[gentoo-commits] proj/linux-patches:4.4 commit in: /

["Mike Pagano" <mpagano@gentoo.org>]

commit:     a3708bfce9d5194bfaaa1ca3484b6e1291fc582a
Author:     Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Fri Dec 11 12:53:51 2020 +0000
Commit:     Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Fri Dec 11 12:53:51 2020 +0000
URL:        https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=a3708bfc

Linux patch 4.4.248

Signed-off-by: Mike Pagano <mpagano <AT> gentoo.org>

 0000_README              |    4 +
 1247_linux-4.4.248.patch | 1421 ++++++++++++++++++++++++++++++++++++++++++++++
 2 files changed, 1425 insertions(+)

diff --git a/0000_README b/0000_README
index 87e6840..a6e4afe 100644
--- a/0000_README
+++ b/0000_README
@@ -1031,6 +1031,10 @@ Patch:  1246_linux-4.4.247.patch
 From:   http://www.kernel.org
 Desc:   Linux 4.4.247
 
+Patch:  1247_linux-4.4.248.patch
+From:   http://www.kernel.org
+Desc:   Linux 4.4.248
+
 Patch:  1500_XATTR_USER_PREFIX.patch
 From:   https://bugs.gentoo.org/show_bug.cgi?id=470644
 Desc:   Support for namespace user.pax.* on tmpfs.

diff --git a/1247_linux-4.4.248.patch b/1247_linux-4.4.248.patch
new file mode 100644
index 0000000..cb89ba2
--- /dev/null
+++ b/1247_linux-4.4.248.patch
@@ -0,0 +1,1421 @@
+diff --git a/Documentation/devicetree/bindings/net/nfc/nxp-nci.txt b/Documentation/devicetree/bindings/net/nfc/nxp-nci.txt
+index 5b6cd9b3f628a..0188bbd2e35f8 100644
+--- a/Documentation/devicetree/bindings/net/nfc/nxp-nci.txt
++++ b/Documentation/devicetree/bindings/net/nfc/nxp-nci.txt
+@@ -27,7 +27,7 @@ Example (for ARM-based BeagleBone with NPC100 NFC controller on I2C2):
+ 		clock-frequency = <100000>;
+ 
+ 		interrupt-parent = <&gpio1>;
+-		interrupts = <29 GPIO_ACTIVE_HIGH>;
++		interrupts = <29 IRQ_TYPE_LEVEL_HIGH>;
+ 
+ 		enable-gpios = <&gpio0 30 GPIO_ACTIVE_HIGH>;
+ 		firmware-gpios = <&gpio0 31 GPIO_ACTIVE_HIGH>;
+diff --git a/Documentation/devicetree/bindings/net/nfc/pn544.txt b/Documentation/devicetree/bindings/net/nfc/pn544.txt
+index dab69f36167c7..8541e8dafd55c 100644
+--- a/Documentation/devicetree/bindings/net/nfc/pn544.txt
++++ b/Documentation/devicetree/bindings/net/nfc/pn544.txt
+@@ -27,7 +27,7 @@ Example (for ARM-based BeagleBone with PN544 on I2C2):
+ 		clock-frequency = <400000>;
+ 
+ 		interrupt-parent = <&gpio1>;
+-		interrupts = <17 GPIO_ACTIVE_HIGH>;
++		interrupts = <17 IRQ_TYPE_LEVEL_HIGH>;
+ 
+ 		enable-gpios = <&gpio3 21 GPIO_ACTIVE_HIGH>;
+ 		firmware-gpios = <&gpio3 19 GPIO_ACTIVE_HIGH>;
+diff --git a/Makefile b/Makefile
+index c493d3ae046f6..7d34194e0f65a 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,6 +1,6 @@
+ VERSION = 4
+ PATCHLEVEL = 4
+-SUBLEVEL = 247
++SUBLEVEL = 248
+ EXTRAVERSION =
+ NAME = Blurry Fish Butt
+ 
+diff --git a/arch/arm64/include/asm/assembler.h b/arch/arm64/include/asm/assembler.h
+index f68abb17aa4b2..7c287917bbbdc 100644
+--- a/arch/arm64/include/asm/assembler.h
++++ b/arch/arm64/include/asm/assembler.h
+@@ -148,22 +148,25 @@ lr	.req	x30		// link register
+ 
+ /*
+  * Pseudo-ops for PC-relative adr/ldr/str <reg>, <symbol> where
+- * <symbol> is within the range +/- 4 GB of the PC.
