Muehlenhoff has uploaded a new change for review.

  https://gerrit.wikimedia.org/r/315215

Change subject: Update to 4.4.24
......................................................................

Update to 4.4.24

Change-Id: I9bb2e5a9367752b95c47ba55beeb13e6c521b339
---
M debian/changelog
A debian/patches/bugfix/all/stable-4.4.24.patch
M debian/patches/series
3 files changed, 2,461 insertions(+), 0 deletions(-)


  git pull ssh://gerrit.wikimedia.org:29418/operations/debs/linux44 
refs/changes/15/315215/1

diff --git a/debian/changelog b/debian/changelog
index 9b250df..2d601d9 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -14,6 +14,9 @@
     https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.4.23
     - Drop 3da2a4cd6e909dd, which is only needed for recent GGC
       releases and clashes with Debian-specific patches
+    - CVE-2016-6828 [bb1fceca22492109be12640d49f5ea5a544c6bb4]
+  * Update to 4.4.24:
+    https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.4.24
 
  -- Moritz Muehlenhoff <mmuhlenh...@wikimedia.org>  Tue, 04 Oct 2016 13:02:55 
+0200
 
diff --git a/debian/patches/bugfix/all/stable-4.4.24.patch 
b/debian/patches/bugfix/all/stable-4.4.24.patch
new file mode 100644
index 0000000..f3a7dba
--- /dev/null
+++ b/debian/patches/bugfix/all/stable-4.4.24.patch
@@ -0,0 +1,2457 @@
+diff --git 
a/Documentation/devicetree/bindings/regulator/qcom,spmi-regulator.txt 
b/Documentation/devicetree/bindings/regulator/qcom,spmi-regulator.txt
+index d00bfd8624a5..e0381c28773d 100644
+--- a/Documentation/devicetree/bindings/regulator/qcom,spmi-regulator.txt
++++ b/Documentation/devicetree/bindings/regulator/qcom,spmi-regulator.txt
+@@ -81,9 +81,9 @@ pm8916:
+       l14, l15, l16, l17, l18
+ 
+ pm8941:
+-      s1, s2, s3, l1, l2, l3, l4, l5, l6, l7, l8, l9, l10, l11, l12, l13, l14,
+-      l15, l16, l17, l18, l19, l20, l21, l22, l23, l24, lvs1, lvs2, lvs3,
+-      mvs1, mvs2
++      s1, s2, s3, s4, l1, l2, l3, l4, l5, l6, l7, l8, l9, l10, l11, l12, l13,
++      l14, l15, l16, l17, l18, l19, l20, l21, l22, l23, l24, lvs1, lvs2, lvs3,
++      5vs1, 5vs2
+ 
+ The content of each sub-node is defined by the standard binding for 
regulators -
+ see regulator.txt - with additional custom properties described below:
+diff --git a/Documentation/pinctrl.txt b/Documentation/pinctrl.txt
+index 4976389e432d..dd15a699ee1c 100644
+--- a/Documentation/pinctrl.txt
++++ b/Documentation/pinctrl.txt
+@@ -831,7 +831,7 @@ separate memory range only intended for GPIO driving, and 
the register
+ range dealing with pin config and pin multiplexing get placed into a
+ different memory range and a separate section of the data sheet.
+ 
+-A flag "strict" in struct pinctrl_desc is available to check and deny
++A flag "strict" in struct pinmux_ops is available to check and deny
+ simultaneous access to the same pin from GPIO and pin multiplexing
+ consumers on hardware of this type. The pinctrl driver should set this flag
+ accordingly.
+diff --git a/Makefile b/Makefile
+index 95421b688f23..cdbc185c3539 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,6 +1,6 @@
+ VERSION = 4
+ PATCHLEVEL = 4
+-SUBLEVEL = 23
++SUBLEVEL = 24
+ EXTRAVERSION =
+ NAME = Blurry Fish Butt
+ 
+diff --git a/arch/arm/boot/compressed/head.S b/arch/arm/boot/compressed/head.S
+index 06e983f59980..856913705169 100644
+--- a/arch/arm/boot/compressed/head.S
++++ b/arch/arm/boot/compressed/head.S
+@@ -776,7 +776,7 @@ __armv7_mmu_cache_on:
+               orrne   r0, r0, #1              @ MMU enabled
+               movne   r1, #0xfffffffd         @ domain 0 = client
+               bic     r6, r6, #1 << 31        @ 32-bit translation system
+-              bic     r6, r6, #3 << 0         @ use only ttbr0
++              bic     r6, r6, #(7 << 0) | (1 << 4)    @ use only ttbr0
+               mcrne   p15, 0, r3, c2, c0, 0   @ load page table pointer
+               mcrne   p15, 0, r1, c3, c0, 0   @ load domain access control
+               mcrne   p15, 0, r6, c2, c0, 2   @ load ttb control
+diff --git a/arch/arm/boot/dts/sun5i-a13.dtsi 
b/arch/arm/boot/dts/sun5i-a13.dtsi
+index d910d3a6c41c..84bdba480d5a 100644
+--- a/arch/arm/boot/dts/sun5i-a13.dtsi
++++ b/arch/arm/boot/dts/sun5i-a13.dtsi
+@@ -83,7 +83,7 @@
+                       trips {
+                               cpu_alert0: cpu_alert0 {
+                                       /* milliCelsius */
+-                                      temperature = <850000>;
++                                      temperature = <85000>;
+                                       hysteresis = <2000>;
+                                       type = "passive";
+                               };
+diff --git a/arch/arm/common/sa1111.c b/arch/arm/common/sa1111.c
+index 3d224941b541..a3a9ad4dc3c6 100644
+--- a/arch/arm/common/sa1111.c
++++ b/arch/arm/common/sa1111.c
+@@ -869,9 +869,9 @@ struct sa1111_save_data {
+ 
+ #ifdef CONFIG_PM
+ 
+-static int sa1111_suspend(struct platform_device *dev, pm_message_t state)
++static int sa1111_suspend_noirq(struct device *dev)
+ {
+-      struct sa1111 *sachip = platform_get_drvdata(dev);
++      struct sa1111 *sachip = dev_get_drvdata(dev);
+       struct sa1111_save_data *save;
+       unsigned long flags;
+       unsigned int val;
+@@ -934,9 +934,9 @@ static int sa1111_suspend(struct platform_device *dev, 
pm_message_t state)
+  *    restored by their respective drivers, and must be called
+  *    via LDM after this function.
+  */
+-static int sa1111_resume(struct platform_device *dev)
++static int sa1111_resume_noirq(struct device *dev)
+ {
+-      struct sa1111 *sachip = platform_get_drvdata(dev);
++      struct sa1111 *sachip = dev_get_drvdata(dev);
+       struct sa1111_save_data *save;
+       unsigned long flags, id;
+       void __iomem *base;
+@@ -952,7 +952,7 @@ static int sa1111_resume(struct platform_device *dev)
+       id = sa1111_readl(sachip->base + SA1111_SKID);
+       if ((id & SKID_ID_MASK) != SKID_SA1111_ID) {
+               __sa1111_remove(sachip);
+-              platform_set_drvdata(dev, NULL);
++              dev_set_drvdata(dev, NULL);
+               kfree(save);
+               return 0;
+       }
+@@ -1003,8 +1003,8 @@ static int sa1111_resume(struct platform_device *dev)
+ }
+ 
+ #else
+-#define sa1111_suspend NULL
+-#define sa1111_resume  NULL
++#define sa1111_suspend_noirq NULL
++#define sa1111_resume_noirq  NULL
+ #endif
+ 
+ static int sa1111_probe(struct platform_device *pdev)
+@@ -1038,6 +1038,11 @@ static int sa1111_remove(struct platform_device *pdev)
+       return 0;
+ }
+ 
++static struct dev_pm_ops sa1111_pm_ops = {
++      .suspend_noirq = sa1111_suspend_noirq,
++      .resume_noirq = sa1111_resume_noirq,
++};
++
+ /*
+  *    Not sure if this should be on the system bus or not yet.
+  *    We really want some way to register a system device at
+@@ -1050,10 +1055,9 @@ static int sa1111_remove(struct platform_device *pdev)
+ static struct platform_driver sa1111_device_driver = {
+       .probe          = sa1111_probe,
+       .remove         = sa1111_remove,
+-      .suspend        = sa1111_suspend,
+-      .resume         = sa1111_resume,
+       .driver         = {
+               .name   = "sa1111",
++              .pm     = &sa1111_pm_ops,
+       },
+ };
+ 
+diff --git a/arch/arm/include/asm/dma-mapping.h 
b/arch/arm/include/asm/dma-mapping.h
+index ccb3aa64640d..b91a2d17a521 100644
+--- a/arch/arm/include/asm/dma-mapping.h
++++ b/arch/arm/include/asm/dma-mapping.h
+@@ -119,7 +119,7 @@ static inline dma_addr_t virt_to_dma(struct device *dev, 
void *addr)
+ /* The ARM override for dma_max_pfn() */
+ static inline unsigned long dma_max_pfn(struct device *dev)
+ {
+-      return PHYS_PFN_OFFSET + dma_to_pfn(dev, *dev->dma_mask);
++      return dma_to_pfn(dev, *dev->dma_mask);
+ }
+ #define dma_max_pfn(dev) dma_max_pfn(dev)
+ 
+diff --git a/arch/arm/kernel/devtree.c b/arch/arm/kernel/devtree.c
+index 65addcbf5b30..b3b950fc8ea0 100644
+--- a/arch/arm/kernel/devtree.c
++++ b/arch/arm/kernel/devtree.c
+@@ -87,6 +87,8 @@ void __init arm_dt_init_cpu_maps(void)
+               return;
+ 
+       for_each_child_of_node(cpus, cpu) {
++              const __be32 *cell;
++              int prop_bytes;
+               u32 hwid;
+ 
+               if (of_node_cmp(cpu->type, "cpu"))
+@@ -98,7 +100,8 @@ void __init arm_dt_init_cpu_maps(void)
+                * properties is considered invalid to build the
+                * cpu_logical_map.
+                */
+-              if (of_property_read_u32(cpu, "reg", &hwid)) {
++              cell = of_get_property(cpu, "reg", &prop_bytes);
++              if (!cell || prop_bytes < sizeof(*cell)) {
+                       pr_debug(" * %s missing reg property\n",
+                                    cpu->full_name);
+                       of_node_put(cpu);
+@@ -106,10 +109,15 @@ void __init arm_dt_init_cpu_maps(void)
+               }
+ 
+               /*
+-               * 8 MSBs must be set to 0 in the DT since the reg property
++               * Bits n:24 must be set to 0 in the DT since the reg property
+                * defines the MPIDR[23:0].
+                */
+-              if (hwid & ~MPIDR_HWID_BITMASK) {
++              do {
++                      hwid = be32_to_cpu(*cell++);
++                      prop_bytes -= sizeof(*cell);
++              } while (!hwid && prop_bytes > 0);
++
++              if (prop_bytes || (hwid & ~MPIDR_HWID_BITMASK)) {
+                       of_node_put(cpu);
+                       return;
+               }
+diff --git a/arch/arm/mach-sa1100/clock.c b/arch/arm/mach-sa1100/clock.c
+index cbf53bb9c814..0db46895c82a 100644
+--- a/arch/arm/mach-sa1100/clock.c
++++ b/arch/arm/mach-sa1100/clock.c
+@@ -125,6 +125,8 @@ static unsigned long clk_36864_get_rate(struct clk *clk)
+ }
+ 
+ static struct clkops clk_36864_ops = {
++      .enable         = clk_cpu_enable,
++      .disable        = clk_cpu_disable,
+       .get_rate       = clk_36864_get_rate,
+ };
+ 
+@@ -140,9 +142,8 @@ static struct clk_lookup sa11xx_clkregs[] = {
+       CLKDEV_INIT(NULL, "OSTIMER0", &clk_36864),
+ };
+ 
+-static int __init sa11xx_clk_init(void)
++int __init sa11xx_clk_init(void)
+ {
+       clkdev_add_table(sa11xx_clkregs, ARRAY_SIZE(sa11xx_clkregs));
+       return 0;
+ }
+-core_initcall(sa11xx_clk_init);
+diff --git a/arch/arm/mach-sa1100/generic.c b/arch/arm/mach-sa1100/generic.c
+index 345e63f4eb71..3e09beddb6e8 100644
+--- a/arch/arm/mach-sa1100/generic.c
++++ b/arch/arm/mach-sa1100/generic.c
+@@ -34,6 +34,7 @@
+ 
+ #include <mach/hardware.h>
+ #include <mach/irqs.h>
++#include <mach/reset.h>
+ 
+ #include "generic.h"
+ #include <clocksource/pxa.h>
+@@ -95,6 +96,8 @@ static void sa1100_power_off(void)
+ 
+ void sa11x0_restart(enum reboot_mode mode, const char *cmd)
+ {
++      clear_reset_status(RESET_STATUS_ALL);
++
+       if (mode == REBOOT_SOFT) {
+               /* Jump into ROM at address 0 */
+               soft_restart(0);
+@@ -388,6 +391,7 @@ void __init sa1100_init_irq(void)
+       sa11x0_init_irq_nodt(IRQ_GPIO0_SC, irq_resource.start);
+ 
+       sa1100_init_gpio();
++      sa11xx_clk_init();
+ }
+ 
+ /*
+diff --git a/arch/arm/mach-sa1100/generic.h b/arch/arm/mach-sa1100/generic.h
+index 0d92e119b36b..68199b603ff7 100644
+--- a/arch/arm/mach-sa1100/generic.h
++++ b/arch/arm/mach-sa1100/generic.h
+@@ -44,3 +44,5 @@ int sa11x0_pm_init(void);
+ #else
+ static inline int sa11x0_pm_init(void) { return 0; }
+ #endif
++
++int sa11xx_clk_init(void);
+diff --git a/arch/arm/mach-shmobile/regulator-quirk-rcar-gen2.c 
b/arch/arm/mach-shmobile/regulator-quirk-rcar-gen2.c
+index 62437b57813e..73e3adbc1330 100644
+--- a/arch/arm/mach-shmobile/regulator-quirk-rcar-gen2.c
++++ b/arch/arm/mach-shmobile/regulator-quirk-rcar-gen2.c
+@@ -41,39 +41,26 @@
+ 
+ #define REGULATOR_IRQ_MASK    BIT(2)  /* IRQ2, active low */
+ 
+-static void __iomem *irqc;
+-
+-static const u8 da9063_mask_regs[] = {
+-      DA9063_REG_IRQ_MASK_A,
+-      DA9063_REG_IRQ_MASK_B,
+-      DA9063_REG_IRQ_MASK_C,
+-      DA9063_REG_IRQ_MASK_D,
+-};
+-
+-/* DA9210 System Control and Event Registers */
++/* start of DA9210 System Control and Event Registers */
+ #define DA9210_REG_MASK_A             0x54
+-#define DA9210_REG_MASK_B             0x55
+-
+-static const u8 da9210_mask_regs[] = {
+-      DA9210_REG_MASK_A,
+-      DA9210_REG_MASK_B,
+-};
+-
+-static void da9xxx_mask_irqs(struct i2c_client *client, const u8 regs[],
+-                           unsigned int nregs)
+-{
+-      unsigned int i;
+ 
+-      dev_info(&client->dev, "Masking %s interrupt sources\n", client->name);
++static void __iomem *irqc;
+ 
+-      for (i = 0; i < nregs; i++) {
+-              int error = i2c_smbus_write_byte_data(client, regs[i], ~0);
+-              if (error) {
+-                      dev_err(&client->dev, "i2c error %d\n", error);
+-                      return;
+-              }
+-      }
+-}
++/* first byte sets the memory pointer, following are consecutive reg values */
++static u8 da9063_irq_clr[] = { DA9063_REG_IRQ_MASK_A, 0xff, 0xff, 0xff, 0xff 
};
++static u8 da9210_irq_clr[] = { DA9210_REG_MASK_A, 0xff, 0xff };
++
++static struct i2c_msg da9xxx_msgs[2] = {
++      {
++              .addr = 0x58,
++              .len = ARRAY_SIZE(da9063_irq_clr),
++              .buf = da9063_irq_clr,
++      }, {
++              .addr = 0x68,
++              .len = ARRAY_SIZE(da9210_irq_clr),
++              .buf = da9210_irq_clr,
++      },
++};
+ 
+ static int regulator_quirk_notify(struct notifier_block *nb,
+                                 unsigned long action, void *data)
+@@ -93,12 +80,15 @@ static int regulator_quirk_notify(struct notifier_block 
*nb,
+       client = to_i2c_client(dev);
+       dev_dbg(dev, "Detected %s\n", client->name);
+ 
+-      if ((client->addr == 0x58 && !strcmp(client->name, "da9063")))
+-              da9xxx_mask_irqs(client, da9063_mask_regs,
+-                               ARRAY_SIZE(da9063_mask_regs));
+-      else if (client->addr == 0x68 && !strcmp(client->name, "da9210"))
+-              da9xxx_mask_irqs(client, da9210_mask_regs,
+-                               ARRAY_SIZE(da9210_mask_regs));
++      if ((client->addr == 0x58 && !strcmp(client->name, "da9063")) ||
++          (client->addr == 0x68 && !strcmp(client->name, "da9210"))) {
++              int ret;
++
++              dev_info(&client->dev, "clearing da9063/da9210 interrupts\n");
++              ret = i2c_transfer(client->adapter, da9xxx_msgs, 
ARRAY_SIZE(da9xxx_msgs));
++              if (ret != ARRAY_SIZE(da9xxx_msgs))
++                      dev_err(&client->dev, "i2c error %d\n", ret);
++      }
+ 
+       mon = ioread32(irqc + IRQC_MONITOR);
+       if (mon & REGULATOR_IRQ_MASK)
+diff --git a/arch/arm64/kernel/debug-monitors.c 
b/arch/arm64/kernel/debug-monitors.c
