, $0       # .. E  .. ..
        nop                     # E  .. .. ..   : U L U L
 
        nop                     # .. .. .. E
        subq    $1, 1, $1       # .. .. E  ..
-       addq    $6, 8, $6       # .. E  .. ..
+       addq    $16, 8, $16     # .. E  .. ..
        blt     $3, $alignmod64 # U  .. .. ..   : U L U L
 
 $bigalign:
 /*
  * $0 is the number of bytes left
  * $1 is the number of quads left
- * $6 is aligned 0mod64
+ * $16 is aligned 0mod64
  * we know that we'll be taking a minimum of one trip through
  * CWG Section 3.7.6: do not expect a sustained store rate of > 1/cycle
  * We are _not_ going to update $0 after every single store.  That
@@ -145,39 +131,39 @@ $bigalign:
        nop                     # E :
        nop                     # E :
        nop                     # E :
-       bis     $6,$6,$3        # E : U L U L : Initial wh64 address is dest
+       bis     $16,$16,$3      # E : U L U L : Initial wh64 address is dest
        /* This might actually help for the current trip... */
 
 $do_wh64:
        wh64    ($3)            # .. .. .. L1   : memory subsystem hint
        subq    $1, 16, $4      # .. .. E  ..   : Forward calculation - repeat 
the loop?
-       EX( stq_u $31, 0($6) )  # .. L  .. ..
+       EX( stq_u $31, 0($16) ) # .. L  .. ..
        subq    $0, 8, $0       # E  .. .. ..   : U L U L
 
-       addq    $6, 128, $3     # E : Target address of wh64
-       EX( stq_u $31, 8($6) )  # L :
-       EX( stq_u $31, 16($6) ) # L :
+       addq    $16, 128, $3    # E : Target address of wh64
+       EX( stq_u $31, 8($16) ) # L :
+       EX( stq_u $31, 16($16) )        # L :
        subq    $0, 16, $0      # E : U L L U
 
        nop                     # E :
-       EX( stq_u $31, 24($6) ) # L :
-       EX( stq_u $31, 32($6) ) # L :
+       EX( stq_u $31, 24($16) )        # L :
+       EX( stq_u $31, 32($16) )        # L :
        subq    $0, 168, $5     # E : U L L U : two trips through the loop left?
        /* 168 = 192 - 24, since we've already completed some stores */
 
        subq    $0, 16, $0      # E :
-       EX( stq_u $31, 40($6) ) # L :
-       EX( stq_u $31, 48($6) ) # L :
-       cmovlt  $5, $6, $3      # E : U L L U : Latency 2, extra mapping cycle
+       EX( stq_u $31, 40($16) )        # L :
+       EX( stq_u $31, 48($16) )        # L :
+       cmovlt  $5, $16, $3     # E : U L L U : Latency 2, extra mapping cycle
 
        subq    $1, 8, $1       # E :
        subq    $0, 16, $0      # E :
-       EX( stq_u $31, 56($6) ) # L :
+       EX( stq_u $31, 56($16) )        # L :
        nop                     # E : U L U L
 
        nop                     # E :
        subq    $0, 8, $0       # E :
-       addq    $6, 64, $6      # E :
+       addq    $16, 64, $16    # E :
        bge     $4, $do_wh64    # U : U L U L
 
 $trailquad:
@@ -190,14 +176,14 @@ $trailquad:
        beq     $1, $trailbytes # U  .. .. ..   : U L U L : Only 0..7 bytes to 
go
 
 $onequad:
-       EX( stq_u $31, 0($6) )  # .. .. .. L
+       EX( stq_u $31, 0($16) ) # .. .. .. L
        subq    $1, 1, $1       # .. .. E  ..
        subq    $0, 8, $0       # .. E  .. ..
        nop                     # E  .. .. ..   : U L U L
 
        nop                     # .. .. .. E
        nop                     # .. .. E  ..
-       addq    $6, 8, $6       # .. E  .. ..
+       addq    $16, 8, $16     # .. E  .. ..
        bgt     $1, $onequad    # U  .. .. ..   : U L U L
 
        # We have an unknown number of bytes left to go.
@@ -211,9 +197,9 @@ $trailbytes:
        # so we will use $0 as the loop counter
        # We know for a fact that $0 > 0 zero due to previous context
 $onebyte:
-       EX( stb $31, 0($6) )    # .. .. .. L
+       EX( stb $31, 0($16) )   # .. .. .. L
        subq    $0, 1, $0       # .. .. E  ..   :
-       addq    $6, 1, $6       # .. E  .. ..   :
+       addq    $16, 1, $16     # .. E  .. ..   :
        bgt     $0, $onebyte    # U  .. .. ..   : U L U L
 
 $zerolength:
@@ -221,6 +207,6 @@ $exception:                 # Destination for exception 
recovery(?)
        nop                     # .. .. .. E    :
        nop                     # .. .. E  ..   :
        nop                     # .. E  .. ..   :
-       ret     $31, ($28), 1   # L0 .. .. ..   : L U L U
-       .end __do_clear_user
-       EXPORT_SYMBOL(__do_clear_user)
+       ret     $31, ($26), 1   # L0 .. .. ..   : L U L U
+       .end __clear_user
+       EXPORT_SYMBOL(__clear_user)
diff --git a/arch/alpha/lib/ev6-copy_user.S b/arch/alpha/lib/ev6-copy_user.S
index be720b518af9..35e6710d0700 100644
--- a/arch/alpha/lib/ev6-copy_user.S
+++ b/arch/alpha/lib/ev6-copy_user.S
@@ -12,21 +12,6 @@
  * only _after_ a successful copy). There is also some rather minor
  * exception setup stuff..
  *
- * NOTE! This is not directly C-callable, because the calling semantics are
- * different:
- *
- * Inputs:
- *     length in $0
- *     destination address in $6
- *     source address in $7
- *     return address in $28
- *
- * Outputs:
- *     bytes left to copy in $0
- *
- * Clobbers:
- *     $1,$2,$3,$4,$5,$6,$7
- *
  * Much of the information about 21264 scheduling/coding comes from:
  *     Compiler Writer's Guide for the Alpha 21264
  *     abbreviated as 'CWG' in other comments here
@@ -60,10 +45,11 @@
                                # Pipeline info: Slotting & Comments
 __copy_user:
        .prologue 0
-       subq $0, 32, $1         # .. E  .. ..   : Is this going to be a small 
copy?
+       andq $18, $18, $0
+       subq $18, 32, $1        # .. E  .. ..   : Is this going to be a small 
copy?
        beq $0, $zerolength     # U  .. .. ..   : U L U L
 
-       and $6,7,$3             # .. .. .. E    : is leading dest misalignment
+       and $16,7,$3            # .. .. .. E    : is leading dest misalignment
        ble $1, $onebyteloop    # .. .. U  ..   : 1st branch : small amount of 
data
        beq $3, $destaligned    # .. U  .. ..   : 2nd (one cycle fetcher stall)
        subq $3, 8, $3          # E  .. .. ..   : L U U L : trip counter
@@ -73,17 +59,17 @@ __copy_user:
  * We know we have at least one trip through this loop
  */
 $aligndest:
-       EXI( ldbu $1,0($7) )    # .. .. .. L    : Keep loads separate from 
stores
-       addq $6,1,$6            # .. .. E  ..   : Section 3.8 in the CWG
+       EXI( ldbu $1,0($17) )   # .. .. .. L    : Keep loads separate from 
stores
+       addq $16,1,$16          # .. .. E  ..   : Section 3.8 in the CWG
        addq $3,1,$3            # .. E  .. ..   :
        nop                     # E  .. .. ..   : U L U L
 
 /*
- * the -1 is to compensate for the inc($6) done in a previous quadpack
+ * the -1 is to compensate for the inc($16) done in a previous quadpack
  * which allows us zero dependencies within either quadpack in the loop
  */
-       EXO( stb $1,-1($6) )    # .. .. .. L    :
-       addq $7,1,$7            # .. .. E  ..   : Section 3.8 in the CWG
+       EXO( stb $1,-1($16) )   # .. .. .. L    :
+       addq $17,1,$17          # .. .. E  ..   : Section 3.8 in the CWG
        subq $0,1,$0            # .. E  .. ..   :
        bne $3, $aligndest      # U  .. .. ..   : U L U L
 
@@ -92,29 +78,29 @@ $aligndest:
  * If we arrived via branch, we have a minimum of 32 bytes
  */
 $destaligned:
-       and $7,7,$1             # .. .. .. E    : Check _current_ source 
alignment
+       and $17,7,$1            # .. .. .. E    : Check _current_ source 
alignment
        bic $0,7,$4             # .. .. E  ..   : number bytes as a quadword 
loop
-       EXI( ldq_u $3,0($7) )   # .. L  .. ..   : Forward fetch for fallthrough 
code
+       EXI( ldq_u $3,0($17) )  # .. L  .. ..   : Forward fetch for fallthrough 
code
        beq $1,$quadaligned     # U  .. .. ..   : U L U L
 
 /*
- * In the worst case, we've just executed an ldq_u here from 0($7)
+ * In the worst case, we've just executed an ldq_u here from 0($17)
  * and we'll repeat it once if we take the branch
  */
 
 /* Misaligned quadword loop - not unrolled.  Leave it that way. */
 $misquad:
-       EXI( ldq_u $2,8($7) )   # .. .. .. L    :
+       EXI( ldq_u $2,8($17) )  # .. .. .. L    :
        subq $4,8,$4            # .. .. E  ..   :
-       extql $3,$7,$3          # .. U  .. ..   :
-       extqh $2,$7,$1          # U  .. .. ..   : U U L L
+       extql $3,$17,$3         # .. U  .. ..   :
+       extqh $2,$17,$1         # U  .. .. ..   : U U L L
 
        bis $3,$1,$1            # .. .. .. E    :
-       EXO( stq $1,0($6) )     # .. .. L  ..   :
-       addq $7,8,$7            # .. E  .. ..   :
+       EXO( stq $1,0($16) )    # .. .. L  ..   :
+       addq $17,8,$17          # .. E  .. ..   :
        subq $0,8,$0            # E  .. .. ..   : U L L U
 
-       addq $6,8,$6            # .. .. .. E    :
+       addq $16,8,$16          # .. .. .. E    :
        bis $2,$2,$3            # .. .. E  ..   :
        nop                     # .. E  .. ..   :
        bne $4,$misquad         # U  .. .. ..   : U L U L
@@ -125,8 +111,8 @@ $misquad:
        beq $0,$zerolength      # U  .. .. ..   : U L U L
 
 /* We know we have at least one trip through the byte loop */
-       EXI ( ldbu $2,0($7) )   # .. .. .. L    : No loads in the same quad
-       addq $6,1,$6            # .. .. E  ..   : as the store (Section 3.8 in 
CWG)
+       EXI ( ldbu $2,0($17) )  # .. .. .. L    : No loads in the same quad
+       addq $16,1,$16          # .. .. E  ..   : as the store (Section 3.8 in 
CWG)
        nop                     # .. E  .. ..   :
        br $31, $dirtyentry     # L0 .. .. ..   : L U U L
 /* Do the trailing byte loop load, then hop into the store part of the loop */
@@ -136,8 +122,8 @@ $misquad:
  * Based upon the usage context, it's worth the effort to unroll this loop
  * $0 - number of bytes to be moved
  * $4 - number of bytes to move as quadwords
- * $6 is current destination address
- * $7 is current source address
+ * $16 is current destination address
+ * $17 is current source address
  */
 $quadaligned:
        subq    $4, 32, $2      # .. .. .. E    : do not unroll for small stuff
@@ -155,29 +141,29 @@ $quadaligned:
  * instruction memory hint instruction).
  */
 $unroll4:
-       EXI( ldq $1,0($7) )     # .. .. .. L
-       EXI( ldq $2,8($7) )     # .. .. L  ..
+       EXI( ldq $1,0($17) )    # .. .. .. L
+       EXI( ldq $2,8($17) )    # .. .. L  ..
        subq    $4,32,$4        # .. E  .. ..
        nop                     # E  .. .. ..   : U U L L
 
-       addq    $7,16,$7        # .. .. .. E
-       EXO( stq $1,0($6) )     # .. .. L  ..
-       EXO( stq $2,8($6) )     # .. L  .. ..
+       addq    $17,16,$17      # .. .. .. E
+       EXO( stq $1,0($16) )    # .. .. L  ..
+       EXO( stq $2,8($16) )    # .. L  .. ..
        subq    $0,16,$0        # E  .. .. ..   : U L L U
 
-       addq    $6,16,$6        # .. .. .. E
-       EXI( ldq $1,0($7) )     # .. .. L  ..
-       EXI( ldq $2,8($7) )     # .. L  .. ..
+       addq    $16,16,$16      # .. .. .. E
+       EXI( ldq $1,0($17) )    # .. .. L  ..
+       EXI( ldq $2,8($17) )    # .. L  .. ..
        subq    $4, 32, $3      # E  .. .. ..   : U U L L : is there enough for 
another trip?
 