++ * <symbol> is within the range +/- 4 GB of the PC when running
++ * in core kernel context. In module context, a movz/movk sequence
++ * is used, since modules may be loaded far away from the kernel
++ * when KASLR is in effect.
+  */
+ 	/*
+ 	 * @dst: destination register (64 bit wide)
+ 	 * @sym: name of the symbol
+-	 * @tmp: optional scratch register to be used if <dst> == sp, which
+-	 *       is not allowed in an adrp instruction
+ 	 */
+-	.macro	adr_l, dst, sym, tmp=
+-	.ifb	\tmp
++	.macro	adr_l, dst, sym
++#ifndef MODULE
+ 	adrp	\dst, \sym
+ 	add	\dst, \dst, :lo12:\sym
+-	.else
+-	adrp	\tmp, \sym
+-	add	\dst, \tmp, :lo12:\sym
+-	.endif
++#else
++	movz	\dst, #:abs_g3:\sym
++	movk	\dst, #:abs_g2_nc:\sym
++	movk	\dst, #:abs_g1_nc:\sym
++	movk	\dst, #:abs_g0_nc:\sym
++#endif
+ 	.endm
+ 
+ 	/*
+@@ -174,6 +177,7 @@ lr	.req	x30		// link register
+ 	 *       the address
+ 	 */
+ 	.macro	ldr_l, dst, sym, tmp=
++#ifndef MODULE
+ 	.ifb	\tmp
+ 	adrp	\dst, \sym
+ 	ldr	\dst, [\dst, :lo12:\sym]
+@@ -181,6 +185,15 @@ lr	.req	x30		// link register
+ 	adrp	\tmp, \sym
+ 	ldr	\dst, [\tmp, :lo12:\sym]
+ 	.endif
++#else
++	.ifb	\tmp
++	adr_l	\dst, \sym
++	ldr	\dst, [\dst]
++	.else
++	adr_l	\tmp, \sym
++	ldr	\dst, [\tmp]
++	.endif
++#endif
+ 	.endm
+ 
+ 	/*
+@@ -190,8 +203,13 @@ lr	.req	x30		// link register
+ 	 *       while <src> needs to be preserved.
+ 	 */
+ 	.macro	str_l, src, sym, tmp
++#ifndef MODULE
+ 	adrp	\tmp, \sym
+ 	str	\src, [\tmp, :lo12:\sym]
++#else
++	adr_l	\tmp, \sym
++	str	\src, [\tmp]
++#endif
+ 	.endm
+ 
+ /*
+diff --git a/arch/arm64/kernel/head.S b/arch/arm64/kernel/head.S
+index 6299a8a361eee..504bcc3a852f9 100644
+--- a/arch/arm64/kernel/head.S
++++ b/arch/arm64/kernel/head.S
+@@ -424,7 +424,8 @@ __mmap_switched:
+ 	str	xzr, [x6], #8			// Clear BSS
+ 	b	1b
+ 2:
+-	adr_l	sp, initial_sp, x4
++	adrp	x4, initial_sp
++	add	sp, x4, :lo12:initial_sp
+ 	str_l	x21, __fdt_pointer, x5		// Save FDT pointer
+ 	str_l	x24, memstart_addr, x6		// Save PHYS_OFFSET
+ 	mov	x29, #0
+diff --git a/arch/powerpc/lib/ppc_ksyms.c b/arch/powerpc/lib/ppc_ksyms.c
+index c7f8e95863161..4b81fd96aa3eb 100644
+--- a/arch/powerpc/lib/ppc_ksyms.c
++++ b/arch/powerpc/lib/ppc_ksyms.c
+@@ -24,7 +24,6 @@ EXPORT_SYMBOL(csum_tcpudp_magic);
+ #endif
+ 
+ EXPORT_SYMBOL(__copy_tofrom_user);
+-EXPORT_SYMBOL(__clear_user);
+ EXPORT_SYMBOL(copy_page);
+ 
+ #ifdef CONFIG_PPC64
+diff --git a/arch/x86/include/asm/insn.h b/arch/x86/include/asm/insn.h
+index 5a51fcbbe563f..6db02d52cdf47 100644
+--- a/arch/x86/include/asm/insn.h
++++ b/arch/x86/include/asm/insn.h
+@@ -198,6 +198,21 @@ static inline int insn_offset_immediate(struct insn *insn)
+ 	return insn_offset_displacement(insn) + insn->displacement.nbytes;
+ }
+ 
++/**
++ * for_each_insn_prefix() -- Iterate prefixes in the instruction
++ * @insn: Pointer to struct insn.