+index e51f27ac13fd..c8875b64be90 100644
+--- a/arch/arm64/kernel/debug-monitors.c
++++ b/arch/arm64/kernel/debug-monitors.c
+@@ -422,8 +422,10 @@ int kernel_active_single_step(void)
+ /* ptrace API */
+ void user_enable_single_step(struct task_struct *task)
+ {
+-      set_ti_thread_flag(task_thread_info(task), TIF_SINGLESTEP);
+-      set_regs_spsr_ss(task_pt_regs(task));
++      struct thread_info *ti = task_thread_info(task);
++
++      if (!test_and_set_ti_thread_flag(ti, TIF_SINGLESTEP))
++              set_regs_spsr_ss(task_pt_regs(task));
+ }
+ 
+ void user_disable_single_step(struct task_struct *task)
+diff --git a/arch/avr32/mach-at32ap/pio.c b/arch/avr32/mach-at32ap/pio.c
+index 4f61378c3453..456128174b17 100644
+--- a/arch/avr32/mach-at32ap/pio.c
++++ b/arch/avr32/mach-at32ap/pio.c
+@@ -435,7 +435,7 @@ void __init at32_init_pio(struct platform_device *pdev)
+       struct resource *regs;
+       struct pio_device *pio;
+ 
+-      if (pdev->id > MAX_NR_PIO_DEVICES) {
++      if (pdev->id >= MAX_NR_PIO_DEVICES) {
+               dev_err(&pdev->dev, "only %d PIO devices supported\n",
+                       MAX_NR_PIO_DEVICES);
+               return;
+diff --git a/arch/mips/include/asm/uprobes.h b/arch/mips/include/asm/uprobes.h
+index 34c325c674c4..70a4a2f173ff 100644
+--- a/arch/mips/include/asm/uprobes.h
++++ b/arch/mips/include/asm/uprobes.h
+@@ -36,7 +36,6 @@ struct arch_uprobe {
+       unsigned long   resume_epc;
+       u32     insn[2];
+       u32     ixol[2];
+-      union   mips_instruction orig_inst[MAX_UINSN_BYTES / 4];
+ };
+ 
+ struct arch_uprobe_task {
+diff --git a/arch/mips/kernel/uprobes.c b/arch/mips/kernel/uprobes.c
+index 8452d933a645..4e7b89f2e244 100644
+--- a/arch/mips/kernel/uprobes.c
++++ b/arch/mips/kernel/uprobes.c
+@@ -157,7 +157,6 @@ bool is_trap_insn(uprobe_opcode_t *insn)
+ int arch_uprobe_pre_xol(struct arch_uprobe *aup, struct pt_regs *regs)
+ {
+       struct uprobe_task *utask = current->utask;
+-      union mips_instruction insn;
+ 
+       /*
+        * Now find the EPC where to resume after the breakpoint has been
+@@ -168,10 +167,10 @@ int arch_uprobe_pre_xol(struct arch_uprobe *aup, struct 
pt_regs *regs)
+               unsigned long epc;
+ 
+               epc = regs->cp0_epc;
+-              __compute_return_epc_for_insn(regs, insn);
++              __compute_return_epc_for_insn(regs,
++                      (union mips_instruction) aup->insn[0]);
+               aup->resume_epc = regs->cp0_epc;
+       }
+-
+       utask->autask.saved_trap_nr = current->thread.trap_nr;
+       current->thread.trap_nr = UPROBE_TRAP_NR;
+       regs->cp0_epc = current->utask->xol_vaddr;
+@@ -257,7 +256,7 @@ unsigned long arch_uretprobe_hijack_return_addr(
+       ra = regs->regs[31];
+ 
+       /* Replace the return address with the trampoline address */
+-      regs->regs[31] = ra;
++      regs->regs[31] = trampoline_vaddr;
+ 
+       return ra;
+ }
+@@ -280,24 +279,6 @@ int __weak set_swbp(struct arch_uprobe *auprobe, struct 
mm_struct *mm,
+       return uprobe_write_opcode(mm, vaddr, UPROBE_SWBP_INSN);
+ }
+ 
+-/**
+- * set_orig_insn - Restore the original instruction.
+- * @mm: the probed process address space.
+- * @auprobe: arch specific probepoint information.
+- * @vaddr: the virtual address to insert the opcode.
+- *
+- * For mm @mm, restore the original opcode (opcode) at @vaddr.
+- * Return 0 (success) or a negative errno.
+- *
+- * This overrides the weak version in kernel/events/uprobes.c.
+- */
+-int set_orig_insn(struct arch_uprobe *auprobe, struct mm_struct *mm,
+-               unsigned long vaddr)
+-{
+-      return uprobe_write_opcode(mm, vaddr,
+-                      *(uprobe_opcode_t *)&auprobe->orig_inst[0].word);
+-}
+-
+ void __weak arch_uprobe_copy_ixol(struct page *page, unsigned long vaddr,
+                                 void *src, unsigned long len)
+ {
+diff --git a/arch/mips/mti-malta/malta-setup.c 
b/arch/mips/mti-malta/malta-setup.c
+index 4740c82fb97a..36b09b2ea972 100644
+--- a/arch/mips/mti-malta/malta-setup.c
++++ b/arch/mips/mti-malta/malta-setup.c
+@@ -39,6 +39,9 @@
+ #include <linux/console.h>
+ #endif
+ 
++#define ROCIT_CONFIG_GEN0             0x1f403000
++#define  ROCIT_CONFIG_GEN0_PCI_IOCU   BIT(7)
++
+ extern void malta_be_init(void);
+ extern int malta_be_handler(struct pt_regs *regs, int is_fixup);
+ 
+@@ -107,6 +110,8 @@ static void __init fd_activate(void)
+ static int __init plat_enable_iocoherency(void)
+ {
+       int supported = 0;
++      u32 cfg;
++
+       if (mips_revision_sconid == MIPS_REVISION_SCON_BONITO) {
+               if (BONITO_PCICACHECTRL & BONITO_PCICACHECTRL_CPUCOH_PRES) {
+                       BONITO_PCICACHECTRL |= BONITO_PCICACHECTRL_CPUCOH_EN;
+@@ -129,7 +134,8 @@ static int __init plat_enable_iocoherency(void)
+       } else if (mips_cm_numiocu() != 0) {
+               /* Nothing special needs to be done to enable coherency */
+               pr_info("CMP IOCU detected\n");
+-              if ((*(unsigned int *)0xbf403000 & 0x81) != 0x81) {
++              cfg = __raw_readl((u32 *)CKSEG1ADDR(ROCIT_CONFIG_GEN0));
++              if (!(cfg & ROCIT_CONFIG_GEN0_PCI_IOCU)) {
+                       pr_crit("IOCU OPERATION DISABLED BY SWITCH - DEFAULTING 
TO SW IO COHERENCY\n");
+                       return 0;
+               }
+diff --git a/arch/powerpc/kernel/prom_init.c b/arch/powerpc/kernel/prom_init.c
+index b7e86e00048f..7b89e7b305e6 100644
+--- a/arch/powerpc/kernel/prom_init.c
++++ b/arch/powerpc/kernel/prom_init.c
+@@ -694,7 +694,7 @@ unsigned char ibm_architecture_vec[] = {
+       OV4_MIN_ENT_CAP,                /* minimum VP entitled capacity */
+ 
+       /* option vector 5: PAPR/OF options */
+-      VECTOR_LENGTH(18),              /* length */
++      VECTOR_LENGTH(21),              /* length */
+       0,                              /* don't ignore, don't halt */
+       OV5_FEAT(OV5_LPAR) | OV5_FEAT(OV5_SPLPAR) | OV5_FEAT(OV5_LARGE_PAGES) |
+       OV5_FEAT(OV5_DRCONF_MEMORY) | OV5_FEAT(OV5_DONATE_DEDICATE_CPU) |
+@@ -725,8 +725,11 @@ unsigned char ibm_architecture_vec[] = {
+       0,
+       0,
+       OV5_FEAT(OV5_PFO_HW_RNG) | OV5_FEAT(OV5_PFO_HW_ENCR) |
+-      OV5_FEAT(OV5_PFO_HW_842),
+-      OV5_FEAT(OV5_SUB_PROCESSORS),
++      OV5_FEAT(OV5_PFO_HW_842),                               /* Byte 17 */
++      0,                                                      /* Byte 18 */
++      0,                                                      /* Byte 19 */
++      0,                                                      /* Byte 20 */
++      OV5_FEAT(OV5_SUB_PROCESSORS),                           /* Byte 21 */
+ 
+       /* option vector 6: IBM PAPR hints */
+       VECTOR_LENGTH(3),               /* length */
+diff --git a/arch/tile/include/asm/elf.h b/arch/tile/include/asm/elf.h
+index c505d77e4d06..e9d54a06736f 100644
+--- a/arch/tile/include/asm/elf.h
++++ b/arch/tile/include/asm/elf.h
+@@ -129,6 +129,7 @@ extern int dump_task_regs(struct task_struct *, 
elf_gregset_t *);
+ struct linux_binprm;
+ extern int arch_setup_additional_pages(struct linux_binprm *bprm,
+                                      int executable_stack);
++/* update AT_VECTOR_SIZE_ARCH if the number of NEW_AUX_ENT entries changes */
+ #define ARCH_DLINFO \
+ do { \
+       NEW_AUX_ENT(AT_SYSINFO_EHDR, VDSO_BASE); \
+diff --git a/arch/tile/include/uapi/asm/auxvec.h 
b/arch/tile/include/uapi/asm/auxvec.h
+index c93e92709f14..f497123ed980 100644
+--- a/arch/tile/include/uapi/asm/auxvec.h
++++ b/arch/tile/include/uapi/asm/auxvec.h
+@@ -18,4 +18,6 @@
+ /* The vDSO location. */
+ #define AT_SYSINFO_EHDR         33
+ 
++#define AT_VECTOR_SIZE_ARCH 1 /* entries in ARCH_DLINFO */
++
+ #endif /* _ASM_TILE_AUXVEC_H */
+diff --git a/arch/x86/include/asm/tlbflush.h b/arch/x86/include/asm/tlbflush.h
+index 3142218e546f..6433e28dc9c8 100644
+--- a/arch/x86/include/asm/tlbflush.h
++++ b/arch/x86/include/asm/tlbflush.h
+@@ -32,7 +32,7 @@ DECLARE_PER_CPU_SHARED_ALIGNED(struct tlb_state, 
cpu_tlbstate);
+ /* Initialize cr4 shadow for this CPU. */
+ static inline void cr4_init_shadow(void)
+ {
+-      this_cpu_write(cpu_tlbstate.cr4, __read_cr4());
++      this_cpu_write(cpu_tlbstate.cr4, __read_cr4_safe());
+ }
+ 
+ /* Set in this cpu's CR4. */
+diff --git a/arch/x86/kernel/cpu/common.c b/arch/x86/kernel/cpu/common.c
+index c2b7522cbf35..2b49b113d65d 100644
+--- a/arch/x86/kernel/cpu/common.c
++++ b/arch/x86/kernel/cpu/common.c
+@@ -737,21 +737,20 @@ static void __init early_identify_cpu(struct cpuinfo_x86 
*c)
+               identify_cpu_without_cpuid(c);
+ 
+       /* cyrix could have cpuid enabled via c_identify()*/
+-      if (!have_cpuid_p())
+-              return;
++      if (have_cpuid_p()) {
++              cpu_detect(c);
++              get_cpu_vendor(c);
++              get_cpu_cap(c);
+ 
+-      cpu_detect(c);
+-      get_cpu_vendor(c);
+-      get_cpu_cap(c);
+-
+-      if (this_cpu->c_early_init)
+-              this_cpu->c_early_init(c);
++              if (this_cpu->c_early_init)
++                      this_cpu->c_early_init(c);
+ 
+-      c->cpu_index = 0;
+-      filter_cpuid_features(c, false);
++              c->cpu_index = 0;
++              filter_cpuid_features(c, false);
+ 
+-      if (this_cpu->c_bsp_init)
+-              this_cpu->c_bsp_init(c);
++              if (this_cpu->c_bsp_init)
++                      this_cpu->c_bsp_init(c);
++      }
+ 
+       setup_force_cpu_cap(X86_FEATURE_ALWAYS);
+       fpu__init_system(c);
+diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c
+index 4589b6feeb7b..268df707b5ce 100644
+--- a/arch/x86/kvm/vmx.c
++++ b/arch/x86/kvm/vmx.c
+@@ -408,6 +408,7 @@ struct nested_vmx {
+       struct list_head vmcs02_pool;
+       int vmcs02_num;
+       u64 vmcs01_tsc_offset;
++      bool change_vmcs01_virtual_x2apic_mode;
+       /* L2 must run next, and mustn't decide to exit to L1. */
+       bool nested_run_pending;
+       /*
+@@ -8184,6 +8185,12 @@ static void vmx_set_virtual_x2apic_mode(struct kvm_vcpu 
*vcpu, bool set)
+ {
+       u32 sec_exec_control;
+ 
++      /* Postpone execution until vmcs01 is the current VMCS. */
++      if (is_guest_mode(vcpu)) {
++              to_vmx(vcpu)->nested.change_vmcs01_virtual_x2apic_mode = true;
++              return;
++      }
++
+       /*
+        * There is not point to enable virtualize x2apic without enable
+        * apicv
+@@ -10483,6 +10490,12 @@ static void nested_vmx_vmexit(struct kvm_vcpu *vcpu, 
u32 exit_reason,
+       /* Update TSC_OFFSET if TSC was changed while L2 ran */
+       vmcs_write64(TSC_OFFSET, vmx->nested.vmcs01_tsc_offset);
+ 
++      if (vmx->nested.change_vmcs01_virtual_x2apic_mode) {
++              vmx->nested.change_vmcs01_virtual_x2apic_mode = false;
++              vmx_set_virtual_x2apic_mode(vcpu,
++                              vcpu->arch.apic_base & X2APIC_ENABLE);
++      }
++
+       /* This is needed for same reason as it was needed in prepare_vmcs02 */
+       vmx->host_rsp = 0;
+ 
+diff --git a/block/blk-mq.c b/block/blk-mq.c
+index 839b1e17481b..c3e461ec40e4 100644
+--- a/block/blk-mq.c
++++ b/block/blk-mq.c
+@@ -780,7 +780,7 @@ static void __blk_mq_run_hw_queue(struct blk_mq_hw_ctx 
*hctx)
+               switch (ret) {
+               case BLK_MQ_RQ_QUEUE_OK:
+                       queued++;
+-                      continue;
++                      break;
+               case BLK_MQ_RQ_QUEUE_BUSY:
+                       list_add(&rq->queuelist, &rq_list);
+                       __blk_mq_requeue_request(rq);
+diff --git a/drivers/acpi/acpica/hwxface.c b/drivers/acpi/acpica/hwxface.c
+index 5f97468df8ff..b2e50d8007fe 100644
+--- a/drivers/acpi/acpica/hwxface.c
++++ b/drivers/acpi/acpica/hwxface.c
+@@ -504,11 +504,20 @@ acpi_get_sleep_type_data(u8 sleep_state, u8 
*sleep_type_a, u8 *sleep_type_b)
+        * Evaluate the \_Sx namespace object containing the register values
+        * for this state
+        */
+-      info->relative_pathname =
+-          ACPI_CAST_PTR(char, acpi_gbl_sleep_state_names[sleep_state]);
++      info->relative_pathname = ACPI_CAST_PTR(char,
++                                              acpi_gbl_sleep_state_names
++                                              [sleep_state]);
++
+       status = acpi_ns_evaluate(info);
+       if (ACPI_FAILURE(status)) {
+-              goto cleanup;
++              if (status == AE_NOT_FOUND) {
++
++                      /* The _Sx states are optional, ignore NOT_FOUND */
++
++                      goto final_cleanup;
++              }
++
++              goto warning_cleanup;
+       }
+ 
+       /* Must have a return object */
+@@ -517,7 +526,7 @@ acpi_get_sleep_type_data(u8 sleep_state, u8 *sleep_type_a, 
u8 *sleep_type_b)
+               ACPI_ERROR((AE_INFO, "No Sleep State object returned from [%s]",
+                           info->relative_pathname));
+               status = AE_AML_NO_RETURN_VALUE;
+-              goto cleanup;
++              goto warning_cleanup;
+       }
+ 
+       /* Return object must be of type Package */
+@@ -526,7 +535,7 @@ acpi_get_sleep_type_data(u8 sleep_state, u8 *sleep_type_a, 
u8 *sleep_type_b)
+               ACPI_ERROR((AE_INFO,
+                           "Sleep State return object is not a Package"));
+               status = AE_AML_OPERAND_TYPE;
+-              goto cleanup1;
++              goto return_value_cleanup;
+       }
+ 
+       /*
+@@ -570,16 +579,17 @@ acpi_get_sleep_type_data(u8 sleep_state, u8 
*sleep_type_a, u8 *sleep_type_b)
+               break;
+       }
+ 
+-cleanup1:
++return_value_cleanup:
+       acpi_ut_remove_reference(info->return_object);
+ 
+-cleanup:
++warning_cleanup:
+       if (ACPI_FAILURE(status)) {
+               ACPI_EXCEPTION((AE_INFO, status,
+                               "While evaluating Sleep State [%s]",
+                               info->relative_pathname));
+       }
+ 
++final_cleanup:
+       ACPI_FREE(info);
+       return_ACPI_STATUS(status);
+ }
+diff --git a/drivers/char/hw_random/omap-rng.c 
b/drivers/char/hw_random/omap-rng.c
+index 8a1432e8bb80..01d4be2c354b 100644
+--- a/drivers/char/hw_random/omap-rng.c
++++ b/drivers/char/hw_random/omap-rng.c
+@@ -384,7 +384,12 @@ static int omap_rng_probe(struct platform_device *pdev)
+       }
+ 
+       pm_runtime_enable(&pdev->dev);
+-      pm_runtime_get_sync(&pdev->dev);
++      ret = pm_runtime_get_sync(&pdev->dev);
++      if (ret) {
++              dev_err(&pdev->dev, "Failed to runtime_get device: %d\n", ret);
++              pm_runtime_put_noidle(&pdev->dev);
++              goto err_ioremap;
++      }
+ 
+       ret = (dev->of_node) ? of_get_omap_rng_device_details(priv, pdev) :
+                               get_omap_rng_device_details(priv);
+@@ -435,8 +440,15 @@ static int __maybe_unused omap_rng_suspend(struct device 