-       EXO( stq $1,0($6) )     # .. .. .. L
-       EXO( stq $2,8($6) )     # .. .. L  ..
+       EXO( stq $1,0($16) )    # .. .. .. L
+       EXO( stq $2,8($16) )    # .. .. L  ..
        subq    $0,16,$0        # .. E  .. ..
-       addq    $7,16,$7        # E  .. .. ..   : U L L U
+       addq    $17,16,$17      # E  .. .. ..   : U L L U
 
        nop                     # .. .. .. E
        nop                     # .. .. E  ..
-       addq    $6,16,$6        # .. E  .. ..
+       addq    $16,16,$16      # .. E  .. ..
        bgt     $3,$unroll4     # U  .. .. ..   : U L U L
 
        nop
@@ -186,14 +172,14 @@ $unroll4:
        beq     $4, $noquads
 
 $onequad:
-       EXI( ldq $1,0($7) )
+       EXI( ldq $1,0($17) )
        subq    $4,8,$4
-       addq    $7,8,$7
+       addq    $17,8,$17
        nop
 
-       EXO( stq $1,0($6) )
+       EXO( stq $1,0($16) )
        subq    $0,8,$0
-       addq    $6,8,$6
+       addq    $16,8,$16
        bne     $4,$onequad
 
 $noquads:
@@ -207,23 +193,23 @@ $noquads:
  * There's no point in doing a lot of complex alignment calculations to try to
  * to quadword stuff for a small amount of data.
  *     $0 - remaining number of bytes left to copy
- *     $6 - current dest addr
- *     $7 - current source addr
+ *     $16 - current dest addr
+ *     $17 - current source addr
  */
 
 $onebyteloop:
-       EXI ( ldbu $2,0($7) )   # .. .. .. L    : No loads in the same quad
-       addq $6,1,$6            # .. .. E  ..   : as the store (Section 3.8 in 
CWG)
+       EXI ( ldbu $2,0($17) )  # .. .. .. L    : No loads in the same quad
+       addq $16,1,$16          # .. .. E  ..   : as the store (Section 3.8 in 
CWG)
        nop                     # .. E  .. ..   :
        nop                     # E  .. .. ..   : U L U L
 
 $dirtyentry:
 /*
- * the -1 is to compensate for the inc($6) done in a previous quadpack
+ * the -1 is to compensate for the inc($16) done in a previous quadpack
  * which allows us zero dependencies within either quadpack in the loop
  */
-       EXO ( stb $2,-1($6) )   # .. .. .. L    :
-       addq $7,1,$7            # .. .. E  ..   : quadpack as the load
+       EXO ( stb $2,-1($16) )  # .. .. .. L    :
+       addq $17,1,$17          # .. .. E  ..   : quadpack as the load
        subq $0,1,$0            # .. E  .. ..   : change count _after_ copy
        bgt $0,$onebyteloop     # U  .. .. ..   : U L U L
 
@@ -233,7 +219,7 @@ $exitout:                   # Destination for exception 
recovery(?)
        nop                     # .. .. .. E
        nop                     # .. .. E  ..
        nop                     # .. E  .. ..
-       ret $31,($28),1         # L0 .. .. ..   : L U L U
+       ret $31,($26),1         # L0 .. .. ..   : L U L U
 
        .end __copy_user
        EXPORT_SYMBOL(__copy_user)
diff --git a/arch/arm/kvm/mmu.c b/arch/arm/kvm/mmu.c
index b5ce1e81f945..16615ae6e257 100644
--- a/arch/arm/kvm/mmu.c
+++ b/arch/arm/kvm/mmu.c
@@ -1834,7 +1834,7 @@ int kvm_arch_prepare_memory_region(struct kvm *kvm,
         * Prevent userspace from creating a memory region outside of the IPA
         * space addressable by the KVM guest IPA space.
         */
-       if (memslot->base_gfn + memslot->npages >=
+       if (memslot->base_gfn + memslot->npages >
            (KVM_PHYS_SIZE >> PAGE_SHIFT))
                return -EFAULT;
 
diff --git a/arch/powerpc/include/asm/code-patching.h 
b/arch/powerpc/include/asm/code-patching.h
index ab934f8232bd..985fa005c1df 100644
--- a/arch/powerpc/include/asm/code-patching.h
+++ b/arch/powerpc/include/asm/code-patching.h
@@ -46,7 +46,7 @@ void __patch_exception(int exc, unsigned long addr);
 #endif
 
 #define OP_RT_RA_MASK  0xffff0000UL
-#define LIS_R2         0x3c020000UL
+#define LIS_R2         0x3c400000UL
 #define ADDIS_R2_R12   0x3c4c0000UL
 #define ADDI_R2_R2     0x38420000UL
 
diff --git a/arch/powerpc/perf/core-book3s.c b/arch/powerpc/perf/core-book3s.c
index 1f1ac446ace9..f2d8f35c181f 100644
--- a/arch/powerpc/perf/core-book3s.c
+++ b/arch/powerpc/perf/core-book3s.c
@@ -2010,7 +2010,17 @@ static void record_and_restart(struct perf_event *event, 
unsigned long val,
                        left += period;
                        if (left <= 0)
                                left = period;
-                       record = siar_valid(regs);
+
+                       /*
+                        * If address is not requested in the sample via
+                        * PERF_SAMPLE_IP, just record that sample irrespective
+                        * of SIAR valid check.
+                        */
+                       if (event->attr.sample_type & PERF_SAMPLE_IP)
+                               record = siar_valid(regs);
+                       else
+                               record = 1;
+
                        event->hw.last_period = event->hw.sample_period;
                }
                if (left < 0x80000000LL)
@@ -2028,9 +2038,10 @@ static void record_and_restart(struct perf_event *event, 
unsigned long val,
         * MMCR2. Check attr.exclude_kernel and address to drop the sample in
         * these cases.
         */
-       if (event->attr.exclude_kernel && record)
-               if (is_kernel_addr(mfspr(SPRN_SIAR)))
-                       record = 0;
+       if (event->attr.exclude_kernel &&
+           (event->attr.sample_type & PERF_SAMPLE_IP) &&
+           is_kernel_addr(mfspr(SPRN_SIAR)))
+               record = 0;
 
        /*
         * Finally record data if requested.
diff --git a/arch/s390/kernel/smp.c b/arch/s390/kernel/smp.c
index cba8e56cd63d..54eb8fe95212 100644
--- a/arch/s390/kernel/smp.c
+++ b/arch/s390/kernel/smp.c
@@ -727,7 +727,7 @@ static int smp_add_core(struct sclp_core_entry *core, 
cpumask_t *avail,
 static int __smp_rescan_cpus(struct sclp_core_info *info, bool early)
 {
        struct sclp_core_entry *core;
-       cpumask_t avail;
+       static cpumask_t avail;
        bool configured;
        u16 core_id;
        int nr, i;
diff --git a/drivers/block/rsxx/core.c b/drivers/block/rsxx/core.c
index 97b678c0ea13..4ab96c7f8fd7 100644
--- a/drivers/block/rsxx/core.c
+++ b/drivers/block/rsxx/core.c
@@ -892,6 +892,7 @@ static int rsxx_pci_probe(struct pci_dev *dev,
        card->event_wq = create_singlethread_workqueue(DRIVER_NAME"_event");
        if (!card->event_wq) {
                dev_err(CARD_TO_DEV(card), "Failed card event setup.\n");
+               st = -ENOMEM;
                goto failed_event_handler;
        }
 
diff --git a/drivers/hwmon/lm90.c b/drivers/hwmon/lm90.c
index 841f2428e84a..293d1184976b 100644
--- a/drivers/hwmon/lm90.c
+++ b/drivers/hwmon/lm90.c
@@ -186,6 +186,7 @@ enum chips { lm90, adm1032, lm99, lm86, max6657, max6659, 
adt7461, max6680,
 #define LM90_HAVE_EMERGENCY_ALARM (1 << 5)/* emergency alarm           */
 #define LM90_HAVE_TEMP3                (1 << 6) /* 3rd temperature sensor      
*/
 #define LM90_HAVE_BROKEN_ALERT (1 << 7) /* Broken alert                */
+#define LM90_PAUSE_FOR_CONFIG  (1 << 8) /* Pause conversion for config */
 
 /* LM90 status */
 #define LM90_STATUS_LTHRM      (1 << 0) /* local THERM limit tripped */
@@ -286,6 +287,7 @@ static const struct lm90_params lm90_params[] = {
                .reg_local_ext = MAX6657_REG_R_LOCAL_TEMPL,
        },
        [max6657] = {
+               .flags = LM90_PAUSE_FOR_CONFIG,
                .alert_alarms = 0x7c,
                .max_convrate = 8,
                .reg_local_ext = MAX6657_REG_R_LOCAL_TEMPL,
@@ -486,6 +488,38 @@ static inline int lm90_select_remote_channel(struct 
i2c_client *client,
        return 0;
 }
 
+static int lm90_write_convrate(struct i2c_client *client,
+                              struct lm90_data *data, int val)
+{
+       int err;
+       int config_orig, config_stop;
+
+       /* Save config and pause conversion */
+       if (data->flags & LM90_PAUSE_FOR_CONFIG) {
+               config_orig = lm90_read_reg(client, LM90_REG_R_CONFIG1);
+               if (config_orig < 0)
+                       return config_orig;
+               config_stop = config_orig | 0x40;
+               if (config_orig != config_stop) {
+                       err = i2c_smbus_write_byte_data(client,
+                                                       LM90_REG_W_CONFIG1,
+                                                       config_stop);
+                       if (err < 0)
+                               return err;
+               }
+       }
+
+       /* Set conv rate */
+       err = i2c_smbus_write_byte_data(client, LM90_REG_W_CONVRATE, val);
+
+       /* Revert change to config */
+       if (data->flags & LM90_PAUSE_FOR_CONFIG && config_orig != config_stop)
+               i2c_smbus_write_byte_data(client, LM90_REG_W_CONFIG1,
+                                         config_orig);
+
+       return err;
+}
+
 /*
  * Set conversion rate.
  * client->update_lock must be held when calling this function (unless we are
@@ -506,7 +540,7 @@ static int lm90_set_convrate(struct i2c_client *client, 
struct lm90_data *data,
                if (interval >= update_interval * 3 / 4)
                        break;
 
-       err = i2c_smbus_write_byte_data(client, LM90_REG_W_CONVRATE, i);
+       err = lm90_write_convrate(client, data, i);
        data->update_interval = DIV_ROUND_CLOSEST(update_interval, 64);
        return err;
 }
@@ -1512,8 +1546,7 @@ static void lm90_restore_conf(void *_data)
        struct i2c_client *client = data->client;
 
        /* Restore initial configuration */
-       i2c_smbus_write_byte_data(client, LM90_REG_W_CONVRATE,
-                                 data->convrate_orig);
+       lm90_write_convrate(client, data, data->convrate_orig);
        i2c_smbus_write_byte_data(client, LM90_REG_W_CONFIG1,
                                  data->config_orig);
 }
@@ -1530,12 +1563,13 @@ static int lm90_init_client(struct i2c_client *client, 
struct lm90_data *data)
        /*
         * Start the conversions.
         */
-       lm90_set_convrate(client, data, 500);   /* 500ms; 2Hz conversion rate */
        config = lm90_read_reg(client, LM90_REG_R_CONFIG1);
        if (config < 0)
                return config;
        data->config_orig = config;
 
+       lm90_set_convrate(client, data, 500); /* 500ms; 2Hz conversion rate */
+
        /* Check Temperature Range Select */
        if (data->kind == adt7461 || data->kind == tmp451) {
                if (config & 0x04)
diff --git a/drivers/iio/imu/adis16400_buffer.c 
b/drivers/iio/imu/adis16400_buffer.c
index 90c24a23c679..c0eb9dfd1c45 100644
--- a/drivers/iio/imu/adis16400_buffer.c
+++ b/drivers/iio/imu/adis16400_buffer.c
@@ -37,8 +37,11 @@ int adis16400_update_scan_mode(struct iio_dev *indio_dev,
                return -ENOMEM;
 
        adis->buffer = kzalloc(burst_length + sizeof(u16), GFP_KERNEL);
-       if (!adis->buffer)
+       if (!adis->buffer) {
+               kfree(adis->xfer);
+               adis->xfer = NULL;
                return -ENOMEM;
+       }
 
        tx = adis->buffer + burst_length;
        tx[0] = ADIS_READ_REG(ADIS16400_GLOB_CMD);
diff --git a/drivers/iio/imu/adis_buffer.c b/drivers/iio/imu/adis_buffer.c
index 36607d52fee0..9de553e8c214 100644
--- a/drivers/iio/imu/adis_buffer.c
+++ b/drivers/iio/imu/adis_buffer.c
@@ -39,8 +39,11 @@ int adis_update_scan_mode(struct iio_dev *indio_dev,
                return -ENOMEM;
 
        adis->buffer = kzalloc(indio_dev->scan_bytes * 2, GFP_KERNEL);
-       if (!adis->buffer)
+       if (!adis->buffer) {
+               kfree(adis->xfer);
+               adis->xfer = NULL;
                return -ENOMEM;
+       }
 
        rx = adis->buffer;
        tx = rx + scan_count;
diff --git a/drivers/media/usb/usbtv/usbtv-audio.c 
b/drivers/media/usb/usbtv/usbtv-audio.c
index 9db31db7d9ac..df593d643d53 100644
--- a/drivers/media/usb/usbtv/usbtv-audio.c
+++ b/drivers/media/usb/usbtv/usbtv-audio.c
@@ -398,7 +398,7 @@ void usbtv_audio_free(struct usbtv *usbtv)
        cancel_work_sync(&usbtv->snd_trigger);
 
        if (usbtv->snd && usbtv->udev) {
-               snd_card_free(usbtv->snd);
+               snd_card_free_when_closed(usbtv->snd);
                usbtv->snd = NULL;
        }
 }
diff --git a/drivers/mmc/core/mmc.c b/drivers/mmc/core/mmc.c
index 97e51309d7af..e76455024d8b 100644
--- a/drivers/mmc/core/mmc.c
+++ b/drivers/mmc/core/mmc.c
@@ -423,10 +423,6 @@ static int mmc_decode_ext_csd(struct mmc_card *card, u8 
*ext_csd)
 
                /* EXT_CSD value is in units of 10ms, but we store in ms */
                card->ext_csd.part_time = 10 * 
ext_csd[EXT_CSD_PART_SWITCH_TIME];
-               /* Some eMMC set the value too low so set a minimum */
-               if (card->ext_csd.part_time &&
-                   card->ext_csd.part_time < MMC_MIN_PART_SWITCH_TIME)
-                       card->ext_csd.part_time = MMC_MIN_PART_SWITCH_TIME;
 
                /* Sleep / awake timeout in 100ns units */
                if (sa_shift > 0 && sa_shift <= 0x17)
@@ -610,6 +606,17 @@ static int mmc_decode_ext_csd(struct mmc_card *card, u8 
*ext_csd)
                card->ext_csd.data_sector_size = 512;
        }
 
+       /*
+        * GENERIC_CMD6_TIME is to be used "unless a specific timeout is defined
+        * when accessing a specific field", so use it here if there is no
+        * PARTITION_SWITCH_TIME.
+        */
+       if (!card->ext_csd.part_time)
+               card->ext_csd.part_time = card->ext_csd.generic_cmd6_time;
+       /* Some eMMC set the value too low so set a minimum */
+       if (card->ext_csd.part_time < MMC_MIN_PART_SWITCH_TIME)
+               card->ext_csd.part_time = MMC_MIN_PART_SWITCH_TIME;
+
        /* eMMC v5 or later */
        if (card->ext_csd.rev >= 7) {
                memcpy(card->ext_csd.fwrev, &ext_csd[EXT_CSD_FIRMWARE_VERSION],
diff --git a/drivers/mmc/host/mtk-sd.c b/drivers/mmc/host/mtk-sd.c
index 7fc6ce381142..125c06a10455 100644
--- a/drivers/mmc/host/mtk-sd.c
+++ b/drivers/mmc/host/mtk-sd.c
@@ -741,13 +741,13 @@ static void msdc_track_cmd_data(struct msdc_host *host,
 static void msdc_request_done(struct msdc_host *host, struct mmc_request *mrq)
 {
        unsigned long flags;
-       bool ret;
 
