From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from lists.gentoo.org (pigeon.gentoo.org [208.92.234.80]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by finch.gentoo.org (Postfix) with ESMTPS id 536571382C5 for ; Tue, 23 Jan 2018 09:37:57 +0000 (UTC) Received: from pigeon.gentoo.org (localhost [127.0.0.1]) by pigeon.gentoo.org (Postfix) with SMTP id ABE26E097E; Tue, 23 Jan 2018 09:37:56 +0000 (UTC) Received: from smtp.gentoo.org (smtp.gentoo.org [140.211.166.183]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by pigeon.gentoo.org (Postfix) with ESMTPS id 5A103E097E for ; Tue, 23 Jan 2018 09:37:56 +0000 (UTC) Received: from oystercatcher.gentoo.org (unknown [IPv6:2a01:4f8:202:4333:225:90ff:fed9:fc84]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.gentoo.org (Postfix) with ESMTPS id B5E29335C36 for ; Tue, 23 Jan 2018 09:37:54 +0000 (UTC) Received: from localhost.localdomain (localhost [IPv6:::1]) by oystercatcher.gentoo.org (Postfix) with ESMTP id 52CD115D for ; Tue, 23 Jan 2018 09:37:53 +0000 (UTC) From: "Alice Ferrazzi" To: gentoo-commits@lists.gentoo.org Content-Transfer-Encoding: 8bit Content-type: text/plain; charset=UTF-8 Reply-To: gentoo-dev@lists.gentoo.org, "Alice Ferrazzi" Message-ID: <1516700259.e50c7e98641a337aac5975ac6fe0fe00036b9714.alicef@gentoo> Subject: [gentoo-commits] proj/linux-patches:4.1 commit in: / X-VCS-Repository: proj/linux-patches X-VCS-Files: 0000_README 1048_linux-4.1.49.patch X-VCS-Directories: / X-VCS-Committer: alicef X-VCS-Committer-Name: Alice Ferrazzi X-VCS-Revision: e50c7e98641a337aac5975ac6fe0fe00036b9714 X-VCS-Branch: 4.1 Date: Tue, 23 Jan 2018 09:37:53 +0000 (UTC) Precedence: bulk List-Post: List-Help: List-Unsubscribe: List-Subscribe: List-Id: Gentoo Linux mail X-BeenThere: gentoo-commits@lists.gentoo.org X-Archives-Salt: ef540987-249e-46de-9609-a42b321a5c89 X-Archives-Hash: a54e21aabfce3116d11500a90fb59944 commit: e50c7e98641a337aac5975ac6fe0fe00036b9714 Author: Alice Ferrazzi gentoo org> AuthorDate: Tue Jan 23 09:37:39 2018 +0000 Commit: Alice Ferrazzi gentoo org> CommitDate: Tue Jan 23 09:37:39 2018 +0000 URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=e50c7e98 linux kernel 4.1.49 0000_README | 4 + 1048_linux-4.1.49.patch | 8523 +++++++++++++++++++++++++++++++++++++++++++++++ 2 files changed, 8527 insertions(+) diff --git a/0000_README b/0000_README index 1b3166c..3abfafc 100644 --- a/0000_README +++ b/0000_README @@ -235,6 +235,10 @@ Patch: 1047_linux-4.1.48.patch From: http://www.kernel.org Desc: Linux 4.1.48 +Patch: 1048_linux-4.1.49.patch +From: http://www.kernel.org +Desc: Linux 4.1.49 + Patch: 1500_XATTR_USER_PREFIX.patch From: https://bugs.gentoo.org/show_bug.cgi?id=470644 Desc: Support for namespace user.pax.* on tmpfs. diff --git a/1048_linux-4.1.49.patch b/1048_linux-4.1.49.patch new file mode 100644 index 0000000..702661c --- /dev/null +++ b/1048_linux-4.1.49.patch @@ -0,0 +1,8523 @@ +diff --git a/Makefile b/Makefile +index 97edf556bfe4..a51938e99e37 100644 +--- a/Makefile ++++ b/Makefile +@@ -1,6 +1,6 @@ + VERSION = 4 + PATCHLEVEL = 1 +-SUBLEVEL = 48 ++SUBLEVEL = 49 + EXTRAVERSION = + NAME = Series 4800 + +@@ -612,6 +612,10 @@ include arch/$(SRCARCH)/Makefile + KBUILD_CFLAGS += $(call cc-option,-fno-delete-null-pointer-checks,) + KBUILD_CFLAGS += $(call cc-option,-fno-PIE) + KBUILD_AFLAGS += $(call cc-option,-fno-PIE) ++KBUILD_CFLAGS += $(call cc-disable-warning,frame-address,) ++KBUILD_CFLAGS += $(call cc-disable-warning, format-truncation) ++KBUILD_CFLAGS += $(call cc-disable-warning, format-overflow) ++KBUILD_CFLAGS += $(call cc-disable-warning, int-in-bool-context) + + ifdef CONFIG_CC_OPTIMIZE_FOR_SIZE + KBUILD_CFLAGS += -Os $(call cc-disable-warning,maybe-uninitialized,) +diff --git a/arch/arm/include/asm/floppy.h b/arch/arm/include/asm/floppy.h +index f4882553fbb0..85a34cc8316a 100644 +--- a/arch/arm/include/asm/floppy.h ++++ b/arch/arm/include/asm/floppy.h +@@ -17,7 +17,7 @@ + + #define fd_outb(val,port) \ + do { \ +- if ((port) == FD_DOR) \ ++ if ((port) == (u32)FD_DOR) \ + fd_setdor((val)); \ + else \ + outb((val),(port)); \ +diff --git a/arch/arm/include/asm/kvm_arm.h b/arch/arm/include/asm/kvm_arm.h +index d995821f1698..aacd6668d1a0 100644 +--- a/arch/arm/include/asm/kvm_arm.h ++++ b/arch/arm/include/asm/kvm_arm.h +@@ -209,6 +209,7 @@ + #define HSR_EC_IABT_HYP (0x21) + #define HSR_EC_DABT (0x24) + #define HSR_EC_DABT_HYP (0x25) ++#define HSR_EC_MAX (0x3f) + + #define HSR_WFI_IS_WFE (1U << 0) + +diff --git a/arch/arm/kvm/handle_exit.c b/arch/arm/kvm/handle_exit.c +index 95f12b2ccdcb..f36b5b1acd1f 100644 +--- a/arch/arm/kvm/handle_exit.c ++++ b/arch/arm/kvm/handle_exit.c +@@ -100,7 +100,19 @@ static int kvm_handle_wfx(struct kvm_vcpu *vcpu, struct kvm_run *run) + return 1; + } + ++static int kvm_handle_unknown_ec(struct kvm_vcpu *vcpu, struct kvm_run *run) ++{ ++ u32 hsr = kvm_vcpu_get_hsr(vcpu); ++ ++ kvm_pr_unimpl("Unknown exception class: hsr: %#08x\n", ++ hsr); ++ ++ kvm_inject_undefined(vcpu); ++ return 1; ++} ++ + static exit_handle_fn arm_exit_handlers[] = { ++ [0 ... HSR_EC_MAX] = kvm_handle_unknown_ec, + [HSR_EC_WFI] = kvm_handle_wfx, + [HSR_EC_CP15_32] = kvm_handle_cp15_32, + [HSR_EC_CP15_64] = kvm_handle_cp15_64, +@@ -122,13 +134,6 @@ static exit_handle_fn kvm_get_exit_handler(struct kvm_vcpu *vcpu) + { + u8 hsr_ec = kvm_vcpu_trap_get_class(vcpu); + +- if (hsr_ec >= ARRAY_SIZE(arm_exit_handlers) || +- !arm_exit_handlers[hsr_ec]) { +- kvm_err("Unknown exception class: hsr: %#08x\n", +- (unsigned int)kvm_vcpu_get_hsr(vcpu)); +- BUG(); +- } +- + return arm_exit_handlers[hsr_ec]; + } + +diff --git a/arch/arm/mach-omap1/dma.c b/arch/arm/mach-omap1/dma.c +index 4be601b638d7..8129e5f9c94d 100644 +--- a/arch/arm/mach-omap1/dma.c ++++ b/arch/arm/mach-omap1/dma.c +@@ -31,7 +31,6 @@ + #include + + #define OMAP1_DMA_BASE (0xfffed800) +-#define OMAP1_LOGICAL_DMA_CH_COUNT 17 + + static u32 enable_1510_mode; + +@@ -311,8 +310,6 @@ static int __init omap1_system_dma_init(void) + goto exit_iounmap; + } + +- d->lch_count = OMAP1_LOGICAL_DMA_CH_COUNT; +- + /* Valid attributes for omap1 plus processors */ + if (cpu_is_omap15xx()) + d->dev_caps = ENABLE_1510_MODE; +@@ -329,13 +326,14 @@ static int __init omap1_system_dma_init(void) + d->dev_caps |= CLEAR_CSR_ON_READ; + d->dev_caps |= IS_WORD_16; + +- if (cpu_is_omap15xx()) +- d->chan_count = 9; +- else if (cpu_is_omap16xx() || cpu_is_omap7xx()) { +- if (!(d->dev_caps & ENABLE_1510_MODE)) +- d->chan_count = 16; ++ /* available logical channels */ ++ if (cpu_is_omap15xx()) { ++ d->lch_count = 9; ++ } else { ++ if (d->dev_caps & ENABLE_1510_MODE) ++ d->lch_count = 9; + else +- d->chan_count = 9; ++ d->lch_count = 16; + } + + p = dma_plat_info; +diff --git a/arch/arm/mach-omap2/gpmc-onenand.c b/arch/arm/mach-omap2/gpmc-onenand.c +index f899e77ff5e6..a9e7733f3c70 100644 +--- a/arch/arm/mach-omap2/gpmc-onenand.c ++++ b/arch/arm/mach-omap2/gpmc-onenand.c +@@ -363,7 +363,7 @@ static int gpmc_onenand_setup(void __iomem *onenand_base, int *freq_ptr) + return ret; + } + +-void gpmc_onenand_init(struct omap_onenand_platform_data *_onenand_data) ++int gpmc_onenand_init(struct omap_onenand_platform_data *_onenand_data) + { + int err; + struct device *dev = &gpmc_onenand_device.dev; +@@ -389,15 +389,17 @@ void gpmc_onenand_init(struct omap_onenand_platform_data *_onenand_data) + if (err < 0) { + dev_err(dev, "Cannot request GPMC CS %d, error %d\n", + gpmc_onenand_data->cs, err); +- return; ++ return err; + } + + gpmc_onenand_resource.end = gpmc_onenand_resource.start + + ONENAND_IO_SIZE - 1; + +- if (platform_device_register(&gpmc_onenand_device) < 0) { ++ err = platform_device_register(&gpmc_onenand_device); ++ if (err) { + dev_err(dev, "Unable to register OneNAND device\n"); + gpmc_cs_free(gpmc_onenand_data->cs); +- return; + } ++ ++ return err; + } +diff --git a/arch/arm/mach-ux500/pm.c b/arch/arm/mach-ux500/pm.c +index 2cb587b50905..7ae4f94db1e8 100644 +--- a/arch/arm/mach-ux500/pm.c ++++ b/arch/arm/mach-ux500/pm.c +@@ -132,8 +132,8 @@ bool prcmu_pending_irq(void) + */ + bool prcmu_is_cpu_in_wfi(int cpu) + { +- return readl(PRCM_ARM_WFI_STANDBY) & cpu ? PRCM_ARM_WFI_STANDBY_WFI1 : +- PRCM_ARM_WFI_STANDBY_WFI0; ++ return readl(PRCM_ARM_WFI_STANDBY) & ++ (cpu ? PRCM_ARM_WFI_STANDBY_WFI1 : PRCM_ARM_WFI_STANDBY_WFI0); + } + + /* +diff --git a/arch/arm64/include/asm/kvm_arm.h b/arch/arm64/include/asm/kvm_arm.h +index ac6fafb95fe7..4b695bfbb7fd 100644 +--- a/arch/arm64/include/asm/kvm_arm.h ++++ b/arch/arm64/include/asm/kvm_arm.h +@@ -162,8 +162,7 @@ + #define VTTBR_X (37 - VTCR_EL2_T0SZ_40B) + #endif + +-#define VTTBR_BADDR_SHIFT (VTTBR_X - 1) +-#define VTTBR_BADDR_MASK (((UL(1) << (PHYS_MASK_SHIFT - VTTBR_X)) - 1) << VTTBR_BADDR_SHIFT) ++#define VTTBR_BADDR_MASK (((UL(1) << (PHYS_MASK_SHIFT - VTTBR_X)) - 1) << VTTBR_X) + #define VTTBR_VMID_SHIFT (UL(48)) + #define VTTBR_VMID_MASK (UL(0xFF) << VTTBR_VMID_SHIFT) + +diff --git a/arch/arm64/include/asm/uaccess.h b/arch/arm64/include/asm/uaccess.h +index 4849baa914d8..8f65f969f51c 100644 +--- a/arch/arm64/include/asm/uaccess.h ++++ b/arch/arm64/include/asm/uaccess.h +@@ -21,6 +21,7 @@ + /* + * User space memory access functions + */ ++#include + #include + #include + +@@ -100,6 +101,13 @@ static inline void set_fs(mm_segment_t fs) + flag; \ + }) + ++/* ++ * When dealing with data aborts, watchpoints, or instruction traps we may end ++ * up with a tagged userland pointer. Clear the tag to get a sane pointer to ++ * pass on to access_ok(), for instance. ++ */ ++#define untagged_addr(addr) sign_extend64(addr, 55) ++ + #define access_ok(type, addr, size) __range_ok(addr, size) + #define user_addr_max get_fs + +diff --git a/arch/arm64/kernel/hw_breakpoint.c b/arch/arm64/kernel/hw_breakpoint.c +index e7d934d3afe0..30f92321c00f 100644 +--- a/arch/arm64/kernel/hw_breakpoint.c ++++ b/arch/arm64/kernel/hw_breakpoint.c +@@ -35,6 +35,7 @@ + #include + #include + #include ++#include + + /* Breakpoint currently in use for each BRP. */ + static DEFINE_PER_CPU(struct perf_event *, bp_on_reg[ARM_MAX_BRP]); +@@ -688,7 +689,7 @@ static int watchpoint_handler(unsigned long addr, unsigned int esr, + + /* Check if the watchpoint value matches. */ + val = read_wb_reg(AARCH64_DBG_REG_WVR, i); +- if (val != (addr & ~alignment_mask)) ++ if (val != (untagged_addr(addr) & ~alignment_mask)) + goto unlock; + + /* Possible match, check the byte address select to confirm. */ +diff --git a/arch/arm64/kernel/process.c b/arch/arm64/kernel/process.c +index c6b1f3b96f45..a838d628cff7 100644 +--- a/arch/arm64/kernel/process.c ++++ b/arch/arm64/kernel/process.c +@@ -258,6 +258,15 @@ int copy_thread(unsigned long clone_flags, unsigned long stack_start, + + memset(&p->thread.cpu_context, 0, sizeof(struct cpu_context)); + ++ /* ++ * In case p was allocated the same task_struct pointer as some ++ * other recently-exited task, make sure p is disassociated from ++ * any cpu that may have run that now-exited task recently. ++ * Otherwise we could erroneously skip reloading the FPSIMD ++ * registers for p. ++ */ ++ fpsimd_flush_task_state(p); ++ + if (likely(!(p->flags & PF_KTHREAD))) { + *childregs = *current_pt_regs(); + childregs->regs[0] = 0; +diff --git a/arch/blackfin/Kconfig b/arch/blackfin/Kconfig +index af76634f8d98..934573cc1134 100644 +--- a/arch/blackfin/Kconfig ++++ b/arch/blackfin/Kconfig +@@ -318,11 +318,14 @@ config BF53x + + config GPIO_ADI + def_bool y ++ depends on !PINCTRL + depends on (BF51x || BF52x || BF53x || BF538 || BF539 || BF561) + +-config PINCTRL ++config PINCTRL_BLACKFIN_ADI2 + def_bool y +- depends on BF54x || BF60x ++ depends on (BF54x || BF60x) ++ select PINCTRL ++ select PINCTRL_ADI2 + + config MEM_MT48LC64M4A2FB_7E + bool +diff --git a/arch/blackfin/Kconfig.debug b/arch/blackfin/Kconfig.debug +index f3337ee03621..a93cf06a4d6f 100644 +--- a/arch/blackfin/Kconfig.debug ++++ b/arch/blackfin/Kconfig.debug +@@ -17,6 +17,7 @@ config DEBUG_VERBOSE + + config DEBUG_MMRS + tristate "Generate Blackfin MMR tree" ++ depends on !PINCTRL + select DEBUG_FS + help + Create a tree of Blackfin MMRs via the debugfs tree. If +diff --git a/arch/c6x/kernel/ptrace.c b/arch/c6x/kernel/ptrace.c +index 3c494e84444d..a511ac16a8e3 100644 +--- a/arch/c6x/kernel/ptrace.c ++++ b/arch/c6x/kernel/ptrace.c +@@ -69,46 +69,6 @@ static int gpr_get(struct task_struct *target, + 0, sizeof(*regs)); + } + +-static int gpr_set(struct task_struct *target, +- const struct user_regset *regset, +- unsigned int pos, unsigned int count, +- const void *kbuf, const void __user *ubuf) +-{ +- int ret; +- struct pt_regs *regs = task_pt_regs(target); +- +- /* Don't copyin TSR or CSR */ +- ret = user_regset_copyin(&pos, &count, &kbuf, &ubuf, +- ®s, +- 0, PT_TSR * sizeof(long)); +- if (ret) +- return ret; +- +- ret = user_regset_copyin_ignore(&pos, &count, &kbuf, &ubuf, +- PT_TSR * sizeof(long), +- (PT_TSR + 1) * sizeof(long)); +- if (ret) +- return ret; +- +- ret = user_regset_copyin(&pos, &count, &kbuf, &ubuf, +- ®s, +- (PT_TSR + 1) * sizeof(long), +- PT_CSR * sizeof(long)); +- if (ret) +- return ret; +- +- ret = user_regset_copyin_ignore(&pos, &count, &kbuf, &ubuf, +- PT_CSR * sizeof(long), +- (PT_CSR + 1) * sizeof(long)); +- if (ret) +- return ret; +- +- ret = user_regset_copyin(&pos, &count, &kbuf, &ubuf, +- ®s, +- (PT_CSR + 1) * sizeof(long), -1); +- return ret; +-} +- + enum c6x_regset { + REGSET_GPR, + }; +@@ -120,7 +80,6 @@ static const struct user_regset c6x_regsets[] = { + .size = sizeof(u32), + .align = sizeof(u32), + .get = gpr_get, +- .set = gpr_set + }, + }; + +diff --git a/arch/metag/kernel/ptrace.c b/arch/metag/kernel/ptrace.c +index 7563628822bd..5e2dc7defd2c 100644 +--- a/arch/metag/kernel/ptrace.c ++++ b/arch/metag/kernel/ptrace.c +@@ -24,6 +24,16 @@ + * user_regset definitions. + */ + ++static unsigned long user_txstatus(const struct pt_regs *regs) ++{ ++ unsigned long data = (unsigned long)regs->ctx.Flags; ++ ++ if (regs->ctx.SaveMask & TBICTX_CBUF_BIT) ++ data |= USER_GP_REGS_STATUS_CATCH_BIT; ++ ++ return data; ++} ++ + int metag_gp_regs_copyout(const struct pt_regs *regs, + unsigned int pos, unsigned int count, + void *kbuf, void __user *ubuf) +@@ -62,9 +72,7 @@ int metag_gp_regs_copyout(const struct pt_regs *regs, + if (ret) + goto out; + /* TXSTATUS */ +- data = (unsigned long)regs->ctx.Flags; +- if (regs->ctx.SaveMask & TBICTX_CBUF_BIT) +- data |= USER_GP_REGS_STATUS_CATCH_BIT; ++ data = user_txstatus(regs); + ret = user_regset_copyout(&pos, &count, &kbuf, &ubuf, + &data, 4*25, 4*26); + if (ret) +@@ -119,6 +127,7 @@ int metag_gp_regs_copyin(struct pt_regs *regs, + if (ret) + goto out; + /* TXSTATUS */ ++ data = user_txstatus(regs); + ret = user_regset_copyin(&pos, &count, &kbuf, &ubuf, + &data, 4*25, 4*26); + if (ret) +@@ -244,6 +253,8 @@ int metag_rp_state_copyin(struct pt_regs *regs, + unsigned long long *ptr; + int ret, i; + ++ if (count < 4*13) ++ return -EINVAL; + /* Read the entire pipeline before making any changes */ + ret = user_regset_copyin(&pos, &count, &kbuf, &ubuf, + &rp, 0, 4*13); +@@ -303,7 +314,7 @@ static int metag_tls_set(struct task_struct *target, + const void *kbuf, const void __user *ubuf) + { + int ret; +- void __user *tls; ++ void __user *tls = target->thread.tls_ptr; + + ret = user_regset_copyin(&pos, &count, &kbuf, &ubuf, &tls, 0, -1); + if (ret) +diff --git a/arch/mips/configs/ip27_defconfig b/arch/mips/configs/ip27_defconfig +index 48e16d98b2cc..6ecc67f3736b 100644 +--- a/arch/mips/configs/ip27_defconfig ++++ b/arch/mips/configs/ip27_defconfig +@@ -206,7 +206,6 @@ CONFIG_MLX4_EN=m + # CONFIG_MLX4_DEBUG is not set + CONFIG_TEHUTI=m + CONFIG_BNX2X=m +-CONFIG_QLGE=m + CONFIG_SFC=m + CONFIG_BE2NET=m + CONFIG_LIBERTAS_THINFIRM=m +diff --git a/arch/mips/dec/int-handler.S b/arch/mips/dec/int-handler.S +index 8c6f508e59de..554d1da97743 100644 +--- a/arch/mips/dec/int-handler.S ++++ b/arch/mips/dec/int-handler.S +@@ -146,7 +146,25 @@ + /* + * Find irq with highest priority + */ +- PTR_LA t1,cpu_mask_nr_tbl ++ # open coded PTR_LA t1, cpu_mask_nr_tbl ++#if (_MIPS_SZPTR == 32) ++ # open coded la t1, cpu_mask_nr_tbl ++ lui t1, %hi(cpu_mask_nr_tbl) ++ addiu t1, %lo(cpu_mask_nr_tbl) ++ ++#endif ++#if (_MIPS_SZPTR == 64) ++ # open coded dla t1, cpu_mask_nr_tbl ++ .set push ++ .set noat ++ lui t1, %highest(cpu_mask_nr_tbl) ++ lui AT, %hi(cpu_mask_nr_tbl) ++ daddiu t1, t1, %higher(cpu_mask_nr_tbl) ++ daddiu AT, AT, %lo(cpu_mask_nr_tbl) ++ dsll t1, 32 ++ daddu t1, t1, AT ++ .set pop ++#endif + 1: lw t2,(t1) + nop + and t2,t0 +@@ -195,7 +213,25 @@ + /* + * Find irq with highest priority + */ +- PTR_LA t1,asic_mask_nr_tbl ++ # open coded PTR_LA t1,asic_mask_nr_tbl ++#if (_MIPS_SZPTR == 32) ++ # open coded la t1, asic_mask_nr_tbl ++ lui t1, %hi(asic_mask_nr_tbl) ++ addiu t1, %lo(asic_mask_nr_tbl) ++ ++#endif ++#if (_MIPS_SZPTR == 64) ++ # open coded dla t1, asic_mask_nr_tbl ++ .set push ++ .set noat ++ lui t1, %highest(asic_mask_nr_tbl) ++ lui AT, %hi(asic_mask_nr_tbl) ++ daddiu t1, t1, %higher(asic_mask_nr_tbl) ++ daddiu AT, AT, %lo(asic_mask_nr_tbl) ++ dsll t1, 32 ++ daddu t1, t1, AT ++ .set pop ++#endif + 2: lw t2,(t1) + nop + and t2,t0 +diff --git a/arch/mips/kernel/ptrace.c b/arch/mips/kernel/ptrace.c +index 81a13fd56d13..2bea5db01b0b 100644 +--- a/arch/mips/kernel/ptrace.c ++++ b/arch/mips/kernel/ptrace.c +@@ -484,7 +484,8 @@ static int fpr_set(struct task_struct *target, + &target->thread.fpu, + 0, sizeof(elf_fpregset_t)); + +- for (i = 0; i < NUM_FPU_REGS; i++) { ++ BUILD_BUG_ON(sizeof(fpr_val) != sizeof(elf_fpreg_t)); ++ for (i = 0; i < NUM_FPU_REGS && count >= sizeof(elf_fpreg_t); i++) { + err = user_regset_copyin(&pos, &count, &kbuf, &ubuf, + &fpr_val, i * sizeof(elf_fpreg_t), + (i + 1) * sizeof(elf_fpreg_t)); +diff --git a/arch/mips/lantiq/irq.c b/arch/mips/lantiq/irq.c +index d01ade63492f..7e2279ac6c0d 100644 +--- a/arch/mips/lantiq/irq.c ++++ b/arch/mips/lantiq/irq.c +@@ -269,6 +269,11 @@ static void ltq_hw5_irqdispatch(void) + DEFINE_HWx_IRQDISPATCH(5) + #endif + ++static void ltq_hw_irq_handler(struct irq_desc *desc) ++{ ++ ltq_hw_irqdispatch(irq_desc_get_irq(desc) - 2); ++} ++ + #ifdef CONFIG_MIPS_MT_SMP + void __init arch_init_ipiirq(int irq, struct irqaction *action) + { +@@ -313,23 +318,19 @@ static struct irqaction irq_call = { + asmlinkage void plat_irq_dispatch(void) + { + unsigned int pending = read_c0_status() & read_c0_cause() & ST0_IM; +- unsigned int i; +- +- if ((MIPS_CPU_TIMER_IRQ == 7) && (pending & CAUSEF_IP7)) { +- do_IRQ(MIPS_CPU_TIMER_IRQ); +- goto out; +- } else { +- for (i = 0; i < MAX_IM; i++) { +- if (pending & (CAUSEF_IP2 << i)) { +- ltq_hw_irqdispatch(i); +- goto out; +- } +- } ++ int irq; ++ ++ if (!pending) { ++ spurious_interrupt(); ++ return; + } +- pr_alert("Spurious IRQ: CAUSE=0x%08x\n", read_c0_status()); + +-out: +- return; ++ pending >>= CAUSEB_IP; ++ while (pending) { ++ irq = fls(pending) - 1; ++ do_IRQ(MIPS_CPU_IRQ_BASE + irq); ++ pending &= ~BIT(irq); ++ } + } + + static int icu_map(struct irq_domain *d, unsigned int irq, irq_hw_number_t hw) +@@ -354,11 +355,6 @@ static const struct irq_domain_ops irq_domain_ops = { + .map = icu_map, + }; + +-static struct irqaction cascade = { +- .handler = no_action, +- .name = "cascade", +-}; +- + int __init icu_of_init(struct device_node *node, struct device_node *parent) + { + struct device_node *eiu_node; +@@ -390,7 +386,7 @@ int __init icu_of_init(struct device_node *node, struct device_node *parent) + mips_cpu_irq_init(); + + for (i = 0; i < MAX_IM; i++) +- setup_irq(i + 2, &cascade); ++ irq_set_chained_handler(i + 2, ltq_hw_irq_handler); + + if (cpu_has_vint) { + pr_info("Setting up vectored interrupts\n"); +diff --git a/arch/mips/mm/sc-ip22.c b/arch/mips/mm/sc-ip22.c +index dc7c5a5214a9..203e4661bc81 100644 +--- a/arch/mips/mm/sc-ip22.c ++++ b/arch/mips/mm/sc-ip22.c +@@ -31,26 +31,29 @@ static inline void indy_sc_wipe(unsigned long first, unsigned long last) + unsigned long tmp; + + __asm__ __volatile__( +- ".set\tpush\t\t\t# indy_sc_wipe\n\t" +- ".set\tnoreorder\n\t" +- ".set\tmips3\n\t" +- ".set\tnoat\n\t" +- "mfc0\t%2, $12\n\t" +- "li\t$1, 0x80\t\t\t# Go 64 bit\n\t" +- "mtc0\t$1, $12\n\t" +- +- "dli\t$1, 0x9000000080000000\n\t" +- "or\t%0, $1\t\t\t# first line to flush\n\t" +- "or\t%1, $1\t\t\t# last line to flush\n\t" +- ".set\tat\n\t" +- +- "1:\tsw\t$0, 0(%0)\n\t" +- "bne\t%0, %1, 1b\n\t" +- " daddu\t%0, 32\n\t" +- +- "mtc0\t%2, $12\t\t\t# Back to 32 bit\n\t" +- "nop; nop; nop; nop;\n\t" +- ".set\tpop" ++ " .set push # indy_sc_wipe \n" ++ " .set noreorder \n" ++ " .set mips3 \n" ++ " .set noat \n" ++ " mfc0 %2, $12 \n" ++ " li $1, 0x80 # Go 64 bit \n" ++ " mtc0 $1, $12 \n" ++ " \n" ++ " dli $1, 0x9000000080000000 \n" ++ " or %0, $1 # first line to flush \n" ++ " or %1, $1 # last line to flush \n" ++ " .set at \n" ++ " \n" ++ "1: sw $0, 0(%0) \n" ++ " bne %0, %1, 1b \n" ++ " daddu %0, 32 \n" ++ " \n" ++ " mtc0 %2, $12 # Back to 32 bit \n" ++ " nop # pipeline hazard \n" ++ " nop \n" ++ " nop \n" ++ " nop \n" ++ " .set pop \n" + : "=r" (first), "=r" (last), "=&r" (tmp) + : "0" (first), "1" (last)); + } +diff --git a/arch/mips/ralink/prom.c b/arch/mips/ralink/prom.c +index 09419f67da39..bdfc253958f4 100644 +--- a/arch/mips/ralink/prom.c ++++ b/arch/mips/ralink/prom.c +@@ -25,8 +25,10 @@ const char *get_system_type(void) + return soc_info.sys_type; + } + +-static __init void prom_init_cmdline(int argc, char **argv) ++static __init void prom_init_cmdline(void) + { ++ int argc; ++ char **argv; + int i; + + pr_debug("prom: fw_arg0=%08x fw_arg1=%08x fw_arg2=%08x fw_arg3=%08x\n", +@@ -55,14 +57,11 @@ static __init void prom_init_cmdline(int argc, char **argv) + + void __init prom_init(void) + { +- int argc; +- char **argv; +- + prom_soc_init(&soc_info); + + pr_info("SoC Type: %s\n", get_system_type()); + +- prom_init_cmdline(argc, argv); ++ prom_init_cmdline(); + } + + void __init prom_free_prom_memory(void) +diff --git a/arch/mips/ralink/rt288x.c b/arch/mips/ralink/rt288x.c +index 738cec865f41..1bd7d704b01b 100644 +--- a/arch/mips/ralink/rt288x.c ++++ b/arch/mips/ralink/rt288x.c +@@ -40,16 +40,6 @@ static struct rt2880_pmx_group rt2880_pinmux_data_act[] = { + { 0 } + }; + +-static void rt288x_wdt_reset(void) +-{ +- u32 t; +- +- /* enable WDT reset output on pin SRAM_CS_N */ +- t = rt_sysc_r32(SYSC_REG_CLKCFG); +- t |= CLKCFG_SRAM_CS_N_WDT; +- rt_sysc_w32(t, SYSC_REG_CLKCFG); +-} +- + void __init ralink_clk_init(void) + { + unsigned long cpu_rate, wmac_rate = 40000000; +diff --git a/arch/mips/ralink/rt305x.c b/arch/mips/ralink/rt305x.c +index c40776ab67db..28bf6fbe8b04 100644 +--- a/arch/mips/ralink/rt305x.c ++++ b/arch/mips/ralink/rt305x.c +@@ -91,17 +91,6 @@ static struct rt2880_pmx_group rt5350_pinmux_data[] = { + { 0 } + }; + +-static void rt305x_wdt_reset(void) +-{ +- u32 t; +- +- /* enable WDT reset output on pin SRAM_CS_N */ +- t = rt_sysc_r32(SYSC_REG_SYSTEM_CONFIG); +- t |= RT305X_SYSCFG_SRAM_CS0_MODE_WDT << +- RT305X_SYSCFG_SRAM_CS0_MODE_SHIFT; +- rt_sysc_w32(t, SYSC_REG_SYSTEM_CONFIG); +-} +- + static unsigned long rt5350_get_mem_size(void) + { + void __iomem *sysc = (void __iomem *) KSEG1ADDR(RT305X_SYSC_BASE); +diff --git a/arch/mips/ralink/rt3883.c b/arch/mips/ralink/rt3883.c +index 5bda39fea483..d7998819954a 100644 +--- a/arch/mips/ralink/rt3883.c ++++ b/arch/mips/ralink/rt3883.c +@@ -63,16 +63,6 @@ static struct rt2880_pmx_group rt3883_pinmux_data[] = { + { 0 } + }; + +-static void rt3883_wdt_reset(void) +-{ +- u32 t; +- +- /* enable WDT reset output on GPIO 2 */ +- t = rt_sysc_r32(RT3883_SYSC_REG_SYSCFG1); +- t |= RT3883_SYSCFG1_GPIO2_AS_WDT_OUT; +- rt_sysc_w32(t, RT3883_SYSC_REG_SYSCFG1); +-} +- + void __init ralink_clk_init(void) + { + unsigned long cpu_rate, sys_rate; +diff --git a/arch/mips/sgi-ip22/Platform b/arch/mips/sgi-ip22/Platform +index b7a4b7e04c38..e8f6b3a42a48 100644 +--- a/arch/mips/sgi-ip22/Platform ++++ b/arch/mips/sgi-ip22/Platform +@@ -25,7 +25,7 @@ endif + # Simplified: what IP22 does at 128MB+ in ksegN, IP28 does at 512MB+ in xkphys + # + ifdef CONFIG_SGI_IP28 +- ifeq ($(call cc-option-yn,-mr10k-cache-barrier=store), n) ++ ifeq ($(call cc-option-yn,-march=r10000 -mr10k-cache-barrier=store), n) + $(error gcc doesn't support needed option -mr10k-cache-barrier=store) + endif + endif +diff --git a/arch/openrisc/include/asm/uaccess.h b/arch/openrisc/include/asm/uaccess.h +index 5cc6b4f1b795..1a836afb636d 100644 +--- a/arch/openrisc/include/asm/uaccess.h ++++ b/arch/openrisc/include/asm/uaccess.h +@@ -215,7 +215,7 @@ do { \ + case 1: __get_user_asm(x, ptr, retval, "l.lbz"); break; \ + case 2: __get_user_asm(x, ptr, retval, "l.lhz"); break; \ + case 4: __get_user_asm(x, ptr, retval, "l.lwz"); break; \ +- case 8: __get_user_asm2(x, ptr, retval); \ ++ case 8: __get_user_asm2(x, ptr, retval); break; \ + default: (x) = __get_user_bad(); \ + } \ + } while (0) +diff --git a/arch/powerpc/kvm/emulate.c b/arch/powerpc/kvm/emulate.c +index 5cc2e7af3a7b..b379146de55b 100644 +--- a/arch/powerpc/kvm/emulate.c ++++ b/arch/powerpc/kvm/emulate.c +@@ -302,7 +302,6 @@ int kvmppc_emulate_instruction(struct kvm_run *run, struct kvm_vcpu *vcpu) + advance = 0; + printk(KERN_ERR "Couldn't emulate instruction 0x%08x " + "(op %d xop %d)\n", inst, get_op(inst), get_xop(inst)); +- kvmppc_core_queue_program(vcpu, 0); + } + } + +diff --git a/arch/powerpc/perf/hv-24x7.c b/arch/powerpc/perf/hv-24x7.c +index ec2eb20631d1..14ac699d30aa 100644 +--- a/arch/powerpc/perf/hv-24x7.c ++++ b/arch/powerpc/perf/hv-24x7.c +@@ -503,7 +503,7 @@ static int memord(const void *d1, size_t s1, const void *d2, size_t s2) + { + if (s1 < s2) + return 1; +- if (s2 > s1) ++ if (s1 > s2) + return -1; + + return memcmp(d1, d2, s1); +diff --git a/arch/powerpc/platforms/powernv/opal-async.c b/arch/powerpc/platforms/powernv/opal-async.c +index 693b6cdac691..3fcaa9ef447b 100644 +--- a/arch/powerpc/platforms/powernv/opal-async.c ++++ b/arch/powerpc/platforms/powernv/opal-async.c +@@ -39,18 +39,18 @@ int __opal_async_get_token(void) + int token; + + spin_lock_irqsave(&opal_async_comp_lock, flags); +- token = find_first_bit(opal_async_complete_map, opal_max_async_tokens); ++ token = find_first_zero_bit(opal_async_token_map, opal_max_async_tokens); + if (token >= opal_max_async_tokens) { + token = -EBUSY; + goto out; + } + +- if (__test_and_set_bit(token, opal_async_token_map)) { ++ if (!__test_and_clear_bit(token, opal_async_complete_map)) { + token = -EBUSY; + goto out; + } + +- __clear_bit(token, opal_async_complete_map); ++ __set_bit(token, opal_async_token_map); + + out: + spin_unlock_irqrestore(&opal_async_comp_lock, flags); +diff --git a/arch/powerpc/platforms/powernv/setup.c b/arch/powerpc/platforms/powernv/setup.c +index 16fdcb23f4c3..20974478f8d0 100644 +--- a/arch/powerpc/platforms/powernv/setup.c ++++ b/arch/powerpc/platforms/powernv/setup.c +@@ -469,7 +469,7 @@ static unsigned long pnv_get_proc_freq(unsigned int cpu) + { + unsigned long ret_freq; + +- ret_freq = cpufreq_quick_get(cpu) * 1000ul; ++ ret_freq = cpufreq_get(cpu) * 1000ul; + + /* + * If the backend cpufreq driver does not exist, +diff --git a/arch/powerpc/sysdev/axonram.c b/arch/powerpc/sysdev/axonram.c +index ee90db17b097..1629dd5aaacb 100644 +--- a/arch/powerpc/sysdev/axonram.c ++++ b/arch/powerpc/sysdev/axonram.c +@@ -274,7 +274,9 @@ failed: + if (bank->disk->major > 0) + unregister_blkdev(bank->disk->major, + bank->disk->disk_name); +- del_gendisk(bank->disk); ++ if (bank->disk->flags & GENHD_FL_UP) ++ del_gendisk(bank->disk); ++ put_disk(bank->disk); + } + device->dev.platform_data = NULL; + if (bank->io_addr != 0) +@@ -299,6 +301,7 @@ axon_ram_remove(struct platform_device *device) + device_remove_file(&device->dev, &dev_attr_ecc); + free_irq(bank->irq_id, device); + del_gendisk(bank->disk); ++ put_disk(bank->disk); + iounmap((void __iomem *) bank->io_addr); + kfree(bank); + +diff --git a/arch/powerpc/sysdev/ipic.c b/arch/powerpc/sysdev/ipic.c +index b28733727ed3..2e41a73ad80a 100644 +--- a/arch/powerpc/sysdev/ipic.c ++++ b/arch/powerpc/sysdev/ipic.c +@@ -843,12 +843,12 @@ void ipic_disable_mcp(enum ipic_mcp_irq mcp_irq) + + u32 ipic_get_mcp_status(void) + { +- return ipic_read(primary_ipic->regs, IPIC_SERMR); ++ return ipic_read(primary_ipic->regs, IPIC_SERSR); + } + + void ipic_clear_mcp_status(u32 mask) + { +- ipic_write(primary_ipic->regs, IPIC_SERMR, mask); ++ ipic_write(primary_ipic->regs, IPIC_SERSR, mask); + } + + /* Return an interrupt vector or NO_IRQ if no interrupt is pending. */ +diff --git a/arch/s390/include/asm/pci_insn.h b/arch/s390/include/asm/pci_insn.h +index 649eb62c52b3..9e02cb7955c1 100644 +--- a/arch/s390/include/asm/pci_insn.h ++++ b/arch/s390/include/asm/pci_insn.h +@@ -81,6 +81,6 @@ int zpci_refresh_trans(u64 fn, u64 addr, u64 range); + int zpci_load(u64 *data, u64 req, u64 offset); + int zpci_store(u64 data, u64 req, u64 offset); + int zpci_store_block(const u64 *data, u64 req, u64 offset); +-void zpci_set_irq_ctrl(u16 ctl, char *unused, u8 isc); ++int zpci_set_irq_ctrl(u16 ctl, char *unused, u8 isc); + + #endif +diff --git a/arch/s390/kernel/setup.c b/arch/s390/kernel/setup.c +index 1942f22e6694..208511437a28 100644 +--- a/arch/s390/kernel/setup.c ++++ b/arch/s390/kernel/setup.c +@@ -801,10 +801,10 @@ static void __init setup_randomness(void) + { + struct sysinfo_3_2_2 *vmms; + +- vmms = (struct sysinfo_3_2_2 *) alloc_page(GFP_KERNEL); +- if (vmms && stsi(vmms, 3, 2, 2) == 0 && vmms->count) +- add_device_randomness(&vmms, vmms->count); +- free_page((unsigned long) vmms); ++ vmms = (struct sysinfo_3_2_2 *) memblock_alloc(PAGE_SIZE, PAGE_SIZE); ++ if (stsi(vmms, 3, 2, 2) == 0 && vmms->count) ++ add_device_randomness(&vmms->vm, sizeof(vmms->vm[0]) * vmms->count); ++ memblock_free((unsigned long) vmms, PAGE_SIZE); + } + + /* +diff --git a/arch/s390/pci/pci.c b/arch/s390/pci/pci.c +index 50a79a5fc116..666baac18ff0 100644 +--- a/arch/s390/pci/pci.c ++++ b/arch/s390/pci/pci.c +@@ -364,7 +364,8 @@ static void zpci_irq_handler(struct airq_struct *airq) + /* End of second scan with interrupts on. */ + break; + /* First scan complete, reenable interrupts. */ +- zpci_set_irq_ctrl(SIC_IRQ_MODE_SINGLE, NULL, PCI_ISC); ++ if (zpci_set_irq_ctrl(SIC_IRQ_MODE_SINGLE, NULL, PCI_ISC)) ++ break; + si = 0; + continue; + } +@@ -922,7 +923,7 @@ static int __init pci_base_init(void) + if (!s390_pci_probe) + return 0; + +- if (!test_facility(69) || !test_facility(71) || !test_facility(72)) ++ if (!test_facility(69) || !test_facility(71)) + return 0; + + rc = zpci_debug_init(); +diff --git a/arch/s390/pci/pci_dma.c b/arch/s390/pci/pci_dma.c +index 6fd8d5836138..888cc878efaa 100644 +--- a/arch/s390/pci/pci_dma.c ++++ b/arch/s390/pci/pci_dma.c +@@ -432,7 +432,7 @@ int zpci_dma_init_device(struct zpci_dev *zdev) + zdev->dma_table = dma_alloc_cpu_table(); + if (!zdev->dma_table) { + rc = -ENOMEM; +- goto out_clean; ++ goto out; + } + + zdev->iommu_size = (unsigned long) high_memory - PAGE_OFFSET; +@@ -440,7 +440,7 @@ int zpci_dma_init_device(struct zpci_dev *zdev) + zdev->iommu_bitmap = vzalloc(zdev->iommu_pages / 8); + if (!zdev->iommu_bitmap) { + rc = -ENOMEM; +- goto out_reg; ++ goto free_dma_table; + } + + rc = zpci_register_ioat(zdev, +@@ -449,12 +449,16 @@ int zpci_dma_init_device(struct zpci_dev *zdev) + zdev->start_dma + zdev->iommu_size - 1, + (u64) zdev->dma_table); + if (rc) +- goto out_reg; +- return 0; ++ goto free_bitmap; + +-out_reg: ++ return 0; ++free_bitmap: ++ vfree(zdev->iommu_bitmap); ++ zdev->iommu_bitmap = NULL; ++free_dma_table: + dma_free_cpu_table(zdev->dma_table); +-out_clean: ++ zdev->dma_table = NULL; ++out: + return rc; + } + +diff --git a/arch/s390/pci/pci_insn.c b/arch/s390/pci/pci_insn.c +index 85267c058af8..abccf44c1e65 100644 +--- a/arch/s390/pci/pci_insn.c ++++ b/arch/s390/pci/pci_insn.c +@@ -7,6 +7,7 @@ + #include + #include + #include ++#include + #include + #include + +@@ -78,11 +79,14 @@ int zpci_refresh_trans(u64 fn, u64 addr, u64 range) + } + + /* Set Interruption Controls */ +-void zpci_set_irq_ctrl(u16 ctl, char *unused, u8 isc) ++int zpci_set_irq_ctrl(u16 ctl, char *unused, u8 isc) + { ++ if (!test_facility(72)) ++ return -EIO; + asm volatile ( + " .insn rsy,0xeb00000000d1,%[ctl],%[isc],%[u]\n" + : : [ctl] "d" (ctl), [isc] "d" (isc << 27), [u] "Q" (*unused)); ++ return 0; + } + + /* PCI Load */ +diff --git a/arch/sparc/kernel/ptrace_64.c b/arch/sparc/kernel/ptrace_64.c +index 9ddc4928a089..c1566170964f 100644 +--- a/arch/sparc/kernel/ptrace_64.c ++++ b/arch/sparc/kernel/ptrace_64.c +@@ -311,7 +311,7 @@ static int genregs64_set(struct task_struct *target, + } + + if (!ret) { +- unsigned long y; ++ unsigned long y = regs->y; + + ret = user_regset_copyin(&pos, &count, &kbuf, &ubuf, + &y, +diff --git a/arch/sparc/mm/init_64.c b/arch/sparc/mm/init_64.c +index 214da575fdc5..49646684b42c 100644 +--- a/arch/sparc/mm/init_64.c ++++ b/arch/sparc/mm/init_64.c +@@ -2285,9 +2285,16 @@ void __init mem_init(void) + { + high_memory = __va(last_valid_pfn << PAGE_SHIFT); + +- register_page_bootmem_info(); + free_all_bootmem(); + ++ /* ++ * Must be done after boot memory is put on freelist, because here we ++ * might set fields in deferred struct pages that have not yet been ++ * initialized, and free_all_bootmem() initializes all the reserved ++ * deferred pages for us. ++ */ ++ register_page_bootmem_info(); ++ + /* + * Set up the zero page, mark it reserved, so that page count + * is not manipulated when freeing the page from user ptes. +diff --git a/arch/x86/crypto/ghash-clmulni-intel_glue.c b/arch/x86/crypto/ghash-clmulni-intel_glue.c +index daf8d2b9a217..b7ef6e202bb7 100644 +--- a/arch/x86/crypto/ghash-clmulni-intel_glue.c ++++ b/arch/x86/crypto/ghash-clmulni-intel_glue.c +@@ -219,6 +219,29 @@ static int ghash_async_final(struct ahash_request *req) + } + } + ++static int ghash_async_import(struct ahash_request *req, const void *in) ++{ ++ struct ahash_request *cryptd_req = ahash_request_ctx(req); ++ struct shash_desc *desc = cryptd_shash_desc(cryptd_req); ++ struct ghash_desc_ctx *dctx = shash_desc_ctx(desc); ++ ++ ghash_async_init(req); ++ memcpy(dctx, in, sizeof(*dctx)); ++ return 0; ++ ++} ++ ++static int ghash_async_export(struct ahash_request *req, void *out) ++{ ++ struct ahash_request *cryptd_req = ahash_request_ctx(req); ++ struct shash_desc *desc = cryptd_shash_desc(cryptd_req); ++ struct ghash_desc_ctx *dctx = shash_desc_ctx(desc); ++ ++ memcpy(out, dctx, sizeof(*dctx)); ++ return 0; ++ ++} ++ + static int ghash_async_digest(struct ahash_request *req) + { + struct crypto_ahash *tfm = crypto_ahash_reqtfm(req); +@@ -288,8 +311,11 @@ static struct ahash_alg ghash_async_alg = { + .final = ghash_async_final, + .setkey = ghash_async_setkey, + .digest = ghash_async_digest, ++ .export = ghash_async_export, ++ .import = ghash_async_import, + .halg = { + .digestsize = GHASH_DIGEST_SIZE, ++ .statesize = sizeof(struct ghash_desc_ctx), + .base = { + .cra_name = "ghash", + .cra_driver_name = "ghash-clmulni", +diff --git a/arch/x86/crypto/salsa20_glue.c b/arch/x86/crypto/salsa20_glue.c +index 399a29d067d6..cb91a64a99e7 100644 +--- a/arch/x86/crypto/salsa20_glue.c ++++ b/arch/x86/crypto/salsa20_glue.c +@@ -59,13 +59,6 @@ static int encrypt(struct blkcipher_desc *desc, + + salsa20_ivsetup(ctx, walk.iv); + +- if (likely(walk.nbytes == nbytes)) +- { +- salsa20_encrypt_bytes(ctx, walk.src.virt.addr, +- walk.dst.virt.addr, nbytes); +- return blkcipher_walk_done(desc, &walk, 0); +- } +- + while (walk.nbytes >= 64) { + salsa20_encrypt_bytes(ctx, walk.src.virt.addr, + walk.dst.virt.addr, +diff --git a/arch/x86/kernel/kprobes/ftrace.c b/arch/x86/kernel/kprobes/ftrace.c +index 5f8f0b3cc674..2c0b0b645a74 100644 +--- a/arch/x86/kernel/kprobes/ftrace.c ++++ b/arch/x86/kernel/kprobes/ftrace.c +@@ -26,7 +26,7 @@ + #include "common.h" + + static nokprobe_inline +-int __skip_singlestep(struct kprobe *p, struct pt_regs *regs, ++void __skip_singlestep(struct kprobe *p, struct pt_regs *regs, + struct kprobe_ctlblk *kcb, unsigned long orig_ip) + { + /* +@@ -41,20 +41,21 @@ int __skip_singlestep(struct kprobe *p, struct pt_regs *regs, + __this_cpu_write(current_kprobe, NULL); + if (orig_ip) + regs->ip = orig_ip; +- return 1; + } + + int skip_singlestep(struct kprobe *p, struct pt_regs *regs, + struct kprobe_ctlblk *kcb) + { +- if (kprobe_ftrace(p)) +- return __skip_singlestep(p, regs, kcb, 0); +- else +- return 0; ++ if (kprobe_ftrace(p)) { ++ __skip_singlestep(p, regs, kcb, 0); ++ preempt_enable_no_resched(); ++ return 1; ++ } ++ return 0; + } + NOKPROBE_SYMBOL(skip_singlestep); + +-/* Ftrace callback handler for kprobes */ ++/* Ftrace callback handler for kprobes -- called under preepmt disabed */ + void kprobe_ftrace_handler(unsigned long ip, unsigned long parent_ip, + struct ftrace_ops *ops, struct pt_regs *regs) + { +@@ -77,13 +78,17 @@ void kprobe_ftrace_handler(unsigned long ip, unsigned long parent_ip, + /* Kprobe handler expects regs->ip = ip + 1 as breakpoint hit */ + regs->ip = ip + sizeof(kprobe_opcode_t); + ++ /* To emulate trap based kprobes, preempt_disable here */ ++ preempt_disable(); + __this_cpu_write(current_kprobe, p); + kcb->kprobe_status = KPROBE_HIT_ACTIVE; +- if (!p->pre_handler || !p->pre_handler(p, regs)) ++ if (!p->pre_handler || !p->pre_handler(p, regs)) { + __skip_singlestep(p, regs, kcb, orig_ip); ++ preempt_enable_no_resched(); ++ } + /* + * If pre_handler returns !0, it sets regs->ip and +- * resets current kprobe. ++ * resets current kprobe, and keep preempt count +1. + */ + } + end: +diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c +index 665b10a55b30..84f2825f19b5 100644 +--- a/arch/x86/kvm/vmx.c ++++ b/arch/x86/kvm/vmx.c +@@ -3354,7 +3354,7 @@ static void fix_rmode_seg(int seg, struct kvm_segment *save) + } + + vmcs_write16(sf->selector, var.selector); +- vmcs_write32(sf->base, var.base); ++ vmcs_writel(sf->base, var.base); + vmcs_write32(sf->limit, var.limit); + vmcs_write32(sf->ar_bytes, vmx_segment_access_rights(&var)); + } +@@ -6075,12 +6075,7 @@ static __init int hardware_setup(void) + memset(vmx_vmread_bitmap, 0xff, PAGE_SIZE); + memset(vmx_vmwrite_bitmap, 0xff, PAGE_SIZE); + +- /* +- * Allow direct access to the PC debug port (it is often used for I/O +- * delays, but the vmexits simply slow things down). +- */ + memset(vmx_io_bitmap_a, 0xff, PAGE_SIZE); +- clear_bit(0x80, vmx_io_bitmap_a); + + memset(vmx_io_bitmap_b, 0xff, PAGE_SIZE); + +@@ -10140,8 +10135,10 @@ static void nested_vmx_vmexit(struct kvm_vcpu *vcpu, u32 exit_reason, + */ + static void vmx_leave_nested(struct kvm_vcpu *vcpu) + { +- if (is_guest_mode(vcpu)) ++ if (is_guest_mode(vcpu)) { ++ to_vmx(vcpu)->nested.nested_run_pending = 0; + nested_vmx_vmexit(vcpu, -1, 0, 0); ++ } + free_nested(to_vmx(vcpu)); + } + +diff --git a/arch/x86/pci/broadcom_bus.c b/arch/x86/pci/broadcom_bus.c +index bb461cfd01ab..526536c81ddc 100644 +--- a/arch/x86/pci/broadcom_bus.c ++++ b/arch/x86/pci/broadcom_bus.c +@@ -97,7 +97,7 @@ static int __init broadcom_postcore_init(void) + * We should get host bridge information from ACPI unless the BIOS + * doesn't support it. + */ +- if (acpi_os_get_root_pointer()) ++ if (!acpi_disabled && acpi_os_get_root_pointer()) + return 0; + #endif + +diff --git a/block/scsi_ioctl.c b/block/scsi_ioctl.c +index 55b6f15dac90..3356fd91bc61 100644 +--- a/block/scsi_ioctl.c ++++ b/block/scsi_ioctl.c +@@ -182,6 +182,9 @@ static void blk_set_cmd_filter_defaults(struct blk_cmd_filter *filter) + __set_bit(WRITE_16, filter->write_ok); + __set_bit(WRITE_LONG, filter->write_ok); + __set_bit(WRITE_LONG_2, filter->write_ok); ++ __set_bit(WRITE_SAME, filter->write_ok); ++ __set_bit(WRITE_SAME_16, filter->write_ok); ++ __set_bit(WRITE_SAME_32, filter->write_ok); + __set_bit(ERASE, filter->write_ok); + __set_bit(GPCMD_MODE_SELECT_10, filter->write_ok); + __set_bit(MODE_SELECT, filter->write_ok); +diff --git a/crypto/Makefile b/crypto/Makefile +index 97b7d3ac87e7..16766ced6a44 100644 +--- a/crypto/Makefile ++++ b/crypto/Makefile +@@ -47,6 +47,7 @@ obj-$(CONFIG_CRYPTO_SHA1) += sha1_generic.o + obj-$(CONFIG_CRYPTO_SHA256) += sha256_generic.o + obj-$(CONFIG_CRYPTO_SHA512) += sha512_generic.o + obj-$(CONFIG_CRYPTO_WP512) += wp512.o ++CFLAGS_wp512.o := $(call cc-option,-fno-schedule-insns) # https://gcc.gnu.org/bugzilla/show_bug.cgi?id=79149 + obj-$(CONFIG_CRYPTO_TGR192) += tgr192.o + obj-$(CONFIG_CRYPTO_GF128MUL) += gf128mul.o + obj-$(CONFIG_CRYPTO_ECB) += ecb.o +@@ -68,6 +69,7 @@ obj-$(CONFIG_CRYPTO_BLOWFISH_COMMON) += blowfish_common.o + obj-$(CONFIG_CRYPTO_TWOFISH) += twofish_generic.o + obj-$(CONFIG_CRYPTO_TWOFISH_COMMON) += twofish_common.o + obj-$(CONFIG_CRYPTO_SERPENT) += serpent_generic.o ++CFLAGS_serpent_generic.o := $(call cc-option,-fsched-pressure) # https://gcc.gnu.org/bugzilla/show_bug.cgi?id=79149 + obj-$(CONFIG_CRYPTO_AES) += aes_generic.o + obj-$(CONFIG_CRYPTO_CAMELLIA) += camellia_generic.o + obj-$(CONFIG_CRYPTO_CAST_COMMON) += cast_common.o +diff --git a/crypto/algif_hash.c b/crypto/algif_hash.c +index d7a3435280d8..db83dabe5fc9 100644 +--- a/crypto/algif_hash.c ++++ b/crypto/algif_hash.c +@@ -184,7 +184,7 @@ static int hash_accept(struct socket *sock, struct socket *newsock, int flags) + struct alg_sock *ask = alg_sk(sk); + struct hash_ctx *ctx = ask->private; + struct ahash_request *req = &ctx->req; +- char state[crypto_ahash_statesize(crypto_ahash_reqtfm(req))]; ++ char state[crypto_ahash_statesize(crypto_ahash_reqtfm(req)) ? : 1]; + struct sock *sk2; + struct alg_sock *ask2; + struct hash_ctx *ctx2; +diff --git a/crypto/asymmetric_keys/x509_cert_parser.c b/crypto/asymmetric_keys/x509_cert_parser.c +index 1995d6d962f5..2eac68e51433 100644 +--- a/crypto/asymmetric_keys/x509_cert_parser.c ++++ b/crypto/asymmetric_keys/x509_cert_parser.c +@@ -399,6 +399,8 @@ int x509_extract_key_data(void *context, size_t hdrlen, + ctx->cert->pub->pkey_algo = PKEY_ALGO_RSA; + + /* Discard the BIT STRING metadata */ ++ if (vlen < 1 || *(const u8 *)value != 0) ++ return -EBADMSG; + ctx->key = value + 1; + ctx->key_size = vlen - 1; + return 0; +diff --git a/crypto/cryptd.c b/crypto/cryptd.c +index 34e4dfafb94f..66c9e8262572 100644 +--- a/crypto/cryptd.c ++++ b/crypto/cryptd.c +@@ -633,6 +633,7 @@ static int cryptd_create_hash(struct crypto_template *tmpl, struct rtattr **tb, + inst->alg.halg.base.cra_flags = type; + + inst->alg.halg.digestsize = salg->digestsize; ++ inst->alg.halg.statesize = salg->statesize; + inst->alg.halg.base.cra_ctxsize = sizeof(struct cryptd_hash_ctx); + + inst->alg.halg.base.cra_init = cryptd_hash_init_tfm; +diff --git a/crypto/hmac.c b/crypto/hmac.c +index 72e38c098bb3..ba07fb6221ae 100644 +--- a/crypto/hmac.c ++++ b/crypto/hmac.c +@@ -194,11 +194,15 @@ static int hmac_create(struct crypto_template *tmpl, struct rtattr **tb) + salg = shash_attr_alg(tb[1], 0, 0); + if (IS_ERR(salg)) + return PTR_ERR(salg); ++ alg = &salg->base; + ++ /* The underlying hash algorithm must be unkeyed */ + err = -EINVAL; ++ if (crypto_shash_alg_has_setkey(salg)) ++ goto out_put_alg; ++ + ds = salg->digestsize; + ss = salg->statesize; +- alg = &salg->base; + if (ds > alg->cra_blocksize || + ss < alg->cra_blocksize) + goto out_put_alg; +diff --git a/crypto/mcryptd.c b/crypto/mcryptd.c +index fe5b495a434d..cfb68a889ef6 100644 +--- a/crypto/mcryptd.c ++++ b/crypto/mcryptd.c +@@ -526,6 +526,7 @@ static int mcryptd_create_hash(struct crypto_template *tmpl, struct rtattr **tb, + inst->alg.halg.base.cra_flags = type; + + inst->alg.halg.digestsize = salg->digestsize; ++ inst->alg.halg.statesize = salg->statesize; + inst->alg.halg.base.cra_ctxsize = sizeof(struct mcryptd_hash_ctx); + + inst->alg.halg.base.cra_init = mcryptd_hash_init_tfm; +diff --git a/crypto/salsa20_generic.c b/crypto/salsa20_generic.c +index f550b5d94630..d7da0eea5622 100644 +--- a/crypto/salsa20_generic.c ++++ b/crypto/salsa20_generic.c +@@ -188,13 +188,6 @@ static int encrypt(struct blkcipher_desc *desc, + + salsa20_ivsetup(ctx, walk.iv); + +- if (likely(walk.nbytes == nbytes)) +- { +- salsa20_encrypt_bytes(ctx, walk.dst.virt.addr, +- walk.src.virt.addr, nbytes); +- return blkcipher_walk_done(desc, &walk, 0); +- } +- + while (walk.nbytes >= 64) { + salsa20_encrypt_bytes(ctx, walk.dst.virt.addr, + walk.src.virt.addr, +diff --git a/crypto/shash.c b/crypto/shash.c +index 17510eaf0a36..73c065321867 100644 +--- a/crypto/shash.c ++++ b/crypto/shash.c +@@ -24,11 +24,12 @@ + + static const struct crypto_type crypto_shash_type; + +-static int shash_no_setkey(struct crypto_shash *tfm, const u8 *key, +- unsigned int keylen) ++int shash_no_setkey(struct crypto_shash *tfm, const u8 *key, ++ unsigned int keylen) + { + return -ENOSYS; + } ++EXPORT_SYMBOL_GPL(shash_no_setkey); + + static int shash_setkey_unaligned(struct crypto_shash *tfm, const u8 *key, + unsigned int keylen) +diff --git a/drivers/acpi/video.c b/drivers/acpi/video.c +index cc79d3fedfb2..493811b895bd 100644 +--- a/drivers/acpi/video.c ++++ b/drivers/acpi/video.c +@@ -1276,6 +1276,9 @@ static int acpi_video_device_enumerate(struct acpi_video_bus *video) + union acpi_object *dod = NULL; + union acpi_object *obj; + ++ if (!video->cap._DOD) ++ return AE_NOT_EXIST; ++ + status = acpi_evaluate_object(video->device->handle, "_DOD", NULL, &buffer); + if (!ACPI_SUCCESS(status)) { + ACPI_EXCEPTION((AE_INFO, status, "Evaluating _DOD")); +diff --git a/drivers/ata/libata-sff.c b/drivers/ata/libata-sff.c +index 7dbba387d12a..18de4c457068 100644 +--- a/drivers/ata/libata-sff.c ++++ b/drivers/ata/libata-sff.c +@@ -1480,7 +1480,6 @@ unsigned int ata_sff_qc_issue(struct ata_queued_cmd *qc) + break; + + default: +- WARN_ON_ONCE(1); + return AC_ERR_SYSTEM; + } + +diff --git a/drivers/atm/horizon.c b/drivers/atm/horizon.c +index 527bbd595e37..d9b762a62e25 100644 +--- a/drivers/atm/horizon.c ++++ b/drivers/atm/horizon.c +@@ -2804,7 +2804,7 @@ out: + return err; + + out_free_irq: +- free_irq(dev->irq, dev); ++ free_irq(irq, dev); + out_free: + kfree(dev); + out_release: +diff --git a/drivers/base/isa.c b/drivers/base/isa.c +index 91dba65d7264..901d8185309e 100644 +--- a/drivers/base/isa.c ++++ b/drivers/base/isa.c +@@ -39,7 +39,7 @@ static int isa_bus_probe(struct device *dev) + { + struct isa_driver *isa_driver = dev->platform_data; + +- if (isa_driver->probe) ++ if (isa_driver && isa_driver->probe) + return isa_driver->probe(dev, to_isa_dev(dev)->id); + + return 0; +@@ -49,7 +49,7 @@ static int isa_bus_remove(struct device *dev) + { + struct isa_driver *isa_driver = dev->platform_data; + +- if (isa_driver->remove) ++ if (isa_driver && isa_driver->remove) + return isa_driver->remove(dev, to_isa_dev(dev)->id); + + return 0; +@@ -59,7 +59,7 @@ static void isa_bus_shutdown(struct device *dev) + { + struct isa_driver *isa_driver = dev->platform_data; + +- if (isa_driver->shutdown) ++ if (isa_driver && isa_driver->shutdown) + isa_driver->shutdown(dev, to_isa_dev(dev)->id); + } + +@@ -67,7 +67,7 @@ static int isa_bus_suspend(struct device *dev, pm_message_t state) + { + struct isa_driver *isa_driver = dev->platform_data; + +- if (isa_driver->suspend) ++ if (isa_driver && isa_driver->suspend) + return isa_driver->suspend(dev, to_isa_dev(dev)->id, state); + + return 0; +@@ -77,7 +77,7 @@ static int isa_bus_resume(struct device *dev) + { + struct isa_driver *isa_driver = dev->platform_data; + +- if (isa_driver->resume) ++ if (isa_driver && isa_driver->resume) + return isa_driver->resume(dev, to_isa_dev(dev)->id); + + return 0; +diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c +index 0c13dfd1c29d..32f5b87fe93c 100644 +--- a/drivers/bluetooth/btusb.c ++++ b/drivers/bluetooth/btusb.c +@@ -945,6 +945,10 @@ static int btusb_open(struct hci_dev *hdev) + return err; + + data->intf->needs_remote_wakeup = 1; ++ /* device specific wakeup source enabled and required for USB ++ * remote wakeup while host is suspended ++ */ ++ device_wakeup_enable(&data->udev->dev); + + if (test_and_set_bit(HCI_RUNNING, &hdev->flags)) + goto done; +@@ -1008,6 +1012,7 @@ static int btusb_close(struct hci_dev *hdev) + goto failed; + + data->intf->needs_remote_wakeup = 0; ++ device_wakeup_disable(&data->udev->dev); + usb_autopm_put_interface(data->intf); + + failed: +diff --git a/drivers/bus/arm-ccn.c b/drivers/bus/arm-ccn.c +index 4d523cfe51ce..31342fccd290 100644 +--- a/drivers/bus/arm-ccn.c ++++ b/drivers/bus/arm-ccn.c +@@ -1157,6 +1157,7 @@ static int arm_ccn_pmu_init(struct arm_ccn *ccn) + + /* Perf driver registration */ + ccn->dt.pmu = (struct pmu) { ++ .module = THIS_MODULE, + .attr_groups = arm_ccn_pmu_attr_groups, + .task_ctx_nr = perf_invalid_context, + .event_init = arm_ccn_pmu_event_init, +diff --git a/drivers/char/tpm/tpm_tis.c b/drivers/char/tpm/tpm_tis.c +index 696ef1d56b4f..5809567d3cf0 100644 +--- a/drivers/char/tpm/tpm_tis.c ++++ b/drivers/char/tpm/tpm_tis.c +@@ -401,7 +401,7 @@ static void disable_interrupts(struct tpm_chip *chip) + iowrite32(intmask, + chip->vendor.iobase + + TPM_INT_ENABLE(chip->vendor.locality)); +- free_irq(chip->vendor.irq, chip); ++ devm_free_irq(chip->pdev, chip->vendor.irq, chip); + chip->vendor.irq = 0; + } + +diff --git a/drivers/clk/tegra/clk-tegra30.c b/drivers/clk/tegra/clk-tegra30.c +index 4b26509fc218..803ef926d682 100644 +--- a/drivers/clk/tegra/clk-tegra30.c ++++ b/drivers/clk/tegra/clk-tegra30.c +@@ -1064,7 +1064,7 @@ static void __init tegra30_super_clk_init(void) + * U71 divider of cclk_lp. + */ + clk = tegra_clk_register_divider("pll_p_out3_cclklp", "pll_p_out3", +- clk_base + SUPER_CCLKG_DIVIDER, 0, ++ clk_base + SUPER_CCLKLP_DIVIDER, 0, + TEGRA_DIVIDER_INT, 16, 8, 1, NULL); + clk_register_clkdev(clk, "pll_p_out3_cclklp", NULL); + +diff --git a/drivers/crypto/s5p-sss.c b/drivers/crypto/s5p-sss.c +index 36d936fb259e..4f0c4a3cc5c5 100644 +--- a/drivers/crypto/s5p-sss.c ++++ b/drivers/crypto/s5p-sss.c +@@ -682,8 +682,9 @@ static int s5p_aes_probe(struct platform_device *pdev) + dev_warn(dev, "feed control interrupt is not available.\n"); + goto err_irq; + } +- err = devm_request_irq(dev, pdata->irq_fc, s5p_aes_interrupt, +- IRQF_SHARED, pdev->name, pdev); ++ err = devm_request_threaded_irq(dev, pdata->irq_fc, NULL, ++ s5p_aes_interrupt, IRQF_ONESHOT, ++ pdev->name, pdev); + if (err < 0) { + dev_warn(dev, "feed control interrupt is not available.\n"); + goto err_irq; +diff --git a/drivers/dma/dmaengine.c b/drivers/dma/dmaengine.c +index 3ddfd1f6c23c..3345a0acc975 100644 +--- a/drivers/dma/dmaengine.c ++++ b/drivers/dma/dmaengine.c +@@ -1002,12 +1002,14 @@ static struct dmaengine_unmap_pool *__get_unmap_pool(int nr) + switch (order) { + case 0 ... 1: + return &unmap_pool[0]; ++#if IS_ENABLED(CONFIG_DMA_ENGINE_RAID) + case 2 ... 4: + return &unmap_pool[1]; + case 5 ... 7: + return &unmap_pool[2]; + case 8: + return &unmap_pool[3]; ++#endif + default: + BUG(); + return NULL; +diff --git a/drivers/dma/dmatest.c b/drivers/dma/dmatest.c +index 897ec0f8d718..2e9bc49d30ec 100644 +--- a/drivers/dma/dmatest.c ++++ b/drivers/dma/dmatest.c +@@ -148,6 +148,12 @@ MODULE_PARM_DESC(run, "Run the test (default: false)"); + #define PATTERN_OVERWRITE 0x20 + #define PATTERN_COUNT_MASK 0x1f + ++/* poor man's completion - we want to use wait_event_freezable() on it */ ++struct dmatest_done { ++ bool done; ++ wait_queue_head_t *wait; ++}; ++ + struct dmatest_thread { + struct list_head node; + struct dmatest_info *info; +@@ -156,6 +162,8 @@ struct dmatest_thread { + u8 **srcs; + u8 **dsts; + enum dma_transaction_type type; ++ wait_queue_head_t done_wait; ++ struct dmatest_done test_done; + bool done; + }; + +@@ -316,18 +324,25 @@ static unsigned int dmatest_verify(u8 **bufs, unsigned int start, + return error_count; + } + +-/* poor man's completion - we want to use wait_event_freezable() on it */ +-struct dmatest_done { +- bool done; +- wait_queue_head_t *wait; +-}; + + static void dmatest_callback(void *arg) + { + struct dmatest_done *done = arg; +- +- done->done = true; +- wake_up_all(done->wait); ++ struct dmatest_thread *thread = ++ container_of(arg, struct dmatest_thread, done_wait); ++ if (!thread->done) { ++ done->done = true; ++ wake_up_all(done->wait); ++ } else { ++ /* ++ * If thread->done, it means that this callback occurred ++ * after the parent thread has cleaned up. This can ++ * happen in the case that driver doesn't implement ++ * the terminate_all() functionality and a dma operation ++ * did not occur within the timeout period ++ */ ++ WARN(1, "dmatest: Kernel memory may be corrupted!!\n"); ++ } + } + + static unsigned int min_odd(unsigned int x, unsigned int y) +@@ -398,9 +413,8 @@ static unsigned long long dmatest_KBs(s64 runtime, unsigned long long len) + */ + static int dmatest_func(void *data) + { +- DECLARE_WAIT_QUEUE_HEAD_ONSTACK(done_wait); + struct dmatest_thread *thread = data; +- struct dmatest_done done = { .wait = &done_wait }; ++ struct dmatest_done *done = &thread->test_done; + struct dmatest_info *info; + struct dmatest_params *params; + struct dma_chan *chan; +@@ -605,9 +619,9 @@ static int dmatest_func(void *data) + continue; + } + +- done.done = false; ++ done->done = false; + tx->callback = dmatest_callback; +- tx->callback_param = &done; ++ tx->callback_param = done; + cookie = tx->tx_submit(tx); + + if (dma_submit_error(cookie)) { +@@ -620,21 +634,12 @@ static int dmatest_func(void *data) + } + dma_async_issue_pending(chan); + +- wait_event_freezable_timeout(done_wait, done.done, ++ wait_event_freezable_timeout(thread->done_wait, done->done, + msecs_to_jiffies(params->timeout)); + + status = dma_async_is_tx_complete(chan, cookie, NULL, NULL); + +- if (!done.done) { +- /* +- * We're leaving the timed out dma operation with +- * dangling pointer to done_wait. To make this +- * correct, we'll need to allocate wait_done for +- * each test iteration and perform "who's gonna +- * free it this time?" dancing. For now, just +- * leave it dangling. +- */ +- WARN(1, "dmatest: Kernel stack may be corrupted!!\n"); ++ if (!done->done) { + dmaengine_unmap_put(um); + result("test timed out", total_tests, src_off, dst_off, + len, 0); +@@ -708,7 +713,7 @@ err_thread_type: + dmatest_KBs(runtime, total_len), ret); + + /* terminate all transfers on specified channels */ +- if (ret) ++ if (ret || failed_tests) + dmaengine_terminate_all(chan); + + thread->done = true; +@@ -766,6 +771,8 @@ static int dmatest_add_threads(struct dmatest_info *info, + thread->info = info; + thread->chan = dtc->chan; + thread->type = type; ++ thread->test_done.wait = &thread->done_wait; ++ init_waitqueue_head(&thread->done_wait); + smp_wmb(); + thread->task = kthread_create(dmatest_func, thread, "%s-%s%u", + dma_chan_name(chan), op, i); +diff --git a/drivers/dma/pl330.c b/drivers/dma/pl330.c +index 3dabc52b9615..cb731749205a 100644 +--- a/drivers/dma/pl330.c ++++ b/drivers/dma/pl330.c +@@ -1651,7 +1651,6 @@ static bool _chan_ns(const struct pl330_dmac *pl330, int i) + static struct pl330_thread *pl330_request_channel(struct pl330_dmac *pl330) + { + struct pl330_thread *thrd = NULL; +- unsigned long flags; + int chans, i; + + if (pl330->state == DYING) +@@ -1659,8 +1658,6 @@ static struct pl330_thread *pl330_request_channel(struct pl330_dmac *pl330) + + chans = pl330->pcfg.num_chan; + +- spin_lock_irqsave(&pl330->lock, flags); +- + for (i = 0; i < chans; i++) { + thrd = &pl330->channels[i]; + if ((thrd->free) && (!_manager_ns(thrd) || +@@ -1678,8 +1675,6 @@ static struct pl330_thread *pl330_request_channel(struct pl330_dmac *pl330) + thrd = NULL; + } + +- spin_unlock_irqrestore(&pl330->lock, flags); +- + return thrd; + } + +@@ -1697,7 +1692,6 @@ static inline void _free_event(struct pl330_thread *thrd, int ev) + static void pl330_release_channel(struct pl330_thread *thrd) + { + struct pl330_dmac *pl330; +- unsigned long flags; + + if (!thrd || thrd->free) + return; +@@ -1709,10 +1703,8 @@ static void pl330_release_channel(struct pl330_thread *thrd) + + pl330 = thrd->dmac; + +- spin_lock_irqsave(&pl330->lock, flags); + _free_event(thrd, thrd->ev); + thrd->free = true; +- spin_unlock_irqrestore(&pl330->lock, flags); + } + + /* Initialize the structure for PL330 configuration, that can be used +@@ -2077,20 +2069,20 @@ static int pl330_alloc_chan_resources(struct dma_chan *chan) + struct pl330_dmac *pl330 = pch->dmac; + unsigned long flags; + +- spin_lock_irqsave(&pch->lock, flags); ++ spin_lock_irqsave(&pl330->lock, flags); + + dma_cookie_init(chan); + pch->cyclic = false; + + pch->thread = pl330_request_channel(pl330); + if (!pch->thread) { +- spin_unlock_irqrestore(&pch->lock, flags); ++ spin_unlock_irqrestore(&pl330->lock, flags); + return -ENOMEM; + } + + tasklet_init(&pch->task, pl330_tasklet, (unsigned long) pch); + +- spin_unlock_irqrestore(&pch->lock, flags); ++ spin_unlock_irqrestore(&pl330->lock, flags); + + return 1; + } +@@ -2188,12 +2180,13 @@ static int pl330_pause(struct dma_chan *chan) + static void pl330_free_chan_resources(struct dma_chan *chan) + { + struct dma_pl330_chan *pch = to_pchan(chan); ++ struct pl330_dmac *pl330 = pch->dmac; + unsigned long flags; + + tasklet_kill(&pch->task); + + pm_runtime_get_sync(pch->dmac->ddma.dev); +- spin_lock_irqsave(&pch->lock, flags); ++ spin_lock_irqsave(&pl330->lock, flags); + + pl330_release_channel(pch->thread); + pch->thread = NULL; +@@ -2201,7 +2194,7 @@ static void pl330_free_chan_resources(struct dma_chan *chan) + if (pch->cyclic) + list_splice_tail_init(&pch->work_list, &pch->dmac->desc_pool); + +- spin_unlock_irqrestore(&pch->lock, flags); ++ spin_unlock_irqrestore(&pl330->lock, flags); + pm_runtime_mark_last_busy(pch->dmac->ddma.dev); + pm_runtime_put_autosuspend(pch->dmac->ddma.dev); + } +diff --git a/drivers/edac/i5000_edac.c b/drivers/edac/i5000_edac.c +index 72e07e3cf718..16e0eb523439 100644 +--- a/drivers/edac/i5000_edac.c ++++ b/drivers/edac/i5000_edac.c +@@ -227,7 +227,7 @@ + #define NREC_RDWR(x) (((x)>>11) & 1) + #define NREC_RANK(x) (((x)>>8) & 0x7) + #define NRECMEMB 0xC0 +-#define NREC_CAS(x) (((x)>>16) & 0xFFFFFF) ++#define NREC_CAS(x) (((x)>>16) & 0xFFF) + #define NREC_RAS(x) ((x) & 0x7FFF) + #define NRECFGLOG 0xC4 + #define NREEECFBDA 0xC8 +@@ -371,7 +371,7 @@ struct i5000_error_info { + /* These registers are input ONLY if there was a + * Non-Recoverable Error */ + u16 nrecmema; /* Non-Recoverable Mem log A */ +- u16 nrecmemb; /* Non-Recoverable Mem log B */ ++ u32 nrecmemb; /* Non-Recoverable Mem log B */ + + }; + +@@ -407,7 +407,7 @@ static void i5000_get_error_info(struct mem_ctl_info *mci, + NERR_FAT_FBD, &info->nerr_fat_fbd); + pci_read_config_word(pvt->branchmap_werrors, + NRECMEMA, &info->nrecmema); +- pci_read_config_word(pvt->branchmap_werrors, ++ pci_read_config_dword(pvt->branchmap_werrors, + NRECMEMB, &info->nrecmemb); + + /* Clear the error bits, by writing them back */ +@@ -1293,7 +1293,7 @@ static int i5000_init_csrows(struct mem_ctl_info *mci) + dimm->mtype = MEM_FB_DDR2; + + /* ask what device type on this row */ +- if (MTR_DRAM_WIDTH(mtr)) ++ if (MTR_DRAM_WIDTH(mtr) == 8) + dimm->dtype = DEV_X8; + else + dimm->dtype = DEV_X4; +diff --git a/drivers/edac/i5400_edac.c b/drivers/edac/i5400_edac.c +index 6ef6ad1ba16e..2ea2f32e608b 100644 +--- a/drivers/edac/i5400_edac.c ++++ b/drivers/edac/i5400_edac.c +@@ -368,7 +368,7 @@ struct i5400_error_info { + + /* These registers are input ONLY if there was a Non-Rec Error */ + u16 nrecmema; /* Non-Recoverable Mem log A */ +- u16 nrecmemb; /* Non-Recoverable Mem log B */ ++ u32 nrecmemb; /* Non-Recoverable Mem log B */ + + }; + +@@ -458,7 +458,7 @@ static void i5400_get_error_info(struct mem_ctl_info *mci, + NERR_FAT_FBD, &info->nerr_fat_fbd); + pci_read_config_word(pvt->branchmap_werrors, + NRECMEMA, &info->nrecmema); +- pci_read_config_word(pvt->branchmap_werrors, ++ pci_read_config_dword(pvt->branchmap_werrors, + NRECMEMB, &info->nrecmemb); + + /* Clear the error bits, by writing them back */ +@@ -1207,13 +1207,14 @@ static int i5400_init_dimms(struct mem_ctl_info *mci) + + dimm->nr_pages = size_mb << 8; + dimm->grain = 8; +- dimm->dtype = MTR_DRAM_WIDTH(mtr) ? DEV_X8 : DEV_X4; ++ dimm->dtype = MTR_DRAM_WIDTH(mtr) == 8 ? ++ DEV_X8 : DEV_X4; + dimm->mtype = MEM_FB_DDR2; + /* + * The eccc mechanism is SDDC (aka SECC), with + * is similar to Chipkill. + */ +- dimm->edac_mode = MTR_DRAM_WIDTH(mtr) ? ++ dimm->edac_mode = MTR_DRAM_WIDTH(mtr) == 8 ? + EDAC_S8ECD8ED : EDAC_S4ECD4ED; + ndimms++; + } +diff --git a/drivers/edac/sb_edac.c b/drivers/edac/sb_edac.c +index cb46c468b01e..25e51151b957 100644 +--- a/drivers/edac/sb_edac.c ++++ b/drivers/edac/sb_edac.c +@@ -1700,6 +1700,7 @@ static int ibridge_mci_bind_devs(struct mem_ctl_info *mci, + break; + case PCI_DEVICE_ID_INTEL_IBRIDGE_IMC_HA0_TA: + pvt->pci_ta = pdev; ++ break; + case PCI_DEVICE_ID_INTEL_IBRIDGE_IMC_HA0_RAS: + pvt->pci_ras = pdev; + break; +diff --git a/drivers/gpio/gpio-74xx-mmio.c b/drivers/gpio/gpio-74xx-mmio.c +index 0763655cca6c..6ed7c0fb3378 100644 +--- a/drivers/gpio/gpio-74xx-mmio.c ++++ b/drivers/gpio/gpio-74xx-mmio.c +@@ -129,7 +129,7 @@ static int mmio_74xx_gpio_probe(struct platform_device *pdev) + if (IS_ERR(dat)) + return PTR_ERR(dat); + +- priv->flags = (unsigned)of_id->data; ++ priv->flags = (uintptr_t) of_id->data; + + err = bgpio_init(&priv->bgc, &pdev->dev, + DIV_ROUND_UP(MMIO_74XX_BIT_CNT(priv->flags), 8), +diff --git a/drivers/hv/hv_balloon.c b/drivers/hv/hv_balloon.c +index 9e7f93bcd3ea..15031b46c9c4 100644 +--- a/drivers/hv/hv_balloon.c ++++ b/drivers/hv/hv_balloon.c +@@ -748,7 +748,7 @@ static int pfn_covered(unsigned long start_pfn, unsigned long pfn_cnt) + * If the pfn range we are dealing with is not in the current + * "hot add block", move on. + */ +- if ((start_pfn >= has->end_pfn)) ++ if (start_pfn < has->start_pfn || start_pfn >= has->end_pfn) + continue; + + /* +@@ -811,7 +811,7 @@ static unsigned long handle_pg_range(unsigned long pg_start, + * If the pfn range we are dealing with is not in the current + * "hot add block", move on. + */ +- if ((start_pfn >= has->end_pfn)) ++ if (start_pfn < has->start_pfn || start_pfn >= has->end_pfn) + continue; + + old_covered_state = has->covered_end_pfn; +diff --git a/drivers/i2c/busses/i2c-riic.c b/drivers/i2c/busses/i2c-riic.c +index d8803c3bbfdc..16833365475f 100644 +--- a/drivers/i2c/busses/i2c-riic.c ++++ b/drivers/i2c/busses/i2c-riic.c +@@ -218,8 +218,12 @@ static irqreturn_t riic_tend_isr(int irq, void *data) + } + + if (riic->is_last || riic->err) { +- riic_clear_set_bit(riic, 0, ICIER_SPIE, RIIC_ICIER); ++ riic_clear_set_bit(riic, ICIER_TEIE, ICIER_SPIE, RIIC_ICIER); + writeb(ICCR2_SP, riic->base + RIIC_ICCR2); ++ } else { ++ /* Transfer is complete, but do not send STOP */ ++ riic_clear_set_bit(riic, ICIER_TEIE, 0, RIIC_ICIER); ++ complete(&riic->msg_done); + } + + return IRQ_HANDLED; +diff --git a/drivers/iio/adc/ti_am335x_adc.c b/drivers/iio/adc/ti_am335x_adc.c +index a0e7161f040c..58e1a54fc119 100644 +--- a/drivers/iio/adc/ti_am335x_adc.c ++++ b/drivers/iio/adc/ti_am335x_adc.c +@@ -121,7 +121,9 @@ static irqreturn_t tiadc_irq_h(int irq, void *private) + { + struct iio_dev *indio_dev = private; + struct tiadc_device *adc_dev = iio_priv(indio_dev); +- unsigned int status, config; ++ unsigned int status, config, adc_fsm; ++ unsigned short count = 0; ++ + status = tiadc_readl(adc_dev, REG_IRQSTATUS); + + /* +@@ -135,6 +137,15 @@ static irqreturn_t tiadc_irq_h(int irq, void *private) + tiadc_writel(adc_dev, REG_CTRL, config); + tiadc_writel(adc_dev, REG_IRQSTATUS, IRQENB_FIFO1OVRRUN + | IRQENB_FIFO1UNDRFLW | IRQENB_FIFO1THRES); ++ ++ /* wait for idle state. ++ * ADC needs to finish the current conversion ++ * before disabling the module ++ */ ++ do { ++ adc_fsm = tiadc_readl(adc_dev, REG_ADCFSM); ++ } while (adc_fsm != 0x10 && count++ < 100); ++ + tiadc_writel(adc_dev, REG_CTRL, (config | CNTRLREG_TSCSSENB)); + return IRQ_HANDLED; + } else if (status & IRQENB_FIFO1THRES) { +diff --git a/drivers/iio/common/hid-sensors/hid-sensor-trigger.c b/drivers/iio/common/hid-sensors/hid-sensor-trigger.c +index 3460dd0e3e99..a8db38db622e 100644 +--- a/drivers/iio/common/hid-sensors/hid-sensor-trigger.c ++++ b/drivers/iio/common/hid-sensors/hid-sensor-trigger.c +@@ -49,8 +49,6 @@ static int _hid_sensor_power_state(struct hid_sensor_common *st, bool state) + st->report_state.report_id, + st->report_state.index, + HID_USAGE_SENSOR_PROP_REPORTING_STATE_ALL_EVENTS_ENUM); +- +- poll_value = hid_sensor_read_poll_value(st); + } else { + int val; + +@@ -90,7 +88,9 @@ static int _hid_sensor_power_state(struct hid_sensor_common *st, bool state) + sensor_hub_get_feature(st->hsdev, st->power_state.report_id, + st->power_state.index, + sizeof(state_val), &state_val); +- if (state && poll_value) ++ if (state) ++ poll_value = hid_sensor_read_poll_value(st); ++ if (poll_value > 0) + msleep_interruptible(poll_value * 2); + + return 0; +diff --git a/drivers/iio/pressure/mpl115.c b/drivers/iio/pressure/mpl115.c +index a0d7deeac62f..3f90985d545e 100644 +--- a/drivers/iio/pressure/mpl115.c ++++ b/drivers/iio/pressure/mpl115.c +@@ -136,6 +136,7 @@ static const struct iio_chan_spec mpl115_channels[] = { + { + .type = IIO_TEMP, + .info_mask_separate = BIT(IIO_CHAN_INFO_RAW), ++ .info_mask_shared_by_type = + BIT(IIO_CHAN_INFO_OFFSET) | BIT(IIO_CHAN_INFO_SCALE), + }, + }; +diff --git a/drivers/iio/pressure/mpl3115.c b/drivers/iio/pressure/mpl3115.c +index 01b2e0b18878..0f5b8767ec2e 100644 +--- a/drivers/iio/pressure/mpl3115.c ++++ b/drivers/iio/pressure/mpl3115.c +@@ -182,7 +182,7 @@ static const struct iio_chan_spec mpl3115_channels[] = { + { + .type = IIO_PRESSURE, + .info_mask_separate = BIT(IIO_CHAN_INFO_RAW), +- BIT(IIO_CHAN_INFO_SCALE), ++ .info_mask_shared_by_type = BIT(IIO_CHAN_INFO_SCALE), + .scan_index = 0, + .scan_type = { + .sign = 'u', +@@ -195,7 +195,7 @@ static const struct iio_chan_spec mpl3115_channels[] = { + { + .type = IIO_TEMP, + .info_mask_separate = BIT(IIO_CHAN_INFO_RAW), +- BIT(IIO_CHAN_INFO_SCALE), ++ .info_mask_shared_by_type = BIT(IIO_CHAN_INFO_SCALE), + .scan_index = 1, + .scan_type = { + .sign = 's', +diff --git a/drivers/infiniband/hw/mlx4/qp.c b/drivers/infiniband/hw/mlx4/qp.c +index 02fc91c68027..ca24eebb5a35 100644 +--- a/drivers/infiniband/hw/mlx4/qp.c ++++ b/drivers/infiniband/hw/mlx4/qp.c +@@ -1496,7 +1496,7 @@ static int __mlx4_ib_modify_qp(struct ib_qp *ibqp, + context->mtu_msgmax = (IB_MTU_4096 << 5) | + ilog2(dev->dev->caps.max_gso_sz); + else +- context->mtu_msgmax = (IB_MTU_4096 << 5) | 12; ++ context->mtu_msgmax = (IB_MTU_4096 << 5) | 13; + } else if (attr_mask & IB_QP_PATH_MTU) { + if (attr->path_mtu < IB_MTU_256 || attr->path_mtu > IB_MTU_4096) { + pr_err("path MTU (%u) is invalid\n", +diff --git a/drivers/infiniband/hw/mlx5/main.c b/drivers/infiniband/hw/mlx5/main.c +index 57c9809e8b87..031801671b80 100644 +--- a/drivers/infiniband/hw/mlx5/main.c ++++ b/drivers/infiniband/hw/mlx5/main.c +@@ -1020,6 +1020,8 @@ static int create_umr_res(struct mlx5_ib_dev *dev) + qp->real_qp = qp; + qp->uobject = NULL; + qp->qp_type = MLX5_IB_QPT_REG_UMR; ++ qp->send_cq = init_attr->send_cq; ++ qp->recv_cq = init_attr->recv_cq; + + attr->qp_state = IB_QPS_INIT; + attr->port_num = 1; +diff --git a/drivers/infiniband/ulp/ipoib/ipoib_ib.c b/drivers/infiniband/ulp/ipoib/ipoib_ib.c +index 63b92cbb29ad..545c7ef480e8 100644 +--- a/drivers/infiniband/ulp/ipoib/ipoib_ib.c ++++ b/drivers/infiniband/ulp/ipoib/ipoib_ib.c +@@ -1052,10 +1052,15 @@ static void __ipoib_ib_dev_flush(struct ipoib_dev_priv *priv, + ipoib_ib_dev_down(dev); + + if (level == IPOIB_FLUSH_HEAVY) { ++ rtnl_lock(); + if (test_bit(IPOIB_FLAG_INITIALIZED, &priv->flags)) + ipoib_ib_dev_stop(dev); +- if (ipoib_ib_dev_open(dev) != 0) ++ ++ result = ipoib_ib_dev_open(dev); ++ rtnl_unlock(); ++ if (result) + return; ++ + if (netif_queue_stopped(dev)) + netif_start_queue(dev); + } +diff --git a/drivers/input/serio/i8042-x86ia64io.h b/drivers/input/serio/i8042-x86ia64io.h +index 18fd4cd6d3c7..74d69fdbdec9 100644 +--- a/drivers/input/serio/i8042-x86ia64io.h ++++ b/drivers/input/serio/i8042-x86ia64io.h +@@ -514,6 +514,13 @@ static const struct dmi_system_id __initconst i8042_dmi_nomux_table[] = { + DMI_MATCH(DMI_PRODUCT_NAME, "IC4I"), + }, + }, ++ { ++ /* TUXEDO BU1406 */ ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "Notebook"), ++ DMI_MATCH(DMI_PRODUCT_NAME, "N24_25BU"), ++ }, ++ }, + { } + }; + +diff --git a/drivers/iommu/intel-iommu.c b/drivers/iommu/intel-iommu.c +index 275f59071f56..9d05a711a2f4 100644 +--- a/drivers/iommu/intel-iommu.c ++++ b/drivers/iommu/intel-iommu.c +@@ -2018,10 +2018,12 @@ static int __domain_mapping(struct