*dev)
+ static int __maybe_unused omap_rng_resume(struct device *dev)
+ {
+       struct omap_rng_dev *priv = dev_get_drvdata(dev);
++      int ret;
++
++      ret = pm_runtime_get_sync(dev);
++      if (ret) {
++              dev_err(dev, "Failed to runtime_get device: %d\n", ret);
++              pm_runtime_put_noidle(dev);
++              return ret;
++      }
+ 
+-      pm_runtime_get_sync(dev);
+       priv->pdata->init(priv);
+ 
+       return 0;
+diff --git a/drivers/char/tpm/tpm2-cmd.c b/drivers/char/tpm/tpm2-cmd.c
+index c12130485fc1..678af51fb29e 100644
+--- a/drivers/char/tpm/tpm2-cmd.c
++++ b/drivers/char/tpm/tpm2-cmd.c
+@@ -657,7 +657,7 @@ ssize_t tpm2_get_tpm_pt(struct tpm_chip *chip, u32 
property_id,  u32 *value,
+ 
+       rc = tpm_transmit_cmd(chip, &cmd, sizeof(cmd), desc);
+       if (!rc)
+-              *value = cmd.params.get_tpm_pt_out.value;
++              *value = be32_to_cpu(cmd.params.get_tpm_pt_out.value);
+ 
+       return rc;
+ }
+diff --git a/drivers/clk/clk-xgene.c b/drivers/clk/clk-xgene.c
+index 10224b01b97c..b134a8b15e2c 100644
+--- a/drivers/clk/clk-xgene.c
++++ b/drivers/clk/clk-xgene.c
+@@ -351,8 +351,8 @@ static int xgene_clk_set_rate(struct clk_hw *hw, unsigned 
long rate,
+               /* Set new divider */
+               data = xgene_clk_read(pclk->param.divider_reg +
+                               pclk->param.reg_divider_offset);
+-              data &= ~((1 << pclk->param.reg_divider_width) - 1)
+-                              << pclk->param.reg_divider_shift;
++              data &= ~(((1 << pclk->param.reg_divider_width) - 1)
++                              << pclk->param.reg_divider_shift);
+               data |= divider;
+               xgene_clk_write(data, pclk->param.divider_reg +
+                                       pclk->param.reg_divider_offset);
+diff --git a/drivers/dma/at_xdmac.c b/drivers/dma/at_xdmac.c
+index e44a1bfb0250..9d05d7dbcfa9 100644
+--- a/drivers/dma/at_xdmac.c
++++ b/drivers/dma/at_xdmac.c
+@@ -1183,8 +1183,8 @@ static struct at_xdmac_desc 
*at_xdmac_memset_create_desc(struct dma_chan *chan,
+       desc->lld.mbr_cfg = chan_cc;
+ 
+       dev_dbg(chan2dev(chan),
+-              "%s: lld: mbr_da=%pad, mbr_ds=%pad, mbr_ubc=0x%08x, 
mbr_cfg=0x%08x\n",
+-              __func__, &desc->lld.mbr_da, &desc->lld.mbr_ds, 
desc->lld.mbr_ubc,
++              "%s: lld: mbr_da=%pad, mbr_ds=0x%08x, mbr_ubc=0x%08x, 
mbr_cfg=0x%08x\n",
++              __func__, &desc->lld.mbr_da, desc->lld.mbr_ds, 
desc->lld.mbr_ubc,
+               desc->lld.mbr_cfg);
+ 
+       return desc;
+@@ -2055,7 +2055,7 @@ err_dma_unregister:
+ err_clk_disable:
+       clk_disable_unprepare(atxdmac->clk);
+ err_free_irq:
+-      free_irq(atxdmac->irq, atxdmac->dma.dev);
++      free_irq(atxdmac->irq, atxdmac);
+       return ret;
+ }
+ 
+@@ -2071,7 +2071,7 @@ static int at_xdmac_remove(struct platform_device *pdev)
+ 
+       synchronize_irq(atxdmac->irq);
+ 
+-      free_irq(atxdmac->irq, atxdmac->dma.dev);
++      free_irq(atxdmac->irq, atxdmac);
+ 
+       for (i = 0; i < atxdmac->dma.chancnt; i++) {
+               struct at_xdmac_chan *atchan = &atxdmac->chan[i];
+diff --git a/drivers/gpio/gpio-sa1100.c b/drivers/gpio/gpio-sa1100.c
+index 990fa9023e22..3b6bce0518ab 100644
+--- a/drivers/gpio/gpio-sa1100.c
++++ b/drivers/gpio/gpio-sa1100.c
+@@ -155,7 +155,7 @@ static int sa1100_gpio_irqdomain_map(struct irq_domain *d,
+ {
+       irq_set_chip_and_handler(irq, &sa1100_gpio_irq_chip,
+                                handle_edge_irq);
+-      irq_set_noprobe(irq);
++      irq_set_probe(irq);
+ 
+       return 0;
+ }
+diff --git a/drivers/gpu/drm/nouveau/nvkm/engine/fifo/dmanv04.c 
b/drivers/gpu/drm/nouveau/nvkm/engine/fifo/dmanv04.c
+index bfcc6408a772..b7f4b826febe 100644
+--- a/drivers/gpu/drm/nouveau/nvkm/engine/fifo/dmanv04.c
++++ b/drivers/gpu/drm/nouveau/nvkm/engine/fifo/dmanv04.c
+@@ -36,7 +36,10 @@ nv04_fifo_dma_object_dtor(struct nvkm_fifo_chan *base, int 
cookie)
+ {
+       struct nv04_fifo_chan *chan = nv04_fifo_chan(base);
+       struct nvkm_instmem *imem = chan->fifo->base.engine.subdev.device->imem;
++
++      mutex_lock(&chan->fifo->base.engine.subdev.mutex);
+       nvkm_ramht_remove(imem->ramht, cookie);
++      mutex_unlock(&chan->fifo->base.engine.subdev.mutex);
+ }
+ 
+ static int
+diff --git a/drivers/gpu/drm/radeon/si_dpm.c b/drivers/gpu/drm/radeon/si_dpm.c
+index caa73de584a5..3aaa07dafc00 100644
+--- a/drivers/gpu/drm/radeon/si_dpm.c
++++ b/drivers/gpu/drm/radeon/si_dpm.c
+@@ -3015,6 +3015,12 @@ static void si_apply_state_adjust_rules(struct 
radeon_device *rdev,
+       if (rdev->pdev->device == 0x6811 &&
+           rdev->pdev->revision == 0x81)
+               max_mclk = 120000;
++      /* limit sclk/mclk on Jet parts for stability */
++      if (rdev->pdev->device == 0x6665 &&
++          rdev->pdev->revision == 0xc3) {
++              max_sclk = 75000;
++              max_mclk = 80000;
++      }
+ 
+       if (rps->vce_active) {
+               rps->evclk = 
rdev->pm.dpm.vce_states[rdev->pm.dpm.vce_level].evclk;
+diff --git a/drivers/hwmon/adt7411.c b/drivers/hwmon/adt7411.c
+index 827c03703128..a7f886961830 100644
+--- a/drivers/hwmon/adt7411.c
++++ b/drivers/hwmon/adt7411.c
+@@ -30,6 +30,7 @@
+ 
+ #define ADT7411_REG_CFG1                      0x18
+ #define ADT7411_CFG1_START_MONITOR            (1 << 0)
++#define ADT7411_CFG1_RESERVED_BIT3            (1 << 3)
+ 
+ #define ADT7411_REG_CFG2                      0x19
+ #define ADT7411_CFG2_DISABLE_AVG              (1 << 5)
+@@ -296,8 +297,10 @@ static int adt7411_probe(struct i2c_client *client,
+       mutex_init(&data->device_lock);
+       mutex_init(&data->update_lock);
+ 
++      /* According to the datasheet, we must only write 1 to bit 3 */
+       ret = adt7411_modify_bit(client, ADT7411_REG_CFG1,
+-                               ADT7411_CFG1_START_MONITOR, 1);
++                               ADT7411_CFG1_RESERVED_BIT3
++                               | ADT7411_CFG1_START_MONITOR, 1);
+       if (ret < 0)
+               return ret;
+ 
+diff --git a/drivers/infiniband/core/multicast.c 
b/drivers/infiniband/core/multicast.c
+index bb6685fb08c6..6aa648cb5381 100644
+--- a/drivers/infiniband/core/multicast.c
++++ b/drivers/infiniband/core/multicast.c
+@@ -106,7 +106,6 @@ struct mcast_group {
+       atomic_t                refcount;
+       enum mcast_group_state  state;
+       struct ib_sa_query      *query;
+-      int                     query_id;
+       u16                     pkey_index;
+       u8                      leave_state;
+       int                     retries;
+@@ -339,11 +338,7 @@ static int send_join(struct mcast_group *group, struct 
mcast_member *member)
+                                      member->multicast.comp_mask,
+                                      3000, GFP_KERNEL, join_handler, group,
+                                      &group->query);
+-      if (ret >= 0) {
+-              group->query_id = ret;
+-              ret = 0;
+-      }
+-      return ret;
++      return (ret > 0) ? 0 : ret;
+ }
+ 
+ static int send_leave(struct mcast_group *group, u8 leave_state)
+@@ -363,11 +358,7 @@ static int send_leave(struct mcast_group *group, u8 
leave_state)
+                                      IB_SA_MCMEMBER_REC_JOIN_STATE,
+                                      3000, GFP_KERNEL, leave_handler,
+                                      group, &group->query);
+-      if (ret >= 0) {
+-              group->query_id = ret;
+-              ret = 0;
+-      }
+-      return ret;
++      return (ret > 0) ? 0 : ret;
+ }
+ 
+ static void join_group(struct mcast_group *group, struct mcast_member *member,
+diff --git a/drivers/infiniband/hw/mlx4/mad.c 
b/drivers/infiniband/hw/mlx4/mad.c
+index 05179f47bbde..d862b9b7910e 100644
+--- a/drivers/infiniband/hw/mlx4/mad.c
++++ b/drivers/infiniband/hw/mlx4/mad.c
+@@ -1080,6 +1080,27 @@ void handle_port_mgmt_change_event(struct work_struct 
*work)
+ 
+               /* Generate GUID changed event */
+               if (changed_attr & MLX4_EQ_PORT_INFO_GID_PFX_CHANGE_MASK) {
++                      if (mlx4_is_master(dev->dev)) {
++                              union ib_gid gid;
++                              int err = 0;
++
++                              if 
(!eqe->event.port_mgmt_change.params.port_info.gid_prefix)
++                                      err = __mlx4_ib_query_gid(&dev->ib_dev, 
port, 0, &gid, 1);
++                              else
++                                      gid.global.subnet_prefix =
++                                              
eqe->event.port_mgmt_change.params.port_info.gid_prefix;
++                              if (err) {
++                                      pr_warn("Could not change QP1 subnet 
prefix for port %d: query_gid error (%d)\n",
++                                              port, err);
++                              } else {
++                                      pr_debug("Changing QP1 subnet prefix 
for port %d. old=0x%llx. new=0x%llx\n",
++                                               port,
++                                               
(u64)atomic64_read(&dev->sriov.demux[port - 1].subnet_prefix),
++                                               
be64_to_cpu(gid.global.subnet_prefix));
++                                      atomic64_set(&dev->sriov.demux[port - 
1].subnet_prefix,
++                                                   
be64_to_cpu(gid.global.subnet_prefix));
++                              }
++                      }
+                       mlx4_ib_dispatch_event(dev, port, IB_EVENT_GID_CHANGE);
+                       /*if master, notify all slaves*/
+                       if (mlx4_is_master(dev->dev))
+@@ -2154,6 +2175,8 @@ int mlx4_ib_init_sriov(struct mlx4_ib_dev *dev)
+               if (err)
+                       goto demux_err;
+               dev->sriov.demux[i].guid_cache[0] = gid.global.interface_id;
++              atomic64_set(&dev->sriov.demux[i].subnet_prefix,
++                           be64_to_cpu(gid.global.subnet_prefix));
+               err = alloc_pv_object(dev, mlx4_master_func_num(dev->dev), i + 
1,
+                                     &dev->sriov.sqps[i]);
+               if (err)
+diff --git a/drivers/infiniband/hw/mlx4/mcg.c 
b/drivers/infiniband/hw/mlx4/mcg.c
+index 99451d887266..36ec8aa048aa 100644
+--- a/drivers/infiniband/hw/mlx4/mcg.c
++++ b/drivers/infiniband/hw/mlx4/mcg.c
+@@ -489,7 +489,7 @@ static u8 get_leave_state(struct mcast_group *group)
+               if (!group->members[i])
+                       leave_state |= (1 << i);
+ 
+-      return leave_state & (group->rec.scope_join_state & 7);
++      return leave_state & (group->rec.scope_join_state & 0xf);
+ }
+ 
+ static int join_group(struct mcast_group *group, int slave, u8 join_mask)
+@@ -564,8 +564,8 @@ static void mlx4_ib_mcg_timeout_handler(struct work_struct 
*work)
+               } else
+                       mcg_warn_group(group, "DRIVER BUG\n");
+       } else if (group->state == MCAST_LEAVE_SENT) {
+-              if (group->rec.scope_join_state & 7)
+-                      group->rec.scope_join_state &= 0xf8;
++              if (group->rec.scope_join_state & 0xf)
++                      group->rec.scope_join_state &= 0xf0;
+               group->state = MCAST_IDLE;
+               mutex_unlock(&group->lock);
+               if (release_group(group, 1))
+@@ -605,7 +605,7 @@ static int handle_leave_req(struct mcast_group *group, u8 
leave_mask,
+ static int handle_join_req(struct mcast_group *group, u8 join_mask,
+                          struct mcast_req *req)
+ {
+-      u8 group_join_state = group->rec.scope_join_state & 7;
++      u8 group_join_state = group->rec.scope_join_state & 0xf;
+       int ref = 0;
+       u16 status;
+       struct ib_sa_mcmember_data *sa_data = (struct ib_sa_mcmember_data 
*)req->sa_mad.data;
+@@ -690,8 +690,8 @@ static void mlx4_ib_mcg_work_handler(struct work_struct 
*work)
+                       u8 cur_join_state;
+ 
+                       resp_join_state = ((struct ib_sa_mcmember_data *)
+-                                              
group->response_sa_mad.data)->scope_join_state & 7;
+-                      cur_join_state = group->rec.scope_join_state & 7;
++                                              
group->response_sa_mad.data)->scope_join_state & 0xf;
++                      cur_join_state = group->rec.scope_join_state & 0xf;
+ 
+                       if (method == IB_MGMT_METHOD_GET_RESP) {
+                               /* successfull join */
+@@ -710,7 +710,7 @@ process_requests:
+               req = list_first_entry(&group->pending_list, struct mcast_req,
+                                      group_list);
+               sa_data = (struct ib_sa_mcmember_data *)req->sa_mad.data;
+-              req_join_state = sa_data->scope_join_state & 0x7;
++              req_join_state = sa_data->scope_join_state & 0xf;
+ 
+               /* For a leave request, we will immediately answer the VF, and
+                * update our internal counters. The actual leave will be sent
+diff --git a/drivers/infiniband/hw/mlx4/mlx4_ib.h 
b/drivers/infiniband/hw/mlx4/mlx4_ib.h
+index 1caa11edac03..78f29e91653a 100644
+--- a/drivers/infiniband/hw/mlx4/mlx4_ib.h
++++ b/drivers/infiniband/hw/mlx4/mlx4_ib.h
+@@ -441,7 +441,7 @@ struct mlx4_ib_demux_ctx {
+       struct workqueue_struct *wq;
+       struct workqueue_struct *ud_wq;
+       spinlock_t ud_lock;
+-      __be64 subnet_prefix;
++      atomic64_t subnet_prefix;
+       __be64 guid_cache[128];
+       struct mlx4_ib_dev *dev;
+       /* the following lock protects both mcg_table and mcg_mgid0_list */
+diff --git a/drivers/infiniband/hw/mlx4/qp.c b/drivers/infiniband/hw/mlx4/qp.c
+index ea1e2ddaddf5..f350f2d61c15 100644
+--- a/drivers/infiniband/hw/mlx4/qp.c
++++ b/drivers/infiniband/hw/mlx4/qp.c
+@@ -2331,24 +2331,27 @@ static int build_mlx_header(struct mlx4_ib_sqp *sqp, 
struct ib_ud_wr *wr,
+               sqp->ud_header.grh.flow_label    =
+                       ah->av.ib.sl_tclass_flowlabel & cpu_to_be32(0xfffff);
+               sqp->ud_header.grh.hop_limit     = ah->av.ib.hop_limit;
+-              if (is_eth)
++              if (is_eth) {
+                       memcpy(sqp->ud_header.grh.source_gid.raw, sgid.raw, 16);
+-              else {
+-              if (mlx4_is_mfunc(to_mdev(ib_dev)->dev)) {
+-                      /* When multi-function is enabled, the ib_core gid
+-                       * indexes don't necessarily match the hw ones, so
+-                       * we must use our own cache */
+-                      sqp->ud_header.grh.source_gid.global.subnet_prefix =
+-                              to_mdev(ib_dev)->sriov.demux[sqp->qp.port - 1].