++ * @idx:  Index storage.
++ * @prefix: Prefix byte.
++ *
++ * Iterate prefix bytes of given @insn. Each prefix byte is stored in @prefix
++ * and the index is stored in @idx (note that this @idx is just for a cursor,
++ * do not change it.)
++ * Since prefixes.nbytes can be bigger than 4 if some prefixes
++ * are repeated, it cannot be used for looping over the prefixes.
++ */
++#define for_each_insn_prefix(insn, idx, prefix)	\
++	for (idx = 0; idx < ARRAY_SIZE(insn->prefixes.bytes) && (prefix = insn->prefixes.bytes[idx]) != 0; idx++)
++
+ #define POP_SS_OPCODE 0x1f
+ #define MOV_SREG_OPCODE 0x8e
+ 
+diff --git a/arch/x86/kernel/uprobes.c b/arch/x86/kernel/uprobes.c
+index 8c38784cf992a..60ccfa4c2768e 100644
+--- a/arch/x86/kernel/uprobes.c
++++ b/arch/x86/kernel/uprobes.c
+@@ -268,10 +268,11 @@ static volatile u32 good_2byte_insns[256 / 32] = {
+ 
+ static bool is_prefix_bad(struct insn *insn)
+ {
++	insn_byte_t p;
+ 	int i;
+ 
+-	for (i = 0; i < insn->prefixes.nbytes; i++) {
+-		switch (insn->prefixes.bytes[i]) {
++	for_each_insn_prefix(insn, i, p) {
++		switch (p) {
+ 		case 0x26:	/* INAT_PFX_ES   */
+ 		case 0x2E:	/* INAT_PFX_CS   */
+ 		case 0x36:	/* INAT_PFX_DS   */
+@@ -711,6 +712,7 @@ static struct uprobe_xol_ops branch_xol_ops = {
+ static int branch_setup_xol_ops(struct arch_uprobe *auprobe, struct insn *insn)
+ {
+ 	u8 opc1 = OPCODE1(insn);
++	insn_byte_t p;
+ 	int i;
+ 
+ 	switch (opc1) {
+@@ -741,8 +743,8 @@ static int branch_setup_xol_ops(struct arch_uprobe *auprobe, struct insn *insn)
+ 	 * Intel and AMD behavior differ in 64-bit mode: Intel ignores 66 prefix.
+ 	 * No one uses these insns, reject any branch insns with such prefix.