dmar_domain *domain, unsigned long iov_pfn, + uint64_t tmp; + + if (!sg_res) { ++ unsigned int pgoff = sg->offset & ~PAGE_MASK; ++ + sg_res = aligned_nrpages(sg->offset, sg->length); +- sg->dma_address = ((dma_addr_t)iov_pfn << VTD_PAGE_SHIFT) + sg->offset; ++ sg->dma_address = ((dma_addr_t)iov_pfn << VTD_PAGE_SHIFT) + pgoff; + sg->dma_length = sg->length; +- pteval = page_to_phys(sg_page(sg)) | prot; ++ pteval = (sg_phys(sg) - pgoff) | prot; + phys_pfn = pteval >> VTD_PAGE_SHIFT; + } + +@@ -3324,7 +3326,7 @@ static int intel_nontranslate_map_sg(struct device *hddev, + + for_each_sg(sglist, sg, nelems, i) { + BUG_ON(!sg_page(sg)); +- sg->dma_address = page_to_phys(sg_page(sg)) + sg->offset; ++ sg->dma_address = sg_phys(sg); + sg->dma_length = sg->length; + } + return nelems; +diff --git a/drivers/irqchip/irq-crossbar.c b/drivers/irqchip/irq-crossbar.c +index 2f7dffaae93a..5ba30449ee53 100644 +--- a/drivers/irqchip/irq-crossbar.c ++++ b/drivers/irqchip/irq-crossbar.c +@@ -194,7 +194,7 @@ static const struct irq_domain_ops crossbar_domain_ops = { + static int __init crossbar_of_init(struct device_node *node) + { + int i, size, reserved = 0; +- u32 max = 0, entry; ++ u32 max = 0, entry, reg_size; + const __be32 *irqsr; + int ret = -ENOMEM; + +@@ -271,9 +271,9 @@ static int __init crossbar_of_init(struct device_node *node) + if (!cb->register_offsets) + goto err_irq_map; + +- of_property_read_u32(node, "ti,reg-size", &size); ++ of_property_read_u32(node, "ti,reg-size", ®_size); + +- switch (size) { ++ switch (reg_size) { + case 1: + cb->write = crossbar_writeb; + break; +@@ -299,7 +299,7 @@ static int __init crossbar_of_init(struct device_node *node) + continue; + + cb->register_offsets[i] = reserved; +- reserved += size; ++ reserved += reg_size; + } + + of_property_read_u32(node, "ti,irqs-safe-map", &cb->safe_map); +diff --git a/drivers/md/bcache/bcache.h b/drivers/md/bcache/bcache.h +index dfdd1908641c..f8a1d20c73f4 100644 +--- a/drivers/md/bcache/bcache.h ++++ b/drivers/md/bcache/bcache.h +@@ -441,7 +441,7 @@ struct cache { + * until a gc finishes - otherwise we could pointlessly burn a ton of + * cpu + */ +- unsigned invalidate_needs_gc:1; ++ unsigned invalidate_needs_gc; + + bool discard; /* Get rid of? */ + +@@ -611,8 +611,8 @@ struct cache_set { + + /* Counts how many sectors bio_insert has added to the cache */ + atomic_t sectors_to_gc; ++ wait_queue_head_t gc_wait; + +- wait_queue_head_t moving_gc_wait; + struct keybuf moving_gc_keys; + /* Number of moving GC bios in flight */ + struct semaphore moving_in_flight; +diff --git a/drivers/md/bcache/btree.c b/drivers/md/bcache/btree.c +index 43829d9493f7..f0b75d54951a 100644 +--- a/drivers/md/bcache/btree.c ++++ b/drivers/md/bcache/btree.c +@@ -1762,33 +1762,34 @@ static void bch_btree_gc(struct cache_set *c) + bch_moving_gc(c); + } + +-static int bch_gc_thread(void *arg) ++static bool gc_should_run(struct cache_set *c) + { +- struct cache_set *c = arg; + struct cache *ca; + unsigned i; + +- while (1) { +-again: +- bch_btree_gc(c); ++ for_each_cache(ca, c, i) ++ if (ca->invalidate_needs_gc) ++ return true; + +- set_current_state(TASK_INTERRUPTIBLE); +- if (kthread_should_stop()) +- break; ++ if (atomic_read(&c->sectors_to_gc) < 0) ++ return true; + +- mutex_lock(&c->bucket_lock); ++ return false; ++} + +- for_each_cache(ca, c, i) +- if (ca->invalidate_needs_gc) { +- mutex_unlock(&c->bucket_lock); +- set_current_state(TASK_RUNNING); +- goto again; +- } ++static int bch_gc_thread(void *arg) ++{ ++ struct cache_set *c = arg; + +- mutex_unlock(&c->bucket_lock); ++ while (1) { ++ wait_event_interruptible(c->gc_wait, ++ kthread_should_stop() || gc_should_run(c)); + +- try_to_freeze(); +- schedule(); ++ if (kthread_should_stop()) ++ break; ++ ++ set_gc_sectors(c); ++ bch_btree_gc(c); + } + + return 0; +@@ -1796,11 +1797,10 @@ again: + + int bch_gc_thread_start(struct cache_set *c) + { +- c->gc_thread = kthread_create(bch_gc_thread, c, "bcache_gc"); ++ c->gc_thread = kthread_run(bch_gc_thread, c, "bcache_gc"); + if (IS_ERR(c->gc_thread)) + return PTR_ERR(c->gc_thread); + +- set_task_state(c->gc_thread, TASK_INTERRUPTIBLE); + return 0; + } + +diff --git a/drivers/md/bcache/btree.h b/drivers/md/bcache/btree.h +index 5c391fa01bed..9b80417cd547 100644 +--- a/drivers/md/bcache/btree.h ++++ b/drivers/md/bcache/btree.h +@@ -260,8 +260,7 @@ void bch_initial_mark_key(struct cache_set *, int, struct bkey *); + + static inline void wake_up_gc(struct cache_set *c) + { +- if (c->gc_thread) +- wake_up_process(c->gc_thread); ++ wake_up(&c->gc_wait); + } + + #define MAP_DONE 0 +diff --git a/drivers/md/bcache/request.c b/drivers/md/bcache/request.c +index ab43faddb447..eb496309af96 100644 +--- a/drivers/md/bcache/request.c ++++ b/drivers/md/bcache/request.c +@@ -193,14 +193,12 @@ static void bch_data_insert_start(struct closure *cl) + struct data_insert_op *op = container_of(cl, struct data_insert_op, cl); + struct bio *bio = op->bio, *n; + +- if (atomic_sub_return(bio_sectors(bio), &op->c->sectors_to_gc) < 0) { +- set_gc_sectors(op->c); +- wake_up_gc(op->c); +- } +- + if (op->bypass) + return bch_data_invalidate(cl); + ++ if (atomic_sub_return(bio_sectors(bio), &op->c->sectors_to_gc) < 0) ++ wake_up_gc(op->c); ++ + /* + * Journal writes are marked REQ_FLUSH; if the original write was a + * flush, it'll wait on the journal write. +@@ -464,6 +462,7 @@ struct search { + unsigned recoverable:1; + unsigned write:1; + unsigned read_dirty_data:1; ++ unsigned cache_missed:1; + + unsigned long start_time; + +@@ -646,6 +645,7 @@ static inline struct search *search_alloc(struct bio *bio, + + s->orig_bio = bio; + s->cache_miss = NULL; ++ s->cache_missed = 0; + s->d = d; + s->recoverable = 1; + s->write = (bio->bi_rw & REQ_WRITE) != 0; +@@ -701,7 +701,14 @@ static void cached_dev_read_error(struct closure *cl) + struct search *s = container_of(cl, struct search, cl); + struct bio *bio = &s->bio.bio; + +- if (s->recoverable) { ++ /* ++ * If read request hit dirty data (s->read_dirty_data is true), ++ * then recovery a failed read request from cached device may ++ * get a stale data back. So read failure recovery is only ++ * permitted when read request hit clean data in cache device, ++ * or when cache read race happened. ++ */ ++ if (s->recoverable && !s->read_dirty_data) { + /* Retry from the backing device: */ + trace_bcache_read_retry(s->orig_bio); + +@@ -762,7 +769,7 @@ static void cached_dev_read_done_bh(struct closure *cl) + struct cached_dev *dc = container_of(s->d, struct cached_dev, disk); + + bch_mark_cache_accounting(s->iop.c, s->d, +- !s->cache_miss, s->iop.bypass); ++ !s->cache_missed, s->iop.bypass); + trace_bcache_read(s->orig_bio, !s->cache_miss, s->iop.bypass); + + if (s->iop.error) +@@ -781,6 +788,8 @@ static int cached_dev_cache_miss(struct btree *b, struct search *s, + struct cached_dev *dc = container_of(s->d, struct cached_dev, disk); + struct bio *miss, *cache_bio; + ++ s->cache_missed = 1; ++ + if (s->cache_miss || s->iop.bypass) { + miss = bio_next_split(bio, sectors, GFP_NOIO, s->d->bio_split); + ret = miss == bio ? MAP_DONE : MAP_CONTINUE; +diff --git a/drivers/md/bcache/super.c b/drivers/md/bcache/super.c +index 8e5666ac8a6a..6f7bc8a8674b 100644 +--- a/drivers/md/bcache/super.c ++++ b/drivers/md/bcache/super.c +@@ -1523,6 +1523,7 @@ struct cache_set *bch_cache_set_alloc(struct cache_sb *sb) + mutex_init(&c->bucket_lock); + init_waitqueue_head(&c->btree_cache_wait); + init_waitqueue_head(&c->bucket_wait); ++ init_waitqueue_head(&c->gc_wait); + sema_init(&c->uuid_write_mutex, 1); + + spin_lock_init(&c->btree_gc_time.lock); +@@ -1581,6 +1582,7 @@ static void run_cache_set(struct cache_set *c) + + for_each_cache(ca, c, i) + c->nbuckets += ca->sb.nbuckets; ++ set_gc_sectors(c); + + if (CACHE_SYNC(&c->sb)) { + LIST_HEAD(journal); +@@ -2120,6 +2122,7 @@ static void bcache_exit(void) + if (bcache_major) + unregister_blkdev(bcache_major, "bcache"); + unregister_reboot_notifier(&reboot); ++ mutex_destroy(&bch_register_lock); + } + + static int __init bcache_init(void) +@@ -2138,14 +2141,15 @@ static int __init bcache_init(void) + bcache_major = register_blkdev(0, "bcache"); + if (bcache_major < 0) { + unregister_reboot_notifier(&reboot); ++ mutex_destroy(&bch_register_lock); + return bcache_major; + } + + if (!(bcache_wq = create_workqueue("bcache")) || + !(bcache_kobj = kobject_create_and_add("bcache", fs_kobj)) || +- sysfs_create_files(bcache_kobj, files) || + bch_request_init() || +- bch_debug_init(bcache_kobj)) ++ bch_debug_init(bcache_kobj) || ++ sysfs_create_files(bcache_kobj, files)) + goto err; + + return 0; +diff --git a/drivers/md/dm.c b/drivers/md/dm.c +index d192ab2ed17c..c2a13fd9e0ca 100644 +--- a/drivers/md/dm.c ++++ b/drivers/md/dm.c +@@ -1435,11 +1435,62 @@ void dm_accept_partial_bio(struct bio *bio, unsigned n_sectors) + } + EXPORT_SYMBOL_GPL(dm_accept_partial_bio); + ++/* ++ * Flush current->bio_list when the target map method blocks. ++ * This fixes deadlocks in snapshot and possibly in other targets. ++ */ ++struct dm_offload { ++ struct blk_plug plug; ++ struct blk_plug_cb cb; ++}; ++ ++static void flush_current_bio_list(struct blk_plug_cb *cb, bool from_schedule) ++{ ++ struct dm_offload *o = container_of(cb, struct dm_offload, cb); ++ struct bio_list list; ++ struct bio *bio; ++ ++ INIT_LIST_HEAD(&o->cb.list); ++ ++ if (unlikely(!current->bio_list)) ++ return; ++ ++ list = *current->bio_list; ++ bio_list_init(current->bio_list); ++ ++ while ((bio = bio_list_pop(&list))) { ++ struct bio_set *bs = bio->bi_pool; ++ if (unlikely(!bs) || bs == fs_bio_set) { ++ bio_list_add(current->bio_list, bio); ++ continue; ++ } ++ ++ spin_lock(&bs->rescue_lock); ++ bio_list_add(&bs->rescue_list, bio); ++ queue_work(bs->rescue_workqueue, &bs->rescue_work); ++ spin_unlock(&bs->rescue_lock); ++ } ++} ++ ++static void dm_offload_start(struct dm_offload *o) ++{ ++ blk_start_plug(&o->plug); ++ o->cb.callback = flush_current_bio_list; ++ list_add(&o->cb.list, ¤t->plug->cb_list); ++} ++ ++static void dm_offload_end(struct dm_offload *o) ++{ ++ list_del(&o->cb.list); ++ blk_finish_plug(&o->plug); ++} ++ + static void __map_bio(struct dm_target_io *tio) + { + int r; + sector_t sector; + struct mapped_device *md; ++ struct dm_offload o; + struct bio *clone = &tio->clone; + struct dm_target *ti = tio->ti; + +@@ -1452,7 +1503,11 @@ static void __map_bio(struct dm_target_io *tio) + */ + atomic_inc(&tio->io->io_count); + sector = clone->bi_iter.bi_sector; ++ ++ dm_offload_start(&o); + r = ti->type->map(ti, clone); ++ dm_offload_end(&o); ++ + if (r == DM_MAPIO_REMAPPED) { + /* the bio has been remapped so dispatch it */ + +diff --git a/drivers/md/md-cluster.c b/drivers/md/md-cluster.c +index fcfc4b9b2672..4eb5cb18f98d 100644 +--- a/drivers/md/md-cluster.c ++++ b/drivers/md/md-cluster.c +@@ -738,6 +738,7 @@ static int leave(struct mddev *mddev) + lockres_free(cinfo->sb_lock); + lockres_free(cinfo->bitmap_lockres); + dlm_release_lockspace(cinfo->lockspace, 2); ++ kfree(cinfo); + return 0; + } + +diff --git a/drivers/md/raid10.c b/drivers/md/raid10.c +index 0ba6c358c6e0..4cbc3df79a2a 100644 +--- a/drivers/md/raid10.c ++++ b/drivers/md/raid10.c +@@ -1161,6 +1161,8 @@ static void __make_request(struct mddev *mddev, struct bio *bio) + int max_sectors; + int sectors; + ++ md_write_start(mddev, bio); ++ + /* + * Register the new request and wait if the reconstruction + * thread has put up a bar for new requests. +@@ -1559,8 +1561,6 @@ static void make_request(struct mddev *mddev, struct bio *bio) + return; + } + +- md_write_start(mddev, bio); +- + do { + + /* +diff --git a/drivers/md/raid5.c b/drivers/md/raid5.c +index 02e6d335f178..907aa9c6e894 100644 +--- a/drivers/md/raid5.c ++++ b/drivers/md/raid5.c +@@ -1679,8 +1679,11 @@ static void ops_complete_reconstruct(void *stripe_head_ref) + struct r5dev *dev = &sh->dev[i]; + + if (dev->written || i == pd_idx || i == qd_idx) { +- if (!discard && !test_bit(R5_SkipCopy, &dev->flags)) ++ if (!discard && !test_bit(R5_SkipCopy, &dev->flags)) { + set_bit(R5_UPTODATE, &dev->flags); ++ if (test_bit(STRIPE_EXPAND_READY, &sh->state)) ++ set_bit(R5_Expanded, &dev->flags); ++ } + if (fua) + set_bit(R5_WantFUA, &dev->flags); + if (sync) +diff --git a/drivers/media/usb/dvb-usb/dibusb-common.c b/drivers/media/usb/dvb-usb/dibusb-common.c +index ef3a8f75f82e..7b15aea2723d 100644 +--- a/drivers/media/usb/dvb-usb/dibusb-common.c ++++ b/drivers/media/usb/dvb-usb/dibusb-common.c +@@ -179,8 +179,20 @@ EXPORT_SYMBOL(dibusb_i2c_algo); + + int dibusb_read_eeprom_byte(struct dvb_usb_device *d, u8 offs, u8 *val) + { +- u8 wbuf[1] = { offs }; +- return dibusb_i2c_msg(d, 0x50, wbuf, 1, val, 1); ++ u8 *buf; ++ int rc; ++ ++ buf = kmalloc(2, GFP_KERNEL); ++ if (!buf) ++ return -ENOMEM; ++ ++ buf[0] = offs; ++ ++ rc = dibusb_i2c_msg(d, 0x50, &buf[0], 1, &buf[1], 1); ++ *val = buf[1]; ++ kfree(buf); ++ ++ return rc; + } + EXPORT_SYMBOL(dibusb_read_eeprom_byte); + +diff --git a/drivers/media/usb/uvc/uvc_driver.c b/drivers/media/usb/uvc/uvc_driver.c +index 5970dd6a1c1c..a41a4f6a51b2 100644 +--- a/drivers/media/usb/uvc/uvc_driver.c ++++ b/drivers/media/usb/uvc/uvc_driver.c +@@ -1574,6 +1574,114 @@ static const char *uvc_print_chain(struct uvc_video_chain *chain) + return buffer; + } + ++static struct uvc_video_chain *uvc_alloc_chain(struct uvc_device *dev) ++{ ++ struct uvc_video_chain *chain; ++ ++ chain = kzalloc(sizeof(*chain), GFP_KERNEL); ++ if (chain == NULL) ++ return NULL; ++ ++ INIT_LIST_HEAD(&chain->entities); ++ mutex_init(&chain->ctrl_mutex); ++ chain->dev = dev; ++ v4l2_prio_init(&chain->prio); ++ ++ return chain; ++} ++ ++/* ++ * Fallback heuristic for devices that don't connect units and terminals in a ++ * valid chain. ++ * ++ * Some devices have invalid baSourceID references, causing uvc_scan_chain() ++ * to fail, but if we just take the entities we can find and put them together ++ * in the most sensible chain we can think of, turns out they do work anyway. ++ * Note: This heuristic assumes there is a single chain. ++ * ++ * At the time of writing, devices known to have such a broken chain are ++ * - Acer Integrated Camera (5986:055a) ++ * - Realtek rtl157a7 (0bda:57a7) ++ */ ++static int uvc_scan_fallback(struct uvc_device *dev) ++{ ++ struct uvc_video_chain *chain; ++ struct uvc_entity *iterm = NULL; ++ struct uvc_entity *oterm = NULL; ++ struct uvc_entity *entity; ++ struct uvc_entity *prev; ++ ++ /* ++ * Start by locating the input and output terminals. We only support ++ * devices with exactly one of each for now. ++ */ ++ list_for_each_entry(entity, &dev->entities, list) { ++ if (UVC_ENTITY_IS_ITERM(entity)) { ++ if (iterm) ++ return -EINVAL; ++ iterm = entity; ++ } ++ ++ if (UVC_ENTITY_IS_OTERM(entity)) { ++ if (oterm) ++ return -EINVAL; ++ oterm = entity; ++ } ++ } ++ ++ if (iterm == NULL || oterm == NULL) ++ return -EINVAL; ++ ++ /* Allocate the chain and fill it. */ ++ chain = uvc_alloc_chain(dev); ++ if (chain == NULL) ++ return -ENOMEM; ++ ++ if (uvc_scan_chain_entity(chain, oterm) < 0) ++ goto error; ++ ++ prev = oterm; ++ ++ /* ++ * Add all Processing and Extension Units with two pads. The order ++ * doesn't matter much, use reverse list traversal to connect units in ++ * UVC descriptor order as we build the chain from output to input. This ++ * leads to units appearing in the order meant by the manufacturer for ++ * the cameras known to require this heuristic. ++ */ ++ list_for_each_entry_reverse(entity, &dev->entities, list) { ++ if (entity->type != UVC_VC_PROCESSING_UNIT && ++ entity->type != UVC_VC_EXTENSION_UNIT) ++ continue; ++ ++ if (entity->num_pads != 2) ++ continue; ++ ++ if (uvc_scan_chain_entity(chain, entity) < 0) ++ goto error; ++ ++ prev->baSourceID[0] = entity->id; ++ prev = entity; ++ } ++ ++ if (uvc_scan_chain_entity(chain, iterm) < 0) ++ goto error; ++ ++ prev->baSourceID[0] = iterm->id; ++ ++ list_add_tail(&chain->list, &dev->chains); ++ ++ uvc_trace(UVC_TRACE_PROBE, ++ "Found a video chain by fallback heuristic (%s).\n", ++ uvc_print_chain(chain)); ++ ++ return 0; ++ ++error: ++ kfree(chain); ++ return -EINVAL; ++} ++ + /* + * Scan the device for video chains and register video devices. + * +@@ -1596,15 +1704,10 @@ static int uvc_scan_device(struct uvc_device *dev) + if (term->chain.next || term->chain.prev) + continue; + +- chain = kzalloc(sizeof(*chain), GFP_KERNEL); ++ chain = uvc_alloc_chain(dev); + if (chain == NULL) + return -ENOMEM; + +- INIT_LIST_HEAD(&chain->entities); +- mutex_init(&chain->ctrl_mutex); +- chain->dev = dev; +- v4l2_prio_init(&chain->prio); +- + term->flags |= UVC_ENTITY_FLAG_DEFAULT; + + if (uvc_scan_chain(chain, term) < 0) { +@@ -1618,6 +1721,9 @@ static int uvc_scan_device(struct uvc_device *dev) + list_add_tail(&chain->list, &dev->chains); + } + ++ if (list_empty(&dev->chains)) ++ uvc_scan_fallback(dev); ++ + if (list_empty(&dev->chains)) { + uvc_printk(KERN_INFO, "No valid video chain found.\n"); + return -1; +diff --git a/drivers/media/usb/uvc/uvc_queue.c b/drivers/media/usb/uvc/uvc_queue.c +index 87a19f33e460..6d072cae6134 100644 +--- a/drivers/media/usb/uvc/uvc_queue.c ++++ b/drivers/media/usb/uvc/uvc_queue.c +@@ -399,7 +399,7 @@ struct uvc_buffer *uvc_queue_next_buffer(struct uvc_video_queue *queue, + nextbuf = NULL; + spin_unlock_irqrestore(&queue->irqlock, flags); + +- buf->state = buf->error ? VB2_BUF_STATE_ERROR : UVC_BUF_STATE_DONE; ++ buf->state = buf->error ? UVC_BUF_STATE_ERROR : UVC_BUF_STATE_DONE; + vb2_set_plane_payload(&buf->buf, 0, buf->bytesused); + vb2_buffer_done(&buf->buf, VB2_BUF_STATE_DONE); + +diff --git a/drivers/memory/omap-gpmc.c b/drivers/memory/omap-gpmc.c +index 2c51acce4b34..fedb19d1516b 100644 +--- a/drivers/memory/omap-gpmc.c ++++ b/drivers/memory/omap-gpmc.c +@@ -1892,9 +1892,7 @@ static int gpmc_probe_onenand_child(struct platform_device *pdev, + if (!of_property_read_u32(child, "dma-channel", &val)) + gpmc_onenand_data->dma_channel = val; + +- gpmc_onenand_init(gpmc_onenand_data); +- +- return 0; ++ return gpmc_onenand_init(gpmc_onenand_data); + } + #else + static int gpmc_probe_onenand_child(struct platform_device *pdev, +diff --git a/drivers/mtd/maps/pmcmsp-flash.c b/drivers/mtd/maps/pmcmsp-flash.c +index 744ca5cacc9b..cf54420f943d 100644 +--- a/drivers/mtd/maps/pmcmsp-flash.c ++++ b/drivers/mtd/maps/pmcmsp-flash.c +@@ -139,15 +139,13 @@ static int __init init_msp_flash(void) + } + + msp_maps[i].bankwidth = 1; +- msp_maps[i].name = kmalloc(7, GFP_KERNEL); ++ msp_maps[i].name = kstrndup(flash_name, 7, GFP_KERNEL); + if (!msp_maps[i].name) { + iounmap(msp_maps[i].virt); + kfree(msp_parts[i]); + goto cleanup_loop; + } + +- msp_maps[i].name = strncpy(msp_maps[i].name, flash_name, 7); +- + for (j = 0; j < pcnt; j++) { + part_name[5] = '0' + i; + part_name[7] = '0' + j; +diff --git a/drivers/net/appletalk/ipddp.c b/drivers/net/appletalk/ipddp.c +index e90c6a7333d7..2e4649655181 100644 +--- a/drivers/net/appletalk/ipddp.c ++++ b/drivers/net/appletalk/ipddp.c +@@ -191,7 +191,7 @@ static netdev_tx_t ipddp_xmit(struct sk_buff *skb, struct net_device *dev) + */ + static int ipddp_create(struct ipddp_route *new_rt) + { +- struct ipddp_route *rt = kmalloc(sizeof(*rt), GFP_KERNEL); ++ struct ipddp_route *rt = kzalloc(sizeof(*rt), GFP_KERNEL); + + if (rt == NULL) + return -ENOMEM; +diff --git a/drivers/net/can/ti_hecc.c b/drivers/net/can/ti_hecc.c +index 7bb3cf38f346..2965453853f3 100644 +--- a/drivers/net/can/ti_hecc.c ++++ b/drivers/net/can/ti_hecc.c +@@ -652,6 +652,9 @@ static int ti_hecc_rx_poll(struct napi_struct *napi, int quota) + mbx_mask = hecc_read(priv, HECC_CANMIM); + mbx_mask |= HECC_TX_MBOX_MASK; + hecc_write(priv, HECC_CANMIM, mbx_mask); ++ } else { ++ /* repoll is done only if whole budget is used */ ++ num_pkts = quota; + } + + return num_pkts; +diff --git a/drivers/net/can/usb/ems_usb.c b/drivers/net/can/usb/ems_usb.c +index 339b0c5ce60c..a5b92d8ff345 100644 +--- a/drivers/net/can/usb/ems_usb.c ++++ b/drivers/net/can/usb/ems_usb.c +@@ -290,6 +290,8 @@ static void ems_usb_read_interrupt_callback(struct urb *urb) + + case -ECONNRESET: /* unlink */ + case -ENOENT: ++ case -EPIPE: ++ case -EPROTO: + case -ESHUTDOWN: + return; + +diff --git a/drivers/net/can/usb/esd_usb2.c b/drivers/net/can/usb/esd_usb2.c +index 730a2bac124d..f413c0b7be23 100644 +--- a/drivers/net/can/usb/esd_usb2.c ++++ b/drivers/net/can/usb/esd_usb2.c +@@ -396,6 +396,8 @@ static void esd_usb2_read_bulk_callback(struct urb *urb) + break; + + case -ENOENT: ++ case -EPIPE: ++ case -EPROTO: + case -ESHUTDOWN: + return; + +diff --git a/drivers/net/can/usb/kvaser_usb.c b/drivers/net/can/usb/kvaser_usb.c +index dc77225227c7..699fdaf19895 100644 +--- a/drivers/net/can/usb/kvaser_usb.c ++++ b/drivers/net/can/usb/kvaser_usb.c +@@ -603,8 +603,8 @@ static int kvaser_usb_wait_msg(const struct kvaser_usb *dev, u8 id, + } + + if (pos + tmp->len > actual_len) { +- dev_err(dev->udev->dev.parent, +- "Format error\n"); ++ dev_err_ratelimited(dev->udev->dev.parent, ++ "Format error\n"); + break; + } + +@@ -809,6 +809,7 @@ static int kvaser_usb_simple_msg_async(struct kvaser_usb_net_priv *priv, + if (err) { + netdev_err(netdev, "Error transmitting URB\n"); + usb_unanchor_urb(urb); ++ kfree(buf); + usb_free_urb(urb); + return err; + } +@@ -1322,6 +1323,8 @@ static void kvaser_usb_read_bulk_callback(struct urb *urb) + case 0: + break; + case -ENOENT: ++ case -EPIPE: ++ case -EPROTO: + case -ESHUTDOWN: + return; + default: +@@ -1330,7 +1333,7 @@ static void kvaser_usb_read_bulk_callback(struct urb *urb) + goto resubmit_urb; + } + +- while (pos <= urb->actual_length - MSG_HEADER_LEN) { ++ while (pos <= (int)(urb->actual_length - MSG_HEADER_LEN)) { + msg = urb->transfer_buffer + pos; + + /* The Kvaser firmware can only read and write messages that +@@ -1349,7 +1352,8 @@ static void kvaser_usb_read_bulk_callback(struct urb *urb) + } + + if (pos + msg->len > urb->actual_length) { +- dev_err(dev->udev->dev.parent, "Format error\n"); ++ dev_err_ratelimited(dev->udev->dev.parent, ++ "Format error\n"); + break; + } + +@@ -1768,6 +1772,7 @@ static netdev_tx_t kvaser_usb_start_xmit(struct sk_buff *skb, + spin_unlock_irqrestore(&priv->tx_contexts_lock, flags); + + usb_unanchor_urb(urb); ++ kfree(buf); + + stats->tx_dropped++; + +diff --git a/drivers/net/can/usb/usb_8dev.c b/drivers/net/can/usb/usb_8dev.c +index d60a9fcc9896..4f4a5be07634 100644 +--- a/drivers/net/can/usb/usb_8dev.c ++++ b/drivers/net/can/usb/usb_8dev.c +@@ -528,6 +528,8 @@ static void usb_8dev_read_bulk_callback(struct urb *urb) + break; + + case -ENOENT: ++ case -EPIPE: ++ case -EPROTO: + case -ESHUTDOWN: + return; + +diff --git a/drivers/net/ethernet/broadcom/bcmsysport.c b/drivers/net/ethernet/broadcom/bcmsysport.c +index 783543ad1fcf..621a970bddf6 100644 +--- a/drivers/net/ethernet/broadcom/bcmsysport.c ++++ b/drivers/net/ethernet/broadcom/bcmsysport.c +@@ -955,15 +955,6 @@ static netdev_tx_t bcm_sysport_xmit(struct sk_buff *skb, + goto out; + } + +- /* Insert TSB and checksum infos */ +- if (priv->tsb_en) { +- skb = bcm_sysport_insert_tsb(skb, dev); +- if (!skb) { +- ret = NETDEV_TX_OK; +- goto out; +- } +- } +- + /* The Ethernet switch we are interfaced with needs packets to be at + * least 64 bytes (including FCS) otherwise they will be discarded when + * they enter the switch port logic. When Broadcom tags are enabled, we +@@ -971,13 +962,21 @@ static netdev_tx_t bcm_sysport_xmit(struct sk_buff *skb, + * (including FCS and tag) because the length verification is done after + * the Broadcom tag is stripped off the ingress packet. + */ +- if (skb_padto(skb, ETH_ZLEN + ENET_BRCM_TAG_LEN)) { ++ if (skb_put_padto(skb, ETH_ZLEN + ENET_BRCM_TAG_LEN)) { + ret = NETDEV_TX_OK; + goto out; + } + +- skb_len = skb->len < ETH_ZLEN + ENET_BRCM_TAG_LEN ? +- ETH_ZLEN + ENET_BRCM_TAG_LEN : skb->len; ++ /* Insert TSB and checksum infos */ ++ if (priv->tsb_en) { ++ skb = bcm_sysport_insert_tsb(skb, dev); ++ if (!skb) { ++ ret = NETDEV_TX_OK; ++ goto out; ++ } ++ } ++ ++ skb_len = skb->len; + + mapping = dma_map_single(kdev, skb->data, skb_len, DMA_TO_DEVICE); + if (dma_mapping_error(kdev, mapping)) { +diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c +index 8a97d28f3d65..a1d149515531 100644 +--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c ++++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c +@@ -13227,7 +13227,7 @@ static int bnx2x_ptp_adjfreq(struct ptp_clock_info *ptp, s32 ppb) + if (!netif_running(bp->dev)) { + DP(BNX2X_MSG_PTP, + "PTP adjfreq called while the interface is down\n"); +- return -EFAULT; ++ return -ENETDOWN; + } + + if (ppb < 0) { +@@ -13286,6 +13286,12 @@ static int bnx2x_ptp_adjtime(struct ptp_clock_info *ptp, s64 delta) + { + struct bnx2x *bp = container_of(ptp, struct bnx2x, ptp_clock_info); + ++ if (!netif_running(bp->dev)) { ++ DP(BNX2X_MSG_PTP, ++ "PTP adjtime called while the interface is down\n"); ++ return -ENETDOWN; ++ } ++ + DP(BNX2X_MSG_PTP, "PTP adjtime called, delta = %llx\n", delta); + + timecounter_adjtime(&bp->timecounter, delta); +@@ -13298,6 +13304,12 @@ static int bnx2x_ptp_gettime(struct ptp_clock_info *ptp, struct timespec64 *ts) + struct bnx2x *bp = container_of(ptp, struct bnx2x, ptp_clock_info); + u64 ns; + ++ if (!netif_running(bp->dev)) { ++ DP(BNX2X_MSG_PTP, ++ "PTP gettime called while the interface is down\n"); ++ return -ENETDOWN; ++ } ++ + ns = timecounter_read(&bp->timecounter); + + DP(BNX2X_MSG_PTP, "PTP gettime called, ns = %llu\n", ns); +@@ -13313,6 +13325,12 @@ static int bnx2x_ptp_settime(struct ptp_clock_info *ptp, + struct bnx2x *bp = container_of(ptp, struct bnx2x, ptp_clock_info); + u64 ns; + ++ if (!netif_running(bp->dev)) { ++ DP(BNX2X_MSG_PTP, ++ "PTP settime called while the interface is down\n"); ++ return -ENETDOWN; ++ } ++ + ns = timespec64_to_ns(ts); + + DP(BNX2X_MSG_PTP, "PTP settime called, ns = %llu\n", ns); +diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_vfpf.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_vfpf.c +index 06b8c0d8fd3b..996d2dc21bde 100644 +--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_vfpf.c ++++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_vfpf.c +@@ -852,7 +852,7 @@ int bnx2x_vfpf_set_mcast(struct net_device *dev) + struct bnx2x *bp = netdev_priv(dev); + struct vfpf_set_q_filters_tlv *req = &bp->vf2pf_mbox->req.set_q_filters; + struct pfvf_general_resp_tlv *resp = &bp->vf2pf_mbox->resp.general_resp; +- int rc, i = 0; ++ int rc = 0, i = 0; + struct netdev_hw_addr *ha; + + if (bp->state != BNX2X_STATE_OPEN) { +@@ -867,6 +867,15 @@ int bnx2x_vfpf_set_mcast(struct net_device *dev) + /* Get Rx mode requested */ + DP(NETIF_MSG_IFUP, "dev->flags = %x\n", dev->flags); + ++ /* We support PFVF_MAX_MULTICAST_PER_VF mcast addresses tops */ ++ if (netdev_mc_count(dev) > PFVF_MAX_MULTICAST_PER_VF) { ++ DP(NETIF_MSG_IFUP, ++ "VF supports not more than %d multicast MAC addresses\n", ++ PFVF_MAX_MULTICAST_PER_VF); ++ rc = -EINVAL; ++ goto out; ++ } ++ + netdev_for_each_mc_addr(ha, dev) { + DP(NETIF_MSG_IFUP, "Adding mcast MAC: %pM\n", + bnx2x_mc_addr(ha)); +@@ -874,16 +883,6 @@ int bnx2x_vfpf_set_mcast(struct net_device *dev) + i++; + } + +- /* We support four PFVF_MAX_MULTICAST_PER_VF mcast +- * addresses tops +- */ +- if (i >= PFVF_MAX_MULTICAST_PER_VF) { +- DP(NETIF_MSG_IFUP, +- "VF supports not more than %d multicast MAC addresses\n", +- PFVF_MAX_MULTICAST_PER_VF); +- return -EINVAL; +- } +- + req->n_multicast = i; + req->flags |= VFPF_SET_Q_FILTERS_MULTICAST_CHANGED; + req->vf_qid = 0; +@@ -908,7 +907,7 @@ int bnx2x_vfpf_set_mcast(struct net_device *dev) + out: + bnx2x_vfpf_finalize(bp, &req->first_tlv); + +- return 0; ++ return rc; + } + + int bnx2x_vfpf_storm_rx_mode(struct bnx2x *bp) +diff --git a/drivers/net/ethernet/broadcom/genet/bcmgenet.c b/drivers/net/ethernet/broadcom/genet/bcmgenet.c +index a9fcac044e9e..77fc04271244 100644 +--- a/drivers/net/ethernet/broadcom/genet/bcmgenet.c ++++ b/drivers/net/ethernet/broadcom/genet/bcmgenet.c +@@ -1,7 +1,7 @@ + /* + * Broadcom GENET (Gigabit Ethernet) controller driver + * +- * Copyright (c) 2014 Broadcom Corporation ++ * Copyright (c) 2014-2017 Broadcom + * + * This program is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License version 2 as +@@ -631,8 +631,9 @@ static const struct bcmgenet_stats bcmgenet_gstrings_stats[] = { + STAT_GENET_RUNT("rx_runt_bytes", mib.rx_runt_bytes), + /* Misc UniMAC counters */ + STAT_GENET_MISC("rbuf_ovflow_cnt", mib.rbuf_ovflow_cnt, +- UMAC_RBUF_OVFL_CNT), +- STAT_GENET_MISC("rbuf_err_cnt", mib.rbuf_err_cnt, UMAC_RBUF_ERR_CNT), ++ UMAC_RBUF_OVFL_CNT_V1), ++ STAT_GENET_MISC("rbuf_err_cnt", mib.rbuf_err_cnt, ++ UMAC_RBUF_ERR_CNT_V1), + STAT_GENET_MISC("mdf_err_cnt", mib.mdf_err_cnt, UMAC_MDF_ERR_CNT), + STAT_GENET_SOFT_MIB("alloc_rx_buff_failed", mib.alloc_rx_buff_failed), + STAT_GENET_SOFT_MIB("rx_dma_failed", mib.rx_dma_failed), +@@ -675,6 +676,45 @@ static void bcmgenet_get_strings(struct net_device *dev, u32 stringset, + } + } + ++static u32 bcmgenet_update_stat_misc(struct bcmgenet_priv *priv, u16 offset) ++{ ++ u16 new_offset; ++ u32 val; ++ ++ switch (offset) { ++ case UMAC_RBUF_OVFL_CNT_V1: ++ if (GENET_IS_V2(priv)) ++ new_offset = RBUF_OVFL_CNT_V2; ++ else ++ new_offset = RBUF_OVFL_CNT_V3PLUS; ++ ++ val = bcmgenet_rbuf_readl(priv, new_offset); ++ /* clear if overflowed */ ++ if (val == ~0) ++ bcmgenet_rbuf_writel(priv, 0, new_offset); ++ break; ++ case UMAC_RBUF_ERR_CNT_V1: ++ if (GENET_IS_V2(priv)) ++ new_offset = RBUF_ERR_CNT_V2; ++ else ++ new_offset = RBUF_ERR_CNT_V3PLUS; ++ ++ val = bcmgenet_rbuf_readl(priv, new_offset); ++ /* clear if overflowed */ ++ if (val == ~0) ++ bcmgenet_rbuf_writel(priv, 0, new_offset); ++ break; ++ default: ++ val = bcmgenet_umac_readl(priv, offset); ++ /* clear if overflowed */ ++ if (val == ~0) ++ bcmgenet_umac_writel(priv, 0, offset); ++ break; ++ } ++ ++ return val; ++} ++ + static void bcmgenet_update_mib_counters(struct bcmgenet_priv *priv) + { + int i, j = 0; +@@ -690,19 +730,28 @@ static void bcmgenet_update_mib_counters(struct bcmgenet_priv *priv) + case BCMGENET_STAT_NETDEV: + case BCMGENET_STAT_SOFT: + continue; +- case BCMGENET_STAT_MIB_RX: +- case BCMGENET_STAT_MIB_TX: + case BCMGENET_STAT_RUNT: +- if (s->type != BCMGENET_STAT_MIB_RX) +- offset = BCMGENET_STAT_OFFSET; ++ offset += BCMGENET_STAT_OFFSET; ++ /* fall through */ ++ case BCMGENET_STAT_MIB_TX: ++ offset += BCMGENET_STAT_OFFSET; ++ /* fall through */ ++ case BCMGENET_STAT_MIB_RX: + val = bcmgenet_umac_readl(priv, + UMAC_MIB_START + j + offset); ++ offset = 0; /* Reset Offset */ + break; + case BCMGENET_STAT_MISC: +- val = bcmgenet_umac_readl(priv, s->reg_offset); +- /* clear if overflowed */ +- if (val == ~0) +- bcmgenet_umac_writel(priv, 0, s->reg_offset); ++ if (GENET_IS_V1(priv)) { ++ val = bcmgenet_umac_readl(priv, s->reg_offset); ++ /* clear if overflowed */ ++ if (val == ~0) ++ bcmgenet_umac_writel(priv, 0, ++ s->reg_offset); ++ } else { ++ val = bcmgenet_update_stat_misc(priv, ++ s->reg_offset); ++ } + break; + } + +@@ -3018,6 +3067,12 @@ static void bcmgenet_set_hw_params(struct bcmgenet_priv *priv) + */ + gphy_rev = reg & 0xffff; + ++ /* This is reserved so should require special treatment */ ++ if (gphy_rev == 0 || gphy_rev == 0x01ff) { ++ pr_warn("Invalid GPHY revision detected: 0x%04x\n", gphy_rev); ++ return; ++ } ++ + /* This is the good old scheme, just GPHY major, no minor nor patch */ + if ((gphy_rev & 0xf0) != 0) + priv->gphy_rev = gphy_rev << 8; +@@ -3026,12 +3081,6 @@ static void bcmgenet_set_hw_params(struct bcmgenet_priv *priv) + else if ((gphy_rev & 0xff00) != 0) + priv->gphy_rev = gphy_rev; + +- /* This is reserved so should require special treatment */ +- else if (gphy_rev == 0 || gphy_rev == 0x01ff) { +- pr_warn("Invalid GPHY revision detected: 0x%04x\n", gphy_rev); +- return; +- } +- + #ifdef CONFIG_PHYS_ADDR_T_64BIT + if (!