+-                                                     subnet_prefix;
+-                      sqp->ud_header.grh.source_gid.global.interface_id =
+-                              to_mdev(ib_dev)->sriov.demux[sqp->qp.port - 1].
+-                                             guid_cache[ah->av.ib.gid_index];
+-              } else
+-                      ib_get_cached_gid(ib_dev,
+-                                        be32_to_cpu(ah->av.ib.port_pd) >> 24,
+-                                        ah->av.ib.gid_index,
+-                                        &sqp->ud_header.grh.source_gid, NULL);
++              } else {
++                      if (mlx4_is_mfunc(to_mdev(ib_dev)->dev)) {
++                              /* When multi-function is enabled, the ib_core 
gid
++                               * indexes don't necessarily match the hw ones, 
so
++                               * we must use our own cache
++                               */
++                              
sqp->ud_header.grh.source_gid.global.subnet_prefix =
++                                      
cpu_to_be64(atomic64_read(&(to_mdev(ib_dev)->sriov.
++                                                                  
demux[sqp->qp.port - 1].
++                                                                  
subnet_prefix)));
++                              
sqp->ud_header.grh.source_gid.global.interface_id =
++                                      
to_mdev(ib_dev)->sriov.demux[sqp->qp.port - 1].
++                                                     
guid_cache[ah->av.ib.gid_index];
++                      } else {
++                              ib_get_cached_gid(ib_dev,
++                                                
be32_to_cpu(ah->av.ib.port_pd) >> 24,
++                                                ah->av.ib.gid_index,
++                                                
&sqp->ud_header.grh.source_gid, NULL);
++                      }
+               }
+               memcpy(sqp->ud_header.grh.destination_gid.raw,
+                      ah->av.ib.dgid, 16);
+diff --git a/drivers/infiniband/ulp/ipoib/ipoib.h 
b/drivers/infiniband/ulp/ipoib/ipoib.h
+index 3ede10309754..69a151ae8261 100644
+--- a/drivers/infiniband/ulp/ipoib/ipoib.h
++++ b/drivers/infiniband/ulp/ipoib/ipoib.h
+@@ -472,6 +472,7 @@ void ipoib_send(struct net_device *dev, struct sk_buff 
*skb,
+               struct ipoib_ah *address, u32 qpn);
+ void ipoib_reap_ah(struct work_struct *work);
+ 
++struct ipoib_path *__path_find(struct net_device *dev, void *gid);
+ void ipoib_mark_paths_invalid(struct net_device *dev);
+ void ipoib_flush_paths(struct net_device *dev);
+ struct ipoib_dev_priv *ipoib_intf_alloc(const char *format);
+diff --git a/drivers/infiniband/ulp/ipoib/ipoib_cm.c 
b/drivers/infiniband/ulp/ipoib/ipoib_cm.c
+index 3ae9726efb98..8ca75af0e6d1 100644
+--- a/drivers/infiniband/ulp/ipoib/ipoib_cm.c
++++ b/drivers/infiniband/ulp/ipoib/ipoib_cm.c
+@@ -1299,6 +1299,8 @@ void ipoib_cm_destroy_tx(struct ipoib_cm_tx *tx)
+       }
+ }
+ 
++#define QPN_AND_OPTIONS_OFFSET        4
++
+ static void ipoib_cm_tx_start(struct work_struct *work)
+ {
+       struct ipoib_dev_priv *priv = container_of(work, struct ipoib_dev_priv,
+@@ -1307,6 +1309,7 @@ static void ipoib_cm_tx_start(struct work_struct *work)
+       struct ipoib_neigh *neigh;
+       struct ipoib_cm_tx *p;
+       unsigned long flags;
++      struct ipoib_path *path;
+       int ret;
+ 
+       struct ib_sa_path_rec pathrec;
+@@ -1319,7 +1322,19 @@ static void ipoib_cm_tx_start(struct work_struct *work)
+               p = list_entry(priv->cm.start_list.next, typeof(*p), list);
+               list_del_init(&p->list);
+               neigh = p->neigh;
++
+               qpn = IPOIB_QPN(neigh->daddr);
++              /*
++               * As long as the search is with these 2 locks,
++               * path existence indicates its validity.
++               */
++              path = __path_find(dev, neigh->daddr + QPN_AND_OPTIONS_OFFSET);
++              if (!path) {
++                      pr_info("%s ignore not valid path %pI6\n",
++                              __func__,
++                              neigh->daddr + QPN_AND_OPTIONS_OFFSET);
++                      goto free_neigh;
++              }
+               memcpy(&pathrec, &p->path->pathrec, sizeof pathrec);
+ 
+               spin_unlock_irqrestore(&priv->lock, flags);
+@@ -1331,6 +1346,7 @@ static void ipoib_cm_tx_start(struct work_struct *work)
+               spin_lock_irqsave(&priv->lock, flags);
+ 
+               if (ret) {
++free_neigh:
+                       neigh = p->neigh;
+                       if (neigh) {
+                               neigh->cm = NULL;
+diff --git a/drivers/infiniband/ulp/ipoib/ipoib_ib.c 
b/drivers/infiniband/ulp/ipoib/ipoib_ib.c
+index fa9c42ff1fb0..85de078fb0ce 100644
+--- a/drivers/infiniband/ulp/ipoib/ipoib_ib.c
++++ b/drivers/infiniband/ulp/ipoib/ipoib_ib.c
+@@ -1028,8 +1028,17 @@ static void __ipoib_ib_dev_flush(struct ipoib_dev_priv 
*priv,
+       }
+ 
+       if (level == IPOIB_FLUSH_LIGHT) {
++              int oper_up;
+               ipoib_mark_paths_invalid(dev);
++              /* Set IPoIB operation as down to prevent races between:
++               * the flush flow which leaves MCG and on the fly joins
++               * which can happen during that time. mcast restart task
++               * should deal with join requests we missed.
++               */
++              oper_up = test_and_clear_bit(IPOIB_FLAG_OPER_UP, &priv->flags);
+               ipoib_mcast_dev_flush(dev);
++              if (oper_up)
++                      set_bit(IPOIB_FLAG_OPER_UP, &priv->flags);
+               ipoib_flush_ah(dev);
+       }
+ 
+diff --git a/drivers/infiniband/ulp/ipoib/ipoib_main.c 
b/drivers/infiniband/ulp/ipoib/ipoib_main.c
+index 942dffca6a9d..5f7681b975d0 100644
+--- a/drivers/infiniband/ulp/ipoib/ipoib_main.c
++++ b/drivers/infiniband/ulp/ipoib/ipoib_main.c
+@@ -481,7 +481,7 @@ int ipoib_set_mode(struct net_device *dev, const char *buf)
+       return -EINVAL;
+ }
+ 
+-static struct ipoib_path *__path_find(struct net_device *dev, void *gid)
++struct ipoib_path *__path_find(struct net_device *dev, void *gid)
+ {
+       struct ipoib_dev_priv *priv = netdev_priv(dev);
+       struct rb_node *n = priv->path_tree.rb_node;
+diff --git a/drivers/irqchip/irq-gic-v3.c b/drivers/irqchip/irq-gic-v3.c
+index 2fc499a2207e..44aa57edf207 100644
+--- a/drivers/irqchip/irq-gic-v3.c
++++ b/drivers/irqchip/irq-gic-v3.c
+@@ -544,7 +544,7 @@ static struct notifier_block gic_cpu_notifier = {
+ static u16 gic_compute_target_list(int *base_cpu, const struct cpumask *mask,
+                                  unsigned long cluster_id)
+ {
+-      int cpu = *base_cpu;
++      int next_cpu, cpu = *base_cpu;
+       unsigned long mpidr = cpu_logical_map(cpu);
+       u16 tlist = 0;
+ 
+@@ -558,9 +558,10 @@ static u16 gic_compute_target_list(int *base_cpu, const 
struct cpumask *mask,
+ 
+               tlist |= 1 << (mpidr & 0xf);
+ 
+-              cpu = cpumask_next(cpu, mask);
+-              if (cpu >= nr_cpu_ids)
++              next_cpu = cpumask_next(cpu, mask);
++              if (next_cpu >= nr_cpu_ids)
+                       goto out;
++              cpu = next_cpu;
+ 
+               mpidr = cpu_logical_map(cpu);
+ 
+diff --git a/drivers/md/dm-log-writes.c b/drivers/md/dm-log-writes.c
+index d8956b4a7b09..c8b513ee117c 100644
+--- a/drivers/md/dm-log-writes.c
++++ b/drivers/md/dm-log-writes.c
+@@ -259,7 +259,7 @@ static int log_one_block(struct log_writes_c *lc,
+       sector++;
+ 
+       atomic_inc(&lc->io_blocks);
+-      bio = bio_alloc(GFP_KERNEL, block->vec_cnt);
++      bio = bio_alloc(GFP_KERNEL, min(block->vec_cnt, BIO_MAX_PAGES));
+       if (!bio) {
+               DMERR("Couldn't alloc log bio");
+               goto error;
+@@ -280,7 +280,7 @@ static int log_one_block(struct log_writes_c *lc,
+               if (ret != block->vecs[i].bv_len) {
+                       atomic_inc(&lc->io_blocks);
+                       submit_bio(WRITE, bio);
+-                      bio = bio_alloc(GFP_KERNEL, block->vec_cnt - i);
++                      bio = bio_alloc(GFP_KERNEL, min(block->vec_cnt - i, 
BIO_MAX_PAGES));
+                       if (!bio) {
+                               DMERR("Couldn't alloc log bio");
+                               goto error;
+diff --git a/drivers/media/usb/em28xx/em28xx-i2c.c 
b/drivers/media/usb/em28xx/em28xx-i2c.c
+index a19b5c8b56ff..1a9e1e556706 100644
+--- a/drivers/media/usb/em28xx/em28xx-i2c.c
++++ b/drivers/media/usb/em28xx/em28xx-i2c.c
+@@ -507,9 +507,8 @@ static int em28xx_i2c_xfer(struct i2c_adapter *i2c_adap,
+       if (dev->disconnected)
+               return -ENODEV;
+ 
+-      rc = rt_mutex_trylock(&dev->i2c_bus_lock);
+-      if (rc < 0)
+-              return rc;
++      if (!rt_mutex_trylock(&dev->i2c_bus_lock))
++              return -EAGAIN;
+ 
+       /* Switch I2C bus if needed */
+       if (bus != dev->cur_i2c_bus &&
+diff --git a/drivers/media/usb/gspca/cpia1.c b/drivers/media/usb/gspca/cpia1.c
+index f23df4a9d8c5..52b88e9e656b 100644
+--- a/drivers/media/usb/gspca/cpia1.c
++++ b/drivers/media/usb/gspca/cpia1.c
+@@ -1624,7 +1624,7 @@ static int sd_start(struct gspca_dev *gspca_dev)
+ 
+ static void sd_stopN(struct gspca_dev *gspca_dev)
+ {
+-      struct sd *sd = (struct sd *) gspca_dev;
++      struct sd *sd __maybe_unused = (struct sd *) gspca_dev;
+ 
+       command_pause(gspca_dev);
+ 
+diff --git a/drivers/media/usb/gspca/konica.c 
b/drivers/media/usb/gspca/konica.c
+index 39c96bb4c985..0712b1bc90b4 100644
+--- a/drivers/media/usb/gspca/konica.c
++++ b/drivers/media/usb/gspca/konica.c
+@@ -243,7 +243,7 @@ static int sd_start(struct gspca_dev *gspca_dev)
+ 
+ static void sd_stopN(struct gspca_dev *gspca_dev)
+ {
+-      struct sd *sd = (struct sd *) gspca_dev;
++      struct sd *sd __maybe_unused = (struct sd *) gspca_dev;
+ 
+       konica_stream_off(gspca_dev);
+ #if IS_ENABLED(CONFIG_INPUT)
+diff --git a/drivers/media/usb/gspca/t613.c b/drivers/media/usb/gspca/t613.c
+index e2cc4e5a0ccb..bb52fc1fe598 100644
+--- a/drivers/media/usb/gspca/t613.c
++++ b/drivers/media/usb/gspca/t613.c
+@@ -837,7 +837,7 @@ static void sd_pkt_scan(struct gspca_dev *gspca_dev,
+                       u8 *data,                       /* isoc packet */
+                       int len)                        /* iso packet length */
+ {
+-      struct sd *sd = (struct sd *) gspca_dev;
++      struct sd *sd __maybe_unused = (struct sd *) gspca_dev;
+       int pkt_type;
+ 
+       if (data[0] == 0x5a) {
+diff --git a/drivers/mmc/host/pxamci.c b/drivers/mmc/host/pxamci.c
+index 28a057fae0a1..72bbb12fb938 100644
+--- a/drivers/mmc/host/pxamci.c
++++ b/drivers/mmc/host/pxamci.c
+@@ -798,14 +798,16 @@ static int pxamci_probe(struct platform_device *pdev)
+               gpio_direction_output(gpio_power,
+                                     host->pdata->gpio_power_invert);
+       }
+-      if (gpio_is_valid(gpio_ro))
++      if (gpio_is_valid(gpio_ro)) {
+               ret = mmc_gpio_request_ro(mmc, gpio_ro);
+-      if (ret) {
+-              dev_err(&pdev->dev, "Failed requesting gpio_ro %d\n", gpio_ro);
+-              goto out;
+-      } else {
+-              mmc->caps2 |= host->pdata->gpio_card_ro_invert ?