-       ret = cancel_delayed_work(&host->req_timeout);
-       if (!ret) {
-               /* delay work already running */
-               return;
-       }
+       /*
+        * No need check the return value of cancel_delayed_work, as only ONE
+        * path will go here!
+        */
+       cancel_delayed_work(&host->req_timeout);
+
        spin_lock_irqsave(&host->lock, flags);
        host->mrq = NULL;
        spin_unlock_irqrestore(&host->lock, flags);
@@ -765,7 +765,7 @@ static bool msdc_cmd_done(struct msdc_host *host, int 
events,
        bool done = false;
        bool sbc_error;
        unsigned long flags;
-       u32 *rsp = cmd->resp;
+       u32 *rsp;
 
        if (mrq->sbc && cmd == mrq->cmd &&
            (events & (MSDC_INT_ACMDRDY | MSDC_INT_ACMDCRCERR
@@ -786,6 +786,7 @@ static bool msdc_cmd_done(struct msdc_host *host, int 
events,
 
        if (done)
                return true;
+       rsp = cmd->resp;
 
        sdr_clr_bits(host->base + MSDC_INTEN, cmd_ints_mask);
 
@@ -968,7 +969,7 @@ static void msdc_data_xfer_next(struct msdc_host *host,
 static bool msdc_data_xfer_done(struct msdc_host *host, u32 events,
                                struct mmc_request *mrq, struct mmc_data *data)
 {
-       struct mmc_command *stop = data->stop;
+       struct mmc_command *stop;
        unsigned long flags;
        bool done;
        unsigned int check_data = events &
@@ -984,6 +985,7 @@ static bool msdc_data_xfer_done(struct msdc_host *host, u32 
events,
 
        if (done)
                return true;
+       stop = data->stop;
 
        if (check_data || (stop && stop->error)) {
                dev_dbg(host->dev, "DMA status: 0x%8X\n",
diff --git a/drivers/mmc/host/mxs-mmc.c b/drivers/mmc/host/mxs-mmc.c
index c8b8ac66ff7e..687fd68fbbcd 100644
--- a/drivers/mmc/host/mxs-mmc.c
+++ b/drivers/mmc/host/mxs-mmc.c
@@ -651,7 +651,7 @@ static int mxs_mmc_probe(struct platform_device *pdev)
 
        ret = mmc_of_parse(mmc);
        if (ret)
-               goto out_clk_disable;
+               goto out_free_dma;
 
        mmc->ocr_avail = MMC_VDD_32_33 | MMC_VDD_33_34;
 
diff --git a/drivers/net/can/flexcan.c b/drivers/net/can/flexcan.c
index 6b866d0451b2..b18bb0334ded 100644
--- a/drivers/net/can/flexcan.c
+++ b/drivers/net/can/flexcan.c
@@ -383,7 +383,7 @@ static int flexcan_chip_freeze(struct flexcan_priv *priv)
        u32 reg;
 
        reg = flexcan_read(&regs->mcr);
-       reg |= FLEXCAN_MCR_HALT;
+       reg |= FLEXCAN_MCR_FRZ | FLEXCAN_MCR_HALT;
        flexcan_write(reg, &regs->mcr);
 
        while (timeout-- && !(flexcan_read(&regs->mcr) & FLEXCAN_MCR_FRZ_ACK))
@@ -1098,10 +1098,14 @@ static int register_flexcandev(struct net_device *dev)
        if (err)
                goto out_chip_disable;
 
-       /* set freeze, halt and activate FIFO, restrict register access */
+       /* set freeze, halt */
+       err = flexcan_chip_freeze(priv);
+       if (err)
+               goto out_chip_disable;
+
+       /* activate FIFO, restrict register access */
        reg = flexcan_read(&regs->mcr);
-       reg |= FLEXCAN_MCR_FRZ | FLEXCAN_MCR_HALT |
-               FLEXCAN_MCR_FEN | FLEXCAN_MCR_SUPV;
+       reg |=  FLEXCAN_MCR_FEN | FLEXCAN_MCR_SUPV;
        flexcan_write(reg, &regs->mcr);
 
        /* Currently we only support newer versions of this core
diff --git a/drivers/net/ethernet/atheros/alx/main.c 
b/drivers/net/ethernet/atheros/alx/main.c
index 2a5bb1012385..9de0f9f5b11c 100644
--- a/drivers/net/ethernet/atheros/alx/main.c
+++ b/drivers/net/ethernet/atheros/alx/main.c
@@ -1694,13 +1694,19 @@ static int alx_resume(struct device *dev)
        struct pci_dev *pdev = to_pci_dev(dev);
        struct alx_priv *alx = pci_get_drvdata(pdev);
        struct alx_hw *hw = &alx->hw;
+       int err;
 
        alx_reset_phy(hw);
 
        if (!netif_running(alx->dev))
                return 0;
+
+       err = __alx_open(alx, true);
+       if (err)
+               return err;
+
        netif_device_attach(alx->dev);
-       return __alx_open(alx, true);
+       return 0;
 }
 
 static SIMPLE_DEV_PM_OPS(alx_pm_ops, alx_suspend, alx_resume);
diff --git a/drivers/net/ethernet/davicom/dm9000.c 
b/drivers/net/ethernet/davicom/dm9000.c
index f45385f5c6e5..f1e4cde963d8 100644
--- a/drivers/net/ethernet/davicom/dm9000.c
+++ b/drivers/net/ethernet/davicom/dm9000.c
@@ -143,6 +143,8 @@ struct board_info {
        u32             wake_state;
 
        int             ip_summed;
+
+       struct regulator *power_supply;
 };
 
 /* debug code */
@@ -1459,7 +1461,7 @@ dm9000_probe(struct platform_device *pdev)
                if (ret) {
                        dev_err(dev, "failed to request reset gpio %d: %d\n",
                                reset_gpios, ret);
-                       return -ENODEV;
+                       goto out_regulator_disable;
                }
 
                /* According to manual PWRST# Low Period Min 1ms */
@@ -1471,8 +1473,10 @@ dm9000_probe(struct platform_device *pdev)
 
        if (!pdata) {
                pdata = dm9000_parse_dt(&pdev->dev);
-               if (IS_ERR(pdata))
-                       return PTR_ERR(pdata);
+               if (IS_ERR(pdata)) {
+                       ret = PTR_ERR(pdata);
+                       goto out_regulator_disable;
+               }
        }
 
        /* Init network device */
@@ -1489,6 +1493,8 @@ dm9000_probe(struct platform_device *pdev)
 
        db->dev = &pdev->dev;
        db->ndev = ndev;
+       if (!IS_ERR(power))
+               db->power_supply = power;
 
        spin_lock_init(&db->lock);
        mutex_init(&db->addr_lock);
@@ -1715,6 +1721,10 @@ dm9000_probe(struct platform_device *pdev)
        dm9000_release_board(pdev, db);
        free_netdev(ndev);
 
+out_regulator_disable:
+       if (!IS_ERR(power))
+               regulator_disable(power);
+
        return ret;
 }
 
@@ -1774,10 +1784,13 @@ static int
 dm9000_drv_remove(struct platform_device *pdev)
 {
        struct net_device *ndev = platform_get_drvdata(pdev);
+       struct board_info *dm = to_dm9000_board(ndev);
 
        unregister_netdev(ndev);
-       dm9000_release_board(pdev, netdev_priv(ndev));
+       dm9000_release_board(pdev, dm);
        free_netdev(ndev);              /* free device structure */
+       if (dm->power_supply)
+               regulator_disable(dm->power_supply);
 
        dev_dbg(&pdev->dev, "released and freed device\n");
        return 0;
diff --git a/drivers/net/ethernet/mellanox/mlx4/en_ethtool.c 
b/drivers/net/ethernet/mellanox/mlx4/en_ethtool.c
index 6068e7c4fc7e..d1224d33ecfa 100644
--- a/drivers/net/ethernet/mellanox/mlx4/en_ethtool.c
+++ b/drivers/net/ethernet/mellanox/mlx4/en_ethtool.c
@@ -47,7 +47,7 @@
 #define EN_ETHTOOL_SHORT_MASK cpu_to_be16(0xffff)
 #define EN_ETHTOOL_WORD_MASK  cpu_to_be32(0xffffffff)
 
-static int mlx4_en_moderation_update(struct mlx4_en_priv *priv)
+int mlx4_en_moderation_update(struct mlx4_en_priv *priv)
 {
        int i;
        int err = 0;
diff --git a/drivers/net/ethernet/mellanox/mlx4/en_netdev.c 
b/drivers/net/ethernet/mellanox/mlx4/en_netdev.c
index 1cfa30e86328..543f30dec4a0 100644
--- a/drivers/net/ethernet/mellanox/mlx4/en_netdev.c
+++ b/drivers/net/ethernet/mellanox/mlx4/en_netdev.c
@@ -3459,6 +3459,8 @@ int mlx4_en_reset_config(struct net_device *dev,
                        en_err(priv, "Failed starting port\n");
        }
 
+       if (!err)
+               err = mlx4_en_moderation_update(priv);
 out:
        mutex_unlock(&mdev->state_lock);
        kfree(tmp);
diff --git a/drivers/net/ethernet/mellanox/mlx4/mlx4_en.h 
b/drivers/net/ethernet/mellanox/mlx4/mlx4_en.h
index 93780f63192a..2e8c138beaf7 100644
--- a/drivers/net/ethernet/mellanox/mlx4/mlx4_en.h
+++ b/drivers/net/ethernet/mellanox/mlx4/mlx4_en.h
@@ -773,6 +773,7 @@ void mlx4_en_ptp_overflow_check(struct mlx4_en_dev *mdev);
 #define DEV_FEATURE_CHANGED(dev, new_features, feature) \
        ((dev->features & feature) ^ (new_features & feature))
 
+int mlx4_en_moderation_update(struct mlx4_en_priv *priv);
 int mlx4_en_reset_config(struct net_device *dev,
                         struct hwtstamp_config ts_config,
                         netdev_features_t new_features);
diff --git a/drivers/net/ethernet/renesas/sh_eth.c 
b/drivers/net/ethernet/renesas/sh_eth.c
index 7458b1a70e5d..0e5b1935af50 100644
--- a/drivers/net/ethernet/renesas/sh_eth.c
+++ b/drivers/net/ethernet/renesas/sh_eth.c
@@ -526,6 +526,8 @@ static struct sh_eth_cpu_data r7s72100_data = {
                          EESR_TDE | EESR_ECI,
        .fdr_value      = 0x0000070f,
 
+       .trscer_err_mask = DESC_I_RINT8 | DESC_I_RINT5,
+
        .no_psr         = 1,
        .apr            = 1,
        .mpr            = 1,
diff --git a/drivers/net/wan/lapbether.c b/drivers/net/wan/lapbether.c
index ef746ba74ab4..666bbacb8cb4 100644
--- a/drivers/net/wan/lapbether.c
+++ b/drivers/net/wan/lapbether.c
@@ -286,7 +286,6 @@ static int lapbeth_open(struct net_device *dev)
                return -ENODEV;
        }
 
-       netif_start_queue(dev);
        return 0;
 }
 
@@ -294,8 +293,6 @@ static int lapbeth_close(struct net_device *dev)
 {
        int err;
 
-       netif_stop_queue(dev);
-
        if ((err = lapb_unregister(dev)) != LAPB_OK)
                pr_err("lapb_unregister error: %d\n", err);
 
diff --git a/drivers/net/wireless/ath/ath9k/ath9k.h 
b/drivers/net/wireless/ath/ath9k/ath9k.h
index 7bda18c61eb6..beaeb5d07c7e 100644
--- a/drivers/net/wireless/ath/ath9k/ath9k.h
+++ b/drivers/net/wireless/ath/ath9k/ath9k.h
@@ -179,7 +179,8 @@ struct ath_frame_info {
        s8 txq;
        u8 keyix;
        u8 rtscts_rate;
-       u8 retries : 7;
+       u8 retries : 6;
+       u8 dyn_smps : 1;
        u8 baw_tracked : 1;
        u8 tx_power;
        enum ath9k_key_type keytype:2;
diff --git a/drivers/net/wireless/ath/ath9k/xmit.c 
b/drivers/net/wireless/ath/ath9k/xmit.c
index 0ef27d99bef3..101bd6547265 100644
--- a/drivers/net/wireless/ath/ath9k/xmit.c
+++ b/drivers/net/wireless/ath/ath9k/xmit.c
@@ -1255,6 +1255,11 @@ static void ath_buf_set_rate(struct ath_softc *sc, 
struct ath_buf *bf,
                                 is_40, is_sgi, is_sp);
                        if (rix < 8 && (tx_info->flags & IEEE80211_TX_CTL_STBC))
                                info->rates[i].RateFlags |= 
ATH9K_RATESERIES_STBC;
+                       if (rix >= 8 && fi->dyn_smps) {
+                               info->rates[i].RateFlags |=
+                                       ATH9K_RATESERIES_RTS_CTS;
+                               info->flags |= ATH9K_TXDESC_CTSENA;
+                       }
 
                        info->txpower[i] = ath_get_rate_txpower(sc, bf, rix,
                                                                is_40, false);
@@ -2158,6 +2163,7 @@ static void setup_frame_info(struct ieee80211_hw *hw,
                fi->keyix = an->ps_key;
        else
                fi->keyix = ATH9K_TXKEYIX_INVALID;
+       fi->dyn_smps = sta && sta->smps_mode == IEEE80211_SMPS_DYNAMIC;
        fi->keytype = keytype;
        fi->framelen = framelen;
        fi->tx_power = txpower;
diff --git a/drivers/pci/host/pci-xgene-msi.c b/drivers/pci/host/pci-xgene-msi.c
index a6456b578269..b6a099371ad2 100644
--- a/drivers/pci/host/pci-xgene-msi.c
+++ b/drivers/pci/host/pci-xgene-msi.c
@@ -393,13 +393,9 @@ static int xgene_msi_hwirq_alloc(unsigned int cpu)
                if (!msi_group->gic_irq)
                        continue;
 