(params->flags & GENET_HAS_40BITS)) + pr_warn("GENET does not support 40-bits PA\n"); +@@ -3073,6 +3122,7 @@ static int bcmgenet_probe(struct platform_device *pdev) + const void *macaddr; + struct resource *r; + int err = -EIO; ++ const char *phy_mode_str; + + /* Up to GENET_MAX_MQ_CNT + 1 TX queues and RX queues */ + dev = alloc_etherdev_mqs(sizeof(*priv), GENET_MAX_MQ_CNT + 1, +@@ -3175,6 +3225,13 @@ static int bcmgenet_probe(struct platform_device *pdev) + priv->clk_eee = NULL; + } + ++ /* If this is an internal GPHY, power it on now, before UniMAC is ++ * brought out of reset as absolutely no UniMAC activity is allowed ++ */ ++ if (dn && !of_property_read_string(dn, "phy-mode", &phy_mode_str) && ++ !strcasecmp(phy_mode_str, "internal")) ++ bcmgenet_power_up(priv, GENET_POWER_PASSIVE); ++ + err = reset_umac(priv); + if (err) + goto err_clk_disable; +@@ -3234,7 +3291,8 @@ static int bcmgenet_suspend(struct device *d) + + bcmgenet_netif_stop(dev); + +- phy_suspend(priv->phydev); ++ if (!device_may_wakeup(d)) ++ phy_suspend(priv->phydev); + + netif_device_detach(dev); + +@@ -3331,7 +3389,8 @@ static int bcmgenet_resume(struct device *d) + + netif_device_attach(dev); + +- phy_resume(priv->phydev); ++ if (!device_may_wakeup(d)) ++ phy_resume(priv->phydev); + + if (priv->eee.eee_enabled) + bcmgenet_eee_enable_set(dev, true); +diff --git a/drivers/net/ethernet/broadcom/genet/bcmgenet.h b/drivers/net/ethernet/broadcom/genet/bcmgenet.h +index 6f2887a5e0be..ae3979a4ca93 100644 +--- a/drivers/net/ethernet/broadcom/genet/bcmgenet.h ++++ b/drivers/net/ethernet/broadcom/genet/bcmgenet.h +@@ -1,5 +1,5 @@ + /* +- * Copyright (c) 2014 Broadcom Corporation ++ * Copyright (c) 2014-2017 Broadcom + * + * This program is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License version 2 as +@@ -214,7 +214,9 @@ struct bcmgenet_mib_counters { + #define MDIO_REG_SHIFT 16 + #define MDIO_REG_MASK 0x1F + +-#define UMAC_RBUF_OVFL_CNT 0x61C ++#define UMAC_RBUF_OVFL_CNT_V1 0x61C ++#define RBUF_OVFL_CNT_V2 0x80 ++#define RBUF_OVFL_CNT_V3PLUS 0x94 + + #define UMAC_MPD_CTRL 0x620 + #define MPD_EN (1 << 0) +@@ -224,7 +226,9 @@ struct bcmgenet_mib_counters { + + #define UMAC_MPD_PW_MS 0x624 + #define UMAC_MPD_PW_LS 0x628 +-#define UMAC_RBUF_ERR_CNT 0x634 ++#define UMAC_RBUF_ERR_CNT_V1 0x634 ++#define RBUF_ERR_CNT_V2 0x84 ++#define RBUF_ERR_CNT_V3PLUS 0x98 + #define UMAC_MDF_ERR_CNT 0x638 + #define UMAC_MDF_CTRL 0x650 + #define UMAC_MDF_ADDR 0x654 +diff --git a/drivers/net/ethernet/dec/tulip/tulip_core.c b/drivers/net/ethernet/dec/tulip/tulip_core.c +index ed41559bae77..b553409e04ad 100644 +--- a/drivers/net/ethernet/dec/tulip/tulip_core.c ++++ b/drivers/net/ethernet/dec/tulip/tulip_core.c +@@ -98,8 +98,7 @@ static int csr0 = 0x01A00000 | 0x4800; + #elif defined(__mips__) + static int csr0 = 0x00200000 | 0x4000; + #else +-#warning Processor architecture undefined! +-static int csr0 = 0x00A00000 | 0x4800; ++static int csr0; + #endif + + /* Operational parameters that usually are not changed. */ +@@ -1982,6 +1981,12 @@ static int __init tulip_init (void) + pr_info("%s", version); + #endif + ++ if (!csr0) { ++ pr_warn("tulip: unknown CPU architecture, using default csr0\n"); ++ /* default to 8 longword cache line alignment */ ++ csr0 = 0x00A00000 | 0x4800; ++ } ++ + /* copy module parms into globals */ + tulip_rx_copybreak = rx_copybreak; + tulip_max_interrupt_work = max_interrupt_work; +diff --git a/drivers/net/ethernet/dec/tulip/winbond-840.c b/drivers/net/ethernet/dec/tulip/winbond-840.c +index 9beb3d34d4ba..3c0e4d5c5fef 100644 +--- a/drivers/net/ethernet/dec/tulip/winbond-840.c ++++ b/drivers/net/ethernet/dec/tulip/winbond-840.c +@@ -907,7 +907,7 @@ static void init_registers(struct net_device *dev) + #elif defined(CONFIG_SPARC) || defined (CONFIG_PARISC) || defined(CONFIG_ARM) + i |= 0x4800; + #else +-#warning Processor architecture undefined ++ dev_warn(&dev->dev, "unknown CPU architecture, using default csr0 setting\n"); + i |= 0x4800; + #endif + iowrite32(i, ioaddr + PCIBusCfg); +diff --git a/drivers/net/ethernet/freescale/fec_main.c b/drivers/net/ethernet/freescale/fec_main.c +index 67aec18dd76c..fe5a7d207b1d 100644 +--- a/drivers/net/ethernet/freescale/fec_main.c ++++ b/drivers/net/ethernet/freescale/fec_main.c +@@ -2850,6 +2850,7 @@ static void set_multicast_list(struct net_device *ndev) + struct netdev_hw_addr *ha; + unsigned int i, bit, data, crc, tmp; + unsigned char hash; ++ unsigned int hash_high = 0, hash_low = 0; + + if (ndev->flags & IFF_PROMISC) { + tmp = readl(fep->hwp + FEC_R_CNTRL); +@@ -2872,11 +2873,7 @@ static void set_multicast_list(struct net_device *ndev) + return; + } + +- /* Clear filter and add the addresses in hash register +- */ +- writel(0, fep->hwp + FEC_GRP_HASH_TABLE_HIGH); +- writel(0, fep->hwp + FEC_GRP_HASH_TABLE_LOW); +- ++ /* Add the addresses in hash register */ + netdev_for_each_mc_addr(ha, ndev) { + /* calculate crc32 value of mac address */ + crc = 0xffffffff; +@@ -2894,16 +2891,14 @@ static void set_multicast_list(struct net_device *ndev) + */ + hash = (crc >> (32 - HASH_BITS)) & 0x3f; + +- if (hash > 31) { +- tmp = readl(fep->hwp + FEC_GRP_HASH_TABLE_HIGH); +- tmp |= 1 << (hash - 32); +- writel(tmp, fep->hwp + FEC_GRP_HASH_TABLE_HIGH); +- } else { +- tmp = readl(fep->hwp + FEC_GRP_HASH_TABLE_LOW); +- tmp |= 1 << hash; +- writel(tmp, fep->hwp + FEC_GRP_HASH_TABLE_LOW); +- } ++ if (hash > 31) ++ hash_high |= 1 << (hash - 32); ++ else ++ hash_low |= 1 << hash; + } ++ ++ writel(hash_high, fep->hwp + FEC_GRP_HASH_TABLE_HIGH); ++ writel(hash_low, fep->hwp + FEC_GRP_HASH_TABLE_LOW); + } + + /* Set a MAC change in hardware. */ +diff --git a/drivers/net/ethernet/intel/igb/e1000_phy.c b/drivers/net/ethernet/intel/igb/e1000_phy.c +index c1bb64d8366f..62e36649ea09 100644 +--- a/drivers/net/ethernet/intel/igb/e1000_phy.c ++++ b/drivers/net/ethernet/intel/igb/e1000_phy.c +@@ -83,6 +83,10 @@ s32 igb_get_phy_id(struct e1000_hw *hw) + s32 ret_val = 0; + u16 phy_id; + ++ /* ensure PHY page selection to fix misconfigured i210 */ ++ if ((hw->mac.type == e1000_i210) || (hw->mac.type == e1000_i211)) ++ phy->ops.write_reg(hw, I347AT4_PAGE_SELECT, 0); ++ + ret_val = phy->ops.read_reg(hw, PHY_ID1, &phy_id); + if (ret_val) + goto out; +diff --git a/drivers/net/ethernet/mellanox/mlx4/cmd.c b/drivers/net/ethernet/mellanox/mlx4/cmd.c +index 3756e45d8cec..1ec0b405aa81 100644 +--- a/drivers/net/ethernet/mellanox/mlx4/cmd.c ++++ b/drivers/net/ethernet/mellanox/mlx4/cmd.c +@@ -2262,6 +2262,17 @@ static int sync_toggles(struct mlx4_dev *dev) + rd_toggle = swab32(readl(&priv->mfunc.comm->slave_read)); + if (wr_toggle == 0xffffffff || rd_toggle == 0xffffffff) { + /* PCI might be offline */ ++ ++ /* If device removal has been requested, ++ * do not continue retrying. ++ */ ++ if (dev->persist->interface_state & ++ MLX4_INTERFACE_STATE_NOWAIT) { ++ mlx4_warn(dev, ++ "communication channel is offline\n"); ++ return -EIO; ++ } ++ + msleep(100); + wr_toggle = swab32(readl(&priv->mfunc.comm-> + slave_write)); +diff --git a/drivers/net/ethernet/mellanox/mlx4/main.c b/drivers/net/ethernet/mellanox/mlx4/main.c +index 115d301f1f61..1f931e6ae3cb 100644 +--- a/drivers/net/ethernet/mellanox/mlx4/main.c ++++ b/drivers/net/ethernet/mellanox/mlx4/main.c +@@ -1717,6 +1717,14 @@ static int mlx4_comm_check_offline(struct mlx4_dev *dev) + (u32)(1 << COMM_CHAN_OFFLINE_OFFSET)); + if (!offline_bit) + return 0; ++ ++ /* If device removal has been requested, ++ * do not continue retrying. ++ */ ++ if (dev->persist->interface_state & ++ MLX4_INTERFACE_STATE_NOWAIT) ++ break; ++ + /* There are cases as part of AER/Reset flow that PF needs + * around 100 msec to load. We therefore sleep for 100 msec + * to allow other tasks to make use of that CPU during this +@@ -3459,6 +3467,9 @@ static void mlx4_remove_one(struct pci_dev *pdev) + struct mlx4_priv *priv = mlx4_priv(dev); + int active_vfs = 0; + ++ if (mlx4_is_slave(dev)) ++ persist->interface_state |= MLX4_INTERFACE_STATE_NOWAIT; ++ + mutex_lock(&persist->interface_state_mutex); + persist->interface_state |= MLX4_INTERFACE_STATE_DELETION; + mutex_unlock(&persist->interface_state_mutex); +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/main.c b/drivers/net/ethernet/mellanox/mlx5/core/main.c +index 28425e5ea91f..316fe86040d4 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/main.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/main.c +@@ -87,7 +87,7 @@ static struct mlx5_profile profile[] = { + [2] = { + .mask = MLX5_PROF_MASK_QP_SIZE | + MLX5_PROF_MASK_MR_CACHE, +- .log_max_qp = 17, ++ .log_max_qp = 18, + .mr_cache[0] = { + .size = 500, + .limit = 250 +diff --git a/drivers/net/ethernet/ti/cpmac.c b/drivers/net/ethernet/ti/cpmac.c +index dd9430043536..cf5ce371ec21 100644 +--- a/drivers/net/ethernet/ti/cpmac.c ++++ b/drivers/net/ethernet/ti/cpmac.c +@@ -1235,7 +1235,7 @@ int cpmac_init(void) + goto fail_alloc; + } + +-#warning FIXME: unhardcode gpio&reset bits ++ /* FIXME: unhardcode gpio&reset bits */ + ar7_gpio_disable(26); + ar7_gpio_disable(27); + ar7_device_reset(AR7_RESET_BIT_CPMAC_LO); +diff --git a/drivers/net/irda/w83977af_ir.c b/drivers/net/irda/w83977af_ir.c +index 4e3d2e7c697c..e8c3a8c32534 100644 +--- a/drivers/net/irda/w83977af_ir.c ++++ b/drivers/net/irda/w83977af_ir.c +@@ -518,7 +518,9 @@ static netdev_tx_t w83977af_hard_xmit(struct sk_buff *skb, + + mtt = irda_get_mtt(skb); + pr_debug("%s(%ld), mtt=%d\n", __func__ , jiffies, mtt); +- if (mtt) ++ if (mtt > 1000) ++ mdelay(mtt/1000); ++ else if (mtt) + udelay(mtt); + + /* Enable DMA interrupt */ +diff --git a/drivers/net/macvlan.c b/drivers/net/macvlan.c +index 9f59f17dc317..e10cff854b24 100644 +--- a/drivers/net/macvlan.c ++++ b/drivers/net/macvlan.c +@@ -440,7 +440,7 @@ static rx_handler_result_t macvlan_handle_frame(struct sk_buff **pskb) + struct macvlan_dev, list); + else + vlan = macvlan_hash_lookup(port, eth->h_dest); +- if (vlan == NULL) ++ if (!vlan || vlan->mode == MACVLAN_MODE_SOURCE) + return RX_HANDLER_PASS; + + dev = vlan->dev; +diff --git a/drivers/net/phy/marvell.c b/drivers/net/phy/marvell.c +index 1b1698f98818..9c582da5a08e 100644 +--- a/drivers/net/phy/marvell.c ++++ b/drivers/net/phy/marvell.c +@@ -763,8 +763,6 @@ static int marvell_read_status(struct phy_device *phydev) + if (adv < 0) + return adv; + +- lpa &= adv; +- + if (status & MII_M1011_PHY_STATUS_FULLDUPLEX) + phydev->duplex = DUPLEX_FULL; + else +diff --git a/drivers/net/phy/spi_ks8995.c b/drivers/net/phy/spi_ks8995.c +index 46530159256b..196f04015e8a 100644 +--- a/drivers/net/phy/spi_ks8995.c ++++ b/drivers/net/phy/spi_ks8995.c +@@ -332,6 +332,7 @@ static int ks8995_probe(struct spi_device *spi) + if (err) + return err; + ++ sysfs_attr_init(&ks->regs_attr.attr); + err = sysfs_create_bin_file(&spi->dev.kobj, &ks->regs_attr); + if (err) { + dev_err(&spi->dev, "unable to create sysfs file, err=%d\n", +diff --git a/drivers/net/ppp/ppp_generic.c b/drivers/net/ppp/ppp_generic.c +index 51ba895f0522..c30c1fc7889a 100644 +--- a/drivers/net/ppp/ppp_generic.c ++++ b/drivers/net/ppp/ppp_generic.c +@@ -918,6 +918,7 @@ static __net_exit void ppp_exit_net(struct net *net) + { + struct ppp_net *pn = net_generic(net, ppp_net_id); + ++ mutex_destroy(&pn->all_ppp_mutex); + idr_destroy(&pn->units_idr); + } + +diff --git a/drivers/net/vxlan.c b/drivers/net/vxlan.c +index 422a9379a644..1ad3700ed9c7 100644 +--- a/drivers/net/vxlan.c ++++ b/drivers/net/vxlan.c +@@ -2432,7 +2432,7 @@ static int vxlan_validate(struct nlattr *tb[], struct nlattr *data[]) + + if (data[IFLA_VXLAN_ID]) { + __u32 id = nla_get_u32(data[IFLA_VXLAN_ID]); +- if (id >= VXLAN_VID_MASK) ++ if (id >= VXLAN_N_VID) + return -ERANGE; + } + +diff --git a/drivers/net/wimax/i2400m/usb.c b/drivers/net/wimax/i2400m/usb.c +index e7f5910a6519..f8eb66ef2944 100644 +--- a/drivers/net/wimax/i2400m/usb.c ++++ b/drivers/net/wimax/i2400m/usb.c +@@ -467,6 +467,9 @@ int i2400mu_probe(struct usb_interface *iface, + struct i2400mu *i2400mu; + struct usb_device *usb_dev = interface_to_usbdev(iface); + ++ if (iface->cur_altsetting->desc.bNumEndpoints < 4) ++ return -ENODEV; ++ + if (usb_dev->speed != USB_SPEED_HIGH) + dev_err(dev, "device not connected as high speed\n"); + +diff --git a/drivers/net/wireless/ath/ath9k/tx99.c b/drivers/net/wireless/ath/ath9k/tx99.c +index b4e6304afd40..7ee1a3183a06 100644 +--- a/drivers/net/wireless/ath/ath9k/tx99.c ++++ b/drivers/net/wireless/ath/ath9k/tx99.c +@@ -180,6 +180,9 @@ static ssize_t write_file_tx99(struct file *file, const char __user *user_buf, + ssize_t len; + int r; + ++ if (count < 1) ++ return -EINVAL; ++ + if (sc->cur_chan->nvifs > 1) + return -EOPNOTSUPP; + +@@ -187,6 +190,8 @@ static ssize_t write_file_tx99(struct file *file, const char __user *user_buf, + if (copy_from_user(buf, user_buf, len)) + return -EFAULT; + ++ buf[len] = '\0'; ++ + if (strtobool(buf, &start)) + return -EINVAL; + +diff --git a/drivers/net/wireless/mac80211_hwsim.c b/drivers/net/wireless/mac80211_hwsim.c +index 03097016fd43..aafb97ce080d 100644 +--- a/drivers/net/wireless/mac80211_hwsim.c ++++ b/drivers/net/wireless/mac80211_hwsim.c +@@ -2884,6 +2884,7 @@ static int hwsim_new_radio_nl(struct sk_buff *msg, struct genl_info *info) + { + struct hwsim_new_radio_params param = { 0 }; + const char *hwname = NULL; ++ int ret; + + param.reg_strict = info->attrs[HWSIM_ATTR_REG_STRICT_REG]; + param.p2p_device = info->attrs[HWSIM_ATTR_SUPPORT_P2P_DEVICE]; +@@ -2923,7 +2924,9 @@ static int hwsim_new_radio_nl(struct sk_buff *msg, struct genl_info *info) + param.regd = hwsim_world_regdom_custom[idx]; + } + +- return mac80211_hwsim_new_radio(info, ¶m); ++ ret = mac80211_hwsim_new_radio(info, ¶m); ++ kfree(hwname); ++ return ret; + } + + static int hwsim_del_radio_nl(struct sk_buff *msg, struct genl_info *info) +diff --git a/drivers/pci/iov.c b/drivers/pci/iov.c +index ee0ebff103a4..089a1f41e44e 100644 +--- a/drivers/pci/iov.c ++++ b/drivers/pci/iov.c +@@ -302,13 +302,6 @@ static int sriov_enable(struct pci_dev *dev, int nr_virtfn) + return rc; + } + +- pci_iov_set_numvfs(dev, nr_virtfn); +- iov->ctrl |= PCI_SRIOV_CTRL_VFE | PCI_SRIOV_CTRL_MSE; +- pci_cfg_access_lock(dev); +- pci_write_config_word(dev, iov->pos + PCI_SRIOV_CTRL, iov->ctrl); +- msleep(100); +- pci_cfg_access_unlock(dev); +- + iov->initial_VFs = initial; + if (nr_virtfn < initial) + initial = nr_virtfn; +@@ -319,6 +312,13 @@ static int sriov_enable(struct pci_dev *dev, int nr_virtfn) + return retval; + } + ++ pci_iov_set_numvfs(dev, nr_virtfn); ++ iov->ctrl |= PCI_SRIOV_CTRL_VFE | PCI_SRIOV_CTRL_MSE; ++ pci_cfg_access_lock(dev); ++ pci_write_config_word(dev, iov->pos + PCI_SRIOV_CTRL, iov->ctrl); ++ msleep(100); ++ pci_cfg_access_unlock(dev); ++ + for (i = 0; i < initial; i++) { + rc = virtfn_add(dev, i, 0); + if (rc) +@@ -552,21 +552,61 @@ void pci_iov_release(struct pci_dev *dev) + } + + /** +- * pci_iov_resource_bar - get position of the SR-IOV BAR ++ * pci_iov_update_resource - update a VF BAR + * @dev: the PCI device + * @resno: the resource number + * +- * Returns position of the BAR encapsulated in the SR-IOV capability. ++ * Update a VF BAR in the SR-IOV capability of a PF. + */ +-int pci_iov_resource_bar(struct pci_dev *dev, int resno) ++void pci_iov_update_resource(struct pci_dev *dev, int resno) + { +- if (resno < PCI_IOV_RESOURCES || resno > PCI_IOV_RESOURCE_END) +- return 0; ++ struct pci_sriov *iov = dev->is_physfn ? dev->sriov : NULL; ++ struct resource *res = dev->resource + resno; ++ int vf_bar = resno - PCI_IOV_RESOURCES; ++ struct pci_bus_region region; ++ u16 cmd; ++ u32 new; ++ int reg; ++ ++ /* ++ * The generic pci_restore_bars() path calls this for all devices, ++ * including VFs and non-SR-IOV devices. If this is not a PF, we ++ * have nothing to do. ++ */ ++ if (!iov) ++ return; ++ ++ pci_read_config_word(dev, iov->pos + PCI_SRIOV_CTRL, &cmd); ++ if ((cmd & PCI_SRIOV_CTRL_VFE) && (cmd & PCI_SRIOV_CTRL_MSE)) { ++ dev_WARN(&dev->dev, "can't update enabled VF BAR%d %pR\n", ++ vf_bar, res); ++ return; ++ } ++ ++ /* ++ * Ignore unimplemented BARs, unused resource slots for 64-bit ++ * BARs, and non-movable resources, e.g., those described via ++ * Enhanced Allocation. ++ */ ++ if (!res->flags) ++ return; ++ ++ if (res->flags & IORESOURCE_UNSET) ++ return; ++ ++ if (res->flags & IORESOURCE_PCI_FIXED) ++ return; + +- BUG_ON(!dev->is_physfn); ++ pcibios_resource_to_bus(dev->bus, ®ion, res); ++ new = region.start; ++ new |= res->flags & ~PCI_BASE_ADDRESS_MEM_MASK; + +- return dev->sriov->pos + PCI_SRIOV_BAR + +- 4 * (resno - PCI_IOV_RESOURCES); ++ reg = iov->pos + PCI_SRIOV_BAR + 4 * vf_bar; ++ pci_write_config_dword(dev, reg, new); ++ if (res->flags & IORESOURCE_MEM_64) { ++ new = region.start >> 16 >> 16; ++ pci_write_config_dword(dev, reg + 4, new); ++ } + } + + resource_size_t __weak pcibios_iov_resource_alignment(struct pci_dev *dev, +diff --git a/drivers/pci/pci.c b/drivers/pci/pci.c +index b5b80a5560ed..409f895b5a3d 100644 +--- a/drivers/pci/pci.c ++++ b/drivers/pci/pci.c +@@ -4270,36 +4270,6 @@ int pci_select_bars(struct pci_dev *dev, unsigned long flags) + } + EXPORT_SYMBOL(pci_select_bars); + +-/** +- * pci_resource_bar - get position of the BAR associated with a resource +- * @dev: the PCI device +- * @resno: the resource number +- * @type: the BAR type to be filled in +- * +- * Returns BAR position in config space, or 0 if the BAR is invalid. +- */ +-int pci_resource_bar(struct pci_dev *dev, int resno, enum pci_bar_type *type) +-{ +- int reg; +- +- if (resno < PCI_ROM_RESOURCE) { +- *type = pci_bar_unknown; +- return PCI_BASE_ADDRESS_0 + 4 * resno; +- } else if (resno == PCI_ROM_RESOURCE) { +- *type = pci_bar_mem32; +- return dev->rom_base_reg; +- } else if (resno < PCI_BRIDGE_RESOURCES) { +- /* device specific resource */ +- *type = pci_bar_unknown; +- reg = pci_iov_resource_bar(dev, resno); +- if (reg) +- return reg; +- } +- +- dev_err(&dev->dev, "BAR %d: invalid resource\n", resno); +- return 0; +-} +- + /* Some architectures require additional programming to enable VGA */ + static arch_set_vga_state_t arch_set_vga_state; + +diff --git a/drivers/pci/pci.h b/drivers/pci/pci.h +index 0c039200ed79..9dac40998336 100644 +--- a/drivers/pci/pci.h ++++ b/drivers/pci/pci.h +@@ -208,7 +208,6 @@ bool pci_bus_read_dev_vendor_id(struct pci_bus *bus, int devfn, u32 *pl, + int pci_setup_device(struct pci_dev *dev); + int __pci_read_base(struct pci_dev *dev, enum pci_bar_type type, + struct resource *res, unsigned int reg); +-int pci_resource_bar(struct pci_dev *dev, int resno, enum pci_bar_type *type); + void pci_configure_ari(struct pci_dev *dev); + void __pci_bus_size_bridges(struct pci_bus *bus, + struct list_head *realloc_head); +@@ -263,7 +262,7 @@ static inline void pci_restore_ats_state(struct pci_dev *dev) + #ifdef CONFIG_PCI_IOV + int pci_iov_init(struct pci_dev *dev); + void pci_iov_release(struct pci_dev *dev); +-int pci_iov_resource_bar(struct pci_dev *dev, int resno); ++void pci_iov_update_resource(struct pci_dev *dev, int resno); + resource_size_t pci_sriov_resource_alignment(struct pci_dev *dev, int resno); + void pci_restore_iov_state(struct pci_dev *dev); + int pci_iov_bus_range(struct pci_bus *bus); +@@ -277,10 +276,6 @@ static inline void pci_iov_release(struct pci_dev *dev) + + { + } +-static inline int pci_iov_resource_bar(struct pci_dev *dev, int resno) +-{ +- return 0; +-} + static inline void pci_restore_iov_state(struct pci_dev *dev) + { + } +diff --git a/drivers/pci/pcie/pme.c b/drivers/pci/pcie/pme.c +index 63fc63911295..deb903112974 100644 +--- a/drivers/pci/pcie/pme.c ++++ b/drivers/pci/pcie/pme.c +@@ -233,6 +233,9 @@ static void pcie_pme_work_fn(struct work_struct *work) + break; + + pcie_capability_read_dword(port, PCI_EXP_RTSTA, &rtsta); ++ if (rtsta == (u32) ~0) ++ break; ++ + if (rtsta & PCI_EXP_RTSTA_PME) { + /* + * Clear PME status of the port. If there are other +@@ -280,7 +283,7 @@ static irqreturn_t pcie_pme_irq(int irq, void *context) + spin_lock_irqsave(&data->lock, flags); + pcie_capability_read_dword(port, PCI_EXP_RTSTA, &rtsta); + +- if (!(rtsta & PCI_EXP_RTSTA_PME)) { ++ if (rtsta == (u32) ~0 || !(rtsta & PCI_EXP_RTSTA_PME)) { + spin_unlock_irqrestore(&data->lock, flags); + return IRQ_NONE; + } +diff --git a/drivers/pci/probe.c b/drivers/pci/probe.c +index 5754d7b48c1f..c7dc06636bf6 100644 +--- a/drivers/pci/probe.c ++++ b/drivers/pci/probe.c +@@ -223,7 +223,8 @@ int __pci_read_base(struct pci_dev *dev, enum pci_bar_type type, + mask64 = (u32)PCI_BASE_ADDRESS_MEM_MASK; + } + } else { +- res->flags |= (l & IORESOURCE_ROM_ENABLE); ++ if (l & PCI_ROM_ADDRESS_ENABLE) ++ res->flags |= IORESOURCE_ROM_ENABLE; + l64 = l & PCI_ROM_ADDRESS_MASK; + sz64 = sz & PCI_ROM_ADDRESS_MASK; + mask64 = (u32)PCI_ROM_ADDRESS_MASK; +diff --git a/drivers/pci/remove.c b/drivers/pci/remove.c +index 8a280e9c2ad1..7e67af2bb366 100644 +--- a/drivers/pci/remove.c ++++ b/drivers/pci/remove.c +@@ -20,9 +20,9 @@ static void pci_stop_dev(struct pci_dev *dev) + pci_pme_active(dev, false); + + if (dev->is_added) { ++ device_release_driver(&dev->dev); + pci_proc_detach_device(dev); + pci_remove_sysfs_dev_files(dev); +- device_release_driver(&dev->dev); + dev->is_added = 0; + } + +diff --git a/drivers/pci/rom.c b/drivers/pci/rom.c +index eb0ad530dc43..3eea7fc5e1a2 100644 +--- a/drivers/pci/rom.c ++++ b/drivers/pci/rom.c +@@ -31,6 +31,11 @@ int pci_enable_rom(struct pci_dev *pdev) + if (!res->flags) + return -1; + ++ /* ++ * Ideally pci_update_resource() would update the ROM BAR address, ++ * and we would only set the enable bit here. But apparently some ++ * devices have buggy ROM BARs that read as zero when disabled. ++ */ + pcibios_resource_to_bus(pdev->bus, ®ion, res); + pci_read_config_dword(pdev, pdev->rom_base_reg, &rom_addr); + rom_addr &= ~PCI_ROM_ADDRESS_MASK; +diff --git a/drivers/pci/setup-res.c b/drivers/pci/setup-res.c +index 232f9254c11a..00f32ff6f74e 100644 +--- a/drivers/pci/setup-res.c ++++ b/drivers/pci/setup-res.c +@@ -25,15 +25,13 @@ + #include + #include "pci.h" + +- +-void pci_update_resource(struct pci_dev *dev, int resno) ++static void pci_std_update_resource(struct pci_dev *dev, int resno) + { + struct pci_bus_region region; + bool disable; + u16 cmd; + u32 new, check, mask; + int reg; +- enum pci_bar_type type; + struct resource *res = dev->resource + resno; + + /* +@@ -55,21 +53,34 @@ void pci_update_resource(struct pci_dev *dev, int resno) + return; + + pcibios_resource_to_bus(dev->bus, ®ion, res); ++ new = region.start; + +- new = region.start | (res->flags & PCI_REGION_FLAG_MASK); +- if (res->flags & IORESOURCE_IO) ++ if (res->flags & IORESOURCE_IO) { + mask = (u32)PCI_BASE_ADDRESS_IO_MASK; +- else ++ new |= res->flags & ~PCI_BASE_ADDRESS_IO_MASK; ++ } else if (resno == PCI_ROM_RESOURCE) { ++ mask = (u32)PCI_ROM_ADDRESS_MASK; ++ } else { + mask = (u32)PCI_BASE_ADDRESS_MEM_MASK; ++ new |= res->flags & ~PCI_BASE_ADDRESS_MEM_MASK; ++ } + +- reg = pci_resource_bar(dev, resno, &type); +- if (!reg) +- return; +- if (type != pci_bar_unknown) { ++ if (resno < PCI_ROM_RESOURCE) { ++ reg = PCI_BASE_ADDRESS_0 + 4 * resno; ++ } else if (resno == PCI_ROM_RESOURCE) { ++ ++ /* ++ * Apparently some Matrox devices have ROM BARs that read ++ * as zero when disabled, so don't update ROM BARs unless ++ * they're enabled. See https://lkml.org/lkml/2005/8/30/138. ++ */ + if (!(res->flags & IORESOURCE_ROM_ENABLE)) + return; ++ ++ reg = dev->rom_base_reg; + new |= PCI_ROM_ADDRESS_ENABLE; +- } ++ } else ++ return; + + /* + * We can't update a 64-bit BAR atomically, so when possible, +@@ -105,6 +116,16 @@ void pci_update_resource(struct pci_dev *dev, int resno) + pci_write_config_word(dev, PCI_COMMAND, cmd); + } + ++void pci_update_resource(struct pci_dev *dev, int resno) ++{ ++ if (resno <= PCI_ROM_RESOURCE) ++ pci_std_update_resource(dev, resno); ++#ifdef CONFIG_PCI_IOV ++ else if (resno >= PCI_IOV_RESOURCES && resno <= PCI_IOV_RESOURCE_END) ++ pci_iov_update_resource(dev, resno); ++#endif ++} ++ + int pci_claim_resource(struct pci_dev *dev, int resource) + { + struct resource *res = &dev->resource[resource]; +diff --git a/drivers/pinctrl/Kconfig b/drivers/pinctrl/Kconfig +index aeb5729fbda6..029ff74ec53c 100644 +--- a/drivers/pinctrl/Kconfig ++++ b/drivers/pinctrl/Kconfig +@@ -28,7 +28,8 @@ config DEBUG_PINCTRL + + config PINCTRL_ADI2 + bool "ADI pin controller driver" +- depends on BLACKFIN ++ depends on (BF54x || BF60x) ++ depends on !GPIO_ADI + select PINMUX + select IRQ_DOMAIN + help +diff --git a/drivers/rtc/interface.c b/drivers/rtc/interface.c +index 166fc60d8b55..faa81ac2d481 100644 +--- a/drivers/rtc/interface.c ++++ b/drivers/rtc/interface.c +@@ -793,9 +793,23 @@ EXPORT_SYMBOL_GPL(rtc_irq_set_freq); + */ + static int rtc_timer_enqueue(struct rtc_device *rtc, struct rtc_timer *timer) + { ++ struct timerqueue_node *next = timerqueue_getnext(&rtc->timerqueue); ++ struct rtc_time tm; ++ ktime_t now; ++ + timer->enabled = 1; ++ __rtc_read_time(rtc, &tm); ++ now = rtc_tm_to_ktime(tm); ++ ++ /* Skip over expired timers */ ++ while (next) { ++ if (next->expires.tv64 >= now.tv64) ++ break; ++ next = timerqueue_iterate_next(next); ++ } ++ + timerqueue_add(&rtc->timerqueue, &timer->node); +- if (&timer->node == timerqueue_getnext(&rtc->timerqueue)) { ++ if (!next) { + struct rtc_wkalrm alarm; + int err; + alarm.time = rtc_ktime_to_tm(timer->node.expires); +diff --git a/drivers/rtc/rtc-s35390a.c b/drivers/rtc/rtc-s35390a.c +index f40afdd0e5f5..d5b572266a72 100644 +--- a/drivers/rtc/rtc-s35390a.c ++++ b/drivers/rtc/rtc-s35390a.c +@@ -15,6 +15,7 @@ + #include + #include + #include ++#include + + #define S35390A_CMD_STATUS1 0 + #define S35390A_CMD_STATUS2 1 +@@ -34,10 +35,14 @@ + #define S35390A_ALRM_BYTE_HOURS 1 + #define S35390A_ALRM_BYTE_MINS 2 + ++/* flags for STATUS1 */ + #define S35390A_FLAG_POC 0x01 + #define S35390A_FLAG_BLD 0x02 ++#define S35390A_FLAG_INT2 0x04 + #define S35390A_FLAG_24H 0x40 + #define S35390A_FLAG_RESET 0x80 ++ ++/* flag for STATUS2 */ + #define S35390A_FLAG_TEST 0x01 + + #define S35390A_INT2_MODE_MASK 0xF0 +@@ -94,19 +99,63 @@ static int s35390a_get_reg(struct s35390a *s35390a, int reg, char *buf, int len) + return 0; + } + +-static int s35390a_reset(struct s35390a *s35390a) ++/* ++ * Returns <0 on error, 0 if rtc is setup fine and 1 if the chip was reset. ++ * To keep the information if an irq is pending, pass the value read from ++ * STATUS1 to the caller. ++ */ ++static int s35390a_reset(struct s35390a *s35390a, char *status1) + { +- char buf[1]; +- +- if (s35390a_get_reg(s35390a, S35390A_CMD_STATUS1, buf, sizeof(buf)) < 0) +- return -EIO; +- +- if (!(buf[0] & (S35390A_FLAG_POC | S35390A_FLAG_BLD))) ++ char buf; ++ int ret; ++ unsigned initcount = 0; ++ ++ ret = s35390a_get_reg(s35390a, S35390A_CMD_STATUS1, status1, 1); ++ if (ret < 0) ++ return ret; ++ ++ if (*status1 & S35390A_FLAG_POC) ++ /* ++ * Do not communicate for 0.5 seconds since the power-on ++ * detection circuit is in operation. ++ */ ++ msleep(500); ++ else if (!(*status1 & S35390A_FLAG_BLD)) ++ /* ++ * If both POC and BLD are unset everything is fine. ++ */ + return 0; + +- buf[0] |= (S35390A_FLAG_RESET | S35390A_FLAG_24H); +- buf[0] &= 0xf0; +- return s35390a_set_reg(s35390a, S35390A_CMD_STATUS1, buf, sizeof(buf)); ++ /* ++ * At least one of POC and BLD are set, so reinitialise chip. Keeping ++ * this information in the hardware to know later that the time isn't ++ * valid is unfortunately not possible because POC and BLD are cleared ++ * on read. So the reset is best done now. ++ * ++ * The 24H bit is kept over reset, so set it already here. ++ */ ++initialize: ++ *status1 = S35390A_FLAG_24H; ++ buf = S35390A_FLAG_RESET | S35390A_FLAG_24H; ++ ret = s35390a_set_reg(s35390a, S35390A_CMD_STATUS1, &buf, 1); ++ ++ if (ret < 0) ++ return ret; ++ ++ ret = s35390a_get_reg(s35390a, S35390A_CMD_STATUS1, &buf, 1); ++ if (ret < 0) ++ return ret; ++ ++ if (buf & (S35390A_FLAG_POC | S35390A_FLAG_BLD)) { ++ /* Try up to five times to reset the chip */ ++ if (initcount < 5) { ++ ++initcount; ++ goto initialize; ++ } else ++ return -EIO; ++ } ++ ++ return 1; + } + + static int s35390a_disable_test_mode(struct s35390a *s35390a) +@@ -242,6 +291,8 @@ static int s35390a_set_alarm(struct i2c_client *client, struct rtc_wkalrm *alm) + + if (alm->time.tm_wday != -1) + buf[S35390A_ALRM_BYTE_WDAY] = bin2bcd(alm->time.tm_wday) | 0x80; ++ else ++ buf[S35390A_ALRM_BYTE_WDAY] = 0; + + buf[S35390A_ALRM_BYTE_HOURS] = s35390a_hr2reg(s35390a, + alm->time.tm_hour) | 0x80; +@@ -269,23 +320,43 @@ static int s35390a_read_alarm(struct i2c_client *client, struct rtc_wkalrm *alm) + if (err < 0) + return err; + +- if (bitrev8(sts) != S35390A_INT2_MODE_ALARM) +- return -EINVAL; ++ if ((bitrev8(sts) & S35390A_INT2_MODE_MASK) != S35390A_INT2_MODE_ALARM) { ++ /* ++ * When the alarm isn't enabled, the register to configure ++ * the alarm time isn't accessible. ++ */ ++ alm->enabled = 0; ++ return 0; ++ } else { ++ alm->enabled = 1; ++ } + + err = s35390a_get_reg(s35390a, S35390A_CMD_INT2_REG1, buf, sizeof(buf)); + if (err < 0) + return err; + + /* This chip returns the bits of each byte in reverse order */ +- for (i = 0; i < 3; ++i) { ++ for (i = 0; i < 3; ++i) + buf[i] = bitrev8(buf[i]); +- buf[i] &= ~0x80; +- } + +- alm->time.tm_wday = bcd2bin(buf[S35390A_ALRM_BYTE_WDAY]); +- alm->time.tm_hour = s35390a_reg2hr(s35390a, +- buf[S35390A_ALRM_BYTE_HOURS]); +- alm->time.tm_min = bcd2bin(buf[S35390A_ALRM_BYTE_MINS]); ++ /* ++ * B0 of the three matching registers is an enable flag. Iff it is set ++ * the configured value is used for matching. ++ */ ++ if (buf[S35390A_ALRM_BYTE_WDAY] & 0x80) ++ alm->time.tm_wday = ++ bcd2bin(buf[S35390A_ALRM_BYTE_WDAY] & ~0x80); ++ ++ if (buf[S35390A_ALRM_BYTE_HOURS] & 0x80) ++ alm->time.tm_hour = ++ s35390a_reg2hr(s35390a, ++ buf[S35390A_ALRM_BYTE_HOURS] & ~0x80); ++ ++ if (buf[S35390A_ALRM_BYTE_MINS] & 0x80) ++ alm->time.tm_min = bcd2bin(buf[S35390A_ALRM_BYTE_MINS] & ~0x80); ++ ++ /* alarm triggers always at s=0 */ ++ alm->time.tm_sec = 0; + + dev_dbg(&client->dev, "%s: alm is mins=%d, hours=%d, wday=%d\n", + __func__, alm->time.tm_min, alm->time.tm_hour, +@@ -327,11 +398,11 @@ static struct i2c_driver s35390a_driver; + static int s35390a_probe(struct i2c_client *client, + const struct i2c_device_id *id) + { +- int err; ++ int err, err_reset; + unsigned int i; + struct s35390a *s35390a; + struct rtc_time tm; +- char buf[1]; ++ char buf, status1; + + if (!i2c_check_functionality(client->adapter, I2C_FUNC_I2C)) { + err = -ENODEV; +@@ -360,29 +431,35 @@ static int s35390a_probe(struct i2c_client *client, + } + } + +- err = s35390a_reset(s35390a); +- if (err < 0) { ++ err_reset = s35390a_reset(s35390a, &status1); ++ if (err_reset < 0) { ++ err = err_reset; + dev_err(&client->dev, "error resetting chip\n"); + goto exit_dummy; + } + +- err = s35390a_disable_test_mode(s35390a); +- if (err < 0) { +- dev_err(&client->dev, "error disabling test mode\n"); +- goto exit_dummy; +- } +- +- err = s35390a_get_reg(s35390a, S35390A_CMD_STATUS1, buf, sizeof(buf)); +- if (err < 0) { +- dev_err(&client->dev, "error checking 12/24 hour mode\n"); +- goto exit_dummy; +- } +- if (buf[0] & S35390A_FLAG_24H) ++ if (status1 & S35390A_FLAG_24H) + s35390a->twentyfourhour = 1; + else + s35390a->twentyfourhour = 0; + +- if (s35390a_get_datetime(client, &tm) < 0) ++ if (status1 & S35390A_FLAG_INT2) { ++ /* disable alarm (and maybe test mode) */ ++ buf = 0; ++ err = s35390a_set_reg(s35390a, S35390A_CMD_STATUS2, &buf, 1); ++ if (err < 0) { ++ dev_err(&client->dev, "error disabling alarm"); ++ goto exit_dummy; ++ } ++ } else { ++ err = s35390a_disable_test_mode(s35390a); ++ if (err < 0) { ++ dev_err(&client->dev, "error disabling test mode\n"); ++ goto exit_dummy; ++ } ++ } ++ ++ if (err_reset > 0 || s35390a_get_datetime(client, &tm) < 0) + dev_warn(&client->dev, "clock needs to be set\n"); + + device_set_wakeup_capable(&client->dev, 1); +@@ -395,6 +472,10 @@ static int s35390a_probe(struct i2c_client *client, + err = PTR_ERR(s35390a->rtc); + goto exit_dummy; + } ++ ++ if (status1 & S35390A_FLAG_INT2) ++ rtc_update_irq(s35390a->rtc, 1, RTC_AF); ++ + return 0; + + exit_dummy: +diff --git a/drivers/scsi/bfa/bfad_debugfs.c b/drivers/scsi/bfa/bfad_debugfs.c +index 74a307c0a240..8f1c58d4d5b5 100644 +--- a/drivers/scsi/bfa/bfad_debugfs.c ++++ b/drivers/scsi/bfa/bfad_debugfs.c +@@ -254,7 +254,8 @@ bfad_debugfs_write_regrd(struct file *file, const char __user *buf, + struct bfad_s *bfad = port->bfad; + struct bfa_s *bfa = &bfad->bfa; + struct bfa_ioc_s *ioc = &bfa->ioc; +- int addr, len, rc, i; ++ int addr, rc, i; ++ u32 len; + u32 *regbuf; + void __iomem *rb, *reg_addr; + unsigned long flags; +@@ -265,7 +266,7 @@ bfad_debugfs_write_regrd(struct file *file, const char __user *buf, + return PTR_ERR(kern_buf); + + rc = sscanf(kern_buf, "%x:%x", &addr, &len); +- if (rc < 2) { ++ if (rc < 2 || len > (UINT_MAX >> 2)) { + printk(KERN_INFO + "bfad[%d]: %s failed to read user buf\n", + bfad->inst_no, __func__); +diff --git a/drivers/scsi/hpsa.c b/drivers/scsi/hpsa.c +index 8eab107b53fb..0ef5d9286e0a 100644 +--- a/drivers/scsi/hpsa.c ++++ b/drivers/scsi/hpsa.c +@@ -4158,7 +4158,7 @@ static void hpsa_scan_complete(struct ctlr_info *h) + + spin_lock_irqsave(&h->scan_lock, flags); + h->scan_finished = 1; +- wake_up_all(&h->scan_wait_queue); ++ wake_up(&h->scan_wait_queue); + spin_unlock_irqrestore(&h->scan_lock, flags); + } + +@@ -4176,11 +4176,23 @@ static void hpsa_scan_start(struct Scsi_Host *sh) + if (unlikely(lockup_detected(h))) + return hpsa_scan_complete(h); + ++ /* ++ * If a scan is already waiting to run, no need to add another ++ */ ++ spin_lock_irqsave(&h->scan_lock, flags); ++ if (h->scan_waiting) { ++ spin_unlock_irqrestore(&h->scan_lock, flags); ++ return; ++ } ++ ++ spin_unlock_irqrestore(&h->scan_lock, flags); ++ + /* wait until any scan already in progress is finished. */ + while (1) { + spin_lock_irqsave(&h->scan_lock, flags); + if (h->scan_finished) + break; ++ h->scan_waiting = 1; + spin_unlock_irqrestore(&h->scan_lock, flags); + wait_event(h->scan_wait_queue, h->scan_finished); + /* Note: We don't need to worry about a race between this +@@ -4190,6 +4202,7 @@ static void hpsa_scan_start(struct Scsi_Host *sh) + */ + } + h->scan_finished = 0; /* mark scan as in progress */ ++ h->scan_waiting = 0; + spin_unlock_irqrestore(&h->scan_lock, flags); + + if (unlikely(lockup_detected(h))) +@@ -6936,6 +6949,7 @@ reinit_after_soft_reset: + goto clean4; + init_waitqueue_head(&h->scan_wait_queue); + h->scan_finished = 1; /* no scan currently in progress */ ++ h->scan_waiting = 0; + + pci_set_drvdata(pdev, h); + h->ndevices = 0; +diff --git a/drivers/scsi/hpsa.h b/drivers/scsi/hpsa.h +index 657713050349..cbaf416d5456 100644 +--- a/drivers/scsi/hpsa.h ++++ b/drivers/scsi/hpsa.h +@@ -166,6 +166,7 @@ struct ctlr_info { + dma_addr_t errinfo_pool_dhandle; + unsigned long *cmd_pool_bits; + int scan_finished; ++ u8 scan_waiting : 1; + spinlock_t scan_lock; + wait_queue_head_t scan_wait_queue; + +diff --git a/drivers/scsi/lpfc/lpfc_els.c b/drivers/scsi/lpfc/lpfc_els.c +index 4da8963315c7..30f2fe9ba766 100644 +--- a/drivers/scsi/lpfc/lpfc_els.c ++++ b/drivers/scsi/lpfc/lpfc_els.c +@@ -7286,11 +7286,17 @@ lpfc_cmpl_reg_new_vport(struct lpfc_hba *phba, LPFC_MBOXQ_t *pmb) + spin_lock_irq(shost->host_lock); + vport->fc_flag |= FC_VPORT_NEEDS_REG_VPI; + spin_unlock_irq(shost->host_lock); +- if (vport->port_type == LPFC_PHYSICAL_PORT +- && !(vport->fc_flag & FC_LOGO_RCVD_DID_CHNG)) +- lpfc_issue_init_vfi(vport); +- else ++ if (mb->mbxStatus == MBX_NOT_FINISHED) ++ break; ++ if ((vport->port_type == LPFC_PHYSICAL_PORT) && ++ !