+-                      0 : MMC_CAP2_RO_ACTIVE_HIGH;
++              if (ret) {
++                      dev_err(&pdev->dev, "Failed requesting gpio_ro %d\n",
++                              gpio_ro);
++                      goto out;
++              } else {
++                      mmc->caps2 |= host->pdata->gpio_card_ro_invert ?
++                              0 : MMC_CAP2_RO_ACTIVE_HIGH;
++              }
+       }
+ 
+       if (gpio_is_valid(gpio_cd))
+diff --git a/drivers/mtd/nand/davinci_nand.c b/drivers/mtd/nand/davinci_nand.c
+index c72313d66cf6..bc054a5ed7f8 100644
+--- a/drivers/mtd/nand/davinci_nand.c
++++ b/drivers/mtd/nand/davinci_nand.c
+@@ -241,6 +241,9 @@ static void nand_davinci_hwctl_4bit(struct mtd_info *mtd, 
int mode)
+       unsigned long flags;
+       u32 val;
+ 
++      /* Reset ECC hardware */
++      davinci_nand_readl(info, NAND_4BIT_ECC1_OFFSET);
++
+       spin_lock_irqsave(&davinci_nand_lock, flags);
+ 
+       /* Start 4-bit ECC calculation for read/write */
+diff --git a/drivers/net/can/dev.c b/drivers/net/can/dev.c
+index ad535a854e5c..eab132778e67 100644
+--- a/drivers/net/can/dev.c
++++ b/drivers/net/can/dev.c
+@@ -21,6 +21,7 @@
+ #include <linux/slab.h>
+ #include <linux/netdevice.h>
+ #include <linux/if_arp.h>
++#include <linux/workqueue.h>
+ #include <linux/can.h>
+ #include <linux/can/dev.h>
+ #include <linux/can/skb.h>
+@@ -471,9 +472,8 @@ EXPORT_SYMBOL_GPL(can_free_echo_skb);
+ /*
+  * CAN device restart for bus-off recovery
+  */
+-static void can_restart(unsigned long data)
++static void can_restart(struct net_device *dev)
+ {
+-      struct net_device *dev = (struct net_device *)data;
+       struct can_priv *priv = netdev_priv(dev);
+       struct net_device_stats *stats = &dev->stats;
+       struct sk_buff *skb;
+@@ -513,6 +513,14 @@ restart:
+               netdev_err(dev, "Error %d during restart", err);
+ }
+ 
++static void can_restart_work(struct work_struct *work)
++{
++      struct delayed_work *dwork = to_delayed_work(work);
++      struct can_priv *priv = container_of(dwork, struct can_priv, 
restart_work);
++
++      can_restart(priv->dev);
++}
++
+ int can_restart_now(struct net_device *dev)
+ {
+       struct can_priv *priv = netdev_priv(dev);
+@@ -526,8 +534,8 @@ int can_restart_now(struct net_device *dev)
+       if (priv->state != CAN_STATE_BUS_OFF)
+               return -EBUSY;
+ 
+-      /* Runs as soon as possible in the timer context */
+-      mod_timer(&priv->restart_timer, jiffies);
++      cancel_delayed_work_sync(&priv->restart_work);
++      can_restart(dev);
+ 
+       return 0;
+ }
+@@ -548,8 +556,8 @@ void can_bus_off(struct net_device *dev)
+       netif_carrier_off(dev);
+ 
+       if (priv->restart_ms)
+-              mod_timer(&priv->restart_timer,
+-                        jiffies + (priv->restart_ms * HZ) / 1000);
++              schedule_delayed_work(&priv->restart_work,
++                                    msecs_to_jiffies(priv->restart_ms));
+ }
+ EXPORT_SYMBOL_GPL(can_bus_off);
+ 
+@@ -658,6 +666,7 @@ struct net_device *alloc_candev(int sizeof_priv, unsigned 
int echo_skb_max)
+               return NULL;
+ 
+       priv = netdev_priv(dev);
++      priv->dev = dev;
+ 
+       if (echo_skb_max) {
+               priv->echo_skb_max = echo_skb_max;
+@@ -667,7 +676,7 @@ struct net_device *alloc_candev(int sizeof_priv, unsigned 
int echo_skb_max)
+ 
+       priv->state = CAN_STATE_STOPPED;
+ 
+-      init_timer(&priv->restart_timer);
++      INIT_DELAYED_WORK(&priv->restart_work, can_restart_work);
+ 
+       return dev;
+ }
+@@ -748,8 +757,6 @@ int open_candev(struct net_device *dev)
+       if (!netif_carrier_ok(dev))
+               netif_carrier_on(dev);
+ 
+-      setup_timer(&priv->restart_timer, can_restart, (unsigned long)dev);
+-
+       return 0;
+ }
+ EXPORT_SYMBOL_GPL(open_candev);
+@@ -764,7 +771,7 @@ void close_candev(struct net_device *dev)
+ {
+       struct can_priv *priv = netdev_priv(dev);
+ 
+-      del_timer_sync(&priv->restart_timer);
++      cancel_delayed_work_sync(&priv->restart_work);
+       can_flush_echo_skb(dev);
+ }
+ EXPORT_SYMBOL_GPL(close_candev);
+diff --git a/drivers/net/ethernet/intel/i40e/i40e_common.c 
b/drivers/net/ethernet/intel/i40e/i40e_common.c
+index 2d74c6e4d7b6..1cf715c72683 100644
+--- a/drivers/net/ethernet/intel/i40e/i40e_common.c
++++ b/drivers/net/ethernet/intel/i40e/i40e_common.c
+@@ -302,13 +302,15 @@ void i40e_debug_aq(struct i40e_hw *hw, enum 
i40e_debug_mask mask, void *desc,
+                  void *buffer, u16 buf_len)
+ {
+       struct i40e_aq_desc *aq_desc = (struct i40e_aq_desc *)desc;
+-      u16 len = le16_to_cpu(aq_desc->datalen);
++      u16 len;
+       u8 *buf = (u8 *)buffer;
+       u16 i = 0;
+ 
+       if ((!(mask & hw->debug_mask)) || (desc == NULL))
+               return;
+ 
++      len = le16_to_cpu(aq_desc->datalen);
++
+       i40e_debug(hw, mask,
+                  "AQ CMD: opcode 0x%04X, flags 0x%04X, datalen 0x%04X, retval 
0x%04X\n",
+                  le16_to_cpu(aq_desc->opcode),
+diff --git a/drivers/net/wireless/ath/ath9k/ar9003_eeprom.c 
b/drivers/net/wireless/ath/ath9k/ar9003_eeprom.c
+index 8b4561e8ce1a..ef493271c712 100644
+--- a/drivers/net/wireless/ath/ath9k/ar9003_eeprom.c
++++ b/drivers/net/wireless/ath/ath9k/ar9003_eeprom.c
+@@ -4176,7 +4176,7 @@ static void ath9k_hw_ar9300_set_board_values(struct 
ath_hw *ah,
+       if (!AR_SREV_9330(ah) && !AR_SREV_9340(ah) && !AR_SREV_9531(ah))
+               ar9003_hw_internal_regulator_apply(ah);
+       ar9003_hw_apply_tuning_caps(ah);
+-      ar9003_hw_apply_minccapwr_thresh(ah, chan);
++      ar9003_hw_apply_minccapwr_thresh(ah, is2ghz);
+       ar9003_hw_txend_to_xpa_off_apply(ah, is2ghz);
+       ar9003_hw_thermometer_apply(ah);
+       ar9003_hw_thermo_cal_apply(ah);
+diff --git a/drivers/net/wireless/brcm80211/brcmfmac/bcmsdh.c 
b/drivers/net/wireless/brcm80211/brcmfmac/bcmsdh.c
+index 410a6645d316..59cef6c69fe8 100644
+--- a/drivers/net/wireless/brcm80211/brcmfmac/bcmsdh.c
++++ b/drivers/net/wireless/brcm80211/brcmfmac/bcmsdh.c
+@@ -726,8 +726,10 @@ int brcmf_sdiod_recv_chain(struct brcmf_sdio_dev *sdiodev,
+                       return -ENOMEM;
+               err = brcmf_sdiod_buffrw(sdiodev, SDIO_FUNC_2, false, addr,
+                                        glom_skb);
+-              if (err)
++              if (err) {
++                      brcmu_pkt_buf_free_skb(glom_skb);
+                       goto done;
++              }
+ 
+               skb_queue_walk(pktq, skb) {
+                       memcpy(skb->data, glom_skb->data, skb->len);
+diff --git a/drivers/net/wireless/brcm80211/brcmsmac/dma.c 
b/drivers/net/wireless/brcm80211/brcmsmac/dma.c
+index 796f5f9d5d5a..b7df576bb84d 100644
+--- a/drivers/net/wireless/brcm80211/brcmsmac/dma.c
++++ b/drivers/net/wireless/brcm80211/brcmsmac/dma.c
+@@ -1079,8 +1079,10 @@ bool dma_rxfill(struct dma_pub *pub)
+ 
+               pa = dma_map_single(di->dmadev, p->data, di->rxbufsize,
+                                   DMA_FROM_DEVICE);
+-              if (dma_mapping_error(di->dmadev, pa))
++              if (dma_mapping_error(di->dmadev, pa)) {
++                      brcmu_pkt_buf_free_skb(p);
+                       return false;
++              }
+ 
+               /* save the free packet pointer */
+               di->rxp[rxout] = p;
+diff --git a/drivers/net/wireless/brcm80211/brcmsmac/stf.c 
b/drivers/net/wireless/brcm80211/brcmsmac/stf.c
+index dd9162722495..0ab865de1491 100644
+--- a/drivers/net/wireless/brcm80211/brcmsmac/stf.c
++++ b/drivers/net/wireless/brcm80211/brcmsmac/stf.c
+@@ -87,7 +87,7 @@ void
+ brcms_c_stf_ss_algo_channel_get(struct brcms_c_info *wlc, u16 
*ss_algo_channel,
+                           u16 chanspec)
+ {
+-      struct tx_power power;
++      struct tx_power power = { };
+       u8 siso_mcs_id, cdd_mcs_id, stbc_mcs_id;
+ 
+       /* Clear previous settings */
+diff --git a/drivers/net/wireless/iwlwifi/mvm/fw.c 
b/drivers/net/wireless/iwlwifi/mvm/fw.c
+index 610c442c7ab2..9584f950fd2f 100644
+--- a/drivers/net/wireless/iwlwifi/mvm/fw.c
++++ b/drivers/net/wireless/iwlwifi/mvm/fw.c
+@@ -935,7 +935,8 @@ int iwl_mvm_start_fw_dbg_conf(struct iwl_mvm *mvm, u8 
conf_id)
+       }
+ 
+       mvm->fw_dbg_conf = conf_id;
+-      return ret;
++
++      return 0;
+ }
+ 
+ static int iwl_mvm_config_ltr(struct iwl_mvm *mvm)
+diff --git a/drivers/net/wireless/iwlwifi/mvm/mac80211.c 
b/drivers/net/wireless/iwlwifi/mvm/mac80211.c
+index f96ab2f4b90e..ce12717e656a 100644
+--- a/drivers/net/wireless/iwlwifi/mvm/mac80211.c
++++ b/drivers/net/wireless/iwlwifi/mvm/mac80211.c
+@@ -3992,8 +3992,8 @@ static int iwl_mvm_mac_get_survey(struct ieee80211_hw 
*hw, int idx,
+       if (idx != 0)
+               return -ENOENT;
+ 
+-      if (fw_has_capa(&mvm->fw->ucode_capa,
+-                      IWL_UCODE_TLV_CAPA_RADIO_BEACON_STATS))
++      if (!fw_has_capa(&mvm->fw->ucode_capa,
++                       IWL_UCODE_TLV_CAPA_RADIO_BEACON_STATS))
+               return -ENOENT;
+ 
+       mutex_lock(&mvm->mutex);
+@@ -4039,8 +4039,8 @@ static void iwl_mvm_mac_sta_statistics(struct 
ieee80211_hw *hw,
+       struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
+       struct iwl_mvm_sta *mvmsta = iwl_mvm_sta_from_mac80211(sta);
+ 
+-      if (fw_has_capa(&mvm->fw->ucode_capa,
+-                      IWL_UCODE_TLV_CAPA_RADIO_BEACON_STATS))
++      if (!fw_has_capa(&mvm->fw->ucode_capa,
++                       IWL_UCODE_TLV_CAPA_RADIO_BEACON_STATS))
+               return;
+ 
+       /* if beacon filtering isn't on mac80211 does it anyway */
+diff --git a/drivers/net/wireless/iwlwifi/mvm/sf.c 
b/drivers/net/wireless/iwlwifi/mvm/sf.c
+index b0f59fdd287c..d7d72adb6343 100644
+--- a/drivers/net/wireless/iwlwifi/mvm/sf.c
++++ b/drivers/net/wireless/iwlwifi/mvm/sf.c
+@@ -215,7 +215,7 @@ static int iwl_mvm_sf_config(struct iwl_mvm *mvm, u8 
sta_id,
+                            enum iwl_sf_state new_state)
+ {
+       struct iwl_sf_cfg_cmd sf_cmd = {
+-              .state = cpu_to_le32(SF_FULL_ON),
++              .state = cpu_to_le32(new_state),
+       };
+       struct ieee80211_sta *sta;
+       int ret = 0;
+diff --git a/drivers/net/wireless/iwlwifi/pcie/tx.c 
b/drivers/net/wireless/iwlwifi/pcie/tx.c
+index a8c8a4a7420b..8dfe6b2bc703 100644
+--- a/drivers/net/wireless/iwlwifi/pcie/tx.c
++++ b/drivers/net/wireless/iwlwifi/pcie/tx.c