+ 	 */
+-	for (i = 0; i < insn->prefixes.nbytes; i++) {
+-		if (insn->prefixes.bytes[i] == 0x66)
++	for_each_insn_prefix(insn, i, p) {
++		if (p == 0x66)
+ 			return -ENOTSUPP;
+ 	}
+ 
+diff --git a/drivers/i2c/busses/i2c-imx.c b/drivers/i2c/busses/i2c-imx.c
+index 37303a7a2e737..117f367636b85 100644
+--- a/drivers/i2c/busses/i2c-imx.c
++++ b/drivers/i2c/busses/i2c-imx.c
+@@ -420,6 +420,19 @@ static void i2c_imx_dma_free(struct imx_i2c_struct *i2c_imx)
+ /** Functions for IMX I2C adapter driver ***************************************
+ *******************************************************************************/
+ 
++static void i2c_imx_clear_irq(struct imx_i2c_struct *i2c_imx, unsigned int bits)
++{
++	unsigned int temp;
++
++	/*
++	 * i2sr_clr_opcode is the value to clear all interrupts. Here we want to
++	 * clear only <bits>, so we write ~i2sr_clr_opcode with just <bits>
++	 * toggled. This is required because i.MX needs W0C and Vybrid uses W1C.
++	 */
++	temp = ~i2c_imx->hwdata->i2sr_clr_opcode ^ bits;
++	imx_i2c_write_reg(temp, i2c_imx, IMX_I2C_I2SR);
++}
++
+ static int i2c_imx_bus_busy(struct imx_i2c_struct *i2c_imx, int for_busy)
+ {
+ 	unsigned long orig_jiffies = jiffies;
+@@ -432,8 +445,7 @@ static int i2c_imx_bus_busy(struct imx_i2c_struct *i2c_imx, int for_busy)
+ 
+ 		/* check for arbitration lost */
+ 		if (temp & I2SR_IAL) {
+-			temp &= ~I2SR_IAL;
+-			imx_i2c_write_reg(temp, i2c_imx, IMX_I2C_I2SR);
++			i2c_imx_clear_irq(i2c_imx, I2SR_IAL);
+ 			return -EAGAIN;
+ 		}
+ 
+@@ -460,6 +472,16 @@ static int i2c_imx_trx_complete(struct imx_i2c_struct *i2c_imx)
+ 		dev_dbg(&i2c_imx->adapter.dev, "<%s> Timeout\n", __func__);
+ 		return -ETIMEDOUT;
+ 	}
++
++	/* check for arbitration lost */
++	if (i2c_imx->i2csr & I2SR_IAL) {
++		dev_dbg(&i2c_imx->adapter.dev, "<%s> Arbitration lost\n", __func__);
++		i2c_imx_clear_irq(i2c_imx, I2SR_IAL);
++
++		i2c_imx->i2csr = 0;
++		return -EAGAIN;
++	}
++
+ 	dev_dbg(&i2c_imx->adapter.dev, "<%s> TRX complete\n", __func__);
+ 	i2c_imx->i2csr = 0;
+ 	return 0;
+@@ -595,9 +617,7 @@ static irqreturn_t i2c_imx_isr(int irq, void *dev_id)
+ 	if (temp & I2SR_IIF) {
+ 		/* save status register */
+ 		i2c_imx->i2csr = temp;
+-		temp &= ~I2SR_IIF;
+-		temp |= (i2c_imx->hwdata->i2sr_clr_opcode & I2SR_IIF);
+-		imx_i2c_write_reg(temp, i2c_imx, IMX_I2C_I2SR);
++		i2c_imx_clear_irq(i2c_imx, I2SR_IIF);
+ 		wake_up(&i2c_imx->queue);
+ 		return IRQ_HANDLED;
+ 	}
+diff --git a/drivers/input/joystick/xpad.c b/drivers/input/joystick/xpad.c
+index 54a6691d7d878..637f1347cd13d 100644
+--- a/drivers/input/joystick/xpad.c
++++ b/drivers/input/joystick/xpad.c
+@@ -258,6 +258,7 @@ static const struct xpad_device {