(vport->fc_flag & FC_LOGO_RCVD_DID_CHNG)) { ++ if (phba->sli_rev == LPFC_SLI_REV4) ++ lpfc_issue_init_vfi(vport); ++ else ++ lpfc_initial_flogi(vport); ++ } else { + lpfc_initial_fdisc(vport); ++ } + break; + } + } else { +diff --git a/drivers/scsi/lpfc/lpfc_hw4.h b/drivers/scsi/lpfc/lpfc_hw4.h +index 1813c45946f4..3757a7399983 100644 +--- a/drivers/scsi/lpfc/lpfc_hw4.h ++++ b/drivers/scsi/lpfc/lpfc_hw4.h +@@ -1180,6 +1180,7 @@ struct lpfc_mbx_wq_create { + #define lpfc_mbx_wq_create_page_size_SHIFT 0 + #define lpfc_mbx_wq_create_page_size_MASK 0x000000FF + #define lpfc_mbx_wq_create_page_size_WORD word1 ++#define LPFC_WQ_PAGE_SIZE_4096 0x1 + #define lpfc_mbx_wq_create_wqe_size_SHIFT 8 + #define lpfc_mbx_wq_create_wqe_size_MASK 0x0000000F + #define lpfc_mbx_wq_create_wqe_size_WORD word1 +@@ -1251,6 +1252,7 @@ struct rq_context { + #define lpfc_rq_context_page_size_SHIFT 0 /* Version 1 Only */ + #define lpfc_rq_context_page_size_MASK 0x000000FF + #define lpfc_rq_context_page_size_WORD word0 ++#define LPFC_RQ_PAGE_SIZE_4096 0x1 + uint32_t reserved1; + uint32_t word2; + #define lpfc_rq_context_cq_id_SHIFT 16 +diff --git a/drivers/scsi/lpfc/lpfc_sli.c b/drivers/scsi/lpfc/lpfc_sli.c +index 7ca27e5ef079..625e3ee877ee 100644 +--- a/drivers/scsi/lpfc/lpfc_sli.c ++++ b/drivers/scsi/lpfc/lpfc_sli.c +@@ -13509,7 +13509,7 @@ lpfc_wq_create(struct lpfc_hba *phba, struct lpfc_queue *wq, + LPFC_WQ_WQE_SIZE_128); + bf_set(lpfc_mbx_wq_create_page_size, + &wq_create->u.request_1, +- (PAGE_SIZE/SLI4_PAGE_SIZE)); ++ LPFC_WQ_PAGE_SIZE_4096); + page = wq_create->u.request_1.page; + break; + } +@@ -13535,8 +13535,9 @@ lpfc_wq_create(struct lpfc_hba *phba, struct lpfc_queue *wq, + LPFC_WQ_WQE_SIZE_128); + break; + } +- bf_set(lpfc_mbx_wq_create_page_size, &wq_create->u.request_1, +- (PAGE_SIZE/SLI4_PAGE_SIZE)); ++ bf_set(lpfc_mbx_wq_create_page_size, ++ &wq_create->u.request_1, ++ LPFC_WQ_PAGE_SIZE_4096); + page = wq_create->u.request_1.page; + break; + default: +@@ -13722,7 +13723,7 @@ lpfc_rq_create(struct lpfc_hba *phba, struct lpfc_queue *hrq, + LPFC_RQE_SIZE_8); + bf_set(lpfc_rq_context_page_size, + &rq_create->u.request.context, +- (PAGE_SIZE/SLI4_PAGE_SIZE)); ++ LPFC_RQ_PAGE_SIZE_4096); + } else { + switch (hrq->entry_count) { + default: +diff --git a/drivers/scsi/mvsas/mv_sas.c b/drivers/scsi/mvsas/mv_sas.c +index 9c780740fb82..e712fe745955 100644 +--- a/drivers/scsi/mvsas/mv_sas.c ++++ b/drivers/scsi/mvsas/mv_sas.c +@@ -737,8 +737,8 @@ static int mvs_task_prep(struct sas_task *task, struct mvs_info *mvi, int is_tmf + mv_dprintk("device %016llx not ready.\n", + SAS_ADDR(dev->sas_addr)); + +- rc = SAS_PHY_DOWN; +- return rc; ++ rc = SAS_PHY_DOWN; ++ return rc; + } + tei.port = dev->port->lldd_port; + if (tei.port && !tei.port->port_attached && !tmf) { +diff --git a/drivers/scsi/scsi_devinfo.c b/drivers/scsi/scsi_devinfo.c +index 42d3f82e75c7..55df57341858 100644 +--- a/drivers/scsi/scsi_devinfo.c ++++ b/drivers/scsi/scsi_devinfo.c +@@ -160,7 +160,7 @@ static struct { + {"DGC", "RAID", NULL, BLIST_SPARSELUN}, /* Dell PV 650F, storage on LUN 0 */ + {"DGC", "DISK", NULL, BLIST_SPARSELUN}, /* Dell PV 650F, no storage on LUN 0 */ + {"EMC", "Invista", "*", BLIST_SPARSELUN | BLIST_LARGELUN}, +- {"EMC", "SYMMETRIX", NULL, BLIST_SPARSELUN | BLIST_LARGELUN | BLIST_FORCELUN}, ++ {"EMC", "SYMMETRIX", NULL, BLIST_SPARSELUN | BLIST_LARGELUN | BLIST_REPORTLUN2}, + {"EMULEX", "MD21/S2 ESDI", NULL, BLIST_SINGLELUN}, + {"easyRAID", "16P", NULL, BLIST_NOREPORTLUN}, + {"easyRAID", "X6P", NULL, BLIST_NOREPORTLUN}, +diff --git a/drivers/scsi/scsi_lib.c b/drivers/scsi/scsi_lib.c +index 17fbf1d3eadc..8ef1d5e6619a 100644 +--- a/drivers/scsi/scsi_lib.c ++++ b/drivers/scsi/scsi_lib.c +@@ -1119,7 +1119,8 @@ int scsi_init_io(struct scsi_cmnd *cmd) + bool is_mq = (rq->mq_ctx != NULL); + int error; + +- BUG_ON(!rq->nr_phys_segments); ++ if (WARN_ON_ONCE(!rq->nr_phys_segments)) ++ return -EINVAL; + + error = scsi_init_sgtable(rq, &cmd->sdb); + if (error) +diff --git a/drivers/scsi/sd.c b/drivers/scsi/sd.c +index 80cebe691fee..a678dd10905f 100644 +--- a/drivers/scsi/sd.c ++++ b/drivers/scsi/sd.c +@@ -1383,11 +1383,15 @@ static int media_not_present(struct scsi_disk *sdkp, + **/ + static unsigned int sd_check_events(struct gendisk *disk, unsigned int clearing) + { +- struct scsi_disk *sdkp = scsi_disk(disk); +- struct scsi_device *sdp = sdkp->device; ++ struct scsi_disk *sdkp = scsi_disk_get(disk); ++ struct scsi_device *sdp; + struct scsi_sense_hdr *sshdr = NULL; + int retval; + ++ if (!sdkp) ++ return 0; ++ ++ sdp = sdkp->device; + SCSI_LOG_HLQUEUE(3, sd_printk(KERN_INFO, sdkp, "sd_check_events\n")); + + /* +@@ -1444,6 +1448,7 @@ out: + kfree(sshdr); + retval = sdp->changed ? DISK_EVENT_MEDIA_CHANGE : 0; + sdp->changed = 0; ++ scsi_disk_put(sdkp); + return retval; + } + +diff --git a/drivers/scsi/storvsc_drv.c b/drivers/scsi/storvsc_drv.c +index 51a0cc047b5f..98b56a7069d3 100644 +--- a/drivers/scsi/storvsc_drv.c ++++ b/drivers/scsi/storvsc_drv.c +@@ -325,8 +325,6 @@ MODULE_PARM_DESC(vcpus_per_sub_channel, "Ratio of VCPUs to subchannels"); + */ + static int storvsc_timeout = 180; + +-static int msft_blist_flags = BLIST_TRY_VPD_PAGES; +- + + static void storvsc_on_channel_callback(void *context); + +@@ -584,17 +582,18 @@ static int do_bounce_buffer(struct scatterlist *sgl, unsigned int sg_count) + for (i = 0; i < sg_count; i++) { + if (i == 0) { + /* make sure 1st one does not have hole */ +- if (sgl[i].offset + sgl[i].length != PAGE_SIZE) ++ if (sgl->offset + sgl->length != PAGE_SIZE) + return i; + } else if (i == sg_count - 1) { + /* make sure last one does not have hole */ +- if (sgl[i].offset != 0) ++ if (sgl->offset != 0) + return i; + } else { + /* make sure no hole in the middle */ +- if (sgl[i].length != PAGE_SIZE || sgl[i].offset != 0) ++ if (sgl->length != PAGE_SIZE || sgl->offset != 0) + return i; + } ++ sgl = sg_next(sgl); + } + return -1; + } +@@ -1416,6 +1415,22 @@ static int storvsc_do_io(struct hv_device *device, + return ret; + } + ++static int storvsc_device_alloc(struct scsi_device *sdevice) ++{ ++ /* ++ * Set blist flag to permit the reading of the VPD pages even when ++ * the target may claim SPC-2 compliance. MSFT targets currently ++ * claim SPC-2 compliance while they implement post SPC-2 features. ++ * With this flag we can correctly handle WRITE_SAME_16 issues. ++ * ++ * Hypervisor reports SCSI_UNKNOWN type for DVD ROM device but ++ * still supports REPORT LUN. ++ */ ++ sdevice->sdev_bflags = BLIST_REPORTLUN2 | BLIST_TRY_VPD_PAGES; ++ ++ return 0; ++} ++ + static int storvsc_device_configure(struct scsi_device *sdevice) + { + +@@ -1427,14 +1442,6 @@ static int storvsc_device_configure(struct scsi_device *sdevice) + + sdevice->no_write_same = 1; + +- /* +- * Add blist flags to permit the reading of the VPD pages even when +- * the target may claim SPC-2 compliance. MSFT targets currently +- * claim SPC-2 compliance while they implement post SPC-2 features. +- * With this patch we can correctly handle WRITE_SAME_16 issues. +- */ +- sdevice->sdev_bflags |= msft_blist_flags; +- + /* + * If the host is WIN8 or WIN8 R2, claim conformance to SPC-3 + * if the device is a MSFT virtual device. +@@ -1722,6 +1729,7 @@ static struct scsi_host_template scsi_driver = { + .eh_host_reset_handler = storvsc_host_reset_handler, + .proc_name = "storvsc_host", + .eh_timed_out = storvsc_eh_timed_out, ++ .slave_alloc = storvsc_device_alloc, + .slave_configure = storvsc_device_configure, + .cmd_per_lun = 255, + .this_id = -1, +diff --git a/drivers/spi/spi-sh-msiof.c b/drivers/spi/spi-sh-msiof.c +index 7872f3c78b51..dc0ffd3dd96a 100644 +--- a/drivers/spi/spi-sh-msiof.c ++++ b/drivers/spi/spi-sh-msiof.c +@@ -860,7 +860,7 @@ static int sh_msiof_transfer_one(struct spi_master *master, + break; + copy32 = copy_bswap32; + } else if (bits <= 16) { +- if (l & 1) ++ if (l & 3) + break; + copy32 = copy_wswap32; + } else { +diff --git a/drivers/staging/lustre/lustre/llite/llite_mmap.c b/drivers/staging/lustre/lustre/llite/llite_mmap.c +index a90214bb84dd..7511b4dfdfe5 100644 +--- a/drivers/staging/lustre/lustre/llite/llite_mmap.c ++++ b/drivers/staging/lustre/lustre/llite/llite_mmap.c +@@ -404,15 +404,13 @@ static int ll_page_mkwrite(struct vm_area_struct *vma, struct vm_fault *vmf) + result = VM_FAULT_LOCKED; + break; + case -ENODATA: ++ case -EAGAIN: + case -EFAULT: + result = VM_FAULT_NOPAGE; + break; + case -ENOMEM: + result = VM_FAULT_OOM; + break; +- case -EAGAIN: +- result = VM_FAULT_RETRY; +- break; + default: + result = VM_FAULT_SIGBUS; + break; +diff --git a/drivers/staging/vt6655/device_main.c b/drivers/staging/vt6655/device_main.c +index 376e4a0c15c6..8f1844f0547e 100644 +--- a/drivers/staging/vt6655/device_main.c ++++ b/drivers/staging/vt6655/device_main.c +@@ -1838,10 +1838,11 @@ static int vt6655_suspend(struct pci_dev *pcid, pm_message_t state) + MACbShutdown(priv->PortOffset); + + pci_disable_device(pcid); +- pci_set_power_state(pcid, pci_choose_state(pcid, state)); + + spin_unlock_irqrestore(&priv->lock, flags); + ++ pci_set_power_state(pcid, pci_choose_state(pcid, state)); ++ + return 0; + } + +diff --git a/drivers/target/iscsi/iscsi_target.c b/drivers/target/iscsi/iscsi_target.c +index 8df1ff3766c4..2d6b0cf0929e 100644 +--- a/drivers/target/iscsi/iscsi_target.c ++++ b/drivers/target/iscsi/iscsi_target.c +@@ -682,6 +682,7 @@ static int iscsit_add_reject_from_cmd( + unsigned char *buf) + { + struct iscsi_conn *conn; ++ const bool do_put = cmd->se_cmd.se_tfo != NULL; + + if (!cmd->conn) { + pr_err("cmd->conn is NULL for ITT: 0x%08x\n", +@@ -712,7 +713,7 @@ static int iscsit_add_reject_from_cmd( + * Perform the kref_put now if se_cmd has already been setup by + * scsit_setup_scsi_cmd() + */ +- if (cmd->se_cmd.se_tfo != NULL) { ++ if (do_put) { + pr_debug("iscsi reject: calling target_put_sess_cmd >>>>>>\n"); + target_put_sess_cmd(&cmd->se_cmd); + } +diff --git a/drivers/target/iscsi/iscsi_target_configfs.c b/drivers/target/iscsi/iscsi_target_configfs.c +index f6169f722991..bc578d3d2178 100644 +--- a/drivers/target/iscsi/iscsi_target_configfs.c ++++ b/drivers/target/iscsi/iscsi_target_configfs.c +@@ -1466,7 +1466,7 @@ static struct se_portal_group *lio_target_tiqn_addtpg( + ret = core_tpg_register(&iscsi_ops, wwn, &tpg->tpg_se_tpg, + tpg, TRANSPORT_TPG_TYPE_NORMAL); + if (ret < 0) +- return NULL; ++ goto free_out; + + ret = iscsit_tpg_add_portal_group(tiqn, tpg); + if (ret != 0) +@@ -1478,6 +1478,7 @@ static struct se_portal_group *lio_target_tiqn_addtpg( + return &tpg->tpg_se_tpg; + out: + core_tpg_deregister(&tpg->tpg_se_tpg); ++free_out: + kfree(tpg); + return NULL; + } +diff --git a/drivers/target/target_core_alua.c b/drivers/target/target_core_alua.c +index 4f8d4d459aa4..edb880faa754 100644 +--- a/drivers/target/target_core_alua.c ++++ b/drivers/target/target_core_alua.c +@@ -1126,13 +1126,11 @@ static int core_alua_do_transition_tg_pt( + unsigned long transition_tmo; + + transition_tmo = tg_pt_gp->tg_pt_gp_implicit_trans_secs * HZ; +- queue_delayed_work(tg_pt_gp->tg_pt_gp_dev->tmr_wq, +- &tg_pt_gp->tg_pt_gp_transition_work, +- transition_tmo); ++ schedule_delayed_work(&tg_pt_gp->tg_pt_gp_transition_work, ++ transition_tmo); + } else { + tg_pt_gp->tg_pt_gp_transition_complete = &wait; +- queue_delayed_work(tg_pt_gp->tg_pt_gp_dev->tmr_wq, +- &tg_pt_gp->tg_pt_gp_transition_work, 0); ++ schedule_delayed_work(&tg_pt_gp->tg_pt_gp_transition_work, 0); + wait_for_completion(&wait); + tg_pt_gp->tg_pt_gp_transition_complete = NULL; + } +diff --git a/drivers/target/target_core_file.c b/drivers/target/target_core_file.c +index dee7dfdf203a..5d5e5cd77261 100644 +--- a/drivers/target/target_core_file.c ++++ b/drivers/target/target_core_file.c +@@ -539,6 +539,10 @@ fd_do_unmap(struct se_cmd *cmd, void *priv, sector_t lba, sector_t nolb) + struct inode *inode = file->f_mapping->host; + int ret; + ++ if (!nolb) { ++ return 0; ++ } ++ + if (cmd->se_dev->dev_attrib.pi_prot_type) { + ret = fd_do_prot_unmap(cmd, lba, nolb); + if (ret) +diff --git a/drivers/target/target_core_pr.c b/drivers/target/target_core_pr.c +index 57fd4e14d4eb..770fc5ae26a7 100644 +--- a/drivers/target/target_core_pr.c ++++ b/drivers/target/target_core_pr.c +@@ -58,8 +58,10 @@ void core_pr_dump_initiator_port( + char *buf, + u32 size) + { +- if (!pr_reg->isid_present_at_reg) ++ if (!pr_reg->isid_present_at_reg) { + buf[0] = '\0'; ++ return; ++ } + + snprintf(buf, size, ",i,0x%s", pr_reg->pr_reg_isid); + } +diff --git a/drivers/thermal/step_wise.c b/drivers/thermal/step_wise.c +index ec4ea5940bf7..96932e88464d 100644 +--- a/drivers/thermal/step_wise.c ++++ b/drivers/thermal/step_wise.c +@@ -31,8 +31,7 @@ + * If the temperature is higher than a trip point, + * a. if the trend is THERMAL_TREND_RAISING, use higher cooling + * state for this trip point +- * b. if the trend is THERMAL_TREND_DROPPING, use lower cooling +- * state for this trip point ++ * b. if the trend is THERMAL_TREND_DROPPING, do nothing + * c. if the trend is THERMAL_TREND_RAISE_FULL, use upper limit + * for this trip point + * d. if the trend is THERMAL_TREND_DROP_FULL, use lower limit +@@ -94,9 +93,11 @@ static unsigned long get_target_state(struct thermal_instance *instance, + if (!throttle) + next_target = THERMAL_NO_TARGET; + } else { +- next_target = cur_state - 1; +- if (next_target > instance->upper) +- next_target = instance->upper; ++ if (!throttle) { ++ next_target = cur_state - 1; ++ if (next_target > instance->upper) ++ next_target = instance->upper; ++ } + } + break; + case THERMAL_TREND_DROP_FULL: +diff --git a/drivers/tty/n_hdlc.c b/drivers/tty/n_hdlc.c +index 644ddb841d9f..6d1e2f746ab4 100644 +--- a/drivers/tty/n_hdlc.c ++++ b/drivers/tty/n_hdlc.c +@@ -114,7 +114,7 @@ + #define DEFAULT_TX_BUF_COUNT 3 + + struct n_hdlc_buf { +- struct n_hdlc_buf *link; ++ struct list_head list_item; + int count; + char buf[1]; + }; +@@ -122,8 +122,7 @@ struct n_hdlc_buf { + #define N_HDLC_BUF_SIZE (sizeof(struct n_hdlc_buf) + maxframe) + + struct n_hdlc_buf_list { +- struct n_hdlc_buf *head; +- struct n_hdlc_buf *tail; ++ struct list_head list; + int count; + spinlock_t spinlock; + }; +@@ -136,7 +135,6 @@ struct n_hdlc_buf_list { + * @backup_tty - TTY to use if tty gets closed + * @tbusy - reentrancy flag for tx wakeup code + * @woke_up - FIXME: describe this field +- * @tbuf - currently transmitting tx buffer + * @tx_buf_list - list of pending transmit frame buffers + * @rx_buf_list - list of received frame buffers + * @tx_free_buf_list - list unused transmit frame buffers +@@ -149,7 +147,6 @@ struct n_hdlc { + struct tty_struct *backup_tty; + int tbusy; + int woke_up; +- struct n_hdlc_buf *tbuf; + struct n_hdlc_buf_list tx_buf_list; + struct n_hdlc_buf_list rx_buf_list; + struct n_hdlc_buf_list tx_free_buf_list; +@@ -159,7 +156,8 @@ struct n_hdlc { + /* + * HDLC buffer list manipulation functions + */ +-static void n_hdlc_buf_list_init(struct n_hdlc_buf_list *list); ++static void n_hdlc_buf_return(struct n_hdlc_buf_list *buf_list, ++ struct n_hdlc_buf *buf); + static void n_hdlc_buf_put(struct n_hdlc_buf_list *list, + struct n_hdlc_buf *buf); + static struct n_hdlc_buf *n_hdlc_buf_get(struct n_hdlc_buf_list *list); +@@ -209,16 +207,9 @@ static void flush_tx_queue(struct tty_struct *tty) + { + struct n_hdlc *n_hdlc = tty2n_hdlc(tty); + struct n_hdlc_buf *buf; +- unsigned long flags; + + while ((buf = n_hdlc_buf_get(&n_hdlc->tx_buf_list))) + n_hdlc_buf_put(&n_hdlc->tx_free_buf_list, buf); +- spin_lock_irqsave(&n_hdlc->tx_buf_list.spinlock, flags); +- if (n_hdlc->tbuf) { +- n_hdlc_buf_put(&n_hdlc->tx_free_buf_list, n_hdlc->tbuf); +- n_hdlc->tbuf = NULL; +- } +- spin_unlock_irqrestore(&n_hdlc->tx_buf_list.spinlock, flags); + } + + static struct tty_ldisc_ops n_hdlc_ldisc = { +@@ -284,7 +275,6 @@ static void n_hdlc_release(struct n_hdlc *n_hdlc) + } else + break; + } +- kfree(n_hdlc->tbuf); + kfree(n_hdlc); + + } /* end of n_hdlc_release() */ +@@ -403,13 +393,7 @@ static void n_hdlc_send_frames(struct n_hdlc *n_hdlc, struct tty_struct *tty) + n_hdlc->woke_up = 0; + spin_unlock_irqrestore(&n_hdlc->tx_buf_list.spinlock, flags); + +- /* get current transmit buffer or get new transmit */ +- /* buffer from list of pending transmit buffers */ +- +- tbuf = n_hdlc->tbuf; +- if (!tbuf) +- tbuf = n_hdlc_buf_get(&n_hdlc->tx_buf_list); +- ++ tbuf = n_hdlc_buf_get(&n_hdlc->tx_buf_list); + while (tbuf) { + if (debuglevel >= DEBUG_LEVEL_INFO) + printk("%s(%d)sending frame %p, count=%d\n", +@@ -421,7 +405,7 @@ static void n_hdlc_send_frames(struct n_hdlc *n_hdlc, struct tty_struct *tty) + + /* rollback was possible and has been done */ + if (actual == -ERESTARTSYS) { +- n_hdlc->tbuf = tbuf; ++ n_hdlc_buf_return(&n_hdlc->tx_buf_list, tbuf); + break; + } + /* if transmit error, throw frame away by */ +@@ -436,10 +420,7 @@ static void n_hdlc_send_frames(struct n_hdlc *n_hdlc, struct tty_struct *tty) + + /* free current transmit buffer */ + n_hdlc_buf_put(&n_hdlc->tx_free_buf_list, tbuf); +- +- /* this tx buffer is done */ +- n_hdlc->tbuf = NULL; +- ++ + /* wait up sleeping writers */ + wake_up_interruptible(&tty->write_wait); + +@@ -449,10 +430,12 @@ static void n_hdlc_send_frames(struct n_hdlc *n_hdlc, struct tty_struct *tty) + if (debuglevel >= DEBUG_LEVEL_INFO) + printk("%s(%d)frame %p pending\n", + __FILE__,__LINE__,tbuf); +- +- /* buffer not accepted by driver */ +- /* set this buffer as pending buffer */ +- n_hdlc->tbuf = tbuf; ++ ++ /* ++ * the buffer was not accepted by driver, ++ * return it back into tx queue ++ */ ++ n_hdlc_buf_return(&n_hdlc->tx_buf_list, tbuf); + break; + } + } +@@ -750,7 +733,8 @@ static int n_hdlc_tty_ioctl(struct tty_struct *tty, struct file *file, + int error = 0; + int count; + unsigned long flags; +- ++ struct n_hdlc_buf *buf = NULL; ++ + if (debuglevel >= DEBUG_LEVEL_INFO) + printk("%s(%d)n_hdlc_tty_ioctl() called %d\n", + __FILE__,__LINE__,cmd); +@@ -764,8 +748,10 @@ static int n_hdlc_tty_ioctl(struct tty_struct *tty, struct file *file, + /* report count of read data available */ + /* in next available frame (if any) */ + spin_lock_irqsave(&n_hdlc->rx_buf_list.spinlock,flags); +- if (n_hdlc->rx_buf_list.head) +- count = n_hdlc->rx_buf_list.head->count; ++ buf = list_first_entry_or_null(&n_hdlc->rx_buf_list.list, ++ struct n_hdlc_buf, list_item); ++ if (buf) ++ count = buf->count; + else + count = 0; + spin_unlock_irqrestore(&n_hdlc->rx_buf_list.spinlock,flags); +@@ -777,8 +763,10 @@ static int n_hdlc_tty_ioctl(struct tty_struct *tty, struct file *file, + count = tty_chars_in_buffer(tty); + /* add size of next output frame in queue */ + spin_lock_irqsave(&n_hdlc->tx_buf_list.spinlock,flags); +- if (n_hdlc->tx_buf_list.head) +- count += n_hdlc->tx_buf_list.head->count; ++ buf = list_first_entry_or_null(&n_hdlc->tx_buf_list.list, ++ struct n_hdlc_buf, list_item); ++ if (buf) ++ count += buf->count; + spin_unlock_irqrestore(&n_hdlc->tx_buf_list.spinlock,flags); + error = put_user(count, (int __user *)arg); + break; +@@ -826,14 +814,14 @@ static unsigned int n_hdlc_tty_poll(struct tty_struct *tty, struct file *filp, + poll_wait(filp, &tty->write_wait, wait); + + /* set bits for operations that won't block */ +- if (n_hdlc->rx_buf_list.head) ++ if (!list_empty(&n_hdlc->rx_buf_list.list)) + mask |= POLLIN | POLLRDNORM; /* readable */ + if (test_bit(TTY_OTHER_CLOSED, &tty->flags)) + mask |= POLLHUP; + if (tty_hung_up_p(filp)) + mask |= POLLHUP; + if (!tty_is_writelocked(tty) && +- n_hdlc->tx_free_buf_list.head) ++ !list_empty(&n_hdlc->tx_free_buf_list.list)) + mask |= POLLOUT | POLLWRNORM; /* writable */ + } + return mask; +@@ -853,11 +841,16 @@ static struct n_hdlc *n_hdlc_alloc(void) + if (!n_hdlc) + return NULL; + +- n_hdlc_buf_list_init(&n_hdlc->rx_free_buf_list); +- n_hdlc_buf_list_init(&n_hdlc->tx_free_buf_list); +- n_hdlc_buf_list_init(&n_hdlc->rx_buf_list); +- n_hdlc_buf_list_init(&n_hdlc->tx_buf_list); +- ++ spin_lock_init(&n_hdlc->rx_free_buf_list.spinlock); ++ spin_lock_init(&n_hdlc->tx_free_buf_list.spinlock); ++ spin_lock_init(&n_hdlc->rx_buf_list.spinlock); ++ spin_lock_init(&n_hdlc->tx_buf_list.spinlock); ++ ++ INIT_LIST_HEAD(&n_hdlc->rx_free_buf_list.list); ++ INIT_LIST_HEAD(&n_hdlc->tx_free_buf_list.list); ++ INIT_LIST_HEAD(&n_hdlc->rx_buf_list.list); ++ INIT_LIST_HEAD(&n_hdlc->tx_buf_list.list); ++ + /* allocate free rx buffer list */ + for(i=0;ispinlock); +-} /* end of n_hdlc_buf_list_init() */ ++ unsigned long flags; ++ ++ spin_lock_irqsave(&buf_list->spinlock, flags); ++ ++ list_add(&buf->list_item, &buf_list->list); ++ buf_list->count++; ++ ++ spin_unlock_irqrestore(&buf_list->spinlock, flags); ++} + + /** + * n_hdlc_buf_put - add specified HDLC buffer to tail of specified list +- * @list - pointer to buffer list ++ * @buf_list - pointer to buffer list + * @buf - pointer to buffer + */ +-static void n_hdlc_buf_put(struct n_hdlc_buf_list *list, ++static void n_hdlc_buf_put(struct n_hdlc_buf_list *buf_list, + struct n_hdlc_buf *buf) + { + unsigned long flags; +- spin_lock_irqsave(&list->spinlock,flags); +- +- buf->link=NULL; +- if (list->tail) +- list->tail->link = buf; +- else +- list->head = buf; +- list->tail = buf; +- (list->count)++; +- +- spin_unlock_irqrestore(&list->spinlock,flags); +- ++ ++ spin_lock_irqsave(&buf_list->spinlock, flags); ++ ++ list_add_tail(&buf->list_item, &buf_list->list); ++ buf_list->count++; ++ ++ spin_unlock_irqrestore(&buf_list->spinlock, flags); + } /* end of n_hdlc_buf_put() */ + + /** + * n_hdlc_buf_get - remove and return an HDLC buffer from list +- * @list - pointer to HDLC buffer list ++ * @buf_list - pointer to HDLC buffer list + * + * Remove and return an HDLC buffer from the head of the specified HDLC buffer + * list. + * Returns a pointer to HDLC buffer if available, otherwise %NULL. + */ +-static struct n_hdlc_buf* n_hdlc_buf_get(struct n_hdlc_buf_list *list) ++static struct n_hdlc_buf *n_hdlc_buf_get(struct n_hdlc_buf_list *buf_list) + { + unsigned long flags; + struct n_hdlc_buf *buf; +- spin_lock_irqsave(&list->spinlock,flags); +- +- buf = list->head; ++ ++ spin_lock_irqsave(&buf_list->spinlock, flags); ++ ++ buf = list_first_entry_or_null(&buf_list->list, ++ struct n_hdlc_buf, list_item); + if (buf) { +- list->head = buf->link; +- (list->count)--; ++ list_del(&buf->list_item); ++ buf_list->count--; + } +- if (!list->head) +- list->tail = NULL; +- +- spin_unlock_irqrestore(&list->spinlock,flags); ++ ++ spin_unlock_irqrestore(&buf_list->spinlock, flags); + return buf; +- + } /* end of n_hdlc_buf_get() */ + + static char hdlc_banner[] __initdata = +diff --git a/drivers/tty/serial/8250/8250_fintek.c b/drivers/tty/serial/8250/8250_fintek.c +index 5815e81b5fc6..a8a6fe6fc924 100644 +--- a/drivers/tty/serial/8250/8250_fintek.c ++++ b/drivers/tty/serial/8250/8250_fintek.c +@@ -118,7 +118,7 @@ static int fintek_8250_rs485_config(struct uart_port *port, + + if ((!!(rs485->flags & SER_RS485_RTS_ON_SEND)) == + (!!(rs485->flags & SER_RS485_RTS_AFTER_SEND))) +- rs485->flags &= SER_RS485_ENABLED; ++ rs485->flags &= ~SER_RS485_ENABLED; + else + config |= RS485_URA; + +diff --git a/drivers/tty/serial/8250/8250_pci.c b/drivers/tty/serial/8250/8250_pci.c +index 83a145f61f1f..0a1e9f4d9882 100644 +--- a/drivers/tty/serial/8250/8250_pci.c ++++ b/drivers/tty/serial/8250/8250_pci.c +@@ -58,6 +58,7 @@ struct serial_private { + unsigned int nr; + void __iomem *remapped_bar[PCI_NUM_BAR_RESOURCES]; + struct pci_serial_quirk *quirk; ++ const struct pciserial_board *board; + int line[0]; + }; + +@@ -4155,6 +4156,7 @@ pciserial_init_ports(struct pci_dev *dev, const struct pciserial_board *board) + } + } + priv->nr = i; ++ priv->board = board; + return priv; + + err_deinit: +@@ -4165,7 +4167,7 @@ err_out: + } + EXPORT_SYMBOL_GPL(pciserial_init_ports); + +-void pciserial_remove_ports(struct serial_private *priv) ++void pciserial_detach_ports(struct serial_private *priv) + { + struct pci_serial_quirk *quirk; + int i; +@@ -4185,7 +4187,11 @@ void pciserial_remove_ports(struct serial_private *priv) + quirk = find_quirk(priv->dev); + if (quirk->exit) + quirk->exit(priv->dev); ++} + ++void pciserial_remove_ports(struct serial_private *priv) ++{ ++ pciserial_detach_ports(priv); + kfree(priv); + } + EXPORT_SYMBOL_GPL(pciserial_remove_ports); +@@ -5908,6 +5914,9 @@ static struct pci_device_id serial_pci_tbl[] = { + { PCI_DEVICE(0x1601, 0x0800), .driver_data = pbn_b0_4_1250000 }, + { PCI_DEVICE(0x1601, 0xa801), .driver_data = pbn_b0_4_1250000 }, + ++ /* Amazon PCI serial device */ ++ { PCI_DEVICE(0x1d0f, 0x8250), .driver_data = pbn_b0_1_115200 }, ++ + /* + * These entries match devices with class COMMUNICATION_SERIAL, + * COMMUNICATION_MODEM or COMMUNICATION_MULTISERIAL +@@ -5936,7 +5945,7 @@ static pci_ers_result_t serial8250_io_error_detected(struct pci_dev *dev, + return PCI_ERS_RESULT_DISCONNECT; + + if (priv) +- pciserial_suspend_ports(priv); ++ pciserial_detach_ports(priv); + + pci_disable_device(dev); + +@@ -5961,9 +5970,16 @@ static pci_ers_result_t serial8250_io_slot_reset(struct pci_dev *dev) + static void serial8250_io_resume(struct pci_dev *dev) + { + struct serial_private *priv = pci_get_drvdata(dev); ++ struct serial_private *new; + +- if (priv) +- pciserial_resume_ports(priv); ++ if (!priv) ++ return; ++ ++ new = pciserial_init_ports(dev, priv->board); ++ if (!IS_ERR(new)) { ++ pci_set_drvdata(dev, new); ++ kfree(priv); ++ } + } + + static const struct pci_error_handlers serial8250_err_handler = { +diff --git a/drivers/tty/sysrq.c b/drivers/tty/sysrq.c +index 2f7cfa5c7b8b..529cc86283e7 100644 +--- a/drivers/tty/sysrq.c ++++ b/drivers/tty/sysrq.c +@@ -237,8 +237,10 @@ static void sysrq_handle_showallcpus(int key) + * architecture has no support for it: + */ + if (!trigger_all_cpu_backtrace()) { +- struct pt_regs *regs = get_irq_regs(); ++ struct pt_regs *regs = NULL; + ++ if (in_irq()) ++ regs = get_irq_regs(); + if (regs) { + pr_info("CPU%d:\n", smp_processor_id()); + show_regs(regs); +@@ -257,7 +259,10 @@ static struct sysrq_key_op sysrq_showallcpus_op = { + + static void sysrq_handle_showregs(int key) + { +- struct pt_regs *regs = get_irq_regs(); ++ struct pt_regs *regs = NULL; ++ ++ if (in_irq()) ++ regs = get_irq_regs(); + if (regs) + show_regs(regs); + perf_event_print_debug(); +diff --git a/drivers/usb/core/config.c b/drivers/usb/core/config.c +index 0b99f913d7f2..b868e77f3bfb 100644 +--- a/drivers/usb/core/config.c ++++ b/drivers/usb/core/config.c +@@ -460,6 +460,9 @@ static int usb_parse_configuration(struct usb_device *dev, int cfgidx, + unsigned iad_num = 0; + + memcpy(&config->desc, buffer, USB_DT_CONFIG_SIZE); ++ nintf = nintf_orig = config->desc.bNumInterfaces; ++ config->desc.bNumInterfaces = 0; // Adjusted later ++ + if (config->desc.bDescriptorType != USB_DT_CONFIG || + config->desc.bLength < USB_DT_CONFIG_SIZE || + config->desc.bLength > size) { +@@ -473,7 +476,6 @@ static int usb_parse_configuration(struct usb_device *dev, int cfgidx, + buffer += config->desc.bLength; + size -= config->desc.bLength; + +- nintf = nintf_orig = config->desc.bNumInterfaces; + if (nintf > USB_MAXINTERFACES) { + dev_warn(ddev, "config %d has too many interfaces: %d, " + "using maximum allowed: %d\n", +diff --git a/drivers/usb/core/devio.c b/drivers/usb/core/devio.c +index 94a15883f8cc..3c31309f06d3 100644 +--- a/drivers/usb/core/devio.c ++++ b/drivers/usb/core/devio.c +@@ -113,42 +113,38 @@ enum snoop_when { + #define USB_DEVICE_DEV MKDEV(USB_DEVICE_MAJOR, 0) + + /* Limit on the total amount of memory we can allocate for transfers */ +-static unsigned usbfs_memory_mb = 16; ++static u32 usbfs_memory_mb = 16; + module_param(usbfs_memory_mb, uint, 0644); + MODULE_PARM_DESC(usbfs_memory_mb, + "maximum MB allowed for usbfs buffers (0 = no limit)"); + + /* Hard limit, necessary to avoid arithmetic overflow */ +-#define USBFS_XFER_MAX (UINT_MAX / 2 - 1000000) ++#define USBFS_XFER_MAX (UINT_MAX / 2 - 1000000) + +-static atomic_t usbfs_memory_usage; /* Total memory currently allocated */ ++static atomic64_t usbfs_memory_usage; /* Total memory currently allocated */ + + /* Check whether it's okay to allocate more memory for a transfer */ +-static int usbfs_increase_memory_usage(unsigned amount) ++static int usbfs_increase_memory_usage(u64 amount) + { +- unsigned lim; ++ u64 lim; + +- /* +- * Convert usbfs_memory_mb to bytes, avoiding overflows. +- * 0 means use the hard limit (effectively unlimited). +- */ + lim = ACCESS_ONCE(usbfs_memory_mb); +- if (lim == 0 || lim > (USBFS_XFER_MAX >> 20)) +- lim = USBFS_XFER_MAX; +- else +- lim <<= 20; ++ lim <<= 20; + +- atomic_add(amount, &usbfs_memory_usage); +- if (atomic_read(&usbfs_memory_usage) <= lim) +- return 0; +- atomic_sub(amount, &usbfs_memory_usage); +- return -ENOMEM; ++ atomic64_add(amount, &usbfs_memory_usage); ++ ++ if (lim > 0 && atomic64_read(&usbfs_memory_usage) > lim) { ++ atomic64_sub(amount, &usbfs_memory_usage); ++ return -ENOMEM; ++ } ++ ++ return 0; + } + + /* Memory for a transfer is being deallocated */ +-static void usbfs_decrease_memory_usage(unsigned amount) ++static void usbfs_decrease_memory_usage(u64 amount) + { +- atomic_sub(amount, &usbfs_memory_usage); ++ atomic64_sub(amount, &usbfs_memory_usage); + } + + static int connected(struct usb_dev_state *ps) +@@ -1077,7 +1073,7 @@ static int proc_bulk(struct usb_dev_state *ps, void __user *arg) + if (!usb_maxpacket(dev, pipe, !(bulk.ep & USB_DIR_IN))) + return -EINVAL; + len1 = bulk.len; +- if (len1 >= USBFS_XFER_MAX) ++ if (len1 >= (INT_MAX - sizeof(struct urb))) + return -EINVAL; + ret = usbfs_increase_memory_usage(len1 + sizeof(struct urb)); + if (ret) +@@ -1294,13 +1290,19 @@ static int proc_do_submiturb(struct usb_dev_state *ps, struct usbdevfs_urb *uurb + int number_of_packets = 0; + unsigned int stream_id = 0; + void *buf; +- +- if (uurb->flags & ~(USBDEVFS_URB_ISO_ASAP | +- USBDEVFS_URB_SHORT_NOT_OK | ++ unsigned long mask = USBDEVFS_URB_SHORT_NOT_OK | + USBDEVFS_URB_BULK_CONTINUATION | + USBDEVFS_URB_NO_FSBR | + USBDEVFS_URB_ZERO_PACKET | +- USBDEVFS_URB_NO_INTERRUPT)) ++ USBDEVFS_URB_NO_INTERRUPT; ++ /* USBDEVFS_URB_ISO_ASAP is a special case */ ++ if (uurb->type == USBDEVFS_URB_TYPE_ISO) ++ mask |= USBDEVFS_URB_ISO_ASAP; ++ ++ if (uurb->flags & ~mask) ++ return -EINVAL; ++ ++ if ((unsigned int)uurb->buffer_length >= USBFS_XFER_MAX) + return -EINVAL; + if (uurb->buffer_length > 0 && !uurb->buffer) + return -EINVAL; +@@ -1420,10 +1422,6 @@ static int proc_do_submiturb(struct usb_dev_state *ps, struct usbdevfs_urb *uurb + return -EINVAL; + } + +- if (uurb->buffer_length >= USBFS_XFER_MAX) { +- ret = -EINVAL; +- goto error; +- } + if (uurb->buffer_length > 0 && + !access_ok(is_in ? VERIFY_WRITE : VERIFY_READ, + uurb->buffer, uurb->buffer_length)) { +diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c +index 8600144a7aab..1ba74441d7bf 100644 +--- a/drivers/usb/core/hub.c ++++ b/drivers/usb/core/hub.c +@@ -4815,6 +4815,15 @@ loop: + usb_put_dev(udev); + if ((status == -ENOTCONN) || (status == -ENOTSUPP)) + break; ++ ++ /* When halfway through our retry count, power-cycle the port */ ++ if (i == (SET_CONFIG_TRIES / 2) - 1) { ++ dev_info(&port_dev->dev, "attempt power cycle\n"); ++ usb_hub_set_port_power(hdev, hub, port1, false); ++ msleep(2 * hub_power_on_good_delay(hub)); ++ usb_hub_set_port_power(hdev, hub, port1, true); ++ msleep(hub_power_on_good_delay(hub)); ++ } + } + if (hub->hdev->parent || + !hcd->driver->port_handed_over || +diff --git a/drivers/usb/core/quirks.c b/drivers/usb/core/quirks.c +index 37c418e581fb..50010282c010 100644 +--- a/drivers/usb/core/quirks.c ++++ b/drivers/usb/core/quirks.c +@@ -151,6 +151,9 @@ static const struct usb_device_id usb_quirk_list[] = { + /* appletouch */ + { USB_DEVICE(0x05ac, 0x021a), .driver_info = USB_QUIRK_RESET_RESUME }, + ++ /* Genesys Logic hub, internally used by KY-688 USB 3.1 Type-C Hub */ ++ { USB_DEVICE(0x05e3, 0x0612), .driver_info = USB_QUIRK_NO_LPM }, ++ + /* Genesys Logic hub, internally used by Moshi USB to Ethernet Adapter */ + { USB_DEVICE(0x05e3, 0x0616), .driver_info = USB_QUIRK_NO_LPM }, + +diff --git a/drivers/usb/gadget/configfs.c b/drivers/usb/gadget/configfs.c +index 0495c94a23d7..23330697aff2 100644 +--- a/drivers/usb/gadget/configfs.c ++++ b/drivers/usb/gadget/configfs.c +@@ -266,6 +266,7 @@ static ssize_t gadget_dev_desc_UDC_store(struct gadget_info *gi, + ret = unregister_gadget(gi); + if (ret) + goto err; ++ kfree(name); + } else { + if (gi->udc_name) { + ret = -EBUSY; +diff --git a/drivers/usb/gadget/function/f_fs.c b/drivers/usb/gadget/function/f_fs.c +index 804b209f4c08..2c25a5dec442 100644 +--- a/drivers/usb/gadget/function/f_fs.c ++++ b/drivers/usb/gadget/function/f_fs.c +@@ -791,7 +791,7 @@ static ssize_t ffs_epfile_io(struct file *file, struct ffs_io_data *io_data) + } + + if (io_data->aio) { +- req = usb_ep_alloc_request(ep->ep, GFP_KERNEL); ++ req = usb_ep_alloc_request(ep->ep, GFP_ATOMIC); + if (unlikely(!req)) + goto error_lock; + +diff --git a/drivers/usb/gadget/legacy/inode.c b/drivers/usb/gadget/legacy/inode.c +index 63d71400dcaf..ada2a4f5a774 100644 +--- a/drivers/usb/gadget/legacy/inode.c ++++ b/drivers/usb/gadget/legacy/inode.c +@@ -1834,8 +1834,10 @@ dev_config (struct file *fd, const char __user *buf, size_t len, loff_t *ptr) + + spin_lock_irq (&dev->lock); + value = -EINVAL; +- if (dev->buf) ++ if (dev->buf) { ++ kfree(kbuf); + goto fail; ++ } + dev->buf = kbuf; + + /* full or low speed config */ +diff --git a/drivers/usb/host/ehci-dbg.c b/drivers/usb/host/ehci-dbg.c +index 524cbf26d992..e37395ef5d49 100644 +--- a/drivers/usb/host/ehci-dbg.c ++++ b/drivers/usb/host/ehci-dbg.c +@@ -850,7 +850,7 @@ static ssize_t fill_registers_buffer(struct debug_buffer *buf) + default: /* unknown */ + break; + } +- temp = (cap >> 8) & 0xff; ++ offset = (cap >> 8) & 0xff; + } + } + #endif +diff --git a/drivers/usb/host/xhci-mem.c b/drivers/usb/host/xhci-mem.c +index 68e37424a26d..3d2b4d1482df 100644 +--- a/drivers/usb/host/xhci-mem.c ++++ b/drivers/usb/host/xhci-mem.c +@@ -981,6 +981,12 @@ void xhci_free_virt_devices_depth_first(struct xhci_hcd *xhci, int slot_id) + if (!vdev) + return; + ++ if (vdev->real_port == 0 || ++ vdev->real_port > HCS_MAX_PORTS(xhci->hcs_params1)) { ++ xhci_dbg(xhci, "Bad vdev->real_port.\n"); ++ goto out; ++ } ++ + tt_list_head = &(xhci->rh_bw[vdev->real_port - 1].tts); + list_for_each_entry_safe(tt_info, next, tt_list_head, tt_list) { + /* is this a hub device that added a tt_info to the tts list */ +@@ -994,6 +1000,7 @@ void xhci_free_virt_devices_depth_first(struct xhci_hcd *xhci, int slot_id) + } + } + } ++out: + /* we are now at a leaf device */ + xhci_free_virt_device(xhci, slot_id); + } +@@ -1010,10 +1017,9 @@ int xhci_alloc_virt_device(struct xhci_hcd *xhci, int slot_id, + return 0; + } + +- xhci->devs[slot_id] = kzalloc(sizeof(*xhci->devs[slot_id]), flags); +- if (!xhci->devs[slot_id]) ++ dev = kzalloc(sizeof(*dev), flags); ++ if (!dev) + return 0; +- dev = xhci->devs[slot_id]; + + /* Allocate the (output) device context that will be used in the HC. */ + dev->out_ctx = xhci_alloc_container_ctx(xhci, XHCI_CTX_TYPE_DEVICE, flags); +@@ -1061,9 +1067,17 @@ int xhci_alloc_virt_device(struct xhci_hcd *xhci, int slot_id, + &xhci->dcbaa->dev_context_ptrs[slot_id], + le64_to_cpu(xhci->dcbaa->dev_context_ptrs[slot_id])); + ++ xhci->devs[slot_id] = dev; ++ + return 1; + fail: +- xhci_free_virt_device(xhci, slot_id); ++ ++ if (dev->in_ctx) ++ xhci_free_container_ctx(xhci, dev->in_ctx); ++ if (dev->out_ctx) ++ xhci_free_container_ctx(xhci, dev->out_ctx); ++ kfree(dev); ++ + return 0; + } + +diff --git a/drivers/usb/musb/da8xx.c b/drivers/usb/musb/da8xx.c +index 9a9c82a4d35d..d6a8e325950c 100644 +--- a/drivers/usb/musb/da8xx.c ++++ b/drivers/usb/musb/da8xx.c +@@ -350,7 +350,15 @@ static irqreturn_t da8xx_musb_interrupt(int irq, void *hci) + musb->xceiv->otg->state = OTG_STATE_A_WAIT_VRISE; + portstate(musb->port1_status |= USB_PORT_STAT_POWER); + del_timer(&otg_workaround); +- } else { ++ } else if (!