+@@ -1508,9 +1508,9 @@ static int iwl_pcie_enqueue_hcmd(struct iwl_trans *trans,
+ 
+       /* start the TFD with the scratchbuf */
+       scratch_size = min_t(int, copy_size, IWL_HCMD_SCRATCHBUF_SIZE);
+-      memcpy(&txq->scratchbufs[q->write_ptr], &out_cmd->hdr, scratch_size);
++      memcpy(&txq->scratchbufs[idx], &out_cmd->hdr, scratch_size);
+       iwl_pcie_txq_build_tfd(trans, txq,
+-                             iwl_pcie_get_scratchbuf_dma(txq, q->write_ptr),
++                             iwl_pcie_get_scratchbuf_dma(txq, idx),
+                              scratch_size, true);
+ 
+       /* map first command fragment, if any remains */
+diff --git a/drivers/nfc/fdp/fdp.c b/drivers/nfc/fdp/fdp.c
+index ccb07a1b153d..23e53780728b 100644
+--- a/drivers/nfc/fdp/fdp.c
++++ b/drivers/nfc/fdp/fdp.c
+@@ -352,7 +352,7 @@ static int fdp_nci_patch_otp(struct nci_dev *ndev)
+ {
+       struct fdp_nci_info *info = nci_get_drvdata(ndev);
+       struct device *dev = &info->phy->i2c_dev->dev;
+-      u8 conn_id;
++      int conn_id;
+       int r = 0;
+ 
+       if (info->otp_version >= info->otp_patch_version)
+@@ -423,7 +423,7 @@ static int fdp_nci_patch_ram(struct nci_dev *ndev)
+ {
+       struct fdp_nci_info *info = nci_get_drvdata(ndev);
+       struct device *dev = &info->phy->i2c_dev->dev;
+-      u8 conn_id;
++      int conn_id;
+       int r = 0;
+ 
+       if (info->ram_version >= info->ram_patch_version)
+diff --git a/drivers/perf/arm_pmu.c b/drivers/perf/arm_pmu.c
+index be3755c973e9..8af1f900ea65 100644
+--- a/drivers/perf/arm_pmu.c
++++ b/drivers/perf/arm_pmu.c
+@@ -815,6 +815,7 @@ static int of_pmu_irq_cfg(struct arm_pmu *pmu)
+                       if (i > 0 && spi != using_spi) {
+                               pr_err("PPI/SPI IRQ type mismatch for %s!\n",
+                                       dn->name);
++                              of_node_put(dn);
+                               kfree(irqs);
+                               return -EINVAL;
+                       }
+diff --git a/drivers/pinctrl/uniphier/pinctrl-uniphier-core.c 
b/drivers/pinctrl/uniphier/pinctrl-uniphier-core.c
+index 589872cc8adb..a19c29c79b0a 100644
+--- a/drivers/pinctrl/uniphier/pinctrl-uniphier-core.c
++++ b/drivers/pinctrl/uniphier/pinctrl-uniphier-core.c
+@@ -73,6 +73,12 @@ static void uniphier_pctl_pin_dbg_show(struct pinctrl_dev 
*pctldev,
+       case UNIPHIER_PIN_PULL_DOWN:
+               pull_dir = "DOWN";
+               break;
++      case UNIPHIER_PIN_PULL_UP_FIXED:
++              pull_dir = "UP(FIXED)";
++              break;
++      case UNIPHIER_PIN_PULL_DOWN_FIXED:
++              pull_dir = "DOWN(FIXED)";
++              break;
+       case UNIPHIER_PIN_PULL_NONE:
+               pull_dir = "NONE";
+               break;
+diff --git a/drivers/regulator/qcom_smd-regulator.c 
b/drivers/regulator/qcom_smd-regulator.c
+index 6fa0c7d13290..4bda998afdef 100644
+--- a/drivers/regulator/qcom_smd-regulator.c
++++ b/drivers/regulator/qcom_smd-regulator.c
+@@ -166,29 +166,30 @@ static const struct regulator_desc pm8x41_hfsmps = {
+ static const struct regulator_desc pm8841_ftsmps = {
+       .linear_ranges = (struct regulator_linear_range[]) {
+               REGULATOR_LINEAR_RANGE(350000,  0, 184, 5000),
+-              REGULATOR_LINEAR_RANGE(700000, 185, 339, 10000),
++              REGULATOR_LINEAR_RANGE(1280000, 185, 261, 10000),
+       },
+       .n_linear_ranges = 2,
+-      .n_voltages = 340,
++      .n_voltages = 262,
+       .ops = &rpm_smps_ldo_ops,
+ };
+ 
+ static const struct regulator_desc pm8941_boost = {
+       .linear_ranges = (struct regulator_linear_range[]) {
+-              REGULATOR_LINEAR_RANGE(4000000, 0, 15, 100000),
++              REGULATOR_LINEAR_RANGE(4000000, 0, 30, 50000),
+       },
+       .n_linear_ranges = 1,
+-      .n_voltages = 16,
++      .n_voltages = 31,
+       .ops = &rpm_smps_ldo_ops,
+ };
+ 
+ static const struct regulator_desc pm8941_pldo = {
+       .linear_ranges = (struct regulator_linear_range[]) {
+-              REGULATOR_LINEAR_RANGE( 750000,  0,  30, 25000),
+-              REGULATOR_LINEAR_RANGE(1500000, 31, 99, 50000),
++              REGULATOR_LINEAR_RANGE( 750000,  0,  63, 12500),
++              REGULATOR_LINEAR_RANGE(1550000, 64, 126, 25000),
++              REGULATOR_LINEAR_RANGE(3100000, 127, 163, 50000),
+       },
+-      .n_linear_ranges = 2,
+-      .n_voltages = 100,
++      .n_linear_ranges = 3,
++      .n_voltages = 164,
+       .ops = &rpm_smps_ldo_ops,
+ };
+ 
+diff --git a/drivers/regulator/qcom_spmi-regulator.c 
b/drivers/regulator/qcom_spmi-regulator.c
+index 88a5dc88badc..fee6457e3111 100644
+--- a/drivers/regulator/qcom_spmi-regulator.c
++++ b/drivers/regulator/qcom_spmi-regulator.c
+@@ -1050,6 +1050,8 @@ static struct regulator_ops spmi_vs_ops = {
+       .set_pull_down          = spmi_regulator_common_set_pull_down,
+       .set_soft_start         = spmi_regulator_common_set_soft_start,
+       .set_over_current_protection = spmi_regulator_vs_ocp,
++      .set_mode               = spmi_regulator_common_set_mode,
++      .get_mode               = spmi_regulator_common_get_mode,
+ };
+ 
+ static struct regulator_ops spmi_boost_ops = {
+@@ -1440,6 +1442,7 @@ static const struct spmi_regulator_data 
pm8941_regulators[] = {
+       { "s1", 0x1400, "vdd_s1", },
+       { "s2", 0x1700, "vdd_s2", },
+       { "s3", 0x1a00, "vdd_s3", },
++      { "s4", 0xa000, },
+       { "l1", 0x4000, "vdd_l1_l3", },
+       { "l2", 0x4100, "vdd_l2_lvs_1_2_3", },
+       { "l3", 0x4200, "vdd_l1_l3", },
+@@ -1467,8 +1470,8 @@ static const struct spmi_regulator_data 
pm8941_regulators[] = {
+       { "lvs1", 0x8000, "vdd_l2_lvs_1_2_3", },
+       { "lvs2", 0x8100, "vdd_l2_lvs_1_2_3", },
+       { "lvs3", 0x8200, "vdd_l2_lvs_1_2_3", },
+-      { "mvs1", 0x8300, "vin_5vs", },
+-      { "mvs2", 0x8400, "vin_5vs", },
++      { "5vs1", 0x8300, "vin_5vs", "ocp-5vs1", },
++      { "5vs2", 0x8400, "vin_5vs", "ocp-5vs2", },
+       { }
+ };
+ 
+diff --git a/drivers/scsi/fnic/fnic_fcs.c b/drivers/scsi/fnic/fnic_fcs.c
+index 67669a9e73c1..f3a33312a9a6 100644
+--- a/drivers/scsi/fnic/fnic_fcs.c
++++ b/drivers/scsi/fnic/fnic_fcs.c
+@@ -954,8 +954,8 @@ int fnic_alloc_rq_frame(struct vnic_rq *rq)
+       skb_put(skb, len);
+       pa = pci_map_single(fnic->pdev, skb->data, len, PCI_DMA_FROMDEVICE);
+ 
+-      r = pci_dma_mapping_error(fnic->pdev, pa);
+-      if (r) {
++      if (pci_dma_mapping_error(fnic->pdev, pa)) {
++              r = -ENOMEM;
+               printk(KERN_ERR "PCI mapping failed with error %d\n", r);
+               goto free_skb;
+       }
+@@ -1093,8 +1093,8 @@ static int fnic_send_frame(struct fnic *fnic, struct 
fc_frame *fp)
+ 
+       pa = pci_map_single(fnic->pdev, eth_hdr, tot_len, PCI_DMA_TODEVICE);
+ 
+-      ret = pci_dma_mapping_error(fnic->pdev, pa);
+-      if (ret) {
++      if (pci_dma_mapping_error(fnic->pdev, pa)) {
++              ret = -ENOMEM;
+               printk(KERN_ERR "DMA map failed with error %d\n", ret);
+               goto free_skb_on_err;
+       }
+diff --git a/drivers/spi/spi-sh-msiof.c b/drivers/spi/spi-sh-msiof.c
+index a7934ab00b96..d22de4c8c399 100644
+--- a/drivers/spi/spi-sh-msiof.c
++++ b/drivers/spi/spi-sh-msiof.c
+@@ -263,6 +263,9 @@ static void sh_msiof_spi_set_clk_regs(struct 
sh_msiof_spi_priv *p,
+ 
+       for (k = 0; k < ARRAY_SIZE(sh_msiof_spi_div_table); k++) {
+               brps = DIV_ROUND_UP(div, sh_msiof_spi_div_table[k].div);
++              /* SCR_BRDV_DIV_1 is valid only if BRPS is x 1/1 or x 1/2 */
++              if (sh_msiof_spi_div_table[k].div == 1 && brps > 2)
++                      continue;
+               if (brps <= 32) /* max of brdv is 32 */
+                       break;
+       }
+diff --git a/drivers/staging/fbtft/fbtft-core.c 
b/drivers/staging/fbtft/fbtft-core.c
+index b1e45161eefc..18c2b6daf588 100644
+--- a/drivers/staging/fbtft/fbtft-core.c
++++ b/drivers/staging/fbtft/fbtft-core.c
+@@ -392,11 +392,11 @@ static void fbtft_update_display(struct fbtft_par *par, 
unsigned start_line,
+ 
+       if (unlikely(timeit)) {
+               ts_end = ktime_get();
+-              if (ktime_to_ns(par->update_time))
++              if (!ktime_to_ns(par->update_time))
+                       par->update_time = ts_start;
+ 
+-              par->update_time = ts_start;
+               fps = ktime_us_delta(ts_start, par->update_time);
++              par->update_time = ts_start;
+               fps = fps ? 1000000 / fps : 0;
+ 
+               throughput = ktime_us_delta(ts_end, ts_start);
+diff --git a/drivers/usb/class/usbtmc.c b/drivers/usb/class/usbtmc.c
+index 7a11a8263171..deaddb950c20 100644
+--- a/drivers/usb/class/usbtmc.c
++++ b/drivers/usb/class/usbtmc.c
+@@ -121,6 +121,7 @@ static void usbtmc_delete(struct kref *kref)
+       struct usbtmc_device_data *data = to_usbtmc_data(kref);
+ 
+       usb_put_dev(data->usb_dev);
++      kfree(data);
+ }
+ 
+ static int usbtmc_open(struct inode *inode, struct file *filp)
+@@ -1104,7 +1105,7 @@ static int usbtmc_probe(struct usb_interface *intf,
+ 
+       dev_dbg(&intf->dev, "%s called\n", __func__);
+ 
+-      data = devm_kzalloc(&intf->dev, sizeof(*data), GFP_KERNEL);
++      data = kmalloc(sizeof(*data), GFP_KERNEL);
+       if (!data)
+               return -ENOMEM;
+ 
+diff --git a/drivers/usb/gadget/udc/fsl_qe_udc.c 
b/drivers/usb/gadget/udc/fsl_qe_udc.c
+index c73689b72f95..b38a33584d4a 100644
+--- a/drivers/usb/gadget/udc/fsl_qe_udc.c
++++ b/drivers/usb/gadget/udc/fsl_qe_udc.c
+@@ -1878,11 +1878,8 @@ static int qe_get_frame(struct usb_gadget *gadget)
+ 
+       tmp = in_be16(&udc->usb_param->frame_n);
+       if (tmp & 0x8000)
+-              tmp = tmp & 0x07ff;
+-      else
+-              tmp = -EINVAL;
+-
+-      return (int)tmp;
++              return tmp & 0x07ff;
++      return -EINVAL;
+ }
+ 
+ static int fsl_qe_start(struct usb_gadget *gadget,
+diff --git a/drivers/usb/misc/legousbtower.c b/drivers/usb/misc/legousbtower.c
+index 7771be3ac178..4dd531ac5a7f 100644
+--- a/drivers/usb/misc/legousbtower.c
++++ b/drivers/usb/misc/legousbtower.c
+@@ -898,24 +898,6 @@ static int tower_probe (struct usb_interface *interface, 
const struct usb_device
+       dev->interrupt_in_interval = interrupt_in_interval ? 
interrupt_in_interval : dev->interrupt_in_endpoint->bInterval;
+       dev->interrupt_out_interval = interrupt_out_interval ? 