-               irq_set_chained_handler(msi_group->gic_irq,
-                                       xgene_msi_isr);
-               err = irq_set_handler_data(msi_group->gic_irq, msi_group);
-               if (err) {
-                       pr_err("failed to register GIC IRQ handler\n");
-                       return -EINVAL;
-               }
+               irq_set_chained_handler_and_data(msi_group->gic_irq,
+                       xgene_msi_isr, msi_group);
+
                /*
                 * Statically allocate MSI GIC IRQs to each CPU core.
                 * With 8-core X-Gene v1, 2 MSI GIC IRQs are allocated
diff --git a/drivers/s390/block/dasd.c b/drivers/s390/block/dasd.c
index 0da246505f70..b72d4243bfb9 100644
--- a/drivers/s390/block/dasd.c
+++ b/drivers/s390/block/dasd.c
@@ -3399,8 +3399,6 @@ void dasd_generic_remove(struct ccw_device *cdev)
        struct dasd_device *device;
        struct dasd_block *block;
 
-       cdev->handler = NULL;
-
        device = dasd_device_from_cdev(cdev);
        if (IS_ERR(device)) {
                dasd_remove_sysfs_files(cdev);
@@ -3419,6 +3417,7 @@ void dasd_generic_remove(struct ccw_device *cdev)
         * no quite down yet.
         */
        dasd_set_target_state(device, DASD_STATE_NEW);
+       cdev->handler = NULL;
        /* dasd_delete_device destroys the device reference. */
        block = device->block;
        dasd_delete_device(device);
diff --git a/drivers/scsi/libiscsi.c b/drivers/scsi/libiscsi.c
index b9c924bb6e3d..50e2943c3337 100644
--- a/drivers/scsi/libiscsi.c
+++ b/drivers/scsi/libiscsi.c
@@ -1568,14 +1568,9 @@ static int iscsi_data_xmit(struct iscsi_conn *conn)
                }
                rc = iscsi_prep_scsi_cmd_pdu(conn->task);
                if (rc) {
-                       if (rc == -ENOMEM || rc == -EACCES) {
-                               spin_lock_bh(&conn->taskqueuelock);
-                               list_add_tail(&conn->task->running,
-                                             &conn->cmdqueue);
-                               conn->task = NULL;
-                               spin_unlock_bh(&conn->taskqueuelock);
-                               goto done;
-                       } else
+                       if (rc == -ENOMEM || rc == -EACCES)
+                               fail_scsi_task(conn->task, DID_IMM_RETRY);
+                       else
                                fail_scsi_task(conn->task, DID_ABORT);
                        spin_lock_bh(&conn->taskqueuelock);
                        continue;
diff --git a/drivers/staging/comedi/drivers/addi_apci_1032.c 
b/drivers/staging/comedi/drivers/addi_apci_1032.c
index 536a135cd00b..9058ef473c33 100644
--- a/drivers/staging/comedi/drivers/addi_apci_1032.c
+++ b/drivers/staging/comedi/drivers/addi_apci_1032.c
@@ -269,6 +269,7 @@ static irqreturn_t apci1032_interrupt(int irq, void *d)
        struct apci1032_private *devpriv = dev->private;
        struct comedi_subdevice *s = dev->read_subdev;
        unsigned int ctrl;
+       unsigned short val;
 
        /* check interrupt is from this device */
        if ((inl(devpriv->amcc_iobase + AMCC_OP_REG_INTCSR) &
@@ -284,7 +285,8 @@ static irqreturn_t apci1032_interrupt(int irq, void *d)
        outl(ctrl & ~APCI1032_CTRL_INT_ENA, dev->iobase + APCI1032_CTRL_REG);
 
        s->state = inl(dev->iobase + APCI1032_STATUS_REG) & 0xffff;
-       comedi_buf_write_samples(s, &s->state, 1);
+       val = s->state;
+       comedi_buf_write_samples(s, &val, 1);
        comedi_handle_events(dev, s);
 
        /* enable the interrupt */
diff --git a/drivers/staging/comedi/drivers/addi_apci_1500.c 
b/drivers/staging/comedi/drivers/addi_apci_1500.c
index c4e36fb6df9d..1f25f565041c 100644
--- a/drivers/staging/comedi/drivers/addi_apci_1500.c
+++ b/drivers/staging/comedi/drivers/addi_apci_1500.c
@@ -217,7 +217,7 @@ static irqreturn_t apci1500_interrupt(int irq, void *d)
        struct comedi_device *dev = d;
        struct apci1500_private *devpriv = dev->private;
        struct comedi_subdevice *s = dev->read_subdev;
-       unsigned int status = 0;
+       unsigned short status = 0;
        unsigned int val;
 
        val = inl(devpriv->amcc + AMCC_OP_REG_INTCSR);
@@ -247,14 +247,14 @@ static irqreturn_t apci1500_interrupt(int irq, void *d)
         *
         *    Mask     Meaning
         * ----------  ------------------------------------------
-        * 0x00000001  Event 1 has occurred
-        * 0x00000010  Event 2 has occurred
-        * 0x00000100  Counter/timer 1 has run down (not implemented)
-        * 0x00001000  Counter/timer 2 has run down (not implemented)
-        * 0x00010000  Counter 3 has run down (not implemented)
-        * 0x00100000  Watchdog has run down (not implemented)
-        * 0x01000000  Voltage error
-        * 0x10000000  Short-circuit error
+        * 0b00000001  Event 1 has occurred
+        * 0b00000010  Event 2 has occurred
+        * 0b00000100  Counter/timer 1 has run down (not implemented)
+        * 0b00001000  Counter/timer 2 has run down (not implemented)
+        * 0b00010000  Counter 3 has run down (not implemented)
+        * 0b00100000  Watchdog has run down (not implemented)
+        * 0b01000000  Voltage error
+        * 0b10000000  Short-circuit error
         */
        comedi_buf_write_samples(s, &status, 1);
        comedi_handle_events(dev, s);
diff --git a/drivers/staging/comedi/drivers/adv_pci1710.c 
b/drivers/staging/comedi/drivers/adv_pci1710.c
index 385e14269870..2b408c893ed6 100644
--- a/drivers/staging/comedi/drivers/adv_pci1710.c
+++ b/drivers/staging/comedi/drivers/adv_pci1710.c
@@ -299,11 +299,11 @@ static int pci1710_ai_eoc(struct comedi_device *dev,
 static int pci1710_ai_read_sample(struct comedi_device *dev,
                                  struct comedi_subdevice *s,
                                  unsigned int cur_chan,
-                                 unsigned int *val)
+                                 unsigned short *val)
 {
        const struct boardtype *board = dev->board_ptr;
        struct pci1710_private *devpriv = dev->private;
-       unsigned int sample;
+       unsigned short sample;
        unsigned int chan;
 
        sample = inw(dev->iobase + PCI171X_AD_DATA_REG);
@@ -344,7 +344,7 @@ static int pci1710_ai_insn_read(struct comedi_device *dev,
        pci1710_ai_setup_chanlist(dev, s, &insn->chanspec, 1, 1);
 
        for (i = 0; i < insn->n; i++) {
-               unsigned int val;
+               unsigned short val;
 
                /* start conversion */
                outw(0, dev->iobase + PCI171X_SOFTTRG_REG);
@@ -394,7 +394,7 @@ static void pci1710_handle_every_sample(struct 
comedi_device *dev,
 {
        struct comedi_cmd *cmd = &s->async->cmd;
        unsigned int status;
-       unsigned int val;
+       unsigned short val;
        int ret;
 
        status = inw(dev->iobase + PCI171X_STATUS_REG);
@@ -454,7 +454,7 @@ static void pci1710_handle_fifo(struct comedi_device *dev,
        }
 
        for (i = 0; i < devpriv->max_samples; i++) {
-               unsigned int val;
+               unsigned short val;
                int ret;
 
                ret = pci1710_ai_read_sample(dev, s, s->async->cur_chan, &val);
diff --git a/drivers/staging/comedi/drivers/das6402.c 
b/drivers/staging/comedi/drivers/das6402.c
index 0fdf5e02182f..c27dbd55564c 100644
--- a/drivers/staging/comedi/drivers/das6402.c
+++ b/drivers/staging/comedi/drivers/das6402.c
@@ -195,7 +195,7 @@ static irqreturn_t das6402_interrupt(int irq, void *d)
        if (status & DAS6402_STATUS_FFULL) {
                async->events |= COMEDI_CB_OVERFLOW;
        } else if (status & DAS6402_STATUS_FFNE) {
-               unsigned int val;
+               unsigned short val;
 
                val = das6402_ai_read_sample(dev, s);
                comedi_buf_write_samples(s, &val, 1);
diff --git a/drivers/staging/comedi/drivers/das800.c 
b/drivers/staging/comedi/drivers/das800.c
index fd4cb4911671..3bdaedc6d864 100644
--- a/drivers/staging/comedi/drivers/das800.c
+++ b/drivers/staging/comedi/drivers/das800.c
@@ -436,7 +436,7 @@ static irqreturn_t das800_interrupt(int irq, void *d)
        struct comedi_cmd *cmd;
        unsigned long irq_flags;
        unsigned int status;
-       unsigned int val;
+       unsigned short val;
        bool fifo_empty;
        bool fifo_overflow;
        int i;
diff --git a/drivers/staging/comedi/drivers/dmm32at.c 
b/drivers/staging/comedi/drivers/dmm32at.c
index b8606ded0623..a2e3240b66a8 100644
--- a/drivers/staging/comedi/drivers/dmm32at.c
+++ b/drivers/staging/comedi/drivers/dmm32at.c
@@ -413,7 +413,7 @@ static irqreturn_t dmm32at_isr(int irq, void *d)
 {
        struct comedi_device *dev = d;
        unsigned char intstat;
-       unsigned int val;
+       unsigned short val;
        int i;
 
        if (!dev->attached) {
diff --git a/drivers/staging/comedi/drivers/me4000.c 
b/drivers/staging/comedi/drivers/me4000.c
index 15a53204a36a..4fe856128870 100644
--- a/drivers/staging/comedi/drivers/me4000.c
+++ b/drivers/staging/comedi/drivers/me4000.c
@@ -933,7 +933,7 @@ static irqreturn_t me4000_ai_isr(int irq, void *dev_id)
        struct comedi_subdevice *s = dev->read_subdev;
        int i;
        int c = 0;
-       unsigned int lval;
+       unsigned short lval;
 
        if (!dev->attached)
                return IRQ_NONE;
diff --git a/drivers/staging/comedi/drivers/pcl711.c 
b/drivers/staging/comedi/drivers/pcl711.c
index 3774daa9d661..e1334733abe7 100644
--- a/drivers/staging/comedi/drivers/pcl711.c
+++ b/drivers/staging/comedi/drivers/pcl711.c
@@ -193,7 +193,7 @@ static irqreturn_t pcl711_interrupt(int irq, void *d)
        struct comedi_device *dev = d;
        struct comedi_subdevice *s = dev->read_subdev;
        struct comedi_cmd *cmd = &s->async->cmd;
-       unsigned int data;
+       unsigned short data;
 
        if (!dev->attached) {
                dev_err(dev->class_dev, "spurious interrupt\n");
diff --git a/drivers/staging/comedi/drivers/pcl818.c 
b/drivers/staging/comedi/drivers/pcl818.c
index 5aeed44dff70..f06241712308 100644
--- a/drivers/staging/comedi/drivers/pcl818.c
+++ b/drivers/staging/comedi/drivers/pcl818.c
@@ -422,7 +422,7 @@ static int pcl818_ai_eoc(struct comedi_device *dev,
 
 static bool pcl818_ai_write_sample(struct comedi_device *dev,
                                   struct comedi_subdevice *s,
-                                  unsigned int chan, unsigned int val)
+                                  unsigned int chan, unsigned short val)
 {
        struct pcl818_private *devpriv = dev->private;
        struct comedi_cmd *cmd = &s->async->cmd;
diff --git a/drivers/staging/ks7010/ks_wlan_net.c 
b/drivers/staging/ks7010/ks_wlan_net.c
index b2b4fa4c3834..498ea7754dcc 100644
--- a/drivers/staging/ks7010/ks_wlan_net.c
+++ b/drivers/staging/ks7010/ks_wlan_net.c
@@ -1404,6 +1404,7 @@ static int ks_wlan_set_scan(struct net_device *dev,
        struct ks_wlan_private *priv =
            (struct ks_wlan_private *)netdev_priv(dev);
        struct iw_scan_req *req = NULL;
+       int len;
        DPRINTK(2, "\n");
 
        if (priv->sleep_mode == SLP_SLEEP) {
@@ -1415,8 +1416,9 @@ static int ks_wlan_set_scan(struct net_device *dev,
        if (wrqu->data.length == sizeof(struct iw_scan_req)
            && wrqu->data.flags & IW_SCAN_THIS_ESSID) {
                req = (struct iw_scan_req *)extra;
-               priv->scan_ssid_len = req->essid_len;
-               memcpy(priv->scan_ssid, req->essid, priv->scan_ssid_len);
+               len = min_t(int, req->essid_len, IW_ESSID_MAX_SIZE);
+               priv->scan_ssid_len = len;
+               memcpy(priv->scan_ssid, req->essid, len);
        } else {
                priv->scan_ssid_len = 0;
        }
diff --git a/drivers/staging/rtl8188eu/core/rtw_ap.c 
b/drivers/staging/rtl8188eu/core/rtw_ap.c
index 6513ace1fce6..7dd6b7f19bf6 100644
--- a/drivers/staging/rtl8188eu/core/rtw_ap.c
+++ b/drivers/staging/rtl8188eu/core/rtw_ap.c
@@ -917,6 +917,7 @@ int rtw_check_beacon_data(struct adapter *padapter, u8 
*pbuf,  int len)
        /* SSID */
        p = rtw_get_ie(ie + _BEACON_IE_OFFSET_, _SSID_IE_, &ie_len, 
(pbss_network->IELength - _BEACON_IE_OFFSET_));
        if (p && ie_len > 0) {
+               ie_len = min_t(int, ie_len, sizeof(pbss_network->Ssid.Ssid));
                memset(&pbss_network->Ssid, 0, sizeof(struct ndis_802_11_ssid));
                memcpy(pbss_network->Ssid.Ssid, (p + 2), ie_len);
                pbss_network->Ssid.SsidLength = ie_len;
@@ -935,6 +936,7 @@ int rtw_check_beacon_data(struct adapter *padapter, u8 
*pbuf,  int len)
        /*  get supported rates */
        p = rtw_get_ie(ie + _BEACON_IE_OFFSET_, _SUPPORTEDRATES_IE_, &ie_len, 
(pbss_network->IELength - _BEACON_IE_OFFSET_));
        if (p) {
+               ie_len = min_t(int, ie_len, NDIS_802_11_LENGTH_RATES_EX);
                memcpy(supportRate, p + 2, ie_len);
                supportRateNum = ie_len;
        }
@@ -942,6 +944,8 @@ int rtw_check_beacon_data(struct adapter *padapter, u8 
*pbuf,  int len)
        /* get ext_supported rates */
        p = rtw_get_ie(ie + _BEACON_IE_OFFSET_, _EXT_SUPPORTEDRATES_IE_, 
&ie_len, pbss_network->IELength - _BEACON_IE_OFFSET_);
        if (p) {
+               ie_len = min_t(int, ie_len,
+                              NDIS_802_11_LENGTH_RATES_EX - supportRateNum);
                memcpy(supportRate + supportRateNum, p + 2, ie_len);
                supportRateNum += ie_len;
        }
@@ -1057,6 +1061,7 @@ int rtw_check_beacon_data(struct adapter *padapter, u8 
*pbuf,  int len)
                        pht_cap->mcs.rx_mask[0] = 0xff;
                        pht_cap->mcs.rx_mask[1] = 0x0;
                }
+               ie_len = min_t(int, ie_len, sizeof(pmlmepriv->htpriv.ht_cap));
                memcpy(&pmlmepriv->htpriv.ht_cap, p+2, ie_len);
        }
 