(musb->int_usb & MUSB_INTR_BABBLE)){ ++ /* ++ * When babble condition happens, drvvbus interrupt ++ * is also generated. Ignore this drvvbus interrupt ++ * and let babble interrupt handler recovers the ++ * controller; otherwise, the host-mode flag is lost ++ * due to the MUSB_DEV_MODE() call below and babble ++ * recovery logic will not called. ++ */ + musb->is_active = 0; + MUSB_DEV_MODE(musb); + otg->default_a = 0; +diff --git a/drivers/usb/phy/phy-isp1301.c b/drivers/usb/phy/phy-isp1301.c +index 8a55b37d1a02..d2ed59a38354 100644 +--- a/drivers/usb/phy/phy-isp1301.c ++++ b/drivers/usb/phy/phy-isp1301.c +@@ -32,6 +32,12 @@ static const struct i2c_device_id isp1301_id[] = { + { } + }; + ++static const struct of_device_id isp1301_of_match[] = { ++ {.compatible = "nxp,isp1301" }, ++ { }, ++}; ++MODULE_DEVICE_TABLE(of, isp1301_of_match); ++ + static struct i2c_client *isp1301_i2c_client; + + static int __isp1301_write(struct isp1301 *isp, u8 reg, u8 value, u8 clear) +@@ -129,6 +135,7 @@ static int isp1301_remove(struct i2c_client *client) + static struct i2c_driver isp1301_driver = { + .driver = { + .name = DRV_NAME, ++ .of_match_table = of_match_ptr(isp1301_of_match), + }, + .probe = isp1301_probe, + .remove = isp1301_remove, +diff --git a/drivers/usb/storage/uas-detect.h b/drivers/usb/storage/uas-detect.h +index a155cd02bce2..ecc83c405a8b 100644 +--- a/drivers/usb/storage/uas-detect.h ++++ b/drivers/usb/storage/uas-detect.h +@@ -111,6 +111,10 @@ static int uas_use_uas_driver(struct usb_interface *intf, + } + } + ++ /* All Seagate disk enclosures have broken ATA pass-through support */ ++ if (le16_to_cpu(udev->descriptor.idVendor) == 0x0bc2) ++ flags |= US_FL_NO_ATA_1X; ++ + usb_stor_adjust_quirks(udev, &flags); + + if (flags & US_FL_IGNORE_UAS) { +diff --git a/drivers/usb/storage/unusual_devs.h b/drivers/usb/storage/unusual_devs.h +index 8e80da125b25..cd2e880979f2 100644 +--- a/drivers/usb/storage/unusual_devs.h ++++ b/drivers/usb/storage/unusual_devs.h +@@ -2138,6 +2138,13 @@ UNUSUAL_DEV(0x152d, 0x9561, 0x0000, 0x9999, + USB_SC_DEVICE, USB_PR_DEVICE, NULL, + US_FL_NO_REPORT_OPCODES), + ++/* Reported by David Kozub */ ++UNUSUAL_DEV(0x152d, 0x0578, 0x0000, 0x9999, ++ "JMicron", ++ "JMS567", ++ USB_SC_DEVICE, USB_PR_DEVICE, NULL, ++ US_FL_BROKEN_FUA), ++ + /* + * Patch by Constantin Baranov + * Report by Andreas Koenecke. +diff --git a/drivers/usb/storage/unusual_uas.h b/drivers/usb/storage/unusual_uas.h +index a37ed1e59e99..2f80163ffb94 100644 +--- a/drivers/usb/storage/unusual_uas.h ++++ b/drivers/usb/storage/unusual_uas.h +@@ -141,6 +141,13 @@ UNUSUAL_DEV(0x152d, 0x0567, 0x0000, 0x9999, + USB_SC_DEVICE, USB_PR_DEVICE, NULL, + US_FL_BROKEN_FUA | US_FL_NO_REPORT_OPCODES), + ++/* Reported-by: David Kozub */ ++UNUSUAL_DEV(0x152d, 0x0578, 0x0000, 0x9999, ++ "JMicron", ++ "JMS567", ++ USB_SC_DEVICE, USB_PR_DEVICE, NULL, ++ US_FL_BROKEN_FUA), ++ + /* Reported-by: Hans de Goede */ + UNUSUAL_DEV(0x2109, 0x0711, 0x0000, 0x9999, + "VIA", +diff --git a/drivers/usb/usbip/stub_tx.c b/drivers/usb/usbip/stub_tx.c +index 021003c4de53..af858d52608a 100644 +--- a/drivers/usb/usbip/stub_tx.c ++++ b/drivers/usb/usbip/stub_tx.c +@@ -178,6 +178,13 @@ static int stub_send_ret_submit(struct stub_device *sdev) + memset(&pdu_header, 0, sizeof(pdu_header)); + memset(&msg, 0, sizeof(msg)); + ++ if (urb->actual_length > 0 && !urb->transfer_buffer) { ++ dev_err(&sdev->udev->dev, ++ "urb: actual_length %d transfer_buffer null\n", ++ urb->actual_length); ++ return -1; ++ } ++ + if (usb_pipetype(urb->pipe) == PIPE_ISOCHRONOUS) + iovnum = 2 + urb->number_of_packets; + else +diff --git a/drivers/video/console/fbcon.c b/drivers/video/console/fbcon.c +index b97210671a81..106348c6d993 100644 +--- a/drivers/video/console/fbcon.c ++++ b/drivers/video/console/fbcon.c +@@ -1165,6 +1165,8 @@ static void fbcon_free_font(struct display *p, bool freefont) + p->userfont = 0; + } + ++static void set_vc_hi_font(struct vc_data *vc, bool set); ++ + static void fbcon_deinit(struct vc_data *vc) + { + struct display *p = &fb_display[vc->vc_num]; +@@ -1200,6 +1202,9 @@ finished: + if (free_font) + vc->vc_font.data = NULL; + ++ if (vc->vc_hi_font_mask) ++ set_vc_hi_font(vc, false); ++ + if (!con_is_bound(&fb_con)) + fbcon_exit(); + +@@ -2434,32 +2439,10 @@ static int fbcon_get_font(struct vc_data *vc, struct console_font *font) + return 0; + } + +-static int fbcon_do_set_font(struct vc_data *vc, int w, int h, +- const u8 * data, int userfont) ++/* set/clear vc_hi_font_mask and update vc attrs accordingly */ ++static void set_vc_hi_font(struct vc_data *vc, bool set) + { +- struct fb_info *info = registered_fb[con2fb_map[vc->vc_num]]; +- struct fbcon_ops *ops = info->fbcon_par; +- struct display *p = &fb_display[vc->vc_num]; +- int resize; +- int cnt; +- char *old_data = NULL; +- +- if (CON_IS_VISIBLE(vc) && softback_lines) +- fbcon_set_origin(vc); +- +- resize = (w != vc->vc_font.width) || (h != vc->vc_font.height); +- if (p->userfont) +- old_data = vc->vc_font.data; +- if (userfont) +- cnt = FNTCHARCNT(data); +- else +- cnt = 256; +- vc->vc_font.data = (void *)(p->fontdata = data); +- if ((p->userfont = userfont)) +- REFCOUNT(data)++; +- vc->vc_font.width = w; +- vc->vc_font.height = h; +- if (vc->vc_hi_font_mask && cnt == 256) { ++ if (!set) { + vc->vc_hi_font_mask = 0; + if (vc->vc_can_do_color) { + vc->vc_complement_mask >>= 1; +@@ -2482,7 +2465,7 @@ static int fbcon_do_set_font(struct vc_data *vc, int w, int h, + ((c & 0xfe00) >> 1) | (c & 0xff); + vc->vc_attr >>= 1; + } +- } else if (!vc->vc_hi_font_mask && cnt == 512) { ++ } else { + vc->vc_hi_font_mask = 0x100; + if (vc->vc_can_do_color) { + vc->vc_complement_mask <<= 1; +@@ -2514,8 +2497,38 @@ static int fbcon_do_set_font(struct vc_data *vc, int w, int h, + } else + vc->vc_video_erase_char = c & ~0x100; + } +- + } ++} ++ ++static int fbcon_do_set_font(struct vc_data *vc, int w, int h, ++ const u8 * data, int userfont) ++{ ++ struct fb_info *info = registered_fb[con2fb_map[vc->vc_num]]; ++ struct fbcon_ops *ops = info->fbcon_par; ++ struct display *p = &fb_display[vc->vc_num]; ++ int resize; ++ int cnt; ++ char *old_data = NULL; ++ ++ if (CON_IS_VISIBLE(vc) && softback_lines) ++ fbcon_set_origin(vc); ++ ++ resize = (w != vc->vc_font.width) || (h != vc->vc_font.height); ++ if (p->userfont) ++ old_data = vc->vc_font.data; ++ if (userfont) ++ cnt = FNTCHARCNT(data); ++ else ++ cnt = 256; ++ vc->vc_font.data = (void *)(p->fontdata = data); ++ if ((p->userfont = userfont)) ++ REFCOUNT(data)++; ++ vc->vc_font.width = w; ++ vc->vc_font.height = h; ++ if (vc->vc_hi_font_mask && cnt == 256) ++ set_vc_hi_font(vc, false); ++ else if (!vc->vc_hi_font_mask && cnt == 512) ++ set_vc_hi_font(vc, true); + + if (resize) { + int cols, rows; +diff --git a/drivers/video/fbdev/au1200fb.c b/drivers/video/fbdev/au1200fb.c +index f9507b1894df..789d3f16ff9f 100644 +--- a/drivers/video/fbdev/au1200fb.c ++++ b/drivers/video/fbdev/au1200fb.c +@@ -1680,8 +1680,10 @@ static int au1200fb_drv_probe(struct platform_device *dev) + + fbi = framebuffer_alloc(sizeof(struct au1200fb_device), + &dev->dev); +- if (!fbi) ++ if (!fbi) { ++ ret = -ENOMEM; + goto failed; ++ } + + _au1200fb_infos[plane] = fbi; + fbdev = fbi->par; +@@ -1699,7 +1701,8 @@ static int au1200fb_drv_probe(struct platform_device *dev) + if (!fbdev->fb_mem) { + print_err("fail to allocate frambuffer (size: %dK))", + fbdev->fb_len / 1024); +- return -ENOMEM; ++ ret = -ENOMEM; ++ goto failed; + } + + /* +diff --git a/drivers/video/fbdev/controlfb.h b/drivers/video/fbdev/controlfb.h +index 6026c60fc100..261522fabdac 100644 +--- a/drivers/video/fbdev/controlfb.h ++++ b/drivers/video/fbdev/controlfb.h +@@ -141,5 +141,7 @@ static struct max_cmodes control_mac_modes[] = { + {{ 1, 2}}, /* 1152x870, 75Hz */ + {{ 0, 1}}, /* 1280x960, 75Hz */ + {{ 0, 1}}, /* 1280x1024, 75Hz */ ++ {{ 1, 2}}, /* 1152x768, 60Hz */ ++ {{ 0, 1}}, /* 1600x1024, 60Hz */ + }; + +diff --git a/drivers/video/fbdev/udlfb.c b/drivers/video/fbdev/udlfb.c +index ff2b8731a2dc..d2a985e59fcd 100644 +--- a/drivers/video/fbdev/udlfb.c ++++ b/drivers/video/fbdev/udlfb.c +@@ -769,11 +769,11 @@ static int dlfb_get_edid(struct dlfb_data *dev, char *edid, int len) + + for (i = 0; i < len; i++) { + ret = usb_control_msg(dev->udev, +- usb_rcvctrlpipe(dev->udev, 0), (0x02), +- (0x80 | (0x02 << 5)), i << 8, 0xA1, rbuf, 2, +- HZ); +- if (ret < 1) { +- pr_err("Read EDID byte %d failed err %x\n", i, ret); ++ usb_rcvctrlpipe(dev->udev, 0), 0x02, ++ (0x80 | (0x02 << 5)), i << 8, 0xA1, ++ rbuf, 2, USB_CTRL_GET_TIMEOUT); ++ if (ret < 2) { ++ pr_err("Read EDID byte %d failed: %d\n", i, ret); + i--; + break; + } +diff --git a/drivers/virtio/virtio.c b/drivers/virtio/virtio.c +index b1877d73fa56..42a51c872754 100644 +--- a/drivers/virtio/virtio.c ++++ b/drivers/virtio/virtio.c +@@ -323,6 +323,8 @@ int register_virtio_device(struct virtio_device *dev) + /* device_register() causes the bus infrastructure to look for a + * matching driver. */ + err = device_register(&dev->dev); ++ if (err) ++ ida_simple_remove(&virtio_index_ida, dev->index); + out: + if (err) + add_status(dev, VIRTIO_CONFIG_S_FAILED); +diff --git a/fs/afs/callback.c b/fs/afs/callback.c +index 7ef637d7f3a5..7d54efd73519 100644 +--- a/fs/afs/callback.c ++++ b/fs/afs/callback.c +@@ -362,7 +362,7 @@ static void afs_callback_updater(struct work_struct *work) + { + struct afs_server *server; + struct afs_vnode *vnode, *xvnode; +- time_t now; ++ time64_t now; + long timeout; + int ret; + +@@ -370,7 +370,7 @@ static void afs_callback_updater(struct work_struct *work) + + _enter(""); + +- now = get_seconds(); ++ now = ktime_get_real_seconds(); + + /* find the first vnode to update */ + spin_lock(&server->cb_lock); +@@ -424,7 +424,8 @@ static void afs_callback_updater(struct work_struct *work) + + /* and then reschedule */ + _debug("reschedule"); +- vnode->update_at = get_seconds() + afs_vnode_update_timeout; ++ vnode->update_at = ktime_get_real_seconds() + ++ afs_vnode_update_timeout; + + spin_lock(&server->cb_lock); + +diff --git a/fs/afs/cmservice.c b/fs/afs/cmservice.c +index 4b0eff6da674..83a8a33a0d73 100644 +--- a/fs/afs/cmservice.c ++++ b/fs/afs/cmservice.c +@@ -115,6 +115,9 @@ bool afs_cm_incoming_call(struct afs_call *call) + case CBProbe: + call->type = &afs_SRXCBProbe; + return true; ++ case CBProbeUuid: ++ call->type = &afs_SRXCBProbeUuid; ++ return true; + case CBTellMeAboutYourself: + call->type = &afs_SRXCBTellMeAboutYourself; + return true; +diff --git a/fs/afs/file.c b/fs/afs/file.c +index 999bc3caec92..cf8a07e282a6 100644 +--- a/fs/afs/file.c ++++ b/fs/afs/file.c +@@ -29,6 +29,7 @@ static int afs_readpages(struct file *filp, struct address_space *mapping, + + const struct file_operations afs_file_operations = { + .open = afs_open, ++ .flush = afs_flush, + .release = afs_release, + .llseek = generic_file_llseek, + .read_iter = generic_file_read_iter, +diff --git a/fs/afs/fsclient.c b/fs/afs/fsclient.c +index c2e930ec2888..10ce44214005 100644 +--- a/fs/afs/fsclient.c ++++ b/fs/afs/fsclient.c +@@ -105,7 +105,7 @@ static void xdr_decode_AFSFetchStatus(const __be32 **_bp, + vnode->vfs_inode.i_mode = mode; + } + +- vnode->vfs_inode.i_ctime.tv_sec = status->mtime_server; ++ vnode->vfs_inode.i_ctime.tv_sec = status->mtime_client; + vnode->vfs_inode.i_mtime = vnode->vfs_inode.i_ctime; + vnode->vfs_inode.i_atime = vnode->vfs_inode.i_ctime; + vnode->vfs_inode.i_version = data_version; +@@ -139,7 +139,7 @@ static void xdr_decode_AFSCallBack(const __be32 **_bp, struct afs_vnode *vnode) + vnode->cb_version = ntohl(*bp++); + vnode->cb_expiry = ntohl(*bp++); + vnode->cb_type = ntohl(*bp++); +- vnode->cb_expires = vnode->cb_expiry + get_seconds(); ++ vnode->cb_expires = vnode->cb_expiry + ktime_get_real_seconds(); + *_bp = bp; + } + +@@ -703,8 +703,8 @@ int afs_fs_create(struct afs_server *server, + memset(bp, 0, padsz); + bp = (void *) bp + padsz; + } +- *bp++ = htonl(AFS_SET_MODE); +- *bp++ = 0; /* mtime */ ++ *bp++ = htonl(AFS_SET_MODE | AFS_SET_MTIME); ++ *bp++ = htonl(vnode->vfs_inode.i_mtime.tv_sec); /* mtime */ + *bp++ = 0; /* owner */ + *bp++ = 0; /* group */ + *bp++ = htonl(mode & S_IALLUGO); /* unix mode */ +@@ -981,8 +981,8 @@ int afs_fs_symlink(struct afs_server *server, + memset(bp, 0, c_padsz); + bp = (void *) bp + c_padsz; + } +- *bp++ = htonl(AFS_SET_MODE); +- *bp++ = 0; /* mtime */ ++ *bp++ = htonl(AFS_SET_MODE | AFS_SET_MTIME); ++ *bp++ = htonl(vnode->vfs_inode.i_mtime.tv_sec); /* mtime */ + *bp++ = 0; /* owner */ + *bp++ = 0; /* group */ + *bp++ = htonl(S_IRWXUGO); /* unix mode */ +@@ -1192,8 +1192,8 @@ static int afs_fs_store_data64(struct afs_server *server, + *bp++ = htonl(vnode->fid.vnode); + *bp++ = htonl(vnode->fid.unique); + +- *bp++ = 0; /* mask */ +- *bp++ = 0; /* mtime */ ++ *bp++ = htonl(AFS_SET_MTIME); /* mask */ ++ *bp++ = htonl(vnode->vfs_inode.i_mtime.tv_sec); /* mtime */ + *bp++ = 0; /* owner */ + *bp++ = 0; /* group */ + *bp++ = 0; /* unix mode */ +@@ -1225,7 +1225,7 @@ int afs_fs_store_data(struct afs_server *server, struct afs_writeback *wb, + _enter(",%x,{%x:%u},,", + key_serial(wb->key), vnode->fid.vid, vnode->fid.vnode); + +- size = to - offset; ++ size = (loff_t)to - (loff_t)offset; + if (first != last) + size += (loff_t)(last - first) << PAGE_SHIFT; + pos = (loff_t)first << PAGE_SHIFT; +@@ -1269,8 +1269,8 @@ int afs_fs_store_data(struct afs_server *server, struct afs_writeback *wb, + *bp++ = htonl(vnode->fid.vnode); + *bp++ = htonl(vnode->fid.unique); + +- *bp++ = 0; /* mask */ +- *bp++ = 0; /* mtime */ ++ *bp++ = htonl(AFS_SET_MTIME); /* mask */ ++ *bp++ = htonl(vnode->vfs_inode.i_mtime.tv_sec); /* mtime */ + *bp++ = 0; /* owner */ + *bp++ = 0; /* group */ + *bp++ = 0; /* unix mode */ +diff --git a/fs/afs/inode.c b/fs/afs/inode.c +index e06f5a23352a..f8fa92b1d43c 100644 +--- a/fs/afs/inode.c ++++ b/fs/afs/inode.c +@@ -69,9 +69,9 @@ static int afs_inode_map_status(struct afs_vnode *vnode, struct key *key) + + set_nlink(inode, vnode->status.nlink); + inode->i_uid = vnode->status.owner; +- inode->i_gid = GLOBAL_ROOT_GID; ++ inode->i_gid = vnode->status.group; + inode->i_size = vnode->status.size; +- inode->i_ctime.tv_sec = vnode->status.mtime_server; ++ inode->i_ctime.tv_sec = vnode->status.mtime_client; + inode->i_ctime.tv_nsec = 0; + inode->i_atime = inode->i_mtime = inode->i_ctime; + inode->i_blocks = 0; +@@ -244,12 +244,13 @@ struct inode *afs_iget(struct super_block *sb, struct key *key, + vnode->cb_version = 0; + vnode->cb_expiry = 0; + vnode->cb_type = 0; +- vnode->cb_expires = get_seconds(); ++ vnode->cb_expires = ktime_get_real_seconds(); + } else { + vnode->cb_version = cb->version; + vnode->cb_expiry = cb->expiry; + vnode->cb_type = cb->type; +- vnode->cb_expires = vnode->cb_expiry + get_seconds(); ++ vnode->cb_expires = vnode->cb_expiry + ++ ktime_get_real_seconds(); + } + } + +@@ -322,7 +323,7 @@ int afs_validate(struct afs_vnode *vnode, struct key *key) + !test_bit(AFS_VNODE_CB_BROKEN, &vnode->flags) && + !test_bit(AFS_VNODE_MODIFIED, &vnode->flags) && + !test_bit(AFS_VNODE_ZAP_DATA, &vnode->flags)) { +- if (vnode->cb_expires < get_seconds() + 10) { ++ if (vnode->cb_expires < ktime_get_real_seconds() + 10) { + _debug("callback expired"); + set_bit(AFS_VNODE_CB_BROKEN, &vnode->flags); + } else { +diff --git a/fs/afs/internal.h b/fs/afs/internal.h +index 71d5982312f3..1330b2a695ff 100644 +--- a/fs/afs/internal.h ++++ b/fs/afs/internal.h +@@ -11,6 +11,7 @@ + + #include + #include ++#include + #include + #include + #include +@@ -247,7 +248,7 @@ struct afs_cache_vhash { + */ + struct afs_vlocation { + atomic_t usage; +- time_t time_of_death; /* time at which put reduced usage to 0 */ ++ time64_t time_of_death; /* time at which put reduced usage to 0 */ + struct list_head link; /* link in cell volume location list */ + struct list_head grave; /* link in master graveyard list */ + struct list_head update; /* link in master update list */ +@@ -258,7 +259,7 @@ struct afs_vlocation { + struct afs_cache_vlocation vldb; /* volume information DB record */ + struct afs_volume *vols[3]; /* volume access record pointer (index by type) */ + wait_queue_head_t waitq; /* status change waitqueue */ +- time_t update_at; /* time at which record should be updated */ ++ time64_t update_at; /* time at which record should be updated */ + spinlock_t lock; /* access lock */ + afs_vlocation_state_t state; /* volume location state */ + unsigned short upd_rej_cnt; /* ENOMEDIUM count during update */ +@@ -271,7 +272,7 @@ struct afs_vlocation { + */ + struct afs_server { + atomic_t usage; +- time_t time_of_death; /* time at which put reduced usage to 0 */ ++ time64_t time_of_death; /* time at which put reduced usage to 0 */ + struct in_addr addr; /* server address */ + struct afs_cell *cell; /* cell in which server resides */ + struct list_head link; /* link in cell's server list */ +@@ -374,8 +375,8 @@ struct afs_vnode { + struct rb_node server_rb; /* link in server->fs_vnodes */ + struct rb_node cb_promise; /* link in server->cb_promises */ + struct work_struct cb_broken_work; /* work to be done on callback break */ +- time_t cb_expires; /* time at which callback expires */ +- time_t cb_expires_at; /* time used to order cb_promise */ ++ time64_t cb_expires; /* time at which callback expires */ ++ time64_t cb_expires_at; /* time used to order cb_promise */ + unsigned cb_version; /* callback version */ + unsigned cb_expiry; /* callback expiry time */ + afs_callback_type_t cb_type; /* type of callback */ +@@ -749,6 +750,7 @@ extern int afs_writepages(struct address_space *, struct writeback_control *); + extern void afs_pages_written_back(struct afs_vnode *, struct afs_call *); + extern ssize_t afs_file_write(struct kiocb *, struct iov_iter *); + extern int afs_writeback_all(struct afs_vnode *); ++extern int afs_flush(struct file *, fl_owner_t); + extern int afs_fsync(struct file *, loff_t, loff_t, int); + + +diff --git a/fs/afs/security.c b/fs/afs/security.c +index 8d010422dc89..bfa9d3428383 100644 +--- a/fs/afs/security.c ++++ b/fs/afs/security.c +@@ -340,17 +340,22 @@ int afs_permission(struct inode *inode, int mask) + } else { + if (!(access & AFS_ACE_LOOKUP)) + goto permission_denied; ++ if ((mask & MAY_EXEC) && !(inode->i_mode & S_IXUSR)) ++ goto permission_denied; + if (mask & (MAY_EXEC | MAY_READ)) { + if (!(access & AFS_ACE_READ)) + goto permission_denied; ++ if (!(inode->i_mode & S_IRUSR)) ++ goto permission_denied; + } else if (mask & MAY_WRITE) { + if (!(access & AFS_ACE_WRITE)) + goto permission_denied; ++ if (!(inode->i_mode & S_IWUSR)) ++ goto permission_denied; + } + } + + key_put(key); +- ret = generic_permission(inode, mask); + _leave(" = %d", ret); + return ret; + +diff --git a/fs/afs/server.c b/fs/afs/server.c +index f342acf3547d..3bc1a46f0bd6 100644 +--- a/fs/afs/server.c ++++ b/fs/afs/server.c +@@ -237,7 +237,7 @@ void afs_put_server(struct afs_server *server) + spin_lock(&afs_server_graveyard_lock); + if (atomic_read(&server->usage) == 0) { + list_move_tail(&server->grave, &afs_server_graveyard); +- server->time_of_death = get_seconds(); ++ server->time_of_death = ktime_get_real_seconds(); + queue_delayed_work(afs_wq, &afs_server_reaper, + afs_server_timeout * HZ); + } +@@ -272,9 +272,9 @@ static void afs_reap_server(struct work_struct *work) + LIST_HEAD(corpses); + struct afs_server *server; + unsigned long delay, expiry; +- time_t now; ++ time64_t now; + +- now = get_seconds(); ++ now = ktime_get_real_seconds(); + spin_lock(&afs_server_graveyard_lock); + + while (!list_empty(&afs_server_graveyard)) { +diff --git a/fs/afs/vlocation.c b/fs/afs/vlocation.c +index 52976785a32c..ee9015c0db5a 100644 +--- a/fs/afs/vlocation.c ++++ b/fs/afs/vlocation.c +@@ -340,7 +340,8 @@ static void afs_vlocation_queue_for_updates(struct afs_vlocation *vl) + struct afs_vlocation *xvl; + + /* wait at least 10 minutes before updating... */ +- vl->update_at = get_seconds() + afs_vlocation_update_timeout; ++ vl->update_at = ktime_get_real_seconds() + ++ afs_vlocation_update_timeout; + + spin_lock(&afs_vlocation_updates_lock); + +@@ -506,7 +507,7 @@ void afs_put_vlocation(struct afs_vlocation *vl) + if (atomic_read(&vl->usage) == 0) { + _debug("buried"); + list_move_tail(&vl->grave, &afs_vlocation_graveyard); +- vl->time_of_death = get_seconds(); ++ vl->time_of_death = ktime_get_real_seconds(); + queue_delayed_work(afs_wq, &afs_vlocation_reap, + afs_vlocation_timeout * HZ); + +@@ -543,11 +544,11 @@ static void afs_vlocation_reaper(struct work_struct *work) + LIST_HEAD(corpses); + struct afs_vlocation *vl; + unsigned long delay, expiry; +- time_t now; ++ time64_t now; + + _enter(""); + +- now = get_seconds(); ++ now = ktime_get_real_seconds(); + spin_lock(&afs_vlocation_graveyard_lock); + + while (!list_empty(&afs_vlocation_graveyard)) { +@@ -622,13 +623,13 @@ static void afs_vlocation_updater(struct work_struct *work) + { + struct afs_cache_vlocation vldb; + struct afs_vlocation *vl, *xvl; +- time_t now; ++ time64_t now; + long timeout; + int ret; + + _enter(""); + +- now = get_seconds(); ++ now = ktime_get_real_seconds(); + + /* find a record to update */ + spin_lock(&afs_vlocation_updates_lock); +@@ -684,7 +685,8 @@ static void afs_vlocation_updater(struct work_struct *work) + + /* and then reschedule */ + _debug("reschedule"); +- vl->update_at = get_seconds() + afs_vlocation_update_timeout; ++ vl->update_at = ktime_get_real_seconds() + ++ afs_vlocation_update_timeout; + + spin_lock(&afs_vlocation_updates_lock); + +diff --git a/fs/afs/write.c b/fs/afs/write.c +index 0714abcd7f32..5cfc05ca184c 100644 +--- a/fs/afs/write.c ++++ b/fs/afs/write.c +@@ -148,12 +148,12 @@ int afs_write_begin(struct file *file, struct address_space *mapping, + kfree(candidate); + return -ENOMEM; + } +- *pagep = page; +- /* page won't leak in error case: it eventually gets cleaned off LRU */ + + if (!PageUptodate(page) && len != PAGE_CACHE_SIZE) { + ret = afs_fill_page(vnode, key, index << PAGE_CACHE_SHIFT, page); + if (ret < 0) { ++ unlock_page(page); ++ put_page(page); + kfree(candidate); + _leave(" = %d [prep]", ret); + return ret; +@@ -161,6 +161,9 @@ int afs_write_begin(struct file *file, struct address_space *mapping, + SetPageUptodate(page); + } + ++ /* page won't leak in error case: it eventually gets cleaned off LRU */ ++ *pagep = page; ++ + try_again: + spin_lock(&vnode->writeback_lock); + +@@ -296,10 +299,14 @@ static void afs_kill_pages(struct afs_vnode *vnode, bool error, + ASSERTCMP(pv.nr, ==, count); + + for (loop = 0; loop < count; loop++) { +- ClearPageUptodate(pv.pages[loop]); ++ struct page *page = pv.pages[loop]; ++ ClearPageUptodate(page); + if (error) +- SetPageError(pv.pages[loop]); +- end_page_writeback(pv.pages[loop]); ++ SetPageError(page); ++ if (PageWriteback(page)) ++ end_page_writeback(page); ++ if (page->index >= first) ++ first = page->index + 1; + } + + __pagevec_release(&pv); +@@ -503,6 +510,7 @@ static int afs_writepages_region(struct address_space *mapping, + + if (PageWriteback(page) || !PageDirty(page)) { + unlock_page(page); ++ put_page(page); + continue; + } + +@@ -739,6 +747,20 @@ out: + return ret; + } + ++/* ++ * Flush out all outstanding writes on a file opened for writing when it is ++ * closed. ++ */ ++int afs_flush(struct file *file, fl_owner_t id) ++{ ++ _enter(""); ++ ++ if ((file->f_mode & FMODE_WRITE) == 0) ++ return 0; ++ ++ return vfs_fsync(file, 0); ++} ++ + /* + * notification that a previously read-only page is about to become writable + * - if it returns an error, the caller will deliver a bus error signal +diff --git a/fs/autofs4/waitq.c b/fs/autofs4/waitq.c +index fe6e7050fe50..98198c57370b 100644 +--- a/fs/autofs4/waitq.c ++++ b/fs/autofs4/waitq.c +@@ -174,7 +174,6 @@ static void autofs4_notify_daemon(struct autofs_sb_info *sbi, + + mutex_unlock(&sbi->wq_mutex); + +- if (autofs4_write(sbi, pipe, &pkt, pktsz)) + switch (ret = autofs4_write(sbi, pipe, &pkt, pktsz)) { + case 0: + break; +diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c +index db6115486166..d14af5bd13d6 100644 +--- a/fs/btrfs/inode.c ++++ b/fs/btrfs/inode.c +@@ -6667,6 +6667,20 @@ static noinline int uncompress_inline(struct btrfs_path *path, + max_size = min_t(unsigned long, PAGE_CACHE_SIZE, max_size); + ret = btrfs_decompress(compress_type, tmp, page, + extent_offset, inline_size, max_size); ++ ++ /* ++ * decompression code contains a memset to fill in any space between the end ++ * of the uncompressed data and the end of max_size in case the decompressed ++ * data ends up shorter than ram_bytes. That doesn't cover the hole between ++ * the end of an inline extent and the beginning of the next block, so we ++ * cover that region here. ++ */ ++ ++ if (max_size + pg_offset < PAGE_SIZE) { ++ char *map = kmap(page); ++ memset(map + pg_offset + max_size, 0, PAGE_SIZE - max_size - pg_offset); ++ kunmap(page); ++ } + kfree(tmp); + return ret; + } +diff --git a/fs/ext4/extents.c b/fs/ext4/extents.c +index 447d64e47c4c..dbc793e31f35 100644 +--- a/fs/ext4/extents.c ++++ b/fs/ext4/extents.c +@@ -4723,6 +4723,7 @@ retry: + EXT4_INODE_EOFBLOCKS); + } + ext4_mark_inode_dirty(handle, inode); ++ ext4_update_inode_fsync_trans(handle, inode, 1); + ret2 = ext4_journal_stop(handle); + if (ret2) + break; +diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c +index 443ff49dc36f..c1feaf011515 100644 +--- a/fs/ext4/inode.c ++++ b/fs/ext4/inode.c +@@ -3531,6 +3531,10 @@ static int ext4_block_truncate_page(handle_t *handle, + unsigned blocksize; + struct inode *inode = mapping->host; + ++ /* If we are processing an encrypted inode during orphan list handling */ ++ if (ext4_encrypted_inode(inode) && !ext4_has_encryption_key(inode)) ++ return 0; ++ + blocksize = inode->i_sb->s_blocksize; + length = blocksize - (offset & (blocksize - 1)); + +diff --git a/fs/ext4/namei.c b/fs/ext4/namei.c +index 03482c01fb3e..aa33db84ccba 100644 +--- a/fs/ext4/namei.c ++++ b/fs/ext4/namei.c +@@ -1412,6 +1412,10 @@ static struct buffer_head * ext4_find_entry (struct inode *dir, + "falling back\n")); + } + nblocks = dir->i_size >> EXT4_BLOCK_SIZE_BITS(sb); ++ if (!nblocks) { ++ ret = NULL; ++ goto cleanup_and_exit; ++ } + start = EXT4_I(dir)->i_dir_start_lookup; + if (start >= nblocks) + start = 0; +diff --git a/fs/ext4/super.c b/fs/ext4/super.c +index 807b1df8e134..b29a7ef4953e 100644 +--- a/fs/ext4/super.c ++++ b/fs/ext4/super.c +@@ -774,6 +774,7 @@ static void ext4_put_super(struct super_block *sb) + { + struct ext4_sb_info *sbi = EXT4_SB(sb); + struct ext4_super_block *es = sbi->s_es; ++ int aborted = 0; + int i, err; + + ext4_unregister_li_request(sb); +@@ -783,9 +784,10 @@ static void ext4_put_super(struct super_block *sb) + destroy_workqueue(sbi->rsv_conversion_wq); + + if (sbi->s_journal) { ++ aborted = is_journal_aborted(sbi->s_journal); + err = jbd2_journal_destroy(sbi->s_journal); + sbi->s_journal = NULL; +- if (err < 0) ++ if ((err < 0) && !aborted) + ext4_abort(sb, "Couldn't clean up the journal"); + } + +@@ -796,7 +798,7 @@ static void ext4_put_super(struct super_block *sb) + ext4_ext_release(sb); + ext4_xattr_put_super(sb); + +- if (!(sb->s_flags & MS_RDONLY)) { ++ if (!(sb->s_flags & MS_RDONLY) && !aborted) { + EXT4_CLEAR_INCOMPAT_FEATURE(sb, EXT4_FEATURE_INCOMPAT_RECOVER); + es->s_state = cpu_to_le16(sbi->s_mount_state); + } +diff --git a/fs/gfs2/file.c b/fs/gfs2/file.c +index 31892871ea87..2f45f0ce5d66 100644 +--- a/fs/gfs2/file.c ++++ b/fs/gfs2/file.c +@@ -255,7 +255,7 @@ static int do_gfs2_set_flags(struct file *filp, u32 reqflags, u32 mask) + goto out; + } + if ((flags ^ new_flags) & GFS2_DIF_JDATA) { +- if (flags & GFS2_DIF_JDATA) ++ if (new_flags & GFS2_DIF_JDATA) + gfs2_log_flush(sdp, ip->i_gl, NORMAL_FLUSH); + error = filemap_fdatawrite(inode->i_mapping); + if (error) +@@ -263,6 +263,8 @@ static int do_gfs2_set_flags(struct file *filp, u32 reqflags, u32 mask) + error = filemap_fdatawait(inode->i_mapping); + if (error) + goto out; ++ if (new_flags & GFS2_DIF_JDATA) ++ gfs2_ordered_del_inode(ip); + } + error = gfs2_trans_begin(sdp, RES_DINODE, 0); + if (error) +diff --git a/fs/nfs/dir.c b/fs/nfs/dir.c +index 1484ae1907c6..d2cb63259560 100644 +--- a/fs/nfs/dir.c ++++ b/fs/nfs/dir.c +@@ -2076,7 +2076,7 @@ out: + if (new_inode != NULL) + nfs_drop_nlink(new_inode); + d_move(old_dentry, new_dentry); +- nfs_set_verifier(new_dentry, ++ nfs_set_verifier(old_dentry, + nfs_save_change_attribute(new_dir)); + } else if (error == -ENOENT) + nfs_dentry_handle_enoent(old_dentry); +diff --git a/fs/nfs/nfs4client.c b/fs/nfs/nfs4client.c +index 5dea913baf46..a03ec3b53d9e 100644 +--- a/fs/nfs/nfs4client.c ++++ b/fs/nfs/nfs4client.c +@@ -899,9 +899,9 @@ static void nfs4_session_set_rwsize(struct nfs_server *server) + server_resp_sz = sess->fc_attrs.max_resp_sz - nfs41_maxread_overhead; + server_rqst_sz = sess->fc_attrs.max_rqst_sz - nfs41_maxwrite_overhead; + +- if (server->rsize > server_resp_sz) ++ if (!server->rsize || server->rsize > server_resp_sz) + server->rsize = server_resp_sz; +- if (server->wsize > server_rqst_sz) ++ if (!server->wsize || server->wsize > server_rqst_sz) + server->wsize = server_rqst_sz; + #endif /* CONFIG_NFS_V4_1 */ + } +diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c +index 1ce18913762a..0fb0dc739fb2 100644 +--- a/fs/nfs/nfs4proc.c ++++ b/fs/nfs/nfs4proc.c +@@ -38,7 +38,6 @@ + #include + #include + #include +-#include + #include + #include + #include +@@ -5605,7 +5604,6 @@ static struct nfs4_lockdata *nfs4_alloc_lockdata(struct file_lock *fl, + p->server = server; + atomic_inc(&lsp->ls_count); + p->ctx = get_nfs_open_context(ctx); +- get_file(fl->fl_file); + memcpy(&p->fl, fl, sizeof(p->fl)); + return p; + out_free_seqid: +@@ -5718,7 +5716,6 @@ static void nfs4_lock_release(void *calldata) + nfs_free_seqid(data->arg.lock_seqid); + nfs4_put_lock_state(data->lsp); + put_nfs_open_context(data->ctx); +- fput(data->fl.fl_file); + kfree(data); + dprintk("%s: done!