+ 	{ 0x1038, 0x1430, "SteelSeries Stratus Duo", 0, XTYPE_XBOX360 },
+ 	{ 0x1038, 0x1431, "SteelSeries Stratus Duo", 0, XTYPE_XBOX360 },
+ 	{ 0x11c9, 0x55f0, "Nacon GC-100XF", 0, XTYPE_XBOX360 },
++	{ 0x1209, 0x2882, "Ardwiino Controller", 0, XTYPE_XBOX360 },
+ 	{ 0x12ab, 0x0004, "Honey Bee Xbox360 dancepad", MAP_DPAD_TO_BUTTONS, XTYPE_XBOX360 },
+ 	{ 0x12ab, 0x0301, "PDP AFTERGLOW AX.1", 0, XTYPE_XBOX360 },
+ 	{ 0x12ab, 0x0303, "Mortal Kombat Klassic FightStick", MAP_TRIGGERS_TO_BUTTONS, XTYPE_XBOX360 },
+@@ -435,6 +436,7 @@ static const struct usb_device_id xpad_table[] = {
+ 	XPAD_XBOXONE_VENDOR(0x0f0d),		/* Hori Controllers */
+ 	XPAD_XBOX360_VENDOR(0x1038),		/* SteelSeries Controllers */
+ 	XPAD_XBOX360_VENDOR(0x11c9),		/* Nacon GC100XF */
++	XPAD_XBOX360_VENDOR(0x1209),		/* Ardwiino Controllers */
+ 	XPAD_XBOX360_VENDOR(0x12ab),		/* X-Box 360 dance pads */
+ 	XPAD_XBOX360_VENDOR(0x1430),		/* RedOctane X-Box 360 controllers */
+ 	XPAD_XBOX360_VENDOR(0x146b),		/* BigBen Interactive Controllers */
+diff --git a/drivers/input/serio/i8042-x86ia64io.h b/drivers/input/serio/i8042-x86ia64io.h
+index 82ff44637ed78..1f45010a5b814 100644
+--- a/drivers/input/serio/i8042-x86ia64io.h
++++ b/drivers/input/serio/i8042-x86ia64io.h
+@@ -223,6 +223,10 @@ static const struct dmi_system_id __initconst i8042_dmi_noloop_table[] = {
+ 			DMI_MATCH(DMI_SYS_VENDOR, "PEGATRON CORPORATION"),
+ 			DMI_MATCH(DMI_PRODUCT_NAME, "C15B"),
+ 		},
++		.matches = {
++			DMI_MATCH(DMI_SYS_VENDOR, "ByteSpeed LLC"),
++			DMI_MATCH(DMI_PRODUCT_NAME, "ByteSpeed Laptop C15B"),
++		},
+ 	},
+ 	{ }
+ };
+diff --git a/drivers/input/serio/i8042.c b/drivers/input/serio/i8042.c
+index 6b648339733fa..37f84ba11f05e 100644
+--- a/drivers/input/serio/i8042.c
++++ b/drivers/input/serio/i8042.c
+@@ -1456,7 +1456,8 @@ static int __init i8042_setup_aux(void)
+ 	if (error)
+ 		goto err_free_ports;
+ 
+-	if (aux_enable())
++	error = aux_enable();
++	if (error)
+ 		goto err_free_irq;
+ 
+ 	i8042_aux_irq_registered = true;
+diff --git a/drivers/iommu/amd_iommu.c b/drivers/iommu/amd_iommu.c
+index 66a406e87e117..d916ac0796629 100644
+--- a/drivers/iommu/amd_iommu.c
++++ b/drivers/iommu/amd_iommu.c
+@@ -3625,7 +3625,7 @@ static struct irq_chip amd_ir_chip;
+ 
+ #define DTE_IRQ_PHYS_ADDR_MASK	(((1ULL << 45)-1) << 6)
+ #define DTE_IRQ_REMAP_INTCTL    (2ULL << 60)
+-#define DTE_IRQ_TABLE_LEN       (8ULL << 1)
++#define DTE_IRQ_TABLE_LEN       (9ULL << 1)
+ #define DTE_IRQ_REMAP_ENABLE    1ULL
+ 
+ static void set_dte_irq_entry(u16 devid, struct irq_remap_table *table)
+diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c
+index 5811235a64c89..a33e8a3b5f0a0 100644
+--- a/drivers/net/bonding/bond_main.c
++++ b/drivers/net/bonding/bond_main.c