diff --git a/drivers/staging/rtl8188eu/os_dep/ioctl_linux.c 
b/drivers/staging/rtl8188eu/os_dep/ioctl_linux.c
index 50793c9df1b3..866f9a571813 100644
--- a/drivers/staging/rtl8188eu/os_dep/ioctl_linux.c
+++ b/drivers/staging/rtl8188eu/os_dep/ioctl_linux.c
@@ -1172,9 +1172,11 @@ static int rtw_wx_set_scan(struct net_device *dev, 
struct iw_request_info *a,
                                                break;
                                        }
                                        sec_len = *(pos++); len -= 1;
-                                       if (sec_len > 0 && sec_len <= len) {
+                                       if (sec_len > 0 &&
+                                           sec_len <= len &&
+                                           sec_len <= 32) {
                                                ssid[ssid_index].SsidLength = 
sec_len;
-                                               memcpy(ssid[ssid_index].Ssid, 
pos, ssid[ssid_index].SsidLength);
+                                               memcpy(ssid[ssid_index].Ssid, 
pos, sec_len);
                                                ssid_index++;
                                        }
                                        pos += sec_len;
diff --git a/drivers/staging/rtl8192e/rtl8192e/rtl_wx.c 
b/drivers/staging/rtl8192e/rtl8192e/rtl_wx.c
index 7413a100ca19..fb3291dde3ae 100644
--- a/drivers/staging/rtl8192e/rtl8192e/rtl_wx.c
+++ b/drivers/staging/rtl8192e/rtl8192e/rtl_wx.c
@@ -419,9 +419,10 @@ static int _rtl92e_wx_set_scan(struct net_device *dev,
                struct iw_scan_req *req = (struct iw_scan_req *)b;
 
                if (req->essid_len) {
-                       ieee->current_network.ssid_len = req->essid_len;
-                       memcpy(ieee->current_network.ssid, req->essid,
-                              req->essid_len);
+                       int len = min_t(int, req->essid_len, IW_ESSID_MAX_SIZE);
+
+                       ieee->current_network.ssid_len = len;
+                       memcpy(ieee->current_network.ssid, req->essid, len);
                }
        }
 
diff --git a/drivers/staging/rtl8192u/r8192U_wx.c 
b/drivers/staging/rtl8192u/r8192U_wx.c
index d2f2f246063f..65aec3c2f574 100644
--- a/drivers/staging/rtl8192u/r8192U_wx.c
+++ b/drivers/staging/rtl8192u/r8192U_wx.c
@@ -333,8 +333,10 @@ static int r8192_wx_set_scan(struct net_device *dev, 
struct iw_request_info *a,
                struct iw_scan_req *req = (struct iw_scan_req *)b;
 
                if (req->essid_len) {
-                       ieee->current_network.ssid_len = req->essid_len;
-                       memcpy(ieee->current_network.ssid, req->essid, 
req->essid_len);
+                       int len = min_t(int, req->essid_len, IW_ESSID_MAX_SIZE);
+
+                       ieee->current_network.ssid_len = len;
+                       memcpy(ieee->current_network.ssid, req->essid, len);
                }
        }
 
diff --git a/drivers/staging/rtl8712/rtl871x_cmd.c 
b/drivers/staging/rtl8712/rtl871x_cmd.c
index b7ee5e63af33..166f5151e2b8 100644
--- a/drivers/staging/rtl8712/rtl871x_cmd.c
+++ b/drivers/staging/rtl8712/rtl871x_cmd.c
@@ -239,8 +239,10 @@ u8 r8712_sitesurvey_cmd(struct _adapter *padapter,
        psurveyPara->ss_ssidlen = 0;
        memset(psurveyPara->ss_ssid, 0, IW_ESSID_MAX_SIZE + 1);
        if ((pssid != NULL) && (pssid->SsidLength)) {
-               memcpy(psurveyPara->ss_ssid, pssid->Ssid, pssid->SsidLength);
-               psurveyPara->ss_ssidlen = cpu_to_le32(pssid->SsidLength);
+               int len = min_t(int, pssid->SsidLength, IW_ESSID_MAX_SIZE);
+
+               memcpy(psurveyPara->ss_ssid, pssid->Ssid, len);
+               psurveyPara->ss_ssidlen = cpu_to_le32(len);
        }
        set_fwstate(pmlmepriv, _FW_UNDER_SURVEY);
        r8712_enqueue_cmd(pcmdpriv, ph2c);
diff --git a/drivers/staging/rtl8712/rtl871x_ioctl_linux.c 
b/drivers/staging/rtl8712/rtl871x_ioctl_linux.c
index 2d26f9a30fcf..af190b3863c8 100644
--- a/drivers/staging/rtl8712/rtl871x_ioctl_linux.c
+++ b/drivers/staging/rtl8712/rtl871x_ioctl_linux.c
@@ -932,7 +932,7 @@ static int r871x_wx_set_priv(struct net_device *dev,
        struct iw_point *dwrq = (struct iw_point *)awrq;
 
        len = dwrq->length;
-       ext = memdup_user(dwrq->pointer, len);
+       ext = strndup_user(dwrq->pointer, len);
        if (IS_ERR(ext))
                return PTR_ERR(ext);
 
diff --git a/drivers/usb/class/cdc-acm.c b/drivers/usb/class/cdc-acm.c
index a251514a0ee9..9f1a1a318a3d 100644
--- a/drivers/usb/class/cdc-acm.c
+++ b/drivers/usb/class/cdc-acm.c
@@ -1883,6 +1883,11 @@ static const struct usb_device_id acm_ids[] = {
        .driver_info = SEND_ZERO_PACKET,
        },
 
+       /* Exclude Goodix Fingerprint Reader */
+       { USB_DEVICE(0x27c6, 0x5395),
+       .driver_info = IGNORE_DEVICE,
+       },
+
        /* control interfaces without any protocol set */
        { USB_INTERFACE_INFO(USB_CLASS_COMM, USB_CDC_SUBCLASS_ACM,
                USB_CDC_PROTO_NONE) },
diff --git a/drivers/usb/gadget/function/f_uac2.c 
b/drivers/usb/gadget/function/f_uac2.c
index af7fd0185a44..62a38fabd2b5 100644
--- a/drivers/usb/gadget/function/f_uac2.c
+++ b/drivers/usb/gadget/function/f_uac2.c
@@ -997,7 +997,7 @@ static int set_ep_max_packet_size(const struct f_uac2_opts 
*uac2_opts,
        }
 
        max_size_bw = num_channels(chmask) * ssize *
-               DIV_ROUND_UP(srate, factor / (1 << (ep_desc->bInterval - 1)));
+               ((srate / (factor / (1 << (ep_desc->bInterval - 1)))) + 1);
        ep_desc->wMaxPacketSize = cpu_to_le16(min_t(u16, max_size_bw,
                                                    max_size_ep));
 
diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c
index b0e1d3da2e7e..809f5f2b0dd9 100644
--- a/drivers/usb/host/xhci.c
+++ b/drivers/usb/host/xhci.c
@@ -1022,6 +1022,7 @@ int xhci_resume(struct xhci_hcd *xhci, bool hibernated)
        struct usb_hcd          *secondary_hcd;
        int                     retval = 0;
        bool                    comp_timer_running = false;
+       bool                    pending_portevent = false;
 
        if (!hcd->state)
                return 0;
@@ -1155,13 +1156,22 @@ int xhci_resume(struct xhci_hcd *xhci, bool hibernated)
 
  done:
        if (retval == 0) {
-               /* Resume root hubs only when have pending events. */
-               if (xhci_pending_portevent(xhci)) {
+               /*
+                * Resume roothubs only if there are pending events.
+                * USB 3 devices resend U3 LFPS wake after a 100ms delay if
+                * the first wake signalling failed, give it that chance.
+                */
+               pending_portevent = xhci_pending_portevent(xhci);
+               if (!pending_portevent) {
+                       msleep(120);
+                       pending_portevent = xhci_pending_portevent(xhci);
+               }
+
+               if (pending_portevent) {
                        usb_hcd_resume_root_hub(xhci->shared_hcd);
                        usb_hcd_resume_root_hub(hcd);
                }
        }
-
        /*
         * If system is subject to the Quirk, Compliance Mode Timer needs to
         * be re-initialized Always after a system resume. Ports are subject
diff --git a/drivers/usb/renesas_usbhs/pipe.c b/drivers/usb/renesas_usbhs/pipe.c
index 8db4ca7d5d45..e8b0a9c34d72 100644
--- a/drivers/usb/renesas_usbhs/pipe.c
+++ b/drivers/usb/renesas_usbhs/pipe.c
@@ -746,6 +746,8 @@ struct usbhs_pipe *usbhs_pipe_malloc(struct usbhs_priv 
*priv,
 
 void usbhs_pipe_free(struct usbhs_pipe *pipe)
 {
+       usbhsp_pipe_select(pipe);
+       usbhsp_pipe_cfg_set(pipe, 0xFFFF, 0);
        usbhsp_put_pipe(pipe);
 }
 
diff --git a/drivers/usb/serial/ch341.c b/drivers/usb/serial/ch341.c
index fc1c8f4f34c1..c6ff79360302 100644
--- a/drivers/usb/serial/ch341.c
+++ b/drivers/usb/serial/ch341.c
@@ -75,6 +75,7 @@ static const struct usb_device_id id_table[] = {
        { USB_DEVICE(0x1a86, 0x7522) },
        { USB_DEVICE(0x1a86, 0x7523) },
        { USB_DEVICE(0x4348, 0x5523) },
+       { USB_DEVICE(0x9986, 0x7523) },
        { },
 };
 MODULE_DEVICE_TABLE(usb, id_table);
diff --git a/drivers/usb/serial/cp210x.c b/drivers/usb/serial/cp210x.c
index 1847074b4d81..7eb83a1a43c2 100644
--- a/drivers/usb/serial/cp210x.c
+++ b/drivers/usb/serial/cp210x.c
@@ -143,6 +143,7 @@ static const struct usb_device_id id_table[] = {
        { USB_DEVICE(0x10C4, 0x8857) }, /* CEL EM357 ZigBee USB Stick */
        { USB_DEVICE(0x10C4, 0x88A4) }, /* MMB Networks ZigBee USB Device */
        { USB_DEVICE(0x10C4, 0x88A5) }, /* Planet Innovation Ingeni ZigBee USB 
Device */
+       { USB_DEVICE(0x10C4, 0x88D8) }, /* Acuity Brands nLight Air Adapter */
        { USB_DEVICE(0x10C4, 0x88FB) }, /* CESINEL MEDCAL STII Network Analyzer 
*/
        { USB_DEVICE(0x10C4, 0x8938) }, /* CESINEL MEDCAL S II Network Analyzer 
*/
        { USB_DEVICE(0x10C4, 0x8946) }, /* Ketra N1 Wireless Interface */
@@ -199,6 +200,8 @@ static const struct usb_device_id id_table[] = {
        { USB_DEVICE(0x1901, 0x0194) }, /* GE Healthcare Remote Alarm Box */
        { USB_DEVICE(0x1901, 0x0195) }, /* GE B850/B650/B450 CP2104 DP UART 
interface */
        { USB_DEVICE(0x1901, 0x0196) }, /* GE B850 CP2105 DP UART interface */
+       { USB_DEVICE(0x1901, 0x0197) }, /* GE CS1000 Display serial interface */
+       { USB_DEVICE(0x1901, 0x0198) }, /* GE CS1000 M.2 Key E serial interface 
*/
        { USB_DEVICE(0x199B, 0xBA30) }, /* LORD WSDA-200-USB */
        { USB_DEVICE(0x19CF, 0x3000) }, /* Parrot NMEA GPS Flight Recorder */
        { USB_DEVICE(0x1ADB, 0x0001) }, /* Schweitzer Engineering C662 Cable */
diff --git a/drivers/usb/serial/io_edgeport.c b/drivers/usb/serial/io_edgeport.c
index 77555242e259..ceece1f52c8a 100644
--- a/drivers/usb/serial/io_edgeport.c
+++ b/drivers/usb/serial/io_edgeport.c
@@ -2959,26 +2959,32 @@ static int edge_startup(struct usb_serial *serial)
                                response = -ENODEV;
                        }
 
-                       usb_free_urb(edge_serial->interrupt_read_urb);
-                       kfree(edge_serial->interrupt_in_buffer);
-
-                       usb_free_urb(edge_serial->read_urb);
-                       kfree(edge_serial->bulk_in_buffer);
-
-                       kfree(edge_serial);
-
-                       return response;
+                       goto error;
                }
 
                /* start interrupt read for this edgeport this interrupt will
                 * continue as long as the edgeport is connected */
                response = usb_submit_urb(edge_serial->interrupt_read_urb,
                                                                GFP_KERNEL);
-               if (response)
+               if (response) {
                        dev_err(ddev, "%s - Error %d submitting control urb\n",
                                __func__, response);
+
+                       goto error;
+               }
        }
        return response;
+
+error:
+       usb_free_urb(edge_serial->interrupt_read_urb);
+       kfree(edge_serial->interrupt_in_buffer);
+
+       usb_free_urb(edge_serial->read_urb);
+       kfree(edge_serial->bulk_in_buffer);
+
+       kfree(edge_serial);
+
+       return response;
 }
 
 
diff --git a/drivers/usb/usbip/stub_dev.c b/drivers/usb/usbip/stub_dev.c
index a5a6a114219a..6b643e6c8f0b 100644
--- a/drivers/usb/usbip/stub_dev.c
+++ b/drivers/usb/usbip/stub_dev.c
@@ -60,6 +60,8 @@ static ssize_t store_sockfd(struct device *dev, struct 
device_attribute *attr,
        int sockfd = 0;
        struct socket *socket;
        int rv;
+       struct task_struct *tcp_rx = NULL;
+       struct task_struct *tcp_tx = NULL;
 
        if (!sdev) {
                dev_err(dev, "sdev is null\n");
@@ -83,23 +85,47 @@ static ssize_t store_sockfd(struct device *dev, struct 
device_attribute *attr,
                }
 
                socket = sockfd_lookup(sockfd, &err);
-               if (!socket)
+               if (!socket) {
+                       dev_err(dev, "failed to lookup sock");
                        goto err;
+               }
 