interrupt_out_interval : dev->interrupt_out_endpoint->bInterval;
+ 
+-      /* we can register the device now, as it is ready */
+-      usb_set_intfdata (interface, dev);
+-
+-      retval = usb_register_dev (interface, &tower_class);
+-
+-      if (retval) {
+-              /* something prevented us from registering this driver */
+-              dev_err(idev, "Not able to get a minor for this device.\n");
+-              usb_set_intfdata (interface, NULL);
+-              goto error;
+-      }
+-      dev->minor = interface->minor;
+-
+-      /* let the user know what node this device is now attached to */
+-      dev_info(&interface->dev, "LEGO USB Tower #%d now attached to major "
+-               "%d minor %d\n", (dev->minor - LEGO_USB_TOWER_MINOR_BASE),
+-               USB_MAJOR, dev->minor);
+-
+       /* get the firmware version and log it */
+       result = usb_control_msg (udev,
+                                 usb_rcvctrlpipe(udev, 0),
+@@ -936,6 +918,23 @@ static int tower_probe (struct usb_interface *interface, 
const struct usb_device
+                get_version_reply.minor,
+                le16_to_cpu(get_version_reply.build_no));
+ 
++      /* we can register the device now, as it is ready */
++      usb_set_intfdata (interface, dev);
++
++      retval = usb_register_dev (interface, &tower_class);
++
++      if (retval) {
++              /* something prevented us from registering this driver */
++              dev_err(idev, "Not able to get a minor for this device.\n");
++              usb_set_intfdata (interface, NULL);
++              goto error;
++      }
++      dev->minor = interface->minor;
++
++      /* let the user know what node this device is now attached to */
++      dev_info(&interface->dev, "LEGO USB Tower #%d now attached to major "
++               "%d minor %d\n", (dev->minor - LEGO_USB_TOWER_MINOR_BASE),
++               USB_MAJOR, dev->minor);
+ 
+ exit:
+       return retval;
+diff --git a/drivers/usb/musb/musb_host.c b/drivers/usb/musb/musb_host.c
+index 59a63a0b7985..e0a083f6ab68 100644
+--- a/drivers/usb/musb/musb_host.c
++++ b/drivers/usb/musb/musb_host.c
+@@ -661,7 +661,7 @@ static int musb_tx_dma_set_mode_mentor(struct 
dma_controller *dma,
+               csr &= ~(MUSB_TXCSR_AUTOSET | MUSB_TXCSR_DMAMODE);
+               csr |= MUSB_TXCSR_DMAENAB; /* against programmer's guide */
+       }
+-      channel->desired_mode = mode;
++      channel->desired_mode = *mode;
+       musb_writew(epio, MUSB_TXCSR, csr);
+ 
+       return 0;
+@@ -2008,10 +2008,8 @@ void musb_host_rx(struct musb *musb, u8 epnum)
+                               qh->offset,
+                               urb->transfer_buffer_length);
+ 
+-                      done = musb_rx_dma_in_inventra_cppi41(c, hw_ep, qh,
+-                                                            urb, xfer_len,
+-                                                            iso_err);
+-                      if (done)
++                      if (musb_rx_dma_in_inventra_cppi41(c, hw_ep, qh, urb,
++                                                         xfer_len, iso_err))
+                               goto finish;
+                       else
+                               dev_err(musb->controller, "error: rx_dma 
failed\n");
+diff --git a/drivers/usb/serial/cp210x.c b/drivers/usb/serial/cp210x.c
+index a2b43a6e7fa7..6eccded3bc33 100644
+--- a/drivers/usb/serial/cp210x.c
++++ b/drivers/usb/serial/cp210x.c
+@@ -117,6 +117,7 @@ static const struct usb_device_id id_table[] = {
+       { USB_DEVICE(0x10C4, 0x8411) }, /* Kyocera GPS Module */
+       { USB_DEVICE(0x10C4, 0x8418) }, /* IRZ Automation Teleport SG-10 
GSM/GPRS Modem */
+       { USB_DEVICE(0x10C4, 0x846E) }, /* BEI USB Sensor Interface (VCP) */
++      { USB_DEVICE(0x10C4, 0x8470) }, /* Juniper Networks BX Series System 
Console */
+       { USB_DEVICE(0x10C4, 0x8477) }, /* Balluff RFID */
+       { USB_DEVICE(0x10C4, 0x84B6) }, /* Starizona Hyperion */
+       { USB_DEVICE(0x10C4, 0x85EA) }, /* AC-Services IBUS-IF */
+@@ -784,7 +785,7 @@ static void cp210x_set_termios(struct tty_struct *tty,
+               } else {
+                       modem_ctl[0] &= ~0x7B;
+                       modem_ctl[0] |= 0x01;
+-                      modem_ctl[1] |= 0x40;
++                      modem_ctl[1] = 0x40;
+                       dev_dbg(dev, "%s - flow control = NONE\n", __func__);
+               }
+ 
+diff --git a/fs/aio.c b/fs/aio.c
+index 155f84253f33..fe4f49212b99 100644
+--- a/fs/aio.c
++++ b/fs/aio.c
+@@ -239,7 +239,12 @@ static struct dentry *aio_mount(struct file_system_type 
*fs_type,
+       static const struct dentry_operations ops = {
+               .d_dname        = simple_dname,
+       };
+-      return mount_pseudo(fs_type, "aio:", NULL, &ops, AIO_RING_MAGIC);
++      struct dentry *root = mount_pseudo(fs_type, "aio:", NULL, &ops,
++                                         AIO_RING_MAGIC);
++
++      if (!IS_ERR(root))
++              root->d_sb->s_iflags |= SB_I_NOEXEC;
++      return root;
+ }
+ 
+ /* aio_setup
+diff --git a/fs/ceph/inode.c b/fs/ceph/inode.c
+index 498dcfa2dcdb..d98536c8abfc 100644
+--- a/fs/ceph/inode.c
++++ b/fs/ceph/inode.c
+@@ -1358,15 +1358,20 @@ static int fill_readdir_cache(struct inode *dir, 
struct dentry *dn,
+ 
+       if (!ctl->page || pgoff != page_index(ctl->page)) {
+               ceph_readdir_cache_release(ctl);
+-              ctl->page  = grab_cache_page(&dir->i_data, pgoff);
++              if (idx == 0)
++                      ctl->page = grab_cache_page(&dir->i_data, pgoff);
++              else
++                      ctl->page = find_lock_page(&dir->i_data, pgoff);
+               if (!ctl->page) {
+                       ctl->index = -1;
+-                      return -ENOMEM;
++                      return idx == 0 ? -ENOMEM : 0;
+               }
+               /* reading/filling the cache are serialized by
+                * i_mutex, no need to use page lock */
+               unlock_page(ctl->page);
+               ctl->dentries = kmap(ctl->page);
++              if (idx == 0)
++                      memset(ctl->dentries, 0, PAGE_CACHE_SIZE);
+       }
+ 
+       if (req->r_dir_release_cnt == atomic64_read(&ci->i_release_count) &&
+diff --git a/fs/nfs/callback_xdr.c b/fs/nfs/callback_xdr.c
+index 646cdac73488..e2e857affbf2 100644
+--- a/fs/nfs/callback_xdr.c
++++ b/fs/nfs/callback_xdr.c
+@@ -912,7 +912,7 @@ static __be32 nfs4_callback_compound(struct svc_rqst 
*rqstp, void *argp, void *r
+       if (hdr_arg.minorversion == 0) {
+               cps.clp = nfs4_find_client_ident(SVC_NET(rqstp), 
hdr_arg.cb_ident);
+               if (!cps.clp || !check_gss_callback_principal(cps.clp, rqstp))
+-                      return rpc_drop_reply;
++                      goto out_invalidcred;
+       }
+ 
+       cps.minorversion = hdr_arg.minorversion;
+@@ -940,6 +940,10 @@ static __be32 nfs4_callback_compound(struct svc_rqst 
*rqstp, void *argp, void *r
+       nfs_put_client(cps.clp);
+       dprintk("%s: done, status = %u\n", __func__, ntohl(status));
+       return rpc_success;
++
++out_invalidcred:
++      pr_warn_ratelimited("NFS: NFSv4 callback contains invalid cred\n");
++      return rpc_autherr_badcred;
+ }
+ 
+ /*
+diff --git a/fs/nfs/filelayout/filelayout.c b/fs/nfs/filelayout/filelayout.c
+index 02ec07973bc4..fd8da630fd22 100644
+--- a/fs/nfs/filelayout/filelayout.c
++++ b/fs/nfs/filelayout/filelayout.c
+@@ -374,8 +374,7 @@ static int filelayout_commit_done_cb(struct rpc_task *task,
+               return -EAGAIN;
+       }
+ 
+-      if (data->verf.committed == NFS_UNSTABLE)
+-              pnfs_set_layoutcommit(data->inode, data->lseg, data->lwb);
++      pnfs_set_layoutcommit(data->inode, data->lseg, data->lwb);
+ 
+       return 0;
+ }
+diff --git a/fs/nfs/flexfilelayout/flexfilelayout.c 
b/fs/nfs/flexfilelayout/flexfilelayout.c
+index 2a2e2d8ddee5..54313322ee5b 100644
+--- a/fs/nfs/flexfilelayout/flexfilelayout.c
++++ b/fs/nfs/flexfilelayout/flexfilelayout.c
+@@ -1414,8 +1414,7 @@ static int ff_layout_commit_done_cb(struct rpc_task 
*task,
+               return -EAGAIN;
+       }
+ 
+-      if (data->verf.committed == NFS_UNSTABLE
+-          && ff_layout_need_layoutcommit(data->lseg))
++      if (ff_layout_need_layoutcommit(data->lseg))
+               pnfs_set_layoutcommit(data->inode, data->lseg, data->lwb);
+ 
+       return 0;
+diff --git a/fs/pstore/inode.c b/fs/pstore/inode.c
+index d8c439d813ce..ac6c78fe19cf 100644
+--- a/fs/pstore/inode.c
++++ b/fs/pstore/inode.c
+@@ -178,7 +178,6 @@ static loff_t pstore_file_llseek(struct file *file, loff_t 
off, int whence)
+ }
+ 
+ static const struct file_operations pstore_file_operations = {
+-      .owner          = THIS_MODULE,
+       .open           = pstore_file_open,
+       .read           = pstore_file_read,
+       .llseek         = pstore_file_llseek,
+diff --git a/include/linux/can/dev.h b/include/linux/can/dev.h
+index 5261751f6bd4..5f5270941ba0 100644
+--- a/include/linux/can/dev.h
++++ b/include/linux/can/dev.h
+@@ -32,6 +32,7 @@ enum can_mode {
+  * CAN common private data
+  */
+ struct can_priv {
++      struct net_device *dev;
+       struct can_device_stats can_stats;
+ 
+       struct can_bittiming bittiming, data_bittiming;
+@@ -47,7 +48,7 @@ struct can_priv {
+       u32 ctrlmode_static;    /* static enabled options for driver/hardware */
+ 
+       int restart_ms;
+-      struct timer_list restart_timer;
++      struct delayed_work restart_work;
+ 
+       int (*do_set_bittiming)(struct net_device *dev);
+       int (*do_set_data_bittiming)(struct net_device *dev);
+diff --git a/include/linux/nvmem-consumer.h b/include/linux/nvmem-consumer.h
+index 9bb77d3ed6e0..c2256d746543 100644
+--- a/include/linux/nvmem-consumer.h
++++ b/include/linux/nvmem-consumer.h
+@@ -74,7 +74,7 @@ static inline void nvmem_cell_put(struct nvmem_cell *cell)
+ {
+ }
+ 
+-static inline char *nvmem_cell_read(struct nvmem_cell *cell, size_t *len)
++static inline void *nvmem_cell_read(struct nvmem_cell *cell, size_t *len)
+ {
+       return ERR_PTR(-ENOSYS);
+ }
+diff --git a/include/linux/sysctl.h b/include/linux/sysctl.h
+index fa7bc29925c9..ef17db6caaed 100644
+--- a/include/linux/sysctl.h
++++ b/include/linux/sysctl.h
+@@ -41,6 +41,8 @@ extern int proc_dostring(struct ctl_table *, int,
+                        void __user *, size_t *, loff_t *);
+ extern int proc_dointvec(struct ctl_table *, int,
+                        void __user *, size_t *, loff_t *);
++extern int proc_douintvec(struct ctl_table *, int,
++                       void __user *, size_t *, loff_t *);
+ extern int proc_dointvec_minmax(struct ctl_table *, int,
+                               void __user *, size_t *, loff_t *);
+ extern int proc_dointvec_jiffies(struct ctl_table *, int,
+diff --git a/kernel/cpuset.c b/kernel/cpuset.c
+index b9279a2844d8..b271353d5202 100644
+--- a/kernel/cpuset.c
++++ b/kernel/cpuset.c
+@@ -324,8 +324,7 @@ static struct file_system_type cpuset_fs_type = {
+ /*
+  * Return in pmask the portion of a cpusets's cpus_allowed that
+  * are online.  If none are online, walk up the cpuset hierarchy
+- * until we find one that does have some online cpus.  The top
+- * cpuset always has some cpus online.
++ * until we find one that does have some online cpus.
+  *
+  * One way or another, we guarantee to return some non-empty subset
+  * of cpu_online_mask.
+@@ -334,8 +333,20 @@ static struct file_system_type cpuset_fs_type = {
+  */
+ static void guarantee_online_cpus(struct cpuset *cs, struct cpumask *pmask)
+ {
+-      while (!cpumask_intersects(cs->effective_cpus, cpu_online_mask))
++      while (!cpumask_intersects(cs->effective_cpus, cpu_online_mask)) {
+               cs = parent_cs(cs);
++              if (unlikely(!cs)) {
++                      /*
++                       * The top cpuset doesn't have any online cpu as a
++                       * consequence of a race between cpuset_hotplug_work
++                       * and cpu hotplug notifier.  But we know the top
++                       * cpuset's effective_cpus is on its way to to be
++                       * identical to cpu_online_mask.
++                       */
++                      cpumask_copy(pmask, cpu_online_mask);
++                      return;
++              }
++      }
+       cpumask_and(pmask, cs->effective_cpus, cpu_online_mask);
+ }
+ 
+diff --git a/kernel/events/core.c b/kernel/events/core.c
+index 12ecd4f0329f..bc6371b0e4fb 100644
+--- a/kernel/events/core.c
++++ b/kernel/events/core.c
+@@ -1539,12 +1539,33 @@ static int __init perf_workqueue_init(void)
+ 
+ core_initcall(perf_workqueue_init);
+ 
+-static inline int pmu_filter_match(struct perf_event *event)
++static inline int __pmu_filter_match(struct perf_event *event)
+ {
+       struct pmu *pmu = event->pmu;
+       return pmu->filter_match ? pmu->filter_match(event) : 1;
+ }
+ 
++/*
++ * Check whether we should attempt to schedule an event group based on
++ * PMU-specific filtering. An event group can consist of HW and SW events,
++ * potentially with a SW leader, so we must check all the filters, to
++ * determine whether a group is schedulable:
++ */
++static inline int pmu_filter_match(struct perf_event *event)
++{
++      struct perf_event *child;
++
++      if (!__pmu_filter_match(event))
++              return 0;
++
++      list_for_each_entry(child, &event->sibling_list, group_entry) {
++              if (!__pmu_filter_match(child))
++                      return 0;
++      }
++
++      return 1;
++}
++
+ static inline int
+ event_filter_match(struct perf_event *event)
+ {
+diff --git a/kernel/fork.c b/kernel/fork.c
+index 8860d1f50d24..7161ebe67cbb 100644
+--- a/kernel/fork.c
++++ b/kernel/fork.c
+@@ -901,14 +901,12 @@ void mm_release(struct task_struct *tsk, struct 
mm_struct *mm)
+       deactivate_mm(tsk, mm);
+ 
+       /*
+-       * If we're exiting normally, clear a user-space tid field if
+-       * requested.  We leave this alone when dying by signal, to leave
+-       * the value intact in a core dump, and to save the unnecessary
+-       * trouble, say, a killed vfork parent shouldn't touch this mm.
+-       * Userland only wants this done for a sys_exit.
++       * Signal userspace if we're not exiting with a core dump
++       * because we want to leave the value intact for debugging
++       * purposes.
+        */
+       if (tsk->clear_child_tid) {
+-              if (!(tsk->flags & PF_SIGNALED) &&
++              if (!(tsk->signal->flags & SIGNAL_GROUP_COREDUMP) &&
+                   atomic_read(&mm->mm_users) > 1) {
+                       /*
+                        * We don't check the error code - if userspace has
+diff --git a/kernel/printk/braille.c b/kernel/printk/braille.c
+index 276762f3a460..d5760c42f042 100644
+--- a/kernel/printk/braille.c
++++ b/kernel/printk/braille.c
+@@ -9,10 +9,10 @@
+ 
+ char *_braille_console_setup(char **str, char **brl_options)
+ {
+-      if (!memcmp(*str, "brl,", 4)) {
++      if (!strncmp(*str, "brl,", 4)) {
+               *brl_options = "";
+               *str += 4;
+-      } else if (!memcmp(str, "brl=", 4)) {
++      } else if (!strncmp(*str, "brl=", 4)) {
+               *brl_options = *str + 4;
+               *str = strchr(*brl_options, ',');
+               if (!*str)
+diff --git a/kernel/sysctl.c b/kernel/sysctl.c
+index 2781141a89f9..999e025bf68e 100644
+--- a/kernel/sysctl.c
++++ b/kernel/sysctl.c
+@@ -2051,6 +2051,21 @@ static int do_proc_dointvec_conv(bool *negp, unsigned 
long *lvalp,
+       return 0;
+ }
+ 
++static int do_proc_douintvec_conv(bool *negp, unsigned long *lvalp,
++                               int *valp,
++                               int write, void *data)
++{
++      if (write) {
++              if (*negp)
++                      return -EINVAL;
++              *valp = *lvalp;
++      } else {
++              unsigned int val = *valp;
++              *lvalp = (unsigned long)val;
++      }
++      return 0;
++}
++
+ static const char proc_wspace_sep[] = { ' ', '\t', '\n' };
+ 
+ static int __do_proc_dointvec(void *tbl_data, struct ctl_table *table,
+@@ -2178,8 +2193,27 @@ static int do_proc_dointvec(struct ctl_table *table, 
int write,
+ int proc_dointvec(struct ctl_table *table, int write,
+                    void __user *buffer, size_t *lenp, loff_t *ppos)
+ {
+-    return do_proc_dointvec(table,write,buffer,lenp,ppos,
+-                          NULL,NULL);
++      return do_proc_dointvec(table, write, buffer, lenp, ppos, NULL, NULL);
++}
++
++/**
++ * proc_douintvec - read a vector of unsigned integers
++ * @table: the sysctl table
++ * @write: %TRUE if this is a write to the sysctl file
++ * @buffer: the user buffer
++ * @lenp: the size of the user buffer
++ * @ppos: file position
++ *
++ * Reads/writes up to table->maxlen/sizeof(unsigned int) unsigned integer
++ * values from/to the user buffer, treated as an ASCII string.
++ *
++ * Returns 0 on success.