+@@ -1225,7 +1225,39 @@ static void bond_upper_dev_unlink(struct net_device *bond_dev,
+ 	rtmsg_ifinfo(RTM_NEWLINK, slave_dev, IFF_SLAVE, GFP_KERNEL);
+ }
+ 
+-static struct slave *bond_alloc_slave(struct bonding *bond)
++static void slave_kobj_release(struct kobject *kobj)
++{
++	struct slave *slave = to_slave(kobj);
++	struct bonding *bond = bond_get_bond_by_slave(slave);
++
++	cancel_delayed_work_sync(&slave->notify_work);
++	if (BOND_MODE(bond) == BOND_MODE_8023AD)
++		kfree(SLAVE_AD_INFO(slave));
++
++	kfree(slave);
++}
++
++static struct kobj_type slave_ktype = {
++	.release = slave_kobj_release,
++#ifdef CONFIG_SYSFS
++	.sysfs_ops = &slave_sysfs_ops,
++#endif
++};
++
++static int bond_kobj_init(struct slave *slave)
++{
++	int err;
++
++	err = kobject_init_and_add(&slave->kobj, &slave_ktype,
++				   &(slave->dev->dev.kobj), "bonding_slave");
++	if (err)
++		kobject_put(&slave->kobj);
++
++	return err;
++}
++
++static struct slave *bond_alloc_slave(struct bonding *bond,
++				      struct net_device *slave_dev)
+ {
+ 	struct slave *slave = NULL;
+ 
+@@ -1233,11 +1265,17 @@ static struct slave *bond_alloc_slave(struct bonding *bond)
+ 	if (!slave)
+ 		return NULL;
+ 
++	slave->bond = bond;
++	slave->dev = slave_dev;
++
++	if (bond_kobj_init(slave))
++		return NULL;
++
+ 	if (BOND_MODE(bond) == BOND_MODE_8023AD) {
+ 		SLAVE_AD_INFO(slave) = kzalloc(sizeof(struct ad_slave_info),
+ 					       GFP_KERNEL);
+ 		if (!SLAVE_AD_INFO(slave)) {
+-			kfree(slave);
++			kobject_put(&slave->kobj);
+ 			return NULL;
+ 		}
+ 	}
+@@ -1246,17 +1284,6 @@ static struct slave *bond_alloc_slave(struct bonding *bond)
+ 	return slave;
+ }
+ 
+-static void bond_free_slave(struct slave *slave)
+-{
+-	struct bonding *bond = bond_get_bond_by_slave(slave);
+-
+-	cancel_delayed_work_sync(&slave->notify_work);
+-	if (BOND_MODE(bond) == BOND_MODE_8023AD)
+-		kfree(SLAVE_AD_INFO(slave));
+-
+-	kfree(slave);
+-}
+-
+ static void bond_fill_ifbond(struct bonding *bond, struct ifbond *info)
+ {
+ 	info->bond_mode = BOND_MODE(bond);
+@@ -1420,14 +1447,12 @@ int bond_enslave(struct net_device *bond_dev, struct net_device *slave_dev)
+ 	    bond->dev->addr_assign_type == NET_ADDR_RANDOM)
+ 		bond_set_dev_addr(bond->dev, slave_dev);
+ 
+-	new_slave = bond_alloc_slave(bond);
++	new_slave = bond_alloc_slave(bond, slave_dev);
+ 	if (!new_slave) {
+ 		res = -ENOMEM;
+ 		goto err_undo_flags;
+ 	}
+ 
+-	new_slave->bond = bond;
+-	new_slave->dev = slave_dev;
+ 	/* Set the new_slave's queue_id to be zero.  Queue ID mapping
+ 	 * is set via sysfs or module option if desired.
+ 	 */
+@@ -1741,7 +1766,7 @@ err_restore_mtu:
+ 	dev_set_mtu(slave_dev, new_slave->original_mtu);
+ 
+ err_free:
+-	bond_free_slave(new_slave);