-               sdev->ud.tcp_socket = socket;
-               sdev->ud.sockfd = sockfd;
+               if (socket->type != SOCK_STREAM) {
+                       dev_err(dev, "Expecting SOCK_STREAM - found %d",
+                               socket->type);
+                       goto sock_err;
+               }
 
+               /* unlock and create threads and get tasks */
                spin_unlock_irq(&sdev->ud.lock);
+               tcp_rx = kthread_create(stub_rx_loop, &sdev->ud, "stub_rx");
+               if (IS_ERR(tcp_rx)) {
+                       sockfd_put(socket);
+                       return -EINVAL;
+               }
+               tcp_tx = kthread_create(stub_tx_loop, &sdev->ud, "stub_tx");
+               if (IS_ERR(tcp_tx)) {
+                       kthread_stop(tcp_rx);
+                       sockfd_put(socket);
+                       return -EINVAL;
+               }
 
-               sdev->ud.tcp_rx = kthread_get_run(stub_rx_loop, &sdev->ud,
-                                                 "stub_rx");
-               sdev->ud.tcp_tx = kthread_get_run(stub_tx_loop, &sdev->ud,
-                                                 "stub_tx");
+               /* get task structs now */
+               get_task_struct(tcp_rx);
+               get_task_struct(tcp_tx);
 
+               /* lock and update sdev->ud state */
                spin_lock_irq(&sdev->ud.lock);
+               sdev->ud.tcp_socket = socket;
+               sdev->ud.sockfd = sockfd;
+               sdev->ud.tcp_rx = tcp_rx;
+               sdev->ud.tcp_tx = tcp_tx;
                sdev->ud.status = SDEV_ST_USED;
                spin_unlock_irq(&sdev->ud.lock);
 
+               wake_up_process(sdev->ud.tcp_rx);
+               wake_up_process(sdev->ud.tcp_tx);
+
        } else {
                dev_info(dev, "stub down\n");
 
@@ -114,6 +140,8 @@ static ssize_t store_sockfd(struct device *dev, struct 
device_attribute *attr,
 
        return count;
 
+sock_err:
+       sockfd_put(socket);
 err:
        spin_unlock_irq(&sdev->ud.lock);
        return -EINVAL;
diff --git a/drivers/usb/usbip/vhci_sysfs.c b/drivers/usb/usbip/vhci_sysfs.c
index e8a008de8dbc..ca00d38d22af 100644
--- a/drivers/usb/usbip/vhci_sysfs.c
+++ b/drivers/usb/usbip/vhci_sysfs.c
@@ -278,6 +278,8 @@ static ssize_t store_attach(struct device *dev, struct 
device_attribute *attr,
        struct vhci_device *vdev;
        int err;
        unsigned long flags;
+       struct task_struct *tcp_rx = NULL;
+       struct task_struct *tcp_tx = NULL;
 
        /*
         * @rhport: port number of vhci_hcd
@@ -309,12 +311,35 @@ static ssize_t store_attach(struct device *dev, struct 
device_attribute *attr,
 
        /* Extract socket from fd. */
        socket = sockfd_lookup(sockfd, &err);
-       if (!socket)
+       if (!socket) {
+               dev_err(dev, "failed to lookup sock");
                return -EINVAL;
+       }
+       if (socket->type != SOCK_STREAM) {
+               dev_err(dev, "Expecting SOCK_STREAM - found %d",
+                       socket->type);
+               sockfd_put(socket);
+               return -EINVAL;
+       }
+
+       /* create threads before locking */
+       tcp_rx = kthread_create(vhci_rx_loop, &vdev->ud, "vhci_rx");
+       if (IS_ERR(tcp_rx)) {
+               sockfd_put(socket);
+               return -EINVAL;
+       }
+       tcp_tx = kthread_create(vhci_tx_loop, &vdev->ud, "vhci_tx");
+       if (IS_ERR(tcp_tx)) {
+               kthread_stop(tcp_rx);
+               sockfd_put(socket);
+               return -EINVAL;
+       }
 
-       /* now need lock until setting vdev status as used */
+       /* get task structs now */
+       get_task_struct(tcp_rx);
+       get_task_struct(tcp_tx);
 
-       /* begin a lock */
+       /* now begin lock until setting vdev status set */
        spin_lock_irqsave(&vhci->lock, flags);
        spin_lock(&vdev->ud.lock);
 
@@ -324,6 +349,8 @@ static ssize_t store_attach(struct device *dev, struct 
device_attribute *attr,
                spin_unlock_irqrestore(&vhci->lock, flags);
 
                sockfd_put(socket);
+               kthread_stop_put(tcp_rx);
+               kthread_stop_put(tcp_tx);
 
                dev_err(dev, "port %d already used\n", rhport);
                return -EINVAL;
@@ -338,14 +365,16 @@ static ssize_t store_attach(struct device *dev, struct 
device_attribute *attr,
        vdev->speed         = speed;
        vdev->ud.sockfd     = sockfd;
        vdev->ud.tcp_socket = socket;
+       vdev->ud.tcp_rx     = tcp_rx;
+       vdev->ud.tcp_tx     = tcp_tx;
        vdev->ud.status     = VDEV_ST_NOTASSIGNED;
 
        spin_unlock(&vdev->ud.lock);
        spin_unlock_irqrestore(&vhci->lock, flags);
        /* end the lock */
 
-       vdev->ud.tcp_rx = kthread_get_run(vhci_rx_loop, &vdev->ud, "vhci_rx");
-       vdev->ud.tcp_tx = kthread_get_run(vhci_tx_loop, &vdev->ud, "vhci_tx");
+       wake_up_process(vdev->ud.tcp_rx);
+       wake_up_process(vdev->ud.tcp_tx);
 
        rh_port_connect(vdev, speed);
 
diff --git a/drivers/usb/usbip/vudc_sysfs.c b/drivers/usb/usbip/vudc_sysfs.c
index 7efa374a4970..e3f7c76d1956 100644
--- a/drivers/usb/usbip/vudc_sysfs.c
+++ b/drivers/usb/usbip/vudc_sysfs.c
@@ -24,6 +24,7 @@
 #include <linux/usb/ch9.h>
 #include <linux/sysfs.h>
 #include <linux/kthread.h>
+#include <linux/file.h>
 #include <linux/byteorder/generic.h>
 
 #include "usbip_common.h"
@@ -150,6 +151,13 @@ static ssize_t store_sockfd(struct device *dev, struct 
device_attribute *attr,
                        goto unlock_ud;
                }
 
+               if (socket->type != SOCK_STREAM) {
+                       dev_err(dev, "Expecting SOCK_STREAM - found %d",
+                               socket->type);
+                       ret = -EINVAL;
+                       goto sock_err;
+               }
+
                udc->ud.tcp_socket = socket;
 
                spin_unlock_irq(&udc->ud.lock);
@@ -189,6 +197,8 @@ static ssize_t store_sockfd(struct device *dev, struct 
device_attribute *attr,
 
        return count;
 
+sock_err:
+       sockfd_put(socket);
 unlock_ud:
        spin_unlock_irq(&udc->ud.lock);
 unlock:
diff --git a/drivers/xen/events/events_2l.c b/drivers/xen/events/events_2l.c
index c31c08a708be..ec3417a9e1a4 100644
--- a/drivers/xen/events/events_2l.c
+++ b/drivers/xen/events/events_2l.c
@@ -46,6 +46,11 @@ static unsigned evtchn_2l_max_channels(void)
        return EVTCHN_2L_NR_CHANNELS;
 }
 
+static void evtchn_2l_remove(evtchn_port_t evtchn, unsigned int cpu)
+{
+       clear_bit(evtchn, BM(per_cpu(cpu_evtchn_mask, cpu)));
+}
+
 static void evtchn_2l_bind_to_cpu(struct irq_info *info, unsigned cpu)
 {
        clear_bit(info->evtchn, BM(per_cpu(cpu_evtchn_mask, info->cpu)));
@@ -70,12 +75,6 @@ static bool evtchn_2l_is_pending(unsigned port)
        return sync_test_bit(port, BM(&s->evtchn_pending[0]));
 }
 
-static bool evtchn_2l_test_and_set_mask(unsigned port)
-{
-       struct shared_info *s = HYPERVISOR_shared_info;
-       return sync_test_and_set_bit(port, BM(&s->evtchn_mask[0]));
-}
-
 static void evtchn_2l_mask(unsigned port)
 {
        struct shared_info *s = HYPERVISOR_shared_info;
@@ -353,18 +352,27 @@ static void evtchn_2l_resume(void)
                                EVTCHN_2L_NR_CHANNELS/BITS_PER_EVTCHN_WORD);
 }
 
+static int evtchn_2l_percpu_deinit(unsigned int cpu)
+{
+       memset(per_cpu(cpu_evtchn_mask, cpu), 0, sizeof(xen_ulong_t) *
+                       EVTCHN_2L_NR_CHANNELS/BITS_PER_EVTCHN_WORD);
+
+       return 0;
+}
+
 static const struct evtchn_ops evtchn_ops_2l = {
        .max_channels      = evtchn_2l_max_channels,
        .nr_channels       = evtchn_2l_max_channels,
+       .remove            = evtchn_2l_remove,
        .bind_to_cpu       = evtchn_2l_bind_to_cpu,
        .clear_pending     = evtchn_2l_clear_pending,
        .set_pending       = evtchn_2l_set_pending,
        .is_pending        = evtchn_2l_is_pending,
-       .test_and_set_mask = evtchn_2l_test_and_set_mask,
        .mask              = evtchn_2l_mask,
        .unmask            = evtchn_2l_unmask,
        .handle_events     = evtchn_2l_handle_events,
        .resume            = evtchn_2l_resume,
+       .percpu_deinit     = evtchn_2l_percpu_deinit,
 };
 
 void __init xen_evtchn_2l_init(void)
diff --git a/drivers/xen/events/events_base.c b/drivers/xen/events/events_base.c
index 5308bc1e0189..2adf54119677 100644
--- a/drivers/xen/events/events_base.c
+++ b/drivers/xen/events/events_base.c
@@ -99,6 +99,7 @@ static DEFINE_RWLOCK(evtchn_rwlock);
  *   evtchn_rwlock
  *     IRQ-desc lock
  *       percpu eoi_list_lock
+ *         irq_info->lock
  */
 
 static LIST_HEAD(xen_irq_list_head);
@@ -220,6 +221,8 @@ static int xen_irq_info_common_setup(struct irq_info *info,
        info->irq = irq;
        info->evtchn = evtchn;
        info->cpu = cpu;
+       info->mask_reason = EVT_MASK_REASON_EXPLICIT;
+       spin_lock_init(&info->lock);
 
        ret = set_evtchn_to_irq(evtchn, irq);
        if (ret < 0)
@@ -286,6 +289,7 @@ static int xen_irq_info_pirq_setup(unsigned irq,
 static void xen_irq_info_cleanup(struct irq_info *info)
 {
        set_evtchn_to_irq(info->evtchn, -1);
+       xen_evtchn_port_remove(info->evtchn, info->cpu);
        info->evtchn = 0;
 }
 
@@ -366,6 +370,34 @@ unsigned int cpu_from_evtchn(unsigned int evtchn)
        return ret;
 }
 
+static void do_mask(struct irq_info *info, u8 reason)
+{
+       unsigned long flags;
+
+       spin_lock_irqsave(&info->lock, flags);
+
+       if (!info->mask_reason)
+               mask_evtchn(info->evtchn);
+
+       info->mask_reason |= reason;
+
+       spin_unlock_irqrestore(&info->lock, flags);
+}
+
+static void do_unmask(struct irq_info *info, u8 reason)
+{
+       unsigned long flags;
+
+       spin_lock_irqsave(&info->lock, flags);
+
+       info->mask_reason &= ~reason;
+
+       if (!info->mask_reason)
+               unmask_evtchn(info->evtchn);
+
+       spin_unlock_irqrestore(&info->lock, flags);
+}
+
 #ifdef CONFIG_X86
 static bool pirq_check_eoi_map(unsigned irq)
 {
@@ -501,7 +533,7 @@ static void xen_irq_lateeoi_locked(struct irq_info *info, 
bool spurious)
        }
 
        info->eoi_time = 0;
-       unmask_evtchn(evtchn);
+       do_unmask(info, EVT_MASK_REASON_EOI_PENDING);
 }
 
 static void xen_irq_lateeoi_worker(struct work_struct *work)
@@ -670,6 +702,12 @@ static void xen_evtchn_close(unsigned int port)
                BUG();
 }
 
+static void event_handler_exit(struct irq_info *info)
+{
+       smp_store_release(&info->is_active, 0);
+       clear_evtchn(info->evtchn);
+}
+
 static void pirq_query_unmask(int irq)
 {
        struct physdev_irq_status_query irq_status;
@@ -688,7 +726,8 @@ static void pirq_query_unmask(int irq)
 
 static void eoi_pirq(struct irq_data *data)
 {
-       int evtchn = evtchn_from_irq(data->irq);
+       struct irq_info *info = info_for_irq(data->irq);
+       int evtchn = info ? info->evtchn : 0;
        struct physdev_eoi eoi = { .irq = pirq_from_irq(data->irq) };
        int rc = 0;
 
@@ -697,16 +736,15 @@ static void eoi_pirq(struct irq_data *data)
 
        if (unlikely(irqd_is_setaffinity_pending(data)) &&
            likely(!irqd_irq_disabled(data))) {
-               int masked = test_and_set_mask(evtchn);
+               do_mask(info, EVT_MASK_REASON_TEMPORARY);
 
-               clear_evtchn(evtchn);
+               event_handler_exit(info);
 
                irq_move_masked_irq(data);
 