++ */
++int proc_douintvec(struct ctl_table *table, int write,
++                   void __user *buffer, size_t *lenp, loff_t *ppos)
++{
++      return do_proc_dointvec(table, write, buffer, lenp, ppos,
++                              do_proc_douintvec_conv, NULL);
+ }
+ 
+ /*
+@@ -2792,6 +2826,12 @@ int proc_dointvec(struct ctl_table *table, int write,
+       return -ENOSYS;
+ }
+ 
++int proc_douintvec(struct ctl_table *table, int write,
++                void __user *buffer, size_t *lenp, loff_t *ppos)
++{
++      return -ENOSYS;
++}
++
+ int proc_dointvec_minmax(struct ctl_table *table, int write,
+                   void __user *buffer, size_t *lenp, loff_t *ppos)
+ {
+@@ -2837,6 +2877,7 @@ int proc_doulongvec_ms_jiffies_minmax(struct ctl_table 
*table, int write,
+  * exception granted :-)
+  */
+ EXPORT_SYMBOL(proc_dointvec);
++EXPORT_SYMBOL(proc_douintvec);
+ EXPORT_SYMBOL(proc_dointvec_jiffies);
+ EXPORT_SYMBOL(proc_dointvec_minmax);
+ EXPORT_SYMBOL(proc_dointvec_userhz_jiffies);
+diff --git a/mm/ksm.c b/mm/ksm.c
+index b5cd647daa52..2f028e6d0831 100644
+--- a/mm/ksm.c
++++ b/mm/ksm.c
+@@ -283,7 +283,8 @@ static inline struct rmap_item *alloc_rmap_item(void)
+ {
+       struct rmap_item *rmap_item;
+ 
+-      rmap_item = kmem_cache_zalloc(rmap_item_cache, GFP_KERNEL);
++      rmap_item = kmem_cache_zalloc(rmap_item_cache, GFP_KERNEL |
++                                              __GFP_NORETRY | __GFP_NOWARN);
+       if (rmap_item)
+               ksm_rmap_items++;
+       return rmap_item;
+diff --git a/net/batman-adv/originator.c b/net/batman-adv/originator.c
+index 17851d3aaf22..6282f021ddfb 100644
+--- a/net/batman-adv/originator.c
++++ b/net/batman-adv/originator.c
+@@ -197,18 +197,12 @@ static void batadv_neigh_node_release(struct 
batadv_neigh_node *neigh_node)
+ {
+       struct hlist_node *node_tmp;
+       struct batadv_neigh_ifinfo *neigh_ifinfo;
+-      struct batadv_algo_ops *bao;
+-
+-      bao = neigh_node->orig_node->bat_priv->bat_algo_ops;
+ 
+       hlist_for_each_entry_safe(neigh_ifinfo, node_tmp,
+                                 &neigh_node->ifinfo_list, list) {
+               batadv_neigh_ifinfo_free_ref(neigh_ifinfo);
+       }
+ 
+-      if (bao->bat_neigh_free)
+-              bao->bat_neigh_free(neigh_node);
+-
+       batadv_hardif_free_ref(neigh_node->if_incoming);
+ 
+       kfree_rcu(neigh_node, rcu);
+diff --git a/net/batman-adv/types.h b/net/batman-adv/types.h
+index d260efd70499..cbd347c2e4a5 100644
+--- a/net/batman-adv/types.h
++++ b/net/batman-adv/types.h
+@@ -1136,8 +1136,6 @@ struct batadv_forw_packet {
+  * @bat_neigh_is_equiv_or_better: check if neigh1 is equally good or better
+  *  than neigh2 for their respective outgoing interface from the metric
+  *  prospective
+- * @bat_neigh_free: free the resources allocated by the routing algorithm for 
a
+- *  neigh_node object
+  * @bat_orig_print: print the originator table (optional)
+  * @bat_orig_free: free the resources allocated by the routing algorithm for 
an
+  *  orig_node object
+@@ -1165,7 +1163,6 @@ struct batadv_algo_ops {
+                struct batadv_hard_iface *if_outgoing1,
+                struct batadv_neigh_node *neigh2,
+                struct batadv_hard_iface *if_outgoing2);
+-      void (*bat_neigh_free)(struct batadv_neigh_node *neigh);
+       /* orig_node handling API */
+       void (*bat_orig_print)(struct batadv_priv *priv, struct seq_file *seq,
+                              struct batadv_hard_iface *hard_iface);
+diff --git a/net/netfilter/ipvs/ip_vs_sync.c b/net/netfilter/ipvs/ip_vs_sync.c
+index 803001a45aa1..1b07578bedf3 100644
+--- a/net/netfilter/ipvs/ip_vs_sync.c
++++ b/net/netfilter/ipvs/ip_vs_sync.c
+@@ -1545,7 +1545,8 @@ error:
+ /*
+  *      Set up receiving multicast socket over UDP
+  */
+-static struct socket *make_receive_sock(struct netns_ipvs *ipvs, int id)
++static struct socket *make_receive_sock(struct netns_ipvs *ipvs, int id,
++                                      int ifindex)
+ {
+       /* multicast addr */
+       union ipvs_sockaddr mcast_addr;
+@@ -1566,6 +1567,7 @@ static struct socket *make_receive_sock(struct 
netns_ipvs *ipvs, int id)
+               set_sock_size(sock->sk, 0, result);
+ 
+       get_mcast_sockaddr(&mcast_addr, &salen, &ipvs->bcfg, id);
++      sock->sk->sk_bound_dev_if = ifindex;
+       result = sock->ops->bind(sock, (struct sockaddr *)&mcast_addr, salen);
+       if (result < 0) {
+               pr_err("Error binding to the multicast addr\n");
+@@ -1868,7 +1870,7 @@ int start_sync_thread(struct netns_ipvs *ipvs, struct 
ipvs_sync_daemon_cfg *c,
+               if (state == IP_VS_STATE_MASTER)
+                       sock = make_send_sock(ipvs, id);
+               else
+-                      sock = make_receive_sock(ipvs, id);
++                      sock = make_receive_sock(ipvs, id, dev->ifindex);
+               if (IS_ERR(sock)) {
+                       result = PTR_ERR(sock);
+                       goto outtinfo;
+diff --git a/net/sunrpc/svc.c b/net/sunrpc/svc.c
+index cc9852897395..c5b0cb4f4056 100644
+--- a/net/sunrpc/svc.c
++++ b/net/sunrpc/svc.c
+@@ -1188,11 +1188,17 @@ svc_process_common(struct svc_rqst *rqstp, struct kvec 
*argv, struct kvec *resv)
+               *statp = procp->pc_func(rqstp, rqstp->rq_argp, rqstp->rq_resp);
+ 
+               /* Encode reply */
+-              if (test_bit(RQ_DROPME, &rqstp->rq_flags)) {
++              if (*statp == rpc_drop_reply ||
++                  test_bit(RQ_DROPME, &rqstp->rq_flags)) {
+                       if (procp->pc_release)
+                               procp->pc_release(rqstp, NULL, rqstp->rq_resp);
+                       goto dropit;
+               }
++              if (*statp == rpc_autherr_badcred) {
++                      if (procp->pc_release)
++                              procp->pc_release(rqstp, NULL, rqstp->rq_resp);
++                      goto err_bad_auth;
++              }
+               if (*statp == rpc_success &&
+                   (xdr = procp->pc_encode) &&
+                   !xdr(rqstp, resv->iov_base+resv->iov_len, rqstp->rq_resp)) {
+diff --git a/sound/pci/hda/patch_conexant.c b/sound/pci/hda/patch_conexant.c
+index 600af5878e75..36cd715986bc 100644
+--- a/sound/pci/hda/patch_conexant.c
++++ b/sound/pci/hda/patch_conexant.c
+@@ -261,6 +261,7 @@ enum {
+       CXT_FIXUP_HP_530,
+       CXT_FIXUP_CAP_MIX_AMP_5047,
+       CXT_FIXUP_MUTE_LED_EAPD,
++      CXT_FIXUP_HP_SPECTRE,
+ };
+ 
+ /* for hda_fixup_thinkpad_acpi() */
+@@ -765,6 +766,14 @@ static const struct hda_fixup cxt_fixups[] = {
+               .type = HDA_FIXUP_FUNC,
+               .v.func = cxt_fixup_mute_led_eapd,
+       },
++      [CXT_FIXUP_HP_SPECTRE] = {
++              .type = HDA_FIXUP_PINS,
++              .v.pins = (const struct hda_pintbl[]) {
++                      /* enable NID 0x1d for the speaker on top */
++                      { 0x1d, 0x91170111 },
++                      { }
++              }
++      },
+ };
+ 
+ static const struct snd_pci_quirk cxt5045_fixups[] = {
+@@ -814,6 +823,7 @@ static const struct snd_pci_quirk cxt5066_fixups[] = {
+       SND_PCI_QUIRK(0x1025, 0x0543, "Acer Aspire One 522", 
CXT_FIXUP_STEREO_DMIC),
+       SND_PCI_QUIRK(0x1025, 0x054c, "Acer Aspire 3830TG", 
CXT_FIXUP_ASPIRE_DMIC),
+       SND_PCI_QUIRK(0x1025, 0x054f, "Acer Aspire 4830T", 
CXT_FIXUP_ASPIRE_DMIC),
++      SND_PCI_QUIRK(0x103c, 0x8174, "HP Spectre x360", CXT_FIXUP_HP_SPECTRE),
+       SND_PCI_QUIRK(0x1043, 0x138d, "Asus", CXT_FIXUP_HEADPHONE_MIC_PIN),
+       SND_PCI_QUIRK(0x152d, 0x0833, "OLPC XO-1.5", CXT_FIXUP_OLPC_XO),
+       SND_PCI_QUIRK(0x17aa, 0x20f2, "Lenovo T400", CXT_PINCFG_LENOVO_TP410),
+diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
+index eaee626ab185..b1fa50aed888 100644
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -5790,6 +5790,13 @@ static const struct hda_model_fixup 
alc269_fixup_models[] = {
+       {0x14, 0x90170110}, \
+       {0x15, 0x0221401f}
+ 
++#define ALC295_STANDARD_PINS \
++      {0x12, 0xb7a60130}, \
++      {0x14, 0x90170110}, \
++      {0x17, 0x21014020}, \
++      {0x18, 0x21a19030}, \
++      {0x21, 0x04211020}
++
+ #define ALC298_STANDARD_PINS \
+       {0x12, 0x90a60130}, \
+       {0x21, 0x03211020}
+@@ -5830,6 +5837,10 @@ static const struct snd_hda_pin_quirk 
alc269_pin_fixup_tbl[] = {
+               {0x14, 0x90170120},
+               {0x21, 0x02211030}),
+       SND_HDA_PIN_QUIRK(0x10ec0255, 0x1028, "Dell", 
ALC255_FIXUP_DELL1_MIC_NO_PRESENCE,
++              {0x14, 0x90170110},
++              {0x1b, 0x02011020},
++              {0x21, 0x0221101f}),
++      SND_HDA_PIN_QUIRK(0x10ec0255, 0x1028, "Dell", 
ALC255_FIXUP_DELL1_MIC_NO_PRESENCE,
+               {0x14, 0x90170130},
+               {0x1b, 0x01014020},
+               {0x21, 0x0221103f}),
+@@ -5895,6 +5906,10 @@ static const struct snd_hda_pin_quirk 
alc269_pin_fixup_tbl[] = {
+               {0x14, 0x90170120},
+               {0x21, 0x02211030}),
+       SND_HDA_PIN_QUIRK(0x10ec0256, 0x1028, "Dell", 
ALC255_FIXUP_DELL1_MIC_NO_PRESENCE,
++              {0x12, 0xb7a60130},
++              {0x14, 0x90170110},
++              {0x21, 0x02211020}),
++      SND_HDA_PIN_QUIRK(0x10ec0256, 0x1028, "Dell", 
ALC255_FIXUP_DELL1_MIC_NO_PRESENCE,
+               ALC256_STANDARD_PINS),
+       SND_HDA_PIN_QUIRK(0x10ec0280, 0x103c, "HP", ALC280_FIXUP_HP_GPIO4,
+               {0x12, 0x90a60130},
+@@ -6005,6 +6020,8 @@ static const struct snd_hda_pin_quirk 
alc269_pin_fixup_tbl[] = {
+       SND_HDA_PIN_QUIRK(0x10ec0293, 0x1028, "Dell", 
ALC293_FIXUP_DELL1_MIC_NO_PRESENCE,
+               ALC292_STANDARD_PINS,
+               {0x13, 0x90a60140}),
++      SND_HDA_PIN_QUIRK(0x10ec0295, 0x1028, "Dell", 
ALC269_FIXUP_DELL1_MIC_NO_PRESENCE,
++              ALC295_STANDARD_PINS),
+       SND_HDA_PIN_QUIRK(0x10ec0298, 0x1028, "Dell", 
ALC298_FIXUP_DELL1_MIC_NO_PRESENCE,
+               ALC298_STANDARD_PINS,
+               {0x17, 0x90170110}),
+diff --git a/sound/soc/intel/skylake/skl.c b/sound/soc/intel/skylake/skl.c
+index caa69c4598a6..b4844f78266f 100644
+--- a/sound/soc/intel/skylake/skl.c
++++ b/sound/soc/intel/skylake/skl.c
+@@ -464,8 +464,10 @@ static int skl_probe(struct pci_dev *pci,
+ 
+       skl->nhlt = skl_nhlt_init(bus->dev);
+ 
+-      if (skl->nhlt == NULL)
++      if (skl->nhlt == NULL) {
++              err = -ENODEV;
+               goto out_free;
++      }
+ 
+       pci_set_drvdata(skl->pci, ebus);
+ 
+diff --git a/sound/soc/omap/omap-mcpdm.c b/sound/soc/omap/omap-mcpdm.c
+index b837265ac3e9..8d0d45d330e7 100644
+--- a/sound/soc/omap/omap-mcpdm.c
++++ b/sound/soc/omap/omap-mcpdm.c
+@@ -390,8 +390,8 @@ static int omap_mcpdm_probe(struct snd_soc_dai *dai)
+       pm_runtime_get_sync(mcpdm->dev);
+       omap_mcpdm_write(mcpdm, MCPDM_REG_CTRL, 0x00);
+ 
+-      ret = devm_request_irq(mcpdm->dev, mcpdm->irq, omap_mcpdm_irq_handler,
+-                              0, "McPDM", (void *)mcpdm);
++      ret = request_irq(mcpdm->irq, omap_mcpdm_irq_handler, 0, "McPDM",
++                        (void *)mcpdm);
+ 
+       pm_runtime_put_sync(mcpdm->dev);
+ 
+@@ -416,6 +416,7 @@ static int omap_mcpdm_remove(struct snd_soc_dai *dai)
+ {
+       struct omap_mcpdm *mcpdm = snd_soc_dai_get_drvdata(dai);
+ 
++      free_irq(mcpdm->irq, (void *)mcpdm);
+       pm_runtime_disable(mcpdm->dev);
+ 
+       return 0;
+diff --git a/tools/vm/slabinfo.c b/tools/vm/slabinfo.c
+index 86e698d07e20..499b8819d4c6 100644
+--- a/tools/vm/slabinfo.c
++++ b/tools/vm/slabinfo.c
+@@ -510,10 +510,11 @@ static void slab_stats(struct slabinfo *s)
+                       s->alloc_node_mismatch, (s->alloc_node_mismatch * 100) 
/ total);
+       }
+ 
+-      if (s->cmpxchg_double_fail || s->cmpxchg_double_cpu_fail)
++      if (s->cmpxchg_double_fail || s->cmpxchg_double_cpu_fail) {
+               printf("\nCmpxchg_double Looping\n------------------------\n");
+               printf("Locked Cmpxchg Double redos   %lu\nUnlocked Cmpxchg 
Double redos %lu\n",
+                       s->cmpxchg_double_fail, s->cmpxchg_double_cpu_fail);
++      }
+ }
+ 
+ static void report(struct slabinfo *s)
diff --git a/debian/patches/series b/debian/patches/series
index 802a829..d50a729 100644
--- a/debian/patches/series
+++ b/debian/patches/series
@@ -124,3 +124,4 @@
 bugfix/all/stable-4.4.21.patch
 bugfix/all/stable-4.4.22.patch
 bugfix/all/stable-4.4.23.patch
+bugfix/all/stable-4.4.24.patch

-- 
To view, visit https://gerrit.wikimedia.org/r/315215
To unsubscribe, visit https://gerrit.wikimedia.org/r/settings

Gerrit-MessageType: newchange
Gerrit-Change-Id: I9bb2e5a9367752b95c47ba55beeb13e6c521b339
Gerrit-PatchSet: 1
Gerrit-Project: operations/debs/linux44
Gerrit-Branch: master
Gerrit-Owner: Muehlenhoff <mmuhlenh...@wikimedia.org>

_______________________________________________
MediaWiki-commits mailing list
MediaWiki-commits@lists.wikimedia.org
https://lists.wikimedia.org/mailman/listinfo/mediawiki-commits

Reply via email to