\n", __func__); + } +diff --git a/fs/nfs/nfs4state.c b/fs/nfs/nfs4state.c +index 2a9ab265aa32..f8d2902ec118 100644 +--- a/fs/nfs/nfs4state.c ++++ b/fs/nfs/nfs4state.c +@@ -1678,7 +1678,6 @@ static int nfs4_recovery_handle_error(struct nfs_client *clp, int error) + break; + case -NFS4ERR_STALE_CLIENTID: + set_bit(NFS4CLNT_LEASE_EXPIRED, &clp->cl_state); +- nfs4_state_clear_reclaim_reboot(clp); + nfs4_state_start_reclaim_reboot(clp); + break; + case -NFS4ERR_EXPIRED: +diff --git a/fs/nfsd/nfssvc.c b/fs/nfsd/nfssvc.c +index c493427e9d69..a208c7ea9680 100644 +--- a/fs/nfsd/nfssvc.c ++++ b/fs/nfsd/nfssvc.c +@@ -151,7 +151,8 @@ int nfsd_vers(int vers, enum vers_op change) + + int nfsd_minorversion(u32 minorversion, enum vers_op change) + { +- if (minorversion > NFSD_SUPPORTED_MINOR_VERSION) ++ if (minorversion > NFSD_SUPPORTED_MINOR_VERSION && ++ change != NFSD_AVAIL) + return -1; + switch(change) { + case NFSD_SET: +@@ -329,23 +330,20 @@ static void nfsd_last_thread(struct svc_serv *serv, struct net *net) + + void nfsd_reset_versions(void) + { +- int found_one = 0; + int i; + +- for (i = NFSD_MINVERS; i < NFSD_NRVERS; i++) { +- if (nfsd_program.pg_vers[i]) +- found_one = 1; +- } +- +- if (!found_one) { +- for (i = NFSD_MINVERS; i < NFSD_NRVERS; i++) +- nfsd_program.pg_vers[i] = nfsd_version[i]; +-#if defined(CONFIG_NFSD_V2_ACL) || defined(CONFIG_NFSD_V3_ACL) +- for (i = NFSD_ACL_MINVERS; i < NFSD_ACL_NRVERS; i++) +- nfsd_acl_program.pg_vers[i] = +- nfsd_acl_version[i]; +-#endif +- } ++ for (i = 0; i < NFSD_NRVERS; i++) ++ if (nfsd_vers(i, NFSD_TEST)) ++ return; ++ ++ for (i = 0; i < NFSD_NRVERS; i++) ++ if (i != 4) ++ nfsd_vers(i, NFSD_SET); ++ else { ++ int minor = 0; ++ while (nfsd_minorversion(minor, NFSD_SET) >= 0) ++ minor++; ++ } + } + + /* +diff --git a/fs/nfsd/vfs.c b/fs/nfsd/vfs.c +index 92de3747ea8b..5eaee287be23 100644 +--- a/fs/nfsd/vfs.c ++++ b/fs/nfsd/vfs.c +@@ -369,7 +369,7 @@ nfsd_setattr(struct svc_rqst *rqstp, struct svc_fh *fhp, struct iattr *iap, + __be32 err; + int host_err; + bool get_write_count; +- int size_change = 0; ++ bool size_change = (iap->ia_valid & ATTR_SIZE); + + if (iap->ia_valid & (ATTR_ATIME | ATTR_MTIME | ATTR_SIZE)) + accmode |= NFSD_MAY_WRITE|NFSD_MAY_OWNER_OVERRIDE; +@@ -382,11 +382,11 @@ nfsd_setattr(struct svc_rqst *rqstp, struct svc_fh *fhp, struct iattr *iap, + /* Get inode */ + err = fh_verify(rqstp, fhp, ftype, accmode); + if (err) +- goto out; ++ return err; + if (get_write_count) { + host_err = fh_want_write(fhp); + if (host_err) +- return nfserrno(host_err); ++ goto out; + } + + dentry = fhp->fh_dentry; +@@ -397,20 +397,28 @@ nfsd_setattr(struct svc_rqst *rqstp, struct svc_fh *fhp, struct iattr *iap, + iap->ia_valid &= ~ATTR_MODE; + + if (!iap->ia_valid) +- goto out; ++ return 0; + + nfsd_sanitize_attrs(inode, iap); + ++ if (check_guard && guardtime != inode->i_ctime.tv_sec) ++ return nfserr_notsync; ++ + /* + * The size case is special, it changes the file in addition to the +- * attributes. ++ * attributes, and file systems don't expect it to be mixed with ++ * "random" attribute changes. We thus split out the size change ++ * into a separate call to ->setattr, and do the rest as a separate ++ * setattr call. + */ +- if (iap->ia_valid & ATTR_SIZE) { ++ if (size_change) { + err = nfsd_get_write_access(rqstp, fhp, iap); + if (err) +- goto out; +- size_change = 1; ++ return err; ++ } + ++ fh_lock(fhp); ++ if (size_change) { + /* + * RFC5661, Section 18.30.4: + * Changing the size of a file with SETATTR indirectly +@@ -418,29 +426,36 @@ nfsd_setattr(struct svc_rqst *rqstp, struct svc_fh *fhp, struct iattr *iap, + * + * (and similar for the older RFCs) + */ +- if (iap->ia_size != i_size_read(inode)) +- iap->ia_valid |= ATTR_MTIME; +- } ++ struct iattr size_attr = { ++ .ia_valid = ATTR_SIZE | ATTR_CTIME | ATTR_MTIME, ++ .ia_size = iap->ia_size, ++ }; + +- iap->ia_valid |= ATTR_CTIME; ++ host_err = notify_change(dentry, &size_attr, NULL); ++ if (host_err) ++ goto out_unlock; ++ iap->ia_valid &= ~ATTR_SIZE; + +- if (check_guard && guardtime != inode->i_ctime.tv_sec) { +- err = nfserr_notsync; +- goto out_put_write_access; ++ /* ++ * Avoid the additional setattr call below if the only other ++ * attribute that the client sends is the mtime, as we update ++ * it as part of the size change above. ++ */ ++ if ((iap->ia_valid & ~ATTR_MTIME) == 0) ++ goto out_unlock; + } + +- fh_lock(fhp); ++ iap->ia_valid |= ATTR_CTIME; + host_err = notify_change(dentry, iap, NULL); +- fh_unlock(fhp); +- err = nfserrno(host_err); + +-out_put_write_access: ++out_unlock: ++ fh_unlock(fhp); + if (size_change) + put_write_access(inode); +- if (!err) +- err = nfserrno(commit_metadata(fhp)); + out: +- return err; ++ if (!host_err) ++ host_err = commit_metadata(fhp); ++ return nfserrno(host_err); + } + + #if defined(CONFIG_NFSD_V4) +diff --git a/fs/proc/proc_tty.c b/fs/proc/proc_tty.c +index 15f327bed8c6..7340c36978a3 100644 +--- a/fs/proc/proc_tty.c ++++ b/fs/proc/proc_tty.c +@@ -14,6 +14,7 @@ + #include + #include + #include ++#include "internal.h" + + /* + * The /proc/tty directory inodes... +@@ -164,7 +165,7 @@ void proc_tty_unregister_driver(struct tty_driver *driver) + if (!ent) + return; + +- remove_proc_entry(driver->driver_name, proc_tty_driver); ++ remove_proc_entry(ent->name, proc_tty_driver); + + driver->proc_entry = NULL; + } +diff --git a/fs/udf/super.c b/fs/udf/super.c +index 6299f341967b..97bbcea2978a 100644 +--- a/fs/udf/super.c ++++ b/fs/udf/super.c +@@ -705,7 +705,7 @@ static loff_t udf_check_vsd(struct super_block *sb) + else + sectorsize = sb->s_blocksize; + +- sector += (sbi->s_session << sb->s_blocksize_bits); ++ sector += (((loff_t)sbi->s_session) << sb->s_blocksize_bits); + + udf_debug("Starting at sector %u (%ld byte sectors)\n", + (unsigned int)(sector >> sb->s_blocksize_bits), +diff --git a/fs/xfs/libxfs/xfs_bmap.c b/fs/xfs/libxfs/xfs_bmap.c +index 51c85b6a0c34..cf9029d9a3f3 100644 +--- a/fs/xfs/libxfs/xfs_bmap.c ++++ b/fs/xfs/libxfs/xfs_bmap.c +@@ -2671,7 +2671,7 @@ xfs_bmap_add_extent_unwritten_real( + &i))) + goto done; + XFS_WANT_CORRUPTED_GOTO(mp, i == 0, done); +- cur->bc_rec.b.br_state = XFS_EXT_NORM; ++ cur->bc_rec.b.br_state = new->br_state; + if ((error = xfs_btree_insert(cur, &i))) + goto done; + XFS_WANT_CORRUPTED_GOTO(mp, i == 1, done); +diff --git a/fs/xfs/libxfs/xfs_inode_buf.c b/fs/xfs/libxfs/xfs_inode_buf.c +index a217176fde65..bc151999b68b 100644 +--- a/fs/xfs/libxfs/xfs_inode_buf.c ++++ b/fs/xfs/libxfs/xfs_inode_buf.c +@@ -301,6 +301,14 @@ xfs_dinode_verify( + if (dip->di_magic != cpu_to_be16(XFS_DINODE_MAGIC)) + return false; + ++ /* don't allow invalid i_size */ ++ if (be64_to_cpu(dip->di_size) & (1ULL << 63)) ++ return false; ++ ++ /* No zero-length symlinks. */ ++ if (S_ISLNK(be16_to_cpu(dip->di_mode)) && dip->di_size == 0) ++ return false; ++ + /* only version 3 or greater inodes are extensively verified here */ + if (dip->di_version < 3) + return true; +diff --git a/fs/xfs/xfs_buf.c b/fs/xfs/xfs_buf.c +index fb0eb697a621..bdb68e919b46 100644 +--- a/fs/xfs/xfs_buf.c ++++ b/fs/xfs/xfs_buf.c +@@ -374,6 +374,7 @@ retry: + out_free_pages: + for (i = 0; i < bp->b_page_count; i++) + __free_page(bp->b_pages[i]); ++ bp->b_flags &= ~_XBF_PAGES; + return error; + } + +diff --git a/fs/xfs/xfs_log_recover.c b/fs/xfs/xfs_log_recover.c +index 4aefff89949d..c0065697498c 100644 +--- a/fs/xfs/xfs_log_recover.c ++++ b/fs/xfs/xfs_log_recover.c +@@ -738,7 +738,7 @@ xlog_find_head( + * in the in-core log. The following number can be made tighter if + * we actually look at the block size of the filesystem. + */ +- num_scan_bblks = XLOG_TOTAL_REC_SHIFT(log); ++ num_scan_bblks = min_t(int, log_bbnum, XLOG_TOTAL_REC_SHIFT(log)); + if (head_blk >= num_scan_bblks) { + /* + * We are guaranteed that the entire check can be performed +diff --git a/include/crypto/internal/hash.h b/include/crypto/internal/hash.h +index a25414ce2898..9779c35f8454 100644 +--- a/include/crypto/internal/hash.h ++++ b/include/crypto/internal/hash.h +@@ -83,6 +83,14 @@ int ahash_register_instance(struct crypto_template *tmpl, + struct ahash_instance *inst); + void ahash_free_instance(struct crypto_instance *inst); + ++int shash_no_setkey(struct crypto_shash *tfm, const u8 *key, ++ unsigned int keylen); ++ ++static inline bool crypto_shash_alg_has_setkey(struct shash_alg *alg) ++{ ++ return alg->setkey != shash_no_setkey; ++} ++ + int crypto_init_ahash_spawn(struct crypto_ahash_spawn *spawn, + struct hash_alg_common *alg, + struct crypto_instance *inst); +diff --git a/include/drm/drmP.h b/include/drm/drmP.h +index 62c40777c009..8aba0f72aae4 100644 +--- a/include/drm/drmP.h ++++ b/include/drm/drmP.h +@@ -153,6 +153,26 @@ void drm_err(const char *format, ...); + /** \name Macros to make printk easier */ + /*@{*/ + ++#define _DRM_PRINTK(once, level, fmt, ...) \ ++ do { \ ++ printk##once(KERN_##level "[" DRM_NAME "] " fmt, \ ++ ##__VA_ARGS__); \ ++ } while (0) ++ ++#define DRM_INFO(fmt, ...) \ ++ _DRM_PRINTK(, INFO, fmt, ##__VA_ARGS__) ++#define DRM_NOTE(fmt, ...) \ ++ _DRM_PRINTK(, NOTICE, fmt, ##__VA_ARGS__) ++#define DRM_WARN(fmt, ...) \ ++ _DRM_PRINTK(, WARNING, fmt, ##__VA_ARGS__) ++ ++#define DRM_INFO_ONCE(fmt, ...) \ ++ _DRM_PRINTK(_once, INFO, fmt, ##__VA_ARGS__) ++#define DRM_NOTE_ONCE(fmt, ...) \ ++ _DRM_PRINTK(_once, NOTICE, fmt, ##__VA_ARGS__) ++#define DRM_WARN_ONCE(fmt, ...) \ ++ _DRM_PRINTK(_once, WARNING, fmt, ##__VA_ARGS__) ++ + /** + * Error output. + * +@@ -178,12 +198,6 @@ void drm_err(const char *format, ...); + drm_err(fmt, ##__VA_ARGS__); \ + }) + +-#define DRM_INFO(fmt, ...) \ +- printk(KERN_INFO "[" DRM_NAME "] " fmt, ##__VA_ARGS__) +- +-#define DRM_INFO_ONCE(fmt, ...) \ +- printk_once(KERN_INFO "[" DRM_NAME "] " fmt, ##__VA_ARGS__) +- + /** + * Debug output. + * +diff --git a/include/linux/bitops.h b/include/linux/bitops.h +index 297f5bda4fdf..858020682ac8 100644 +--- a/include/linux/bitops.h ++++ b/include/linux/bitops.h +@@ -171,6 +171,17 @@ static inline __s32 sign_extend32(__u32 value, int index) + return (__s32)(value << shift) >> shift; + } + ++/** ++ * sign_extend64 - sign extend a 64-bit value using specified bit as sign-bit ++ * @value: value to sign extend ++ * @index: 0 based bit index (0<=index<64) to sign bit ++ */ ++static inline __s64 sign_extend64(__u64 value, int index) ++{ ++ __u8 shift = 63 - index; ++ return (__s64)(value << shift) >> shift; ++} ++ + static inline unsigned fls_long(unsigned long l) + { + if (sizeof(l) == 4) +diff --git a/include/linux/buffer_head.h b/include/linux/buffer_head.h +index e6797ded700e..696b6c44c564 100644 +--- a/include/linux/buffer_head.h ++++ b/include/linux/buffer_head.h +@@ -236,12 +236,10 @@ static inline int block_page_mkwrite_return(int err) + { + if (err == 0) + return VM_FAULT_LOCKED; +- if (err == -EFAULT) ++ if (err == -EFAULT || err == -EAGAIN) + return VM_FAULT_NOPAGE; + if (err == -ENOMEM) + return VM_FAULT_OOM; +- if (err == -EAGAIN) +- return VM_FAULT_RETRY; + /* -ENOSPC, -EDQUOT, -EIO ... */ + return VM_FAULT_SIGBUS; + } +diff --git a/include/linux/ceph/osdmap.h b/include/linux/ceph/osdmap.h +index e55c08bc3a96..0abc56140c83 100644 +--- a/include/linux/ceph/osdmap.h ++++ b/include/linux/ceph/osdmap.h +@@ -49,7 +49,7 @@ static inline bool ceph_can_shift_osds(struct ceph_pg_pool_info *pool) + case CEPH_POOL_TYPE_EC: + return false; + default: +- BUG_ON(1); ++ BUG(); + } + } + +diff --git a/include/linux/genalloc.h b/include/linux/genalloc.h +index 1ccaab44abcc..ec78cd93c0c1 100644 +--- a/include/linux/genalloc.h ++++ b/include/linux/genalloc.h +@@ -31,6 +31,7 @@ + #define __GENALLOC_H__ + + #include ++#include + + struct device; + struct device_node; +@@ -66,7 +67,7 @@ struct gen_pool { + */ + struct gen_pool_chunk { + struct list_head next_chunk; /* next chunk in pool */ +- atomic_t avail; ++ atomic_long_t avail; + phys_addr_t phys_addr; /* physical starting address of memory chunk */ + unsigned long start_addr; /* start address of memory chunk */ + unsigned long end_addr; /* end address of memory chunk (inclusive) */ +diff --git a/include/linux/kvm_host.h b/include/linux/kvm_host.h +index 29a57a5b7cee..ef4945c3f713 100644 +--- a/include/linux/kvm_host.h ++++ b/include/linux/kvm_host.h +@@ -173,8 +173,8 @@ int kvm_io_bus_read(struct kvm_vcpu *vcpu, enum kvm_bus bus_idx, gpa_t addr, + int len, void *val); + int kvm_io_bus_register_dev(struct kvm *kvm, enum kvm_bus bus_idx, gpa_t addr, + int len, struct kvm_io_device *dev); +-int kvm_io_bus_unregister_dev(struct kvm *kvm, enum kvm_bus bus_idx, +- struct kvm_io_device *dev); ++void kvm_io_bus_unregister_dev(struct kvm *kvm, enum kvm_bus bus_idx, ++ struct kvm_io_device *dev); + + #ifdef CONFIG_KVM_ASYNC_PF + struct kvm_async_pf { +diff --git a/include/linux/log2.h b/include/linux/log2.h +index ef3d4f67118c..c373295f359f 100644 +--- a/include/linux/log2.h ++++ b/include/linux/log2.h +@@ -15,12 +15,6 @@ + #include + #include + +-/* +- * deal with unrepresentable constant logarithms +- */ +-extern __attribute__((const, noreturn)) +-int ____ilog2_NaN(void); +- + /* + * non-constant log of base 2 calculators + * - the arch may override these in asm/bitops.h if they can be implemented +@@ -85,7 +79,7 @@ unsigned long __rounddown_pow_of_two(unsigned long n) + #define ilog2(n) \ + ( \ + __builtin_constant_p(n) ? ( \ +- (n) < 1 ? ____ilog2_NaN() : \ ++ (n) < 2 ? 0 : \ + (n) & (1ULL << 63) ? 63 : \ + (n) & (1ULL << 62) ? 62 : \ + (n) & (1ULL << 61) ? 61 : \ +@@ -148,10 +142,7 @@ unsigned long __rounddown_pow_of_two(unsigned long n) + (n) & (1ULL << 4) ? 4 : \ + (n) & (1ULL << 3) ? 3 : \ + (n) & (1ULL << 2) ? 2 : \ +- (n) & (1ULL << 1) ? 1 : \ +- (n) & (1ULL << 0) ? 0 : \ +- ____ilog2_NaN() \ +- ) : \ ++ 1 ) : \ + (sizeof(n) <= 4) ? \ + __ilog2_u32(n) : \ + __ilog2_u64(n) \ +diff --git a/include/linux/mlx4/device.h b/include/linux/mlx4/device.h +index 83e80ab94500..41fe2f858830 100644 +--- a/include/linux/mlx4/device.h ++++ b/include/linux/mlx4/device.h +@@ -443,6 +443,7 @@ enum { + enum { + MLX4_INTERFACE_STATE_UP = 1 << 0, + MLX4_INTERFACE_STATE_DELETION = 1 << 1, ++ MLX4_INTERFACE_STATE_NOWAIT = 1 << 2, + }; + + #define MSTR_SM_CHANGE_MASK (MLX4_EQ_PORT_INFO_MSTR_SM_SL_CHANGE_MASK | \ +diff --git a/include/linux/mman.h b/include/linux/mman.h +index 16373c8f5f57..369bc3405a6d 100644 +--- a/include/linux/mman.h ++++ b/include/linux/mman.h +@@ -63,8 +63,9 @@ static inline int arch_validate_prot(unsigned long prot) + * ("bit1" and "bit2" must be single bits) + */ + #define _calc_vm_trans(x, bit1, bit2) \ ++ ((!(bit1) || !(bit2)) ? 0 : \ + ((bit1) <= (bit2) ? ((x) & (bit1)) * ((bit2) / (bit1)) \ +- : ((x) & (bit1)) / ((bit1) / (bit2))) ++ : ((x) & (bit1)) / ((bit1) / (bit2)))) + + /* + * Combine the mmap "prot" argument into "vm_flags" used internally. +diff --git a/include/linux/omap-gpmc.h b/include/linux/omap-gpmc.h +index 7dee00143afd..c201e31e9d7e 100644 +--- a/include/linux/omap-gpmc.h ++++ b/include/linux/omap-gpmc.h +@@ -191,10 +191,11 @@ static inline int gpmc_nand_init(struct omap_nand_platform_data *d, + #endif + + #if IS_ENABLED(CONFIG_MTD_ONENAND_OMAP2) +-extern void gpmc_onenand_init(struct omap_onenand_platform_data *d); ++extern int gpmc_onenand_init(struct omap_onenand_platform_data *d); + #else + #define board_onenand_data NULL +-static inline void gpmc_onenand_init(struct omap_onenand_platform_data *d) ++static inline int gpmc_onenand_init(struct omap_onenand_platform_data *d) + { ++ return 0; + } + #endif +diff --git a/include/scsi/libsas.h b/include/scsi/libsas.h +index dae99d7d2bc0..706a7017885c 100644 +--- a/include/scsi/libsas.h ++++ b/include/scsi/libsas.h +@@ -165,11 +165,11 @@ struct expander_device { + + struct sata_device { + unsigned int class; +- struct smp_resp rps_resp; /* report_phy_sata_resp */ + u8 port_no; /* port number, if this is a PM (Port) */ + + struct ata_port *ap; + struct ata_host ata_host; ++ struct smp_resp rps_resp ____cacheline_aligned; /* report_phy_sata_resp */ + u8 fis[ATA_RESP_FIS_SIZE]; + }; + +diff --git a/include/uapi/linux/packet_diag.h b/include/uapi/linux/packet_diag.h +index d08c63f3dd6f..0c5d5dd61b6a 100644 +--- a/include/uapi/linux/packet_diag.h ++++ b/include/uapi/linux/packet_diag.h +@@ -64,7 +64,7 @@ struct packet_diag_mclist { + __u32 pdmc_count; + __u16 pdmc_type; + __u16 pdmc_alen; +- __u8 pdmc_addr[MAX_ADDR_LEN]; ++ __u8 pdmc_addr[32]; /* MAX_ADDR_LEN */ + }; + + struct packet_diag_ring { +diff --git a/kernel/audit.c b/kernel/audit.c +index 1c13e4267de6..ae05a41d713a 100644 +--- a/kernel/audit.c ++++ b/kernel/audit.c +@@ -80,13 +80,13 @@ static int audit_initialized; + #define AUDIT_OFF 0 + #define AUDIT_ON 1 + #define AUDIT_LOCKED 2 +-u32 audit_enabled; +-u32 audit_ever_enabled; ++u32 audit_enabled = AUDIT_OFF; ++u32 audit_ever_enabled = !!AUDIT_OFF; + + EXPORT_SYMBOL_GPL(audit_enabled); + + /* Default state when kernel boots without any parameters. */ +-static u32 audit_default; ++static u32 audit_default = AUDIT_OFF; + + /* If auditing cannot proceed, audit_failure selects what happens. */ + static u32 audit_failure = AUDIT_FAIL_PRINTK; +@@ -1165,8 +1165,6 @@ static int __init audit_init(void) + skb_queue_head_init(&audit_skb_queue); + skb_queue_head_init(&audit_skb_hold_queue); + audit_initialized = AUDIT_INITIALIZED; +- audit_enabled = audit_default; +- audit_ever_enabled |= !!audit_default; + + audit_log(NULL, GFP_KERNEL, AUDIT_KERNEL, "initialized"); + +@@ -1183,6 +1181,8 @@ static int __init audit_enable(char *str) + audit_default = !!simple_strtol(str, NULL, 0); + if (!audit_default) + audit_initialized = AUDIT_DISABLED; ++ audit_enabled = audit_default; ++ audit_ever_enabled = !!audit_enabled; + + pr_info("%s\n", audit_default ? + "enabled (after initialization)" : "disabled (until reboot)"); +diff --git a/kernel/debug/kdb/kdb_io.c b/kernel/debug/kdb/kdb_io.c +index fc1ef736253c..77777d918676 100644 +--- a/kernel/debug/kdb/kdb_io.c ++++ b/kernel/debug/kdb/kdb_io.c +@@ -349,7 +349,7 @@ poll_again: + } + kdb_printf("\n"); + for (i = 0; i < count; i++) { +- if (kallsyms_symbol_next(p_tmp, i) < 0) ++ if (WARN_ON(!kallsyms_symbol_next(p_tmp, i))) + break; + kdb_printf("%s ", p_tmp); + *(p_tmp + len) = '\0'; +diff --git a/kernel/gcov/base.c b/kernel/gcov/base.c +index a744098e4eb7..f850e906564b 100644 +--- a/kernel/gcov/base.c ++++ b/kernel/gcov/base.c +@@ -92,6 +92,18 @@ void __gcov_merge_time_profile(gcov_type *counters, unsigned int n_counters) + } + EXPORT_SYMBOL(__gcov_merge_time_profile); + ++void __gcov_merge_icall_topn(gcov_type *counters, unsigned int n_counters) ++{ ++ /* Unused. */ ++} ++EXPORT_SYMBOL(__gcov_merge_icall_topn); ++ ++void __gcov_exit(void) ++{ ++ /* Unused. */ ++} ++EXPORT_SYMBOL(__gcov_exit); ++ + /** + * gcov_enable_events - enable event reporting through gcov_event() + * +diff --git a/kernel/gcov/gcc_4_7.c b/kernel/gcov/gcc_4_7.c +index 826ba9fb5e32..46a18e72bce6 100644 +--- a/kernel/gcov/gcc_4_7.c ++++ b/kernel/gcov/gcc_4_7.c +@@ -18,7 +18,11 @@ + #include + #include "gcov.h" + +-#if __GNUC__ == 4 && __GNUC_MINOR__ >= 9 ++#if (__GNUC__ >= 7) ++#define GCOV_COUNTERS 9 ++#elif (__GNUC__ > 5) || (__GNUC__ == 5 && __GNUC_MINOR__ >= 1) ++#define GCOV_COUNTERS 10 ++#elif __GNUC__ == 4 && __GNUC_MINOR__ >= 9 + #define GCOV_COUNTERS 9 + #else + #define GCOV_COUNTERS 8 +diff --git a/kernel/padata.c b/kernel/padata.c +index ed6f4f93cc92..ecc7b3f452c7 100644 +--- a/kernel/padata.c ++++ b/kernel/padata.c +@@ -189,19 +189,20 @@ static struct padata_priv *padata_get_next(struct parallel_data *pd) + + reorder = &next_queue->reorder; + ++ spin_lock(&reorder->lock); + if (!list_empty(&reorder->list)) { + padata = list_entry(reorder->list.next, + struct padata_priv, list); + +- spin_lock(&reorder->lock); + list_del_init(&padata->list); + atomic_dec(&pd->reorder_objects); +- spin_unlock(&reorder->lock); + + pd->processed++; + ++ spin_unlock(&reorder->lock); + goto out; + } ++ spin_unlock(&reorder->lock); + + if (__this_cpu_read(pd->pqueue->cpu_index) == next_queue->cpu_index) { + padata = ERR_PTR(-ENODATA); +diff --git a/kernel/sched/deadline.c b/kernel/sched/deadline.c +index 5e95145088fd..e45d441176a8 100644 +--- a/kernel/sched/deadline.c ++++ b/kernel/sched/deadline.c +@@ -419,13 +419,13 @@ static void replenish_dl_entity(struct sched_dl_entity *dl_se, + * + * This function returns true if: + * +- * runtime / (deadline - t) > dl_runtime / dl_period , ++ * runtime / (deadline - t) > dl_runtime / dl_deadline , + * + * IOW we can't recycle current parameters. + * +- * Notice that the bandwidth check is done against the period. For ++ * Notice that the bandwidth check is done against the deadline. For + * task with deadline equal to period this is the same of using +- * dl_deadline instead of dl_period in the equation above. ++ * dl_period instead of dl_deadline in the equation above. + */ + static bool dl_entity_overflow(struct sched_dl_entity *dl_se, + struct sched_dl_entity *pi_se, u64 t) +@@ -450,7 +450,7 @@ static bool dl_entity_overflow(struct sched_dl_entity *dl_se, + * of anything below microseconds resolution is actually fiction + * (but still we want to give the user that illusion >;). + */ +- left = (pi_se->dl_period >> DL_SCALE) * (dl_se->runtime >> DL_SCALE); ++ left = (pi_se->dl_deadline >> DL_SCALE) * (dl_se->runtime >> DL_SCALE); + right = ((dl_se->deadline - t) >> DL_SCALE) * + (pi_se->dl_runtime >> DL_SCALE); + +diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c +index ca1a306ea7e6..7a26798ffbf9 100644 +--- a/kernel/trace/trace.c ++++ b/kernel/trace/trace.c +@@ -3376,37 +3376,30 @@ static const struct file_operations show_traces_fops = { + .llseek = seq_lseek, + }; + +-/* +- * The tracer itself will not take this lock, but still we want +- * to provide a consistent cpumask to user-space: +- */ +-static DEFINE_MUTEX(tracing_cpumask_update_lock); +- +-/* +- * Temporary storage for the character representation of the +- * CPU bitmask (and one more byte for the newline): +- */ +-static char mask_str[NR_CPUS + 1]; +- + static ssize_t + tracing_cpumask_read(struct file *filp, char __user *ubuf, + size_t count, loff_t *ppos) + { + struct trace_array *tr = file_inode(filp)->i_private; ++ char *mask_str; + int len; + +- mutex_lock(&tracing_cpumask_update_lock); ++ len = snprintf(NULL, 0, "%*pb\n", ++ cpumask_pr_args(tr->tracing_cpumask)) + 1; ++ mask_str = kmalloc(len, GFP_KERNEL); ++ if (!mask_str) ++ return -ENOMEM; + +- len = snprintf(mask_str, count, "%*pb\n", ++ len = snprintf(mask_str, len, "%*pb\n", + cpumask_pr_args(tr->tracing_cpumask)); + if (len >= count) { + count = -EINVAL; + goto out_err; + } +- count = simple_read_from_buffer(ubuf, count, ppos, mask_str, NR_CPUS+1); ++ count = simple_read_from_buffer(ubuf, count, ppos, mask_str, len); + + out_err: +- mutex_unlock(&tracing_cpumask_update_lock); ++ kfree(mask_str); + + return count; + } +@@ -3426,8 +3419,6 @@ tracing_cpumask_write(struct file *filp, const char __user *ubuf, + if (err) + goto err_unlock; + +- mutex_lock(&tracing_cpumask_update_lock); +- + local_irq_disable(); + arch_spin_lock(&tr->max_lock); + for_each_tracing_cpu(cpu) { +@@ -3450,8 +3441,6 @@ tracing_cpumask_write(struct file *filp, const char __user *ubuf, + local_irq_enable(); + + cpumask_copy(tr->tracing_cpumask, tracing_cpumask_new); +- +- mutex_unlock(&tracing_cpumask_update_lock); + free_cpumask_var(tracing_cpumask_new); + + return count; +diff --git a/kernel/workqueue.c b/kernel/workqueue.c +index 791f6ebc84a3..376db986db9b 100644 +--- a/kernel/workqueue.c ++++ b/kernel/workqueue.c +@@ -1484,6 +1484,7 @@ static void __queue_delayed_work(int cpu, struct workqueue_struct *wq, + struct timer_list *timer = &dwork->timer; + struct work_struct *work = &dwork->work; + ++ WARN_ON_ONCE(!wq); + WARN_ON_ONCE(timer->function != delayed_work_timer_fn || + timer->data != (unsigned long)dwork); + WARN_ON_ONCE(timer_pending(timer)); +diff --git a/lib/asn1_decoder.c b/lib/asn1_decoder.c +index 3bb040e347ec..bbdfbcb912f3 100644 +--- a/lib/asn1_decoder.c ++++ b/lib/asn1_decoder.c +@@ -421,6 +421,8 @@ next_op: + else + act = machine[pc + 1]; + ret = actions[act](context, hdr, 0, data + tdp, len); ++ if (ret < 0) ++ return ret; + } + pc += asn1_op_lengths[op]; + goto next_op; +diff --git a/lib/dynamic_debug.c b/lib/dynamic_debug.c +index d8f3d3150603..2b382c165571 100644 +--- a/lib/dynamic_debug.c ++++ b/lib/dynamic_debug.c +@@ -353,6 +353,10 @@ static int ddebug_parse_query(char *words[], int nwords, + if (parse_lineno(last, &query->last_lineno) < 0) + return -EINVAL; + ++ /* special case for last lineno not specified */ ++ if (query->last_lineno == 0) ++ query->last_lineno = UINT_MAX; ++ + if (query->last_lineno < query->first_lineno) { + pr_err("last-line:%d < 1st-line:%d\n", + query->last_lineno, +diff --git a/lib/genalloc.c b/lib/genalloc.c +index d214866eeea2..59dafa4ff412 100644 +--- a/lib/genalloc.c ++++ b/lib/genalloc.c +@@ -193,7 +193,7 @@ int gen_pool_add_virt(struct gen_pool *pool, unsigned long virt, phys_addr_t phy + chunk->phys_addr = phys; + chunk->start_addr = virt; + chunk->end_addr = virt + size - 1; +- atomic_set(&chunk->avail, size); ++ atomic_long_set(&chunk->avail, size); + + spin_lock(&pool->lock); + list_add_rcu(&chunk->next_chunk, &pool->chunks); +@@ -284,7 +284,7 @@ unsigned long gen_pool_alloc(struct gen_pool *pool, size_t size) + nbits = (size + (1UL << order) - 1) >> order; + rcu_read_lock(); + list_for_each_entry_rcu(chunk, &pool->chunks, next_chunk) { +- if (size > atomic_read(&chunk->avail)) ++ if (size > atomic_long_read(&chunk->avail)) + continue; + + end_bit = chunk_size(chunk) >> order; +@@ -303,7 +303,7 @@ retry: + + addr = chunk->start_addr + ((unsigned long)start_bit << order); + size = nbits << order; +- atomic_sub(size, &chunk->avail); ++ atomic_long_sub(size, &chunk->avail); + break; + } + rcu_read_unlock(); +@@ -369,7 +369,7 @@ void gen_pool_free(struct gen_pool *pool, unsigned long addr, size_t size) + remain = bitmap_clear_ll(chunk->bits, start_bit, nbits); + BUG_ON(remain); + size = nbits << order; +- atomic_add(size, &chunk->avail); ++ atomic_long_add(size, &chunk->avail); + rcu_read_unlock(); + return; + } +@@ -443,7 +443,7 @@ size_t gen_pool_avail(struct gen_pool *pool) + + rcu_read_lock(); + list_for_each_entry_rcu(chunk, &pool->chunks, next_chunk) +- avail += atomic_read(&chunk->avail); ++ avail += atomic_long_read(&chunk->avail); + rcu_read_unlock(); + return avail; + } +diff --git a/net/ceph/messenger.c b/net/ceph/messenger.c +index 940ba74b297c..d30864a8ed57 100644 +--- a/net/ceph/messenger.c ++++ b/net/ceph/messenger.c +@@ -6,6 +6,7 @@ + #include + #include + #include ++#include + #include + #include + #include +@@ -477,11 +478,16 @@ static int ceph_tcp_connect(struct ceph_connection *con) + { + struct sockaddr_storage *paddr = &con->peer_addr.in_addr; + struct socket *sock; ++ unsigned int noio_flag; + int ret; + + BUG_ON(con->sock); ++ ++ /* sock_create_kern() allocates with GFP_KERNEL */ ++ noio_flag = memalloc_noio_save(); + ret = sock_create_kern(con->peer_addr.in_addr.ss_family, SOCK_STREAM, + IPPROTO_TCP, &sock); ++ memalloc_noio_restore(noio_flag); + if (ret) + return ret; + sock->sk->sk_allocation = GFP_NOFS; +diff --git a/net/ceph/osdmap.c b/net/ceph/osdmap.c +index ddc3573894b0..bc95e48d5cfb 100644 +--- a/net/ceph/osdmap.c ++++ b/net/ceph/osdmap.c +@@ -1265,7 +1265,6 @@ static int decode_new_up_state_weight(void **p, void *end, + if ((map->osd_state[osd] & CEPH_OSD_EXISTS) && + (xorstate & CEPH_OSD_EXISTS)) { + pr_info("osd%d does not exist\n", osd); +- map->osd_weight[osd] = CEPH_OSD_IN; + ret = set_primary_affinity(map, osd, + CEPH_OSD_DEFAULT_PRIMARY_AFFINITY); + if (ret) +diff --git a/net/core/dev.c b/net/core/dev.c +index 33674208d325..4d4213b6f7f6 100644 +--- a/net/core/dev.c ++++ b/net/core/dev.c +@@ -1268,6 +1268,7 @@ void netdev_notify_peers(struct net_device *dev) + { + rtnl_lock(); + call_netdevice_notifiers(NETDEV_NOTIFY_PEERS, dev); ++ call_netdevice_notifiers(NETDEV_RESEND_IGMP, dev); + rtnl_unlock(); + } + EXPORT_SYMBOL(netdev_notify_peers); +diff --git a/net/core/skbuff.c b/net/core/skbuff.c +index 2894bb5b7e0a..97a1fa140a9b 100644 +--- a/net/core/skbuff.c ++++ b/net/core/skbuff.c +@@ -3696,13 +3696,14 @@ void skb_complete_tx_timestamp(struct sk_buff *skb, + if (!skb_may_tx_timestamp(sk, false)) + return; + +- /* take a reference to prevent skb_orphan() from freeing the socket */ +- sock_hold(sk); +- +- *skb_hwtstamps(skb) = *hwtstamps; +- __skb_complete_tx_timestamp(skb, sk, SCM_TSTAMP_SND); +- +- sock_put(sk); ++ /* Take a reference to prevent skb_orphan() from freeing the socket, ++ * but only if the socket refcount is not zero. ++ */ ++ if (likely(atomic_inc_not_zero(&sk->sk_refcnt))) { ++ *skb_hwtstamps(skb) = *hwtstamps; ++ __skb_complete_tx_timestamp(skb, sk, SCM_TSTAMP_SND); ++ sock_put(sk); ++ } + } + EXPORT_SYMBOL_GPL(skb_complete_tx_timestamp); + +@@ -3753,7 +3754,7 @@ void skb_complete_wifi_ack(struct sk_buff *skb, bool acked) + { + struct sock *sk = skb->sk; + struct sock_exterr_skb *serr; +- int err; ++ int err = 1; + + skb->wifi_acked_valid = 1; + skb->wifi_acked = acked; +@@ -3763,14 +3764,15 @@ void skb_complete_wifi_ack(struct sk_buff *skb, bool acked) + serr->ee.ee_errno = ENOMSG; + serr->ee.ee_origin = SO_EE_ORIGIN_TXSTATUS; + +- /* take a reference to prevent skb_orphan() from freeing the socket */ +- sock_hold(sk); +- +- err = sock_queue_err_skb(sk, skb); ++ /* Take a reference to prevent skb_orphan() from freeing the socket, ++ * but only if the socket refcount is not zero. ++ */ ++ if (likely(atomic_inc_not_zero(&sk->sk_refcnt))) { ++ err = sock_queue_err_skb(sk, skb); ++ sock_put(sk); ++ } + if (err) + kfree_skb(skb); +- +- sock_put(sk); + } + EXPORT_SYMBOL_GPL(skb_complete_wifi_ack); + +diff --git a/net/core/sock.c b/net/core/sock.c +index e369262ea57e..76e0b874f378 100644 +--- a/net/core/sock.c ++++ b/net/core/sock.c +@@ -1435,6 +1435,11 @@ static void __sk_free(struct sock *sk) + pr_debug("%s: optmem leakage (%d bytes) detected\n", + __func__, atomic_read(&sk->sk_omem_alloc)); + ++ if (sk->sk_frag.page) { ++ put_page(sk->sk_frag.page); ++ sk->sk_frag.page = NULL; ++ } ++ + if (sk->sk_peer_cred) + put_cred(sk->sk_peer_cred); + put_pid(sk->sk_peer_pid); +@@ -2622,11 +2627,6 @@ void sk_common_release(struct sock *sk) + + sk_refcnt_debug_release(sk); + +- if (sk->sk_frag.page) { +- put_page(sk->sk_frag.page); +- sk->sk_frag.page = NULL; +- } +- + sock_put(sk); + } + EXPORT_SYMBOL(sk_common_release); +diff --git a/net/dccp/ccids/ccid2.c b/net/dccp/ccids/ccid2.c +index f053198e730c..5e3a7302f774 100644 +--- a/net/dccp/ccids/ccid2.c ++++ b/net/dccp/ccids/ccid2.c +@@ -749,6 +749,7 @@ static void ccid2_hc_tx_exit(struct sock *sk) + for (i = 0; i < hc->tx_seqbufc; i++) + kfree(hc->tx_seqbuf[i]); + hc->tx_seqbufc = 0; ++ dccp_ackvec_parsed_cleanup(&hc->tx_av_chunks); + } + + static void ccid2_hc_rx_packet_recv(struct sock *sk, struct sk_buff *skb) +diff --git a/net/dccp/ipv4.c b/net/dccp/ipv4.c +index fd7ac7895c38..bafb2223b879 100644 +--- a/net/dccp/ipv4.c ++++ b/net/dccp/ipv4.c +@@ -289,7 +289,8 @@ static void dccp_v4_err(struct sk_buff *skb, u32 info) + + switch (type) { + case ICMP_REDIRECT: +- dccp_do_redirect(skb, sk); ++ if (!sock_owned_by_user(sk)) ++ dccp_do_redirect(skb, sk); + goto out; + case ICMP_SOURCE_QUENCH: + /* Just silently ignore these. */ +diff --git a/net/dccp/ipv6.c b/net/dccp/ipv6.c +index a0490508d213..d61027e78e25 100644 +--- a/net/dccp/ipv6.c ++++ b/net/dccp/ipv6.c +@@ -121,10 +121,12 @@ static void dccp_v6_err(struct sk_buff *skb, struct inet6_skb_parm *opt, + np = inet6_sk(sk); + + if (type == NDISC_REDIRECT) { +- struct dst_entry *dst = __sk_dst_check(sk, np->dst_cookie); ++ if (!sock_owned_by_user(sk)) { ++ struct dst_entry *dst = __sk_dst_check(sk, np->dst_cookie); + +- if (dst) +- dst->ops->redirect(dst, sk, skb); ++ if (dst) ++ dst->ops->redirect(dst, sk, skb); ++ } + goto out; + } + +diff --git a/net/dccp/minisocks.c b/net/dccp/minisocks.c +index 838f524cf11a..53c38641fe98 100644 +--- a/net/dccp/minisocks.c ++++ b/net/dccp/minisocks.c +@@ -122,6 +122,7 @@ struct sock *dccp_create_openreq_child(struct sock *sk, + /* It is still raw copy of parent, so invalidate + * destructor and make plain sk_free() */ + newsk->sk_destruct = NULL; ++ bh_unlock_sock(newsk); + sk_free(newsk); + return NULL; + } +diff --git a/net/ipv4/fib_frontend.c b/net/ipv4/fib_frontend.c +index 765909ba781e..a8db70b7fe45 100644 +--- a/net/ipv4/fib_frontend.c ++++ b/net/ipv4/fib_frontend.c +@@ -1033,7 +1033,8 @@ static void nl_fib_input(struct sk_buff *skb) + + net = sock_net(skb->sk); + nlh = nlmsg_hdr(skb); +- if (skb->len < NLMSG_HDRLEN || skb->len < nlh->nlmsg_len || ++ if (skb->len < nlmsg_total_size(sizeof(*frn)) || ++ skb->len < nlh->nlmsg_len || + nlmsg_len(nlh) < sizeof(*frn)) + return; + +diff --git a/net/ipv4/route.c b/net/ipv4/route.c +index 6141fef3a64b..6a9a495aff23 100644 +--- a/net/ipv4/route.c ++++ b/net/ipv4/route.c +@@ -622,9 +622,12 @@ static void update_or_create_fnhe(struct fib_nh *nh, __be32 daddr, __be32 gw, + struct fnhe_hash_bucket *hash; + struct fib_nh_exception *fnhe; + struct rtable *rt; ++ u32 genid, hval; + unsigned int i; + int depth; +- u32 hval = fnhe_hashfun(daddr); ++ ++ genid = fnhe_genid(dev_net(nh->nh_dev)); ++ hval = fnhe_hashfun(daddr); + + spin_lock_bh(&fnhe_lock); + +@@ -647,12 +650,13 @@ static void update_or_create_fnhe(struct fib_nh *nh, __be32 daddr, __be32 gw, + } + + if (fnhe) { ++ if (fnhe->fnhe_genid != genid) ++ fnhe->fnhe_genid = genid; + if (gw) + fnhe->fnhe_gw = gw; +- if (pmtu) { ++ if (pmtu) + fnhe->fnhe_pmtu = pmtu; +- fnhe->fnhe_expires = max(1UL, expires); +- } ++ fnhe->fnhe_expires = max(1UL, expires); + /* Update all cached dsts too */ + rt = rcu_dereference(fnhe->fnhe_rth_input); + if (rt) +@@ -671,7 +675,7 @@ static void update_or_create_fnhe(struct fib_nh *nh, __be32 daddr, __be32 gw, + fnhe->fnhe_next = hash->chain; + rcu_assign_pointer(hash->chain, fnhe); + } +- fnhe->fnhe_genid = fnhe_genid(dev_net(nh->nh_dev)); ++ fnhe->fnhe_genid = genid; + fnhe->fnhe_daddr = daddr; + fnhe->fnhe_gw = gw; + fnhe->fnhe_pmtu = pmtu; +@@ -1887,6 +1891,7 @@ int ip_route_input_noref(struct sk_buff *skb, __be32 daddr, __be32 saddr, + { + int res; + ++ tos &= IPTOS_RT_MASK; + rcu_read_lock(); + + /* Multicast recognition logic is moved from route cache to here. +diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c +index 1ba4d0964042..a1de8300cfce 100644 +--- a/net/ipv4/tcp.c ++++ b/net/ipv4/tcp.c +@@ -2227,6 +2227,8 @@ int tcp_disconnect(struct sock *sk, int flags) + tcp_init_send_head(sk); + memset(&tp->rx_opt, 0, sizeof(tp->rx_opt)); + __sk_dst_reset(sk); ++ dst_release(sk->sk_rx_dst); ++ sk->sk_rx_dst = NULL; + + WARN_ON(inet->inet_num && !icsk->icsk_bind_hash); + +diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c +index 95f98d2444fa..4763c431f7d8 100644 +--- a/net/ipv4/tcp_input.c ++++ b/net/ipv4/tcp_input.c +@@ -4895,7 +4895,7 @@ static void tcp_check_space(struct sock *sk) + if (sock_flag(sk, SOCK_QUEUE_SHRUNK)) { + sock_reset_flag(sk, SOCK_QUEUE_SHRUNK); + /* pairs with tcp_poll() */ +- smp_mb__after_atomic(); ++ smp_mb(); + if (sk->sk_socket && + test_bit(SOCK_NOSPACE, &sk->sk_socket->flags)) + tcp_new_space(sk); +@@ -5388,6 +5388,7 @@ void tcp_finish_connect(struct sock *sk, struct sk_buff *skb) + struct inet_connection_sock *icsk = inet_csk(sk); + + tcp_set_state(sk, TCP_ESTABLISHED); ++ icsk->icsk_ack.lrcvtime = tcp_time_stamp; + + if (skb) { + icsk->icsk_af_ops->sk_rx_dst_set(sk, skb); +@@ -5600,7 +5601,6 @@ static int tcp_rcv_synsent_state_process(struct sock *sk, struct sk_buff *skb, + * to stand against the temptation 8) --ANK + */ + inet_csk_schedule_ack(sk); +- icsk->icsk_ack.lrcvtime = tcp_time_stamp; + tcp_enter_quickack_mode(sk); + inet_csk_reset_xmit_timer(sk, ICSK_TIME_DACK, + TCP_DELACK_MAX, TCP_RTO_MAX); +diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c +index 13b92d595138..2923f7f7932a 100644 +--- a/net/ipv4/tcp_ipv4.c ++++ b/net/ipv4/tcp_ipv4.c +@@ -271,10 +271,13 @@ EXPORT_SYMBOL(tcp_v4_connect); + */ + void tcp_v4_mtu_reduced(struct sock *sk) + { +- struct dst_entry *dst; + struct inet_sock *inet = inet_sk(sk); +- u32 mtu = tcp_sk(sk)->mtu_info; ++ struct dst_entry *dst; ++ u32 mtu; + ++ if ((1 << sk->sk_state) & (TCPF_LISTEN | TCPF_CLOSE)) ++ return; ++ mtu = tcp_sk(sk)->mtu_info; + dst = inet_csk_update_pmtu(sk, mtu); + if (!dst) + return; +@@ -417,7 +420,8 @@ void tcp_v4_err(struct sk_buff *icmp_skb, u32 info) + + switch (type) { + case ICMP_REDIRECT: +- do_redirect(icmp_skb, sk); ++ if (!sock_owned_by_user(sk)) ++ do_redirect(icmp_skb, sk); + goto out; + case ICMP_SOURCE_QUENCH: + /* Just silently ignore these. */ +diff --git a/net/ipv4/tcp_minisocks.c b/net/ipv4/tcp_minisocks.c +index fec2907b85e8..2c58a5d4cba8 100644 +--- a/net/ipv4/tcp_minisocks.c ++++ b/net/ipv4/tcp_minisocks.c +@@ -462,6 +462,7 @@ struct sock *tcp_create_openreq_child(struct sock *sk, struct request_sock *req, + newtp->srtt_us = 0; + newtp->mdev_us = jiffies_to_usecs(TCP_TIMEOUT_INIT); + newicsk->icsk_rto = TCP_TIMEOUT_INIT; ++ newicsk->icsk_ack.lrcvtime = tcp_time_stamp; + + newtp->packets_out = 0; + newtp->retrans_out = 0; +diff --git a/net/ipv4/tcp_timer.c b/net/ipv4/tcp_timer.c +index c8f97858d6f6..f8c6b2343301 100644 +--- a/net/ipv4/tcp_timer.c ++++ b/net/ipv4/tcp_timer.c +@@ -223,7 +223,8 @@ void tcp_delack_timer_handler(struct sock *sk) + + sk_mem_reclaim_partial(sk); + +- if (sk->sk_state == TCP_CLOSE || !(icsk->icsk_ack.pending & ICSK_ACK_TIMER)) ++ if (((1 << sk->sk_state) & (TCPF_CLOSE | TCPF_LISTEN)) || ++ !(icsk->icsk_ack.pending & ICSK_ACK_TIMER)) + goto out; + + if (time_after(icsk->icsk_ack.timeout, jiffies)) { +@@ -504,7 +505,8 @@ void tcp_write_timer_handler(struct sock *sk) + struct inet_connection_sock *icsk = inet_csk(sk); + int event; + +- if (sk->sk_state == TCP_CLOSE || !icsk->icsk_pending) ++ if (((1 << sk->sk_state) & (TCPF_CLOSE | TCPF_LISTEN)) || ++ !icsk->icsk_pending) + goto out; + + if (time_after(icsk->icsk_timeout, jiffies)) { +diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c +index df4edab0ba3a..8441f9939d49 100644 +--- a/net/ipv6/addrconf.c ++++ b/net/ipv6/addrconf.c +@@ -3068,6 +3068,7 @@ static int addrconf_notify(struct notifier_block *this, unsigned long event, + { + struct net_device *dev = netdev_notifier_info_to_dev(ptr); + struct inet6_dev *idev = __in6_dev_get(dev); ++ struct net *net = dev_net(dev); + int run_pending = 0; + int err; + +@@ -3170,7 +3171,7 @@ static int addrconf_notify(struct notifier_block *this, unsigned long event, + * IPV6_MIN_MTU stop IPv6 on this interface. + */ + if (dev->mtu < IPV6_MIN_MTU) +- addrconf_ifdown(dev, 1); ++ addrconf_ifdown(dev, dev != net->loopback_dev); + } + break; + +diff --git a/net/ipv6/af_inet6.c b/net/ipv6/af_inet6.c +index bad62fa5e70f..44bae47fa1b9 100644 +--- a/net/ipv6/af_inet6.c ++++ b/net/ipv6/af_inet6.c +@@ -889,12 +889,12 @@ static int __init inet6_init(void) + err = register_pernet_subsys(&inet6_net_ops); + if (err) + goto register_pernet_fail; +- err = icmpv6_init(); +- if (err) +- goto icmp_fail; + err = ip6_mr_init(); + if (err) + goto ipmr_fail; ++ err = icmpv6_init(); ++ if (err) ++ goto icmp_fail; + err = ndisc_init(); + if (err) + goto ndisc_fail; +@@ -1012,10 +1012,10 @@ igmp_fail: + ndisc_cleanup(); + ndisc_fail: + ip6_mr_cleanup(); +-ipmr_fail: +- icmpv6_cleanup(); + icmp_fail: + unregister_pernet_subsys(&inet6_net_ops); ++ipmr_fail: ++ icmpv6_cleanup(); + register_pernet_fail: + sock_unregister(PF_INET6); + rtnl_unregister_all(PF_INET6); +diff --git a/net/ipv6/ip6_fib.c b/net/ipv6/ip6_fib.c +index e7a60f5de097..0c9a4cac95ee 100644 +--- a/net/ipv6/ip6_fib.c ++++ b/net/ipv6/ip6_fib.c +@@ -868,6 +868,8 @@ add: + ins = &rt->dst.rt6_next; + iter = *ins; + while (iter) { ++ if (iter->rt6i_metric > rt->rt6i_metric) ++ break; + if (rt6_qualify_for_ecmp(iter)) { + *ins = iter->dst.rt6_next; + fib6_purge_rt(iter, fn, info->nl_net); +diff --git a/net/ipv6/ip6_vti.c b/net/ipv6/ip6_vti.c +index 6ac448d8dd76..c460e653b6a5 100644 +--- a/net/ipv6/ip6_vti.c ++++ b/net/ipv6/ip6_vti.c +@@ -189,12 +189,12 @@ static int vti6_tnl_create2(struct net_device *dev) + struct vti6_net *ip6n = net_generic(net, vti6_net_id); + int err; + ++ dev->rtnl_link_ops = &vti6_link_ops; + err = register_netdevice(dev); + if (err < 0) + goto out; + + strcpy(t->parms.name, dev->name); +- dev->rtnl_link_ops = &vti6_link_ops; + + dev_hold(dev); + vti6_tnl_link(ip6n, t); +@@ -474,11 +474,15 @@ vti6_xmit(struct sk_buff *skb, struct net_device *dev, struct flowi *fl) + if (!skb->ignore_df && skb->len > mtu) { + skb_dst(skb)->ops->update_pmtu(dst, NULL, skb, mtu); + +- if (skb->protocol == htons(ETH_P_IPV6)) ++ if (skb->protocol == htons(ETH_P_IPV6)) { ++ if (mtu < IPV6_MIN_MTU) ++ mtu = IPV6_MIN_MTU; ++ + icmpv6_send(skb, ICMPV6_PKT_TOOBIG, 0, mtu); +- else ++ } else { + icmp_send(skb, ICMP_DEST_UNREACH, ICMP_FRAG_NEEDED, + htonl(mtu)); ++ } + + return -EMSGSIZE; + } +@@ -681,6 +685,10 @@ vti6_parm_to_user(struct ip6_tnl_parm2 *u, const struct __ip6_tnl_parm *p) + u->link = p->link; + u->i_key = p->i_key; + u->o_key = p->o_key; ++ if (u->i_key) ++ u->i_flags |= GRE_KEY; ++ if (u->o_key) ++ u->o_flags |= GRE_KEY; + u->proto = p->proto; + + memcpy(u->name, p->name, sizeof(u->name)); +diff --git a/net/ipv6/sit.c b/net/ipv6/sit.c +index 85c4b2fff504..295502b261a8 100644 +--- a/net/ipv6/sit.c ++++ b/net/ipv6/sit.c +@@ -1092,6 +1092,7 @@ static void ipip6_tunnel_update(struct ip_tunnel *t, struct ip_tunnel_parm *p) + ipip6_tunnel_link(sitn, t); + t->parms.iph.ttl = p->iph.ttl; + t->parms.iph.tos = p->iph.tos; ++ t->parms.iph.frag_off = p->iph.frag_off; + if (t->parms.link != p->link) { + t->parms.link = p->link; + ipip6_tunnel_bind_dev(t->dev); +diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c +index 0b43bcb6e576..2f0f1b415fbe 100644 +--- a/net/ipv6/tcp_ipv6.c ++++ b/net/ipv6/tcp_ipv6.c +@@ -382,10 +382,12 @@ static void tcp_v6_err(struct sk_buff *skb, struct inet6_skb_parm *opt, + np = inet6_sk(sk); + + if (type == NDISC_REDIRECT) { +- struct dst_entry *dst = __sk_dst_check(sk, np->dst_cookie); ++ if (!sock_owned_by_user(sk)) { ++ struct dst_entry *dst = __sk_dst_check(sk, np->dst_cookie); + +- if (dst) +- dst->ops->redirect(dst, sk, skb); ++ if (dst) ++ dst->ops->redirect(dst, sk, skb); ++ } + goto out; + } + +diff --git a/net/irda/irqueue.c b/net/irda/irqueue.c +index acbe61c7e683..160dc89335e2 100644 +--- a/net/irda/irqueue.c ++++ b/net/irda/irqueue.c +@@ -383,9 +383,6 @@ EXPORT_SYMBOL(hashbin_new); + * for deallocating this structure if it's complex. If not the user can + * just supply kfree, which should take care of the job. + */ +-#ifdef CONFIG_LOCKDEP +-static int hashbin_lock_depth = 0; +-#endif + int hashbin_delete( hashbin_t* hashbin, FREE_FUNC free_func) + { + irda_queue_t* queue; +@@ -396,22 +393,27 @@ int hashbin_delete( hashbin_t* hashbin, FREE_FUNC free_func) + IRDA_ASSERT(hashbin->magic == HB_MAGIC, return -1;); + + /* Synchronize */ +- if ( hashbin->hb_type & HB_LOCK ) { +- spin_lock_irqsave_nested(&hashbin->hb_spinlock, flags, +- hashbin_lock_depth++); +- } ++ if (hashbin->hb_type & HB_LOCK) ++ spin_lock_irqsave(&hashbin->hb_spinlock, flags); + + /* + * Free the entries in the hashbin, TODO: use hashbin_clear when + * it has been shown to work + */ + for (i = 0; i < HASHBIN_SIZE; i ++ ) { +- queue = dequeue_first((irda_queue_t**) &hashbin->hb_queue[i]); +- while (queue ) { +- if (free_func) +- (*free_func)(queue); +- queue = dequeue_first( +- (irda_queue_t**) &hashbin->hb_queue[i]); ++ while (1) { ++ queue = dequeue_first((irda_queue_t**) &hashbin->hb_queue[i]); ++ ++ if (!queue) ++ break; ++ ++ if (free_func) { ++ if (hashbin->hb_type & HB_LOCK) ++ spin_unlock_irqrestore(&hashbin->hb_spinlock, flags); ++ free_func(queue); ++ if (hashbin->hb_type & HB_LOCK) ++ spin_lock_irqsave(&hashbin->hb_spinlock, flags); ++ } + } + } + +@@ -420,12 +422,8 @@ int hashbin_delete( hashbin_t* hashbin, FREE_FUNC free_func) + hashbin->magic = ~HB_MAGIC; + + /* Release lock */ +- if ( hashbin->hb_type & HB_LOCK) { ++ if (hashbin->hb_type & HB_LOCK) + spin_unlock_irqrestore(&hashbin->hb_spinlock, flags); +-#ifdef CONFIG_LOCKDEP +- hashbin_lock_depth--; +-#endif +- } + + /* + * Free the hashbin structure +diff --git a/net/l2tp/l2tp_core.c b/net/l2tp/l2tp_core.c +index 8a1d1542eb2f..0c4de8dd58bf 100644 +--- a/net/l2tp/l2tp_core.c ++++ b/net/l2tp/l2tp_core.c +@@ -1859,7 +1859,7 @@ static __net_exit void l2tp_exit_net(struct net *net) + + rcu_read_lock_bh(); + list_for_each_entry_rcu(tunnel, &pn->l2tp_tunnel_list, list) { +- (void)l2tp_tunnel_delete(tunnel); ++ l2tp_tunnel_delete(tunnel); + } + rcu_read_unlock_bh(); + } +diff --git a/net/l2tp/l2tp_ip.c b/net/l2tp/l2tp_ip.c +index 44ee0683b14b..13c5a7ca0482 100644 +--- a/net/l2tp/l2tp_ip.c ++++ b/net/l2tp/l2tp_ip.c +@@ -381,7 +381,7 @@ static int l2tp_ip_backlog_recv(struct sock *sk, struct sk_buff *skb) + drop: + IP_INC_STATS(sock_net(sk), IPSTATS_MIB_INDISCARDS); + kfree_skb(skb); +- return -1; ++ return 0; + } + + /* Userspace will call sendmsg() on the tunnel socket to send L2TP +diff --git a/net/l2tp/l2tp_netlink.c b/net/l2tp/l2tp_netlink.c +index 4c0ce67329ca..1e412ad6ced5 100644 +--- a/net/l2tp/l2tp_netlink.c ++++ b/net/l2tp/l2tp_netlink.c +@@ -285,7 +285,7 @@ static int l2tp_nl_cmd_tunnel_delete(struct sk_buff *skb, struct genl_info *info + l2tp_tunnel_notify(&l2tp_nl_family, info, + tunnel, L2TP_CMD_TUNNEL_DELETE); + +- (void) l2tp_tunnel_delete(tunnel); ++ l2tp_tunnel_delete(tunnel); + + out: + return ret; +diff --git a/net/llc/llc_conn.c b/net/llc/llc_conn.c +index 81a61fce3afb..841026e02ce8 100644 +--- a/net/llc/llc_conn.c ++++ b/net/llc/llc_conn.c +@@ -821,7 +821,10 @@ void llc_conn_handler(struct llc_sap *sap, struct sk_buff *skb) + * another trick required to cope with how the PROCOM state + * machine works. -acme + */ ++ skb_orphan(skb); ++ sock_hold(sk); + skb->sk = sk; ++ skb->destructor = sock_efree; + } + if (!sock_owned_by_user(sk)) + llc_conn_rcv(sk, skb); +diff --git a/net/llc/llc_sap.c b/net/llc/llc_sap.c +index d0e1e804ebd7..5404d0d195cc 100644 +--- a/net/llc/llc_sap.c ++++ b/net/llc/llc_sap.c +@@ -290,7 +290,10 @@ static void llc_sap_rcv(struct llc_sap *sap, struct sk_buff *skb, + + ev->type = LLC_SAP_EV_TYPE_PDU; + ev->reason = 0; ++ skb_orphan(skb); ++ sock_hold(sk); + skb->sk = sk; ++ skb->destructor = sock_efree; + llc_sap_state_process(sap, skb); + } + +diff --git a/net/mac80211/mesh.c b/net/mac80211/mesh.c +index 48257f17688f..2ce35082a335 100644 +--- a/net/mac80211/mesh.c ++++ b/net/mac80211/mesh.c +@@ -289,8 +289,6 @@ int mesh_add_meshconf_ie(struct ieee80211_sub_if_data *sdata, + /* Mesh PS mode. See IEEE802.11-2012 8.4.2.100.8 */ + *pos |= ifmsh->ps_peers_deep_sleep ? + IEEE80211_MESHCONF_CAPAB_POWER_SAVE_LEVEL : 0x00; +- *pos++ = 0x00; +- + return 0; + } + +diff --git a/net/mpls/af_mpls.c b/net/mpls/af_mpls.c +index 1f93a5978f2a..398375098efb 100644 +--- a/net/mpls/af_mpls.c ++++ b/net/mpls/af_mpls.c +@@ -1098,6 +1098,7 @@ static void mpls_net_exit(struct net *net) + for (index = 0; index < platform_labels; index++) { + struct mpls_route *rt = rtnl_dereference(platform_label[index]); + RCU_INIT_POINTER(platform_label[index], NULL); ++ mpls_notify_route(net, index, rt, NULL, NULL); + mpls_rt_free(rt); + } + rtnl_unlock(); +diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c +index 4cd7e27e3fc4..7f5d147aff63 100644 +--- a/net/packet/af_packet.c ++++ b/net/packet/af_packet.c +@@ -1447,13 +1447,16 @@ static int fanout_add(struct sock *sk, u16 id, u16 type_flags) + return -EINVAL; + } + ++ mutex_lock(&fanout_mutex); ++ ++ err = -EINVAL; + if (!po->running) +- return -EINVAL; ++ goto out; + ++ err = -EALREADY; + if (po->fanout) +- return -EALREADY; ++ goto out; + +- mutex_lock(&fanout_mutex); + match = NULL; + list_for_each_entry(f, &fanout_list, list) { + if (f->id == id && +@@ -1509,17 +1512,16 @@ static void fanout_release(struct sock *sk) + struct packet_sock *po = pkt_sk(sk); + struct packet_fanout *f; + +- f = po->fanout; +- if (!f) +- return; +- + mutex_lock(&fanout_mutex); +- po->fanout = NULL; ++ f = po->fanout; ++ if (f) { ++ po->fanout = NULL; + +- if (atomic_dec_and_test(&f->sk_ref)) { +- list_del(&f->list); +- dev_remove_pack(&f->prot_hook); +- kfree(f); ++ if (atomic_dec_and_test(&f->sk_ref)) { ++ list_del(&f->list); ++ dev_remove_pack(&f->prot_hook); ++ kfree(f); ++ } + } + mutex_unlock(&fanout_mutex); + } +@@ -2728,6 +2730,10 @@ static int packet_do_bind(struct sock *sk, const char *name, int ifindex, + if (need_rehook) { + if (po->running) { + rcu_read_unlock(); ++ /* prevents packet_notifier() from calling ++ * register_prot_hook() ++ */ ++ po->num = 0; + __unregister_prot_hook(sk, true); + rcu_read_lock(); + dev_curr = po->prot_hook.dev; +@@ -2736,6 +2742,7 @@ static int packet_do_bind(struct sock *sk, const char *name, int ifindex, + dev->ifindex); + } + ++ BUG_ON(po->running); + po->num = proto; + po->prot_hook.type = proto; + +@@ -2779,7 +2786,7 @@ static int packet_bind_spkt(struct socket *sock, struct sockaddr *uaddr, + int addr_len) + { + struct sock *sk = sock->sk; +- char name[15]; ++ char name[sizeof(uaddr->sa_data) + 1]; + + /* + * Check legality +@@ -2787,7 +2794,11 @@ static int packet_bind_spkt(struct socket *sock, struct sockaddr *uaddr, + + if (addr_len != sizeof(struct sockaddr)) + return -EINVAL; +- strlcpy(name, uaddr->sa_data, sizeof(name)); ++ /* uaddr->sa_data comes from the userspace, it's not guaranteed to be ++ * zero-terminated. ++ */ ++ memcpy(name, uaddr->sa_data, sizeof(uaddr->sa_data)); ++ name[sizeof(uaddr->sa_data)] = 0; + + return packet_do_bind(sk, name, 0, pkt_sk(sk)->num); + } +diff --git a/net/rds/rdma.c b/net/rds/rdma.c +index 3738b1920c09..612c3050d514 100644 +--- a/net/rds/rdma.c ++++ b/net/rds/rdma.c +@@ -184,7 +184,7 @@ static int __rds_rdma_map(struct rds_sock *rs, struct rds_get_mr_args *args, + long i; + int ret; + +- if (rs->rs_bound_addr == 0) { ++ if (rs->rs_bound_addr == 0 || !rs->rs_transport) { + ret = -ENOTCONN; /* XXX not a great errno */ + goto out; + } +diff --git a/net/sched/act_api.c b/net/sched/act_api.c +index f8d9c2a2c451..c9387f62f634 100644 +--- a/net/sched/act_api.c ++++ b/net/sched/act_api.c +@@ -802,10 +802,8 @@ static int tca_action_flush(struct net *net, struct nlattr *nla, + goto out_module_put; + + err = a.ops->walk(skb, &dcb, RTM_DELACTION, &a); +- if (err < 0) ++ if (err <= 0) + goto out_module_put; +- if (err == 0) +- goto noflush_out; + + nla_nest_end(skb, nest); + +@@ -822,7 +820,6 @@ static int tca_action_flush(struct net *net, struct nlattr *nla, + out_module_put: + module_put(a.ops->owner); + err_out: +-noflush_out: + kfree_skb(skb); + return err; + } +diff --git a/net/sched/act_connmark.c b/net/sched/act_connmark.c +index 295d14bd6c67..85e3207d047a 100644 +--- a/net/sched/act_connmark.c ++++ b/net/sched/act_connmark.c +@@ -105,6 +105,9 @@ static int tcf_connmark_init(struct net *net, struct nlattr *nla, + if (ret < 0) + return ret; + ++ if (!tb[TCA_CONNMARK_PARMS]) ++ return -EINVAL; ++ + parm = nla_data(tb[TCA_CONNMARK_PARMS]); + + if (!tcf_hash_check(parm->index, a, bind)) { +diff --git a/net/sctp/debug.c b/net/sctp/debug.c +index 95d7b15dad21..e371a0d90068 100644 +--- a/net/sctp/debug.c ++++ b/net/sctp/debug.c +@@ -166,7 +166,7 @@ static const char *const sctp_timer_tbl[] = { + /* Lookup timer debug name. */ + const char *sctp_tname(const sctp_subtype_t id) + { +- if (id.timeout <= SCTP_EVENT_TIMEOUT_MAX) ++ if (id.timeout < ARRAY_SIZE(sctp_timer_tbl)) + return sctp_timer_tbl[id.timeout]; + return "unknown_timer"; + } +diff --git a/net/sctp/socket.c b/net/sctp/socket.c +index cb7193ed4284..946d1c28f93f 100644 +--- a/net/sctp/socket.c ++++ b/net/sctp/socket.c +@@ -82,8 +82,8 @@ + /* Forward declarations for internal helper functions. */ + static int sctp_writeable(struct sock *sk); + static void sctp_wfree(struct sk_buff *skb); +-static int sctp_wait_for_sndbuf(struct sctp_association *, long *timeo_p, +- size_t msg_len); ++static int sctp_wait_for_sndbuf(struct sctp_association *asoc, long *timeo_p, ++ size_t msg_len, struct sock **orig_sk); + static int sctp_wait_for_packet(struct sock *sk, int *err, long *timeo_p); + static int sctp_wait_for_connect(struct sctp_association *, long *timeo_p); + static int sctp_wait_for_accept(struct sock *sk, long timeo); +@@ -1947,9 +1947,16 @@ static int sctp_sendmsg(struct sock *sk, struct msghdr *msg, size_t msg_len) + + timeo = sock_sndtimeo(sk, msg->msg_flags & MSG_DONTWAIT); + if (!sctp_wspace(asoc)) { +- err = sctp_wait_for_sndbuf(asoc, &timeo, msg_len); +- if (err) ++ /* sk can be changed by peel off when waiting for buf. */ ++ err = sctp_wait_for_sndbuf(asoc, &timeo, msg_len, &sk); ++ if (err) { ++ if (err == -ESRCH) { ++ /* asoc is already dead. */ ++ new_asoc = NULL; ++ err = -EPIPE; ++ } + goto out_free; ++ } + } + + /* If an address is passed with the sendto/sendmsg call, it is used +@@ -6972,7 +6979,7 @@ void sctp_sock_rfree(struct sk_buff *skb) + + /* Helper function to wait for space in the sndbuf. */ + static int sctp_wait_for_sndbuf(struct sctp_association *asoc, long *timeo_p, +- size_t msg_len) ++ size_t msg_len, struct sock **orig_sk) + { + struct sock *sk = asoc->base.sk; + int err = 0; +@@ -6989,10 +6996,11 @@ static int sctp_wait_for_sndbuf(struct sctp_association *asoc, long *timeo_p, + for (;;) { + prepare_to_wait_exclusive(&asoc->wait, &wait, + TASK_INTERRUPTIBLE); ++ if (asoc->base.dead) ++ goto do_dead; + if (!*timeo_p) + goto do_nonblock; +- if (sk->sk_err || asoc->state >= SCTP_STATE_SHUTDOWN_PENDING || +- asoc->base.dead) ++ if (sk->sk_err || asoc->state >= SCTP_STATE_SHUTDOWN_PENDING) + goto do_error; + if (signal_pending(current)) + goto do_interrupted; +@@ -7006,11 +7014,17 @@ static int sctp_wait_for_sndbuf(struct sctp_association *asoc, long *timeo_p, + current_timeo = schedule_timeout(current_timeo); + BUG_ON(sk != asoc->base.sk); + lock_sock(sk); ++ if (sk != asoc->base.sk) { ++ release_sock(sk); ++ sk = asoc->base.sk; ++ lock_sock(sk); ++ } + + *timeo_p = current_timeo; + } + + out: ++ *orig_sk = sk; + finish_wait(&asoc->wait, &wait); + + /* Release the association's refcnt. */ +@@ -7018,6 +7032,10 @@ out: + + return err; + ++do_dead: ++ err = -ESRCH; ++ goto out; ++ + do_error: + err = -EPIPE; + goto out; +diff --git a/net/socket.c b/net/socket.c +index e66e4f357506..12d681c1b66d 100644 +--- a/net/socket.c ++++ b/net/socket.c +@@ -1706,6 +1706,7 @@ SYSCALL_DEFINE6(recvfrom, int, fd, void __user *, ubuf, size_t, size, + /* We assume all kernel code knows the size of sockaddr_storage */ + msg.msg_namelen = 0; + msg.msg_iocb = NULL; ++ msg.msg_flags = 0; + if (sock->file->f_flags & O_NONBLOCK) + flags |= MSG_DONTWAIT; + err = sock_recvmsg(sock, &msg, iov_iter_count(&msg.msg_iter), flags); +@@ -2192,8 +2193,10 @@ int __sys_recvmmsg(int fd, struct mmsghdr __user *mmsg, unsigned int vlen, + return err; + + err = sock_error(sock->sk); +- if (err) ++ if (err) { ++ datagrams = err; + goto out_put; ++ } + + entry = mmsg; + compat_entry = (struct compat_mmsghdr __user *)mmsg; +diff --git a/net/sunrpc/sched.c b/net/sunrpc/sched.c +index 337ca851a350..d1907b3cf832 100644 +--- a/net/sunrpc/sched.c ++++ b/net/sunrpc/sched.c +@@ -273,10 +273,9 @@ static inline void rpc_task_set_debuginfo(struct rpc_task *task) + + static void rpc_set_active(struct rpc_task *task) + { +- trace_rpc_task_begin(task->tk_client, task, NULL); +- + rpc_task_set_debuginfo(task); + set_bit(RPC_TASK_ACTIVE, &task->tk_runstate); ++ trace_rpc_task_begin(task->tk_client, task, NULL); + } + + /* +diff --git a/net/tipc/server.c b/net/tipc/server.c +index d0d619813684..7c52cb5781ab 100644 +--- a/net/tipc/server.c ++++ b/net/tipc/server.c +@@ -614,14 +614,12 @@ int tipc_server_start(struct tipc_server *s) + void tipc_server_stop(struct tipc_server *s) + { + struct tipc_conn *con; +- int total = 0; + int id; + + spin_lock_bh(&s->idr_lock); +- for (id = 0; total < s->idr_in_use; id++) { ++ for (id = 0; s->idr_in_use; id++) { + con = idr_find(&s->conn_idr, id); + if (con) { +- total++; + spin_unlock_bh(&s->idr_lock); + tipc_close_conn(con); + spin_lock_bh(&s->idr_lock); +diff --git a/net/unix/garbage.c b/net/unix/garbage.c +index 6a0d48525fcf..c36757e72844 100644 +--- a/net/unix/garbage.c ++++ b/net/unix/garbage.c +@@ -146,6 +146,7 @@ void unix_notinflight(struct user_struct *user, struct file *fp) + if (s) { + struct unix_sock *u = unix_sk(s); + ++ BUG_ON(!atomic_long_read(&u->inflight)); + BUG_ON(list_empty(&u->link)); + + if (atomic_long_dec_and_test(&u->inflight)) +@@ -341,6 +342,14 @@ void unix_gc(void) + } + list_del(&cursor); + ++ /* Now gc_candidates contains only garbage. Restore original ++ * inflight counters for these as well, and remove the skbuffs ++ * which are creating the cycle(s). ++ */ ++ skb_queue_head_init(&hitlist); ++ list_for_each_entry(u, &gc_candidates, link) ++ scan_children(&u->sk, inc_inflight, &hitlist); ++ + /* not_cycle_list contains those sockets which do not make up a + * cycle. Restore these to the inflight list. + */ +@@ -350,14 +359,6 @@ void unix_gc(void) + list_move_tail(&u->link, &gc_inflight_list); + } + +- /* Now gc_candidates contains only garbage. Restore original +- * inflight counters for these as well, and remove the skbuffs +- * which are creating the cycle(s). +- */ +- skb_queue_head_init(&hitlist); +- list_for_each_entry(u, &gc_candidates, link) +- scan_children(&u->sk, inc_inflight, &hitlist); +- + spin_unlock(&unix_gc_lock); + + /* Here we are. Hitlist is filled. Die. */ +diff --git a/net/xfrm/xfrm_policy.c b/net/xfrm/xfrm_policy.c +index 04a025218d13..7306683a7207 100644 +--- a/net/xfrm/xfrm_policy.c ++++ b/net/xfrm/xfrm_policy.c +@@ -1352,6 +1352,7 @@ static struct xfrm_policy *clone_policy(const struct xfrm_policy *old, int dir) + newp->xfrm_nr = old->xfrm_nr; + newp->index = old->index; + newp->type = old->type; ++ newp->family = old->family; + memcpy(newp->xfrm_vec, old->xfrm_vec, + newp->xfrm_nr*sizeof(struct xfrm_tmpl)); + write_lock_bh(&net->xfrm.xfrm_policy_lock); +@@ -2963,6 +2964,11 @@ static int __net_init xfrm_net_init(struct net *net) + { + int rv; + ++ /* Initialize the per-net locks here */ ++ spin_lock_init(&net->xfrm.xfrm_state_lock); ++ rwlock_init(&net->xfrm.xfrm_policy_lock); ++ mutex_init(&net->xfrm.xfrm_cfg_mutex); ++ + rv = xfrm_statistics_init(net); + if (rv < 0) + goto out_statistics; +@@ -2979,11 +2985,6 @@ static int __net_init xfrm_net_init(struct net *net) + if (rv < 0) + goto out; + +- /* Initialize the per-net locks here */ +- spin_lock_init(&net->xfrm.xfrm_state_lock); +- rwlock_init(&net->xfrm.xfrm_policy_lock); +- mutex_init(&net->xfrm.xfrm_cfg_mutex); +- + return 0; + + out: +diff --git a/net/xfrm/xfrm_user.c b/net/xfrm/xfrm_user.c +index 18d9cf2eb648..30593cadd428 100644 +--- a/net/xfrm/xfrm_user.c ++++ b/net/xfrm/xfrm_user.c +@@ -386,7 +386,14 @@ static inline int xfrm_replay_verify_len(struct xfrm_replay_state_esn *replay_es + up = nla_data(rp); + ulen = xfrm_replay_state_esn_len(up); + +- if (nla_len(rp) < ulen || xfrm_replay_state_esn_len(replay_esn) != ulen) ++ /* Check the overall length and the internal bitmap length to avoid ++ * potential overflow. */ ++ if (nla_len(rp) < ulen || ++ xfrm_replay_state_esn_len(replay_esn) != ulen || ++ replay_esn->bmp_len != up->bmp_len) ++ return -EINVAL; ++ ++ if (up->replay_window > up->bmp_len * sizeof(__u32) * 8) + return -EINVAL; + + return 0; +diff --git a/scripts/module-common.lds b/scripts/module-common.lds +index 73a2c7da0e55..53234e85192a 100644 +--- a/scripts/module-common.lds ++++ b/scripts/module-common.lds +@@ -19,4 +19,6 @@ SECTIONS { + + . = ALIGN(8); + .init_array 0 : { *(SORT(.init_array.*)) *(.init_array) } ++ ++ __jump_table 0 : ALIGN(8) { KEEP(*(__jump_table)) } + } +diff --git a/security/integrity/ima/ima_main.c b/security/integrity/ima/ima_main.c +index eeee00dce729..cf837338a85e 100644 +--- a/security/integrity/ima/ima_main.c ++++ b/security/integrity/ima/ima_main.c +@@ -52,6 +52,8 @@ static int __init hash_setup(char *str) + ima_hash_algo = HASH_ALGO_SHA1; + else if (strncmp(str, "md5", 3) == 0) + ima_hash_algo = HASH_ALGO_MD5; ++ else ++ return 1; + goto out; + } + +@@ -61,6 +63,8 @@ static int __init hash_setup(char *str) + break; + } + } ++ if (i == HASH_ALGO__LAST) ++ return 1; + out: + hash_setup_done = 1; + return 1; +diff --git a/security/keys/keyctl.c b/security/keys/keyctl.c +index a2d29cca16c6..c804189d0d03 100644 +--- a/security/keys/keyctl.c ++++ b/security/keys/keyctl.c +@@ -99,7 +99,7 @@ SYSCALL_DEFINE5(add_key, const char __user *, _type, + payload = NULL; + + vm = false; +- if (_payload) { ++ if (plen) { + ret = -ENOMEM; + payload = kmalloc(plen, GFP_KERNEL | __GFP_NOWARN); + if (!payload) { +@@ -333,7 +333,7 @@ long keyctl_update_key(key_serial_t id, + + /* pull the payload in if one was supplied */ + payload = NULL; +- if (_payload) { ++ if (plen) { + ret = -ENOMEM; + payload = kmalloc(plen, GFP_KERNEL); + if (!payload) +diff --git a/sound/core/pcm.c b/sound/core/pcm.c +index f6e7fdd354de..7c60cb289719 100644 +--- a/sound/core/pcm.c ++++ b/sound/core/pcm.c +@@ -149,7 +149,9 @@ static int snd_pcm_control_ioctl(struct snd_card *card, + err = -ENXIO; + goto _error; + } ++ mutex_lock(&pcm->open_mutex); + err = snd_pcm_info_user(substream, info); ++ mutex_unlock(&pcm->open_mutex); + _error: + mutex_unlock(®ister_mutex); + return err; +diff --git a/sound/core/seq/seq_timer.c b/sound/core/seq/seq_timer.c +index a2468f1101d1..0e6210000fa9 100644 +--- a/sound/core/seq/seq_timer.c ++++ b/sound/core/seq/seq_timer.c +@@ -355,7 +355,7 @@ static int initialize_timer(struct snd_seq_timer *tmr) + unsigned long freq; + + t = tmr->timeri->timer; +- if (snd_BUG_ON(!t)) ++ if (!t) + return -EINVAL; + + freq = tmr->preferred_resolution; +diff --git a/sound/usb/mixer.c b/sound/usb/mixer.c +index 3ebfaa527825..2ee449fbe55f 100644 +--- a/sound/usb/mixer.c ++++ b/sound/usb/mixer.c +@@ -203,6 +203,10 @@ static int snd_usb_copy_string_desc(struct mixer_build *state, + int index, char *buf, int maxlen) + { + int len = usb_string(state->chip->dev, index, buf, maxlen - 1); ++ ++ if (len < 0) ++ return 0; ++ + buf[len] = 0; + return len; + } +@@ -2096,13 +2100,14 @@ static int parse_audio_selector_unit(struct mixer_build *state, int unitid, + if (len) + ; + else if (nameid) +- snd_usb_copy_string_desc(state, nameid, kctl->id.name, ++ len = snd_usb_copy_string_desc(state, nameid, kctl->id.name, + sizeof(kctl->id.name)); +- else { ++ else + len = get_term_name(state, &state->oterm, + kctl->id.name, sizeof(kctl->id.name), 0); +- if (!len) +- strlcpy(kctl->id.name, "USB", sizeof(kctl->id.name)); ++ ++ if (!len) { ++ strlcpy(kctl->id.name, "USB", sizeof(kctl->id.name)); + + if (desc->bDescriptorSubtype == UAC2_CLOCK_SELECTOR) + append_ctl_name(kctl, " Clock Source"); +diff --git a/tools/hv/hv_kvp_daemon.c b/tools/hv/hv_kvp_daemon.c +index 408bb076a234..db4a1eb5af7d 100644 +--- a/tools/hv/hv_kvp_daemon.c ++++ b/tools/hv/hv_kvp_daemon.c +@@ -195,11 +195,14 @@ static void kvp_update_mem_state(int pool) + for (;;) { + readp = &record[records_read]; + records_read += fread(readp, sizeof(struct kvp_record), +- ENTRIES_PER_BLOCK * num_blocks, +- filep); ++ ENTRIES_PER_BLOCK * num_blocks - records_read, ++ filep); + + if (ferror(filep)) { +- syslog(LOG_ERR, "Failed to read file, pool: %d", pool); ++ syslog(LOG_ERR, ++ "Failed to read file, pool: %d; error: %d %s", ++ pool, errno, strerror(errno)); ++ kvp_release_lock(pool); + exit(EXIT_FAILURE); + } + +@@ -212,6 +215,7 @@ static void kvp_update_mem_state(int pool) + + if (record == NULL) { + syslog(LOG_ERR, "malloc failed"); ++ kvp_release_lock(pool); + exit(EXIT_FAILURE); + } + continue; +@@ -226,15 +230,11 @@ static void kvp_update_mem_state(int pool) + fclose(filep); + kvp_release_lock(pool); + } ++ + static int kvp_file_init(void) + { + int fd; +- FILE *filep; +- size_t records_read; + char *fname; +- struct kvp_record *record; +- struct kvp_record *readp; +- int num_blocks; + int i; + int alloc_unit = sizeof(struct kvp_record) * ENTRIES_PER_BLOCK; + +@@ -248,61 +248,19 @@ static int kvp_file_init(void) + + for (i = 0; i < KVP_POOL_COUNT; i++) { + fname = kvp_file_info[i].fname; +- records_read = 0; +- num_blocks = 1; + sprintf(fname, "%s/.kvp_pool_%d", KVP_CONFIG_LOC, i); + fd = open(fname, O_RDWR | O_CREAT | O_CLOEXEC, 0644 /* rw-r--r-- */); + + if (fd == -1) + return 1; + +- +- filep = fopen(fname, "re"); +- if (!filep) { +- close(fd); +- return 1; +- } +- +- record = malloc(alloc_unit * num_blocks); +- if (record == NULL) { +- fclose(filep); +- close(fd); +- return 1; +- } +- for (;;) { +- readp = &record[records_read]; +- records_read += fread(readp, sizeof(struct kvp_record), +- ENTRIES_PER_BLOCK, +- filep); +- +- if (ferror(filep)) { +- syslog(LOG_ERR, "Failed to read file, pool: %d", +- i); +- exit(EXIT_FAILURE); +- } +- +- if (!feof(filep)) { +- /* +- * We have more data to read. +- */ +- num_blocks++; +- record = realloc(record, alloc_unit * +- num_blocks); +- if (record == NULL) { +- fclose(filep); +- close(fd); +- return 1; +- } +- continue; +- } +- break; +- } + kvp_file_info[i].fd = fd; +- kvp_file_info[i].num_blocks = num_blocks; +- kvp_file_info[i].records = record; +- kvp_file_info[i].num_records = records_read; +- fclose(filep); +- ++ kvp_file_info[i].num_blocks = 1; ++ kvp_file_info[i].records = malloc(alloc_unit); ++ if (kvp_file_info[i].records == NULL) ++ return 1; ++ kvp_file_info[i].num_records = 0; ++ kvp_update_mem_state(i); + } + + return 0; +diff --git a/tools/include/linux/log2.h b/tools/include/linux/log2.h +index 41446668ccce..d5677d39c1e4 100644 +--- a/tools/include/linux/log2.h ++++ b/tools/include/linux/log2.h +@@ -12,12 +12,6 @@ + #ifndef _TOOLS_LINUX_LOG2_H + #define _TOOLS_LINUX_LOG2_H + +-/* +- * deal with unrepresentable constant logarithms +- */ +-extern __attribute__((const, noreturn)) +-int ____ilog2_NaN(void); +- + /* + * non-constant log of base 2 calculators + * - the arch may override these in asm/bitops.h if they can be implemented +@@ -78,7 +72,7 @@ unsigned long __rounddown_pow_of_two(unsigned long n) + #define ilog2(n) \ + ( \ + __builtin_constant_p(n) ? ( \ +- (n) < 1 ? ____ilog2_NaN() : \ ++ (n) < 2 ? 0 : \ + (n) & (1ULL << 63) ? 63 : \ + (n) & (1ULL << 62) ? 62 : \ + (n) & (1ULL << 61) ? 61 : \ +@@ -141,10 +135,7 @@ unsigned long __rounddown_pow_of_two(unsigned long n) + (n) & (1ULL << 4) ? 4 : \ + (n) & (1ULL << 3) ? 3 : \ + (n) & (1ULL << 2) ? 2 : \ +- (n) & (1ULL << 1) ? 1 : \ +- (n) & (1ULL << 0) ? 0 : \ +- ____ilog2_NaN() \ +- ) : \ ++ 1 ) : \ + (sizeof(n) <= 4) ? \ + __ilog2_u32(n) : \ + __ilog2_u64(n) \ +diff --git a/tools/perf/tests/attr.c b/tools/perf/tests/attr.c +index 2dfc9ad0e6f2..8e92b56c610a 100644 +--- a/tools/perf/tests/attr.c ++++ b/tools/perf/tests/attr.c +@@ -150,7 +150,7 @@ static int run_dir(const char *d, const char *perf) + snprintf(cmd, 3*PATH_MAX, PYTHON " %s/attr.py -d %s/attr/ -p %s %.*s", + d, d, perf, vcnt, v); + +- return system(cmd); ++ return system(cmd) ? TEST_FAIL : TEST_OK; + } + + int test__attr(void) +diff --git a/tools/perf/util/symbol.c b/tools/perf/util/symbol.c +index 99378a5c57a7..28ee003beee1 100644 +--- a/tools/perf/util/symbol.c ++++ b/tools/perf/util/symbol.c +@@ -194,7 +194,7 @@ void symbols__fixup_end(struct rb_root *symbols) + + /* Last entry */ + if (curr->end == curr->start) +- curr->end = roundup(curr->start, 4096); ++ curr->end = roundup(curr->start, 4096) + 4096; + } + + void __map_groups__fixup_end(struct map_groups *mg, enum map_type type) +diff --git a/tools/testing/selftests/powerpc/harness.c b/tools/testing/selftests/powerpc/harness.c +index f7997affd143..f45cee80c58b 100644 +--- a/tools/testing/selftests/powerpc/harness.c ++++ b/tools/testing/selftests/powerpc/harness.c +@@ -109,9 +109,11 @@ int test_harness(int (test_function)(void), char *name) + + rc = run_test(test_function, name); + +- if (rc == MAGIC_SKIP_RETURN_VALUE) ++ if (rc == MAGIC_SKIP_RETURN_VALUE) { + test_skip(name); +- else ++ /* so that skipped test is not marked as failed */ ++ rc = 0; ++ } else + test_finish(name, rc); + + return rc; +diff --git a/virt/kvm/eventfd.c b/virt/kvm/eventfd.c +index 79db45336e3a..962bf7371cee 100644 +--- a/virt/kvm/eventfd.c ++++ b/virt/kvm/eventfd.c +@@ -862,7 +862,8 @@ kvm_deassign_ioeventfd_idx(struct kvm *kvm, enum kvm_bus bus_idx, + continue; + + kvm_io_bus_unregister_dev(kvm, bus_idx, &p->dev); +- kvm->buses[bus_idx]->ioeventfd_count--; ++ if (kvm->buses[bus_idx]) ++ kvm->buses[bus_idx]->ioeventfd_count--; + ioeventfd_release(p); + ret = 0; + break; +diff --git a/virt/kvm/kvm_main.c b/virt/kvm/kvm_main.c +index f9746f29f870..457719410ab4 100644 +--- a/virt/kvm/kvm_main.c ++++ b/virt/kvm/kvm_main.c +@@ -600,8 +600,11 @@ static void kvm_destroy_vm(struct kvm *kvm) + list_del(&kvm->vm_list); + spin_unlock(&kvm_lock); + kvm_free_irq_routing(kvm); +- for (i = 0; i < KVM_NR_BUSES; i++) +- kvm_io_bus_destroy(kvm->buses[i]); ++ for (i = 0; i < KVM_NR_BUSES; i++) { ++ if (kvm->buses[i]) ++ kvm_io_bus_destroy(kvm->buses[i]); ++ kvm->buses[i] = NULL; ++ } + kvm_coalesced_mmio_free(kvm); + #if defined(CONFIG_MMU_NOTIFIER) && defined(KVM_ARCH_WANT_MMU_NOTIFIER) + mmu_notifier_unregister(&kvm->mmu_notifier, kvm->mm); +@@ -3038,6 +3041,8 @@ int kvm_io_bus_write(struct kvm_vcpu *vcpu, enum kvm_bus bus_idx, gpa_t addr, + }; + + bus = srcu_dereference(vcpu->kvm->buses[bus_idx], &vcpu->kvm->srcu); ++ if (!bus) ++ return -ENOMEM; + r = __kvm_io_bus_write(vcpu, bus, &range, val); + return r < 0 ? r : 0; + } +@@ -3055,6 +3060,8 @@ int kvm_io_bus_write_cookie(struct kvm_vcpu *vcpu, enum kvm_bus bus_idx, + }; + + bus = srcu_dereference(vcpu->kvm->buses[bus_idx], &vcpu->kvm->srcu); ++ if (!bus) ++ return -ENOMEM; + + /* First try the device referenced by cookie. */ + if ((cookie >= 0) && (cookie < bus->dev_count) && +@@ -3105,6 +3112,8 @@ int kvm_io_bus_read(struct kvm_vcpu *vcpu, enum kvm_bus bus_idx, gpa_t addr, + }; + + bus = srcu_dereference(vcpu->kvm->buses[bus_idx], &vcpu->kvm->srcu); ++ if (!bus) ++ return -ENOMEM; + r = __kvm_io_bus_read(vcpu, bus, &range, val); + return r < 0 ? r : 0; + } +@@ -3117,6 +3126,9 @@ int kvm_io_bus_register_dev(struct kvm *kvm, enum kvm_bus bus_idx, gpa_t addr, + struct kvm_io_bus *new_bus, *bus; + + bus = kvm->buses[bus_idx]; ++ if (!bus) ++ return -ENOMEM; ++ + /* exclude ioeventfd which is limited by maximum fd */ + if (bus->dev_count - bus->ioeventfd_count > NR_IOBUS_DEVS - 1) + return -ENOSPC; +@@ -3136,37 +3148,41 @@ int kvm_io_bus_register_dev(struct kvm *kvm, enum kvm_bus bus_idx, gpa_t addr, + } + + /* Caller must hold slots_lock. */ +-int kvm_io_bus_unregister_dev(struct kvm *kvm, enum kvm_bus bus_idx, +- struct kvm_io_device *dev) ++void kvm_io_bus_unregister_dev(struct kvm *kvm, enum kvm_bus bus_idx, ++ struct kvm_io_device *dev) + { +- int i, r; ++ int i; + struct kvm_io_bus *new_bus, *bus; + + bus = kvm->buses[bus_idx]; +- r = -ENOENT; ++ if (!bus) ++ return; ++ + for (i = 0; i < bus->dev_count; i++) + if (bus->range[i].dev == dev) { +- r = 0; + break; + } + +- if (r) +- return r; ++ if (i == bus->dev_count) ++ return; + + new_bus = kzalloc(sizeof(*bus) + ((bus->dev_count - 1) * + sizeof(struct kvm_io_range)), GFP_KERNEL); +- if (!new_bus) +- return -ENOMEM; ++ if (!new_bus) { ++ pr_err("kvm: failed to shrink bus, removing it completely\n"); ++ goto broken; ++ } + + memcpy(new_bus, bus, sizeof(*bus) + i * sizeof(struct kvm_io_range)); + new_bus->dev_count--; + memcpy(new_bus->range + i, bus->range + i + 1, + (new_bus->dev_count - i) * sizeof(struct kvm_io_range)); + ++broken: + rcu_assign_pointer(kvm->buses[bus_idx], new_bus); + synchronize_srcu_expedited(&kvm->srcu); + kfree(bus); +- return r; ++ return; + } + + static struct notifier_block kvm_cpu_notifier = {