-               if (!masked)
-                       unmask_evtchn(evtchn);
+               do_unmask(info, EVT_MASK_REASON_TEMPORARY);
        } else
-               clear_evtchn(evtchn);
+               event_handler_exit(info);
 
        if (pirq_needs_eoi(data->irq)) {
                rc = HYPERVISOR_physdev_op(PHYSDEVOP_eoi, &eoi);
@@ -757,7 +795,8 @@ static unsigned int __startup_pirq(unsigned int irq)
                goto err;
 
 out:
-       unmask_evtchn(evtchn);
+       do_unmask(info, EVT_MASK_REASON_EXPLICIT);
+
        eoi_pirq(irq_get_irq_data(irq));
 
        return 0;
@@ -784,7 +823,7 @@ static void shutdown_pirq(struct irq_data *data)
        if (!VALID_EVTCHN(evtchn))
                return;
 
-       mask_evtchn(evtchn);
+       do_mask(info, EVT_MASK_REASON_EXPLICIT);
        xen_evtchn_close(evtchn);
        xen_irq_info_cleanup(info);
 }
@@ -1541,6 +1580,8 @@ void handle_irq_for_port(evtchn_port_t port, struct 
evtchn_loop_ctrl *ctrl)
        }
 
        info = info_for_irq(irq);
+       if (xchg_acquire(&info->is_active, 1))
+               return;
 
        if (ctrl->defer_eoi) {
                info->eoi_cpu = smp_processor_id();
@@ -1647,8 +1688,8 @@ void rebind_evtchn_irq(int evtchn, int irq)
 static int rebind_irq_to_cpu(unsigned irq, unsigned tcpu)
 {
        struct evtchn_bind_vcpu bind_vcpu;
-       int evtchn = evtchn_from_irq(irq);
-       int masked;
+       struct irq_info *info = info_for_irq(irq);
+       int evtchn = info ? info->evtchn : 0;
 
        if (!VALID_EVTCHN(evtchn))
                return -1;
@@ -1664,7 +1705,7 @@ static int rebind_irq_to_cpu(unsigned irq, unsigned tcpu)
         * Mask the event while changing the VCPU binding to prevent
         * it being delivered on an unexpected VCPU.
         */
-       masked = test_and_set_mask(evtchn);
+       do_mask(info, EVT_MASK_REASON_TEMPORARY);
 
        /*
         * If this fails, it usually just indicates that we're dealing with a
@@ -1674,8 +1715,7 @@ static int rebind_irq_to_cpu(unsigned irq, unsigned tcpu)
        if (HYPERVISOR_event_channel_op(EVTCHNOP_bind_vcpu, &bind_vcpu) >= 0)
                bind_evtchn_to_cpu(evtchn, tcpu);
 
-       if (!masked)
-               unmask_evtchn(evtchn);
+       do_unmask(info, EVT_MASK_REASON_TEMPORARY);
 
        return 0;
 }
@@ -1690,39 +1730,41 @@ static int set_affinity_irq(struct irq_data *data, 
const struct cpumask *dest,
 
 static void enable_dynirq(struct irq_data *data)
 {
-       int evtchn = evtchn_from_irq(data->irq);
+       struct irq_info *info = info_for_irq(data->irq);
+       evtchn_port_t evtchn = info ? info->evtchn : 0;
 
        if (VALID_EVTCHN(evtchn))
-               unmask_evtchn(evtchn);
+               do_unmask(info, EVT_MASK_REASON_EXPLICIT);
 }
 
 static void disable_dynirq(struct irq_data *data)
 {
-       int evtchn = evtchn_from_irq(data->irq);
+       struct irq_info *info = info_for_irq(data->irq);
+       evtchn_port_t evtchn = info ? info->evtchn : 0;
 
        if (VALID_EVTCHN(evtchn))
-               mask_evtchn(evtchn);
+               do_mask(info, EVT_MASK_REASON_EXPLICIT);
 }
 
 static void ack_dynirq(struct irq_data *data)
 {
-       int evtchn = evtchn_from_irq(data->irq);
+       struct irq_info *info = info_for_irq(data->irq);
+       evtchn_port_t evtchn = info ? info->evtchn : 0;
 
        if (!VALID_EVTCHN(evtchn))
                return;
 
        if (unlikely(irqd_is_setaffinity_pending(data)) &&
            likely(!irqd_irq_disabled(data))) {
-               int masked = test_and_set_mask(evtchn);
+               do_mask(info, EVT_MASK_REASON_TEMPORARY);
 
-               clear_evtchn(evtchn);
+               event_handler_exit(info);
 
                irq_move_masked_irq(data);
 
-               if (!masked)
-                       unmask_evtchn(evtchn);
+               do_unmask(info, EVT_MASK_REASON_TEMPORARY);
        } else
-               clear_evtchn(evtchn);
+               event_handler_exit(info);
 }
 
 static void mask_ack_dynirq(struct irq_data *data)
@@ -1731,18 +1773,39 @@ static void mask_ack_dynirq(struct irq_data *data)
        ack_dynirq(data);
 }
 
+static void lateeoi_ack_dynirq(struct irq_data *data)
+{
+       struct irq_info *info = info_for_irq(data->irq);
+       evtchn_port_t evtchn = info ? info->evtchn : 0;
+
+       if (VALID_EVTCHN(evtchn)) {
+               do_mask(info, EVT_MASK_REASON_EOI_PENDING);
+               event_handler_exit(info);
+       }
+}
+
+static void lateeoi_mask_ack_dynirq(struct irq_data *data)
+{
+       struct irq_info *info = info_for_irq(data->irq);
+       evtchn_port_t evtchn = info ? info->evtchn : 0;
+
+       if (VALID_EVTCHN(evtchn)) {
+               do_mask(info, EVT_MASK_REASON_EXPLICIT);
+               event_handler_exit(info);
+       }
+}
+
 static int retrigger_dynirq(struct irq_data *data)
 {
-       unsigned int evtchn = evtchn_from_irq(data->irq);
-       int masked;
+       struct irq_info *info = info_for_irq(data->irq);
+       evtchn_port_t evtchn = info ? info->evtchn : 0;
 
        if (!VALID_EVTCHN(evtchn))
                return 0;
 
-       masked = test_and_set_mask(evtchn);
+       do_mask(info, EVT_MASK_REASON_TEMPORARY);
        set_evtchn(evtchn);
-       if (!masked)
-               unmask_evtchn(evtchn);
+       do_unmask(info, EVT_MASK_REASON_TEMPORARY);
 
        return 1;
 }
@@ -1837,10 +1900,11 @@ static void restore_cpu_ipis(unsigned int cpu)
 /* Clear an irq's pending state, in preparation for polling on it */
 void xen_clear_irq_pending(int irq)
 {
-       int evtchn = evtchn_from_irq(irq);
+       struct irq_info *info = info_for_irq(irq);
+       evtchn_port_t evtchn = info ? info->evtchn : 0;
 
        if (VALID_EVTCHN(evtchn))
-               clear_evtchn(evtchn);
+               event_handler_exit(info);
 }
 EXPORT_SYMBOL(xen_clear_irq_pending);
 void xen_set_irq_pending(int irq)
@@ -1949,8 +2013,8 @@ static struct irq_chip xen_lateeoi_chip __read_mostly = {
        .irq_mask               = disable_dynirq,
        .irq_unmask             = enable_dynirq,
 
-       .irq_ack                = mask_ack_dynirq,
-       .irq_mask_ack           = mask_ack_dynirq,
+       .irq_ack                = lateeoi_ack_dynirq,
+       .irq_mask_ack           = lateeoi_mask_ack_dynirq,
 
        .irq_set_affinity       = set_affinity_irq,
        .irq_retrigger          = retrigger_dynirq,
diff --git a/drivers/xen/events/events_fifo.c b/drivers/xen/events/events_fifo.c
index 0a4fece5fd8d..3f7d325d2be4 100644
--- a/drivers/xen/events/events_fifo.c
+++ b/drivers/xen/events/events_fifo.c
@@ -209,12 +209,6 @@ static bool evtchn_fifo_is_pending(unsigned port)
        return sync_test_bit(EVTCHN_FIFO_BIT(PENDING, word), BM(word));
 }
 
-static bool evtchn_fifo_test_and_set_mask(unsigned port)
-{
-       event_word_t *word = event_word_from_port(port);
-       return sync_test_and_set_bit(EVTCHN_FIFO_BIT(MASKED, word), BM(word));
-}
-
 static void evtchn_fifo_mask(unsigned port)
 {
        event_word_t *word = event_word_from_port(port);
@@ -421,7 +415,6 @@ static const struct evtchn_ops evtchn_ops_fifo = {
        .clear_pending     = evtchn_fifo_clear_pending,
        .set_pending       = evtchn_fifo_set_pending,
        .is_pending        = evtchn_fifo_is_pending,
-       .test_and_set_mask = evtchn_fifo_test_and_set_mask,
        .mask              = evtchn_fifo_mask,
        .unmask            = evtchn_fifo_unmask,
        .handle_events     = evtchn_fifo_handle_events,
diff --git a/drivers/xen/events/events_internal.h 
b/drivers/xen/events/events_internal.h
index b9b4f5919893..3df6f28b75e6 100644
--- a/drivers/xen/events/events_internal.h
+++ b/drivers/xen/events/events_internal.h
@@ -35,13 +35,19 @@ struct irq_info {
        struct list_head eoi_list;
        short refcnt;
        short spurious_cnt;
-       enum xen_irq_type type; /* type */
+       short type;             /* type */
+       u8 mask_reason;         /* Why is event channel masked */
+#define EVT_MASK_REASON_EXPLICIT       0x01
+#define EVT_MASK_REASON_TEMPORARY      0x02
+#define EVT_MASK_REASON_EOI_PENDING    0x04
+       u8 is_active;           /* Is event just being handled? */
        unsigned irq;
        unsigned int evtchn;    /* event channel */
        unsigned short cpu;     /* cpu bound */
        unsigned short eoi_cpu; /* EOI must happen on this cpu */
        unsigned int irq_epoch; /* If eoi_cpu valid: irq_epoch of event */
        u64 eoi_time;           /* Time in jiffies when to EOI. */
+       spinlock_t lock;
 
        union {
                unsigned short virq;
@@ -67,12 +73,12 @@ struct evtchn_ops {
        unsigned (*nr_channels)(void);
 
        int (*setup)(struct irq_info *info);
+       void (*remove)(evtchn_port_t port, unsigned int cpu);
        void (*bind_to_cpu)(struct irq_info *info, unsigned cpu);
 
        void (*clear_pending)(unsigned port);
        void (*set_pending)(unsigned port);
        bool (*is_pending)(unsigned port);
-       bool (*test_and_set_mask)(unsigned port);
        void (*mask)(unsigned port);
        void (*unmask)(unsigned port);
 
@@ -109,6 +115,13 @@ static inline int xen_evtchn_port_setup(struct irq_info 
*info)
        return 0;
 }
 
+static inline void xen_evtchn_port_remove(evtchn_port_t evtchn,
+                                         unsigned int cpu)
+{
+       if (evtchn_ops->remove)
+               evtchn_ops->remove(evtchn, cpu);
+}
+
 static inline void xen_evtchn_port_bind_to_cpu(struct irq_info *info,
                                               unsigned cpu)
 {
@@ -130,11 +143,6 @@ static inline bool test_evtchn(unsigned port)
        return evtchn_ops->is_pending(port);
 }
 
-static inline bool test_and_set_mask(unsigned port)
-{
-       return evtchn_ops->test_and_set_mask(port);
-}
-
 static inline void mask_evtchn(unsigned port)
 {
        return evtchn_ops->mask(port);
diff --git a/fs/binfmt_misc.c b/fs/binfmt_misc.c
index f842261ce973..2bda9245cabe 100644
--- a/fs/binfmt_misc.c
+++ b/fs/binfmt_misc.c
@@ -695,12 +695,24 @@ static ssize_t bm_register_write(struct file *file, const 
char __user *buffer,
        struct super_block *sb = file_inode(file)->i_sb;
        struct dentry *root = sb->s_root, *dentry;
        int err = 0;
+       struct file *f = NULL;
 
        e = create_entry(buffer, count);
 
        if (IS_ERR(e))
                return PTR_ERR(e);
 
+       if (e->flags & MISC_FMT_OPEN_FILE) {
+               f = open_exec(e->interpreter);
+               if (IS_ERR(f)) {
+                       pr_notice("register: failed to install interpreter file 
%s\n",
+                                e->interpreter);
+                       kfree(e);
+                       return PTR_ERR(f);
+               }
+               e->interp_file = f;
+       }
+
        inode_lock(d_inode(root));
        dentry = lookup_one_len(e->name, root, strlen(e->name));
        err = PTR_ERR(dentry);
@@ -724,21 +736,6 @@ static ssize_t bm_register_write(struct file *file, const 
char __user *buffer,
                goto out2;
        }
 
-       if (e->flags & MISC_FMT_OPEN_FILE) {
-               struct file *f;
-
-               f = open_exec(e->interpreter);
-               if (IS_ERR(f)) {
-                       err = PTR_ERR(f);
-                       pr_notice("register: failed to install interpreter file 
%s\n", e->interpreter);
-                       simple_release_fs(&bm_mnt, &entry_count);
-                       iput(inode);
-                       inode = NULL;
-                       goto out2;
-               }
-               e->interp_file = f;
-       }
-
        e->dentry = dget(dentry);
        inode->i_private = e;
        inode->i_fop = &bm_entry_operations;
@@ -755,6 +752,8 @@ static ssize_t bm_register_write(struct file *file, const 
char __user *buffer,
        inode_unlock(d_inode(root));
 
        if (err) {
+               if (f)
+                       filp_close(f, NULL);
                kfree(e);
                return err;
        }
diff --git a/fs/cifs/cifsfs.c b/fs/cifs/cifsfs.c
index be84d49f2406..375ccd209206 100644
--- a/fs/cifs/cifsfs.c
+++ b/fs/cifs/cifsfs.c
@@ -208,7 +208,7 @@ cifs_statfs(struct dentry *dentry, struct kstatfs *buf)
                rc = server->ops->queryfs(xid, tcon, buf);
 
        free_xid(xid);
-       return 0;
+       return rc;
 }
 
 static long cifs_fallocate(struct file *file, int mode, loff_t off, loff_t len)
diff --git a/fs/configfs/file.c b/fs/configfs/file.c
index 7285440bc62e..896e90dc9193 100644
--- a/fs/configfs/file.c
+++ b/fs/configfs/file.c
@@ -392,7 +392,7 @@ static int __configfs_open_file(struct inode *inode, struct 
file *file, int type
 
        attr = to_attr(dentry);
        if (!attr)
-               goto out_put_item;
+               goto out_free_buffer;
 
        if (type & CONFIGFS_ITEM_BIN_ATTR) {
                buffer->bin_attr = to_bin_attr(dentry);
@@ -405,7 +405,7 @@ static int __configfs_open_file(struct inode *inode, struct 
file *file, int type
        /* Grab the module reference for this attribute if we have one */
        error = -ENODEV;
        if (!try_module_get(buffer->owner))
-               goto out_put_item;
+               goto out_free_buffer;
 
        error = -EACCES;
        if (!buffer->item->ci_type)
@@ -449,8 +449,6 @@ static int __configfs_open_file(struct inode *inode, struct 
file *file, int type
 
 out_put_module:
        module_put(buffer->owner);
-out_put_item:
-       config_item_put(buffer->item);
 out_free_buffer:
        up_read(&frag->frag_sem);
        kfree(buffer);
diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c
index 2abdb2070c87..0cebe0ca03b2 100644
--- a/fs/nfs/nfs4proc.c
+++ b/fs/nfs/nfs4proc.c
@@ -5218,7 +5218,7 @@ static int _nfs4_get_security_label(struct inode *inode, 
void *buf,
                return ret;
        if (!(fattr.valid & NFS_ATTR_FATTR_V4_SECURITY_LABEL))
                return -ENOENT;
-       return 0;
+       return label.len;
 }
 
 static int nfs4_get_security_label(struct inode *inode, void *buf,
diff --git a/fs/udf/inode.c b/fs/udf/inode.c
index 149baf5f3d19..50607673a6a9 100644
--- a/fs/udf/inode.c
+++ b/fs/udf/inode.c
@@ -548,11 +548,14 @@ static int udf_do_extend_file(struct inode *inode,
 
                udf_write_aext(inode, last_pos, &last_ext->extLocation,
                                last_ext->extLength, 1);
+
                /*
-                * We've rewritten the last extent but there may be empty
-                * indirect extent after it - enter it.
+                * We've rewritten the last extent. If we are going to add
+                * more extents, we may need to enter possible following
+                * empty indirect extent.
                 */
-               udf_next_aext(inode, last_pos, &tmploc, &tmplen, 0);
+               if (new_block_bytes || prealloc_len)
+                       udf_next_aext(inode, last_pos, &tmploc, &tmplen, 0);
        }
 
        /* Managed to do everything necessary? */
diff --git a/include/linux/can/skb.h b/include/linux/can/skb.h
index 1a2111c775ae..0e7350973e0e 100644
--- a/include/linux/can/skb.h
+++ b/include/linux/can/skb.h
@@ -48,8 +48,12 @@ static inline void can_skb_reserve(struct sk_buff *skb)
 
 static inline void can_skb_set_owner(struct sk_buff *skb, struct sock *sk)
 {
-       if (sk) {
-               sock_hold(sk);
+       /* If the socket has already been closed by user space, the
+        * refcount may already be 0 (and the socket will be freed
+        * after the last TX skb has been freed). So only increase
+        * socket refcount if the refcount is > 0.
+        */
+       if (sk && atomic_inc_not_zero(&sk->sk_refcnt)) {
                skb->destructor = sock_efree;
                skb->sk = sk;
        }
diff --git a/include/uapi/linux/netfilter/nfnetlink_cthelper.h 
b/include/uapi/linux/netfilter/nfnetlink_cthelper.h
index 33659f6fad3e..30557bade935 100644
--- a/include/uapi/linux/netfilter/nfnetlink_cthelper.h
+++ b/include/uapi/linux/netfilter/nfnetlink_cthelper.h
@@ -4,7 +4,7 @@
 #define NFCT_HELPER_STATUS_DISABLED    0
 #define NFCT_HELPER_STATUS_ENABLED     1
 
-enum nfnl_acct_msg_types {
+enum nfnl_cthelper_msg_types {
        NFNL_MSG_CTHELPER_NEW,
        NFNL_MSG_CTHELPER_GET,
        NFNL_MSG_CTHELPER_DEL,
diff --git a/mm/slub.c b/mm/slub.c
index 5c48a8a0524a..0b13135fd571 100644
--- a/mm/slub.c
+++ b/mm/slub.c
@@ -1833,7 +1833,7 @@ static void *get_partial_node(struct kmem_cache *s, 
struct kmem_cache_node *n,
 
                t = acquire_slab(s, n, page, object == NULL, &objects);
                if (!t)
-                       continue; /* cmpxchg raced */
+                       break;
 
                available += objects;
                if (!object) {
diff --git a/net/ipv4/udp_offload.c b/net/ipv4/udp_offload.c
index f4f616eaaeb8..b1b43d7da91b 100644
--- a/net/ipv4/udp_offload.c
+++ b/net/ipv4/udp_offload.c
@@ -265,7 +265,7 @@ struct sk_buff **udp_gro_receive(struct sk_buff **head, 
struct sk_buff *skb,
        struct sock *sk;
 
        if (NAPI_GRO_CB(skb)->encap_mark ||
-           (skb->ip_summed != CHECKSUM_PARTIAL &&
+           (uh->check && skb->ip_summed != CHECKSUM_PARTIAL &&
             NAPI_GRO_CB(skb)->csum_cnt == 0 &&
             !NAPI_GRO_CB(skb)->csum_valid))
                goto out;
diff --git a/net/mpls/mpls_gso.c b/net/mpls/mpls_gso.c
index b4da6d8e8632..2129856b5933 100644
--- a/net/mpls/mpls_gso.c
+++ b/net/mpls/mpls_gso.c
@@ -18,6 +18,7 @@
 #include <linux/netdev_features.h>
 #include <linux/netdevice.h>
 #include <linux/skbuff.h>
+#include <net/mpls.h>
 
 static struct sk_buff *mpls_gso_segment(struct sk_buff *skb,
                                       netdev_features_t features)
@@ -31,6 +32,8 @@ static struct sk_buff *mpls_gso_segment(struct sk_buff *skb,
 
        skb_reset_network_header(skb);
        mpls_hlen = skb_inner_network_header(skb) - skb_network_header(skb);
+       if (unlikely(!mpls_hlen || mpls_hlen % MPLS_HLEN))
+               goto out;
        if (unlikely(!pskb_may_pull(skb, mpls_hlen)))
                goto out;
 
diff --git a/net/netfilter/x_tables.c b/net/netfilter/x_tables.c
index e065140d0c93..cef5674ea434 100644
--- a/net/netfilter/x_tables.c
+++ b/net/netfilter/x_tables.c
@@ -272,6 +272,7 @@ static int match_revfn(u8 af, const char *name, u8 
revision, int *bestp)
        const struct xt_match *m;
        int have_rev = 0;
 
+       mutex_lock(&xt[af].mutex);
        list_for_each_entry(m, &xt[af].match, list) {
                if (strcmp(m->name, name) == 0) {
                        if (m->revision > *bestp)
@@ -280,6 +281,7 @@ static int match_revfn(u8 af, const char *name, u8 
revision, int *bestp)
                                have_rev = 1;
                }
        }
+       mutex_unlock(&xt[af].mutex);
 
        if (af != NFPROTO_UNSPEC && !have_rev)
                return match_revfn(NFPROTO_UNSPEC, name, revision, bestp);
@@ -292,6 +294,7 @@ static int target_revfn(u8 af, const char *name, u8 
revision, int *bestp)
        const struct xt_target *t;
        int have_rev = 0;
 
+       mutex_lock(&xt[af].mutex);
        list_for_each_entry(t, &xt[af].target, list) {
                if (strcmp(t->name, name) == 0) {
                        if (t->revision > *bestp)
@@ -300,6 +303,7 @@ static int target_revfn(u8 af, const char *name, u8 
revision, int *bestp)
                                have_rev = 1;
                }
        }
+       mutex_unlock(&xt[af].mutex);
 
        if (af != NFPROTO_UNSPEC && !have_rev)
                return target_revfn(NFPROTO_UNSPEC, name, revision, bestp);
@@ -313,12 +317,10 @@ int xt_find_revision(u8 af, const char *name, u8 
revision, int target,
 {
        int have_rev, best = -1;
 
-       mutex_lock(&xt[af].mutex);
        if (target == 1)
                have_rev = target_revfn(af, name, revision, &best);
        else
                have_rev = match_revfn(af, name, revision, &best);
-       mutex_unlock(&xt[af].mutex);
 
        /* Nothing at all?  Return 0 to try loading module. */
        if (best == -1) {
diff --git a/net/sched/sch_api.c b/net/sched/sch_api.c
index 45038c837eab..98d88386d6d5 100644
--- a/net/sched/sch_api.c
+++ b/net/sched/sch_api.c
@@ -1789,7 +1789,7 @@ static int tc_dump_tclass_qdisc(struct Qdisc *q, struct 
sk_buff *skb,
 
 static int tc_dump_tclass_root(struct Qdisc *root, struct sk_buff *skb,
                               struct tcmsg *tcm, struct netlink_callback *cb,
-                              int *t_p, int s_t)
+                              int *t_p, int s_t, bool recur)
 {
        struct Qdisc *q;
        int b;
@@ -1800,7 +1800,7 @@ static int tc_dump_tclass_root(struct Qdisc *root, struct 
sk_buff *skb,
        if (tc_dump_tclass_qdisc(root, skb, tcm, cb, t_p, s_t) < 0)
                return -1;
 
-       if (!qdisc_dev(root))
+       if (!qdisc_dev(root) || !recur)
                return 0;
 
        hash_for_each(qdisc_dev(root)->qdisc_hash, b, q, hash) {
@@ -1828,13 +1828,13 @@ static int tc_dump_tclass(struct sk_buff *skb, struct 
netlink_callback *cb)
        s_t = cb->args[0];
        t = 0;
 
-       if (tc_dump_tclass_root(dev->qdisc, skb, tcm, cb, &t, s_t) < 0)
+       if (tc_dump_tclass_root(dev->qdisc, skb, tcm, cb, &t, s_t, true) < 0)
                goto done;
 
        dev_queue = dev_ingress_queue(dev);
        if (dev_queue &&
            tc_dump_tclass_root(dev_queue->qdisc_sleeping, skb, tcm, cb,
-                               &t, s_t) < 0)
+                               &t, s_t, false) < 0)
                goto done;
 
 done:
diff --git a/scripts/recordmcount.c b/scripts/recordmcount.c
index 9972141f11aa..5adff21316c6 100644
--- a/scripts/recordmcount.c
+++ b/scripts/recordmcount.c
@@ -362,7 +362,7 @@ static uint32_t (*w2)(uint16_t);
 static int
 is_mcounted_section_name(char const *const txtname)
 {
-       return strcmp(".text",           txtname) == 0 ||
+       return strncmp(".text",          txtname, 5) == 0 ||
                strcmp(".ref.text",      txtname) == 0 ||
                strcmp(".sched.text",    txtname) == 0 ||
                strcmp(".spinlock.text", txtname) == 0 ||
diff --git a/scripts/recordmcount.pl b/scripts/recordmcount.pl
index fb0d25ced2fb..113c7a071810 100755
--- a/scripts/recordmcount.pl
+++ b/scripts/recordmcount.pl
@@ -140,6 +140,11 @@ my %text_sections = (
      ".text.unlikely" => 1,
 );
 
+# Acceptable section-prefixes to record.
+my %text_section_prefixes = (
+     ".text." => 1,
+);
+
 # Note: we are nice to C-programmers here, thus we skip the '||='-idiom.
 $objdump = 'objdump' if (!$objdump);
 $objcopy = 'objcopy' if (!$objcopy);
@@ -505,6 +510,14 @@ while (<IN>) {
 
        # Only record text sections that we know are safe
        $read_function = defined($text_sections{$1});
+       if (!$read_function) {
+           foreach my $prefix (keys %text_section_prefixes) {
+               if (substr($1, 0, length $prefix) eq $prefix) {
+                   $read_function = 1;
+                   last;
+               }
+           }
+       }
        # print out any recorded offsets
        update_funcs();
 
diff --git a/sound/pci/hda/hda_bind.c b/sound/pci/hda/hda_bind.c
index d0d6dfbfcfdf..f25c2c43c562 100644
--- a/sound/pci/hda/hda_bind.c
+++ b/sound/pci/hda/hda_bind.c
@@ -46,6 +46,10 @@ static void hda_codec_unsol_event(struct hdac_device *dev, 
unsigned int ev)
        if (codec->bus->shutdown)
                return;
 
+       /* ignore unsol events during system suspend/resume */
+       if (codec->core.dev.power.power_state.event != PM_EVENT_ON)
+               return;
+
        if (codec->patch_ops.unsol_event)
                codec->patch_ops.unsol_event(codec, ev);
 }
diff --git a/sound/pci/hda/patch_hdmi.c b/sound/pci/hda/patch_hdmi.c
index ba0c3a381933..8b240a55cb89 100644
--- a/sound/pci/hda/patch_hdmi.c
+++ b/sound/pci/hda/patch_hdmi.c
@@ -2156,6 +2156,18 @@ static void generic_hdmi_free(struct hda_codec *codec)
 }
 
 #ifdef CONFIG_PM
+static int generic_hdmi_suspend(struct hda_codec *codec)
+{
+       struct hdmi_spec *spec = codec->spec;
+       int pin_idx;
+
+       for (pin_idx = 0; pin_idx < spec->num_pins; pin_idx++) {
+               struct hdmi_spec_per_pin *per_pin = get_pin(spec, pin_idx);
+               cancel_delayed_work_sync(&per_pin->work);
+       }
+       return 0;
+}
+
 static int generic_hdmi_resume(struct hda_codec *codec)
 {
        struct hdmi_spec *spec = codec->spec;
@@ -2179,6 +2191,7 @@ static const struct hda_codec_ops generic_hdmi_patch_ops 
= {
        .build_controls         = generic_hdmi_build_controls,
        .unsol_event            = hdmi_unsol_event,
 #ifdef CONFIG_PM
+       .suspend                = generic_hdmi_suspend,
        .resume                 = generic_hdmi_resume,
 #endif
 };
diff --git a/sound/usb/quirks.c b/sound/usb/quirks.c
index 66b7ccb33c7b..664aff41f071 100644
--- a/sound/usb/quirks.c
+++ b/sound/usb/quirks.c
@@ -1153,6 +1153,7 @@ bool snd_usb_get_sample_rate_quirk(struct snd_usb_audio 
*chip)
        case USB_ID(0x1de7, 0x0114): /* Phoenix Audio MT202pcs */
        case USB_ID(0x21B4, 0x0081): /* AudioQuest DragonFly */
        case USB_ID(0x2912, 0x30c8): /* Audioengine D1 */
+       case USB_ID(0x413c, 0xa506): /* Dell AE515 sound bar */
                return true;
        }
        return false;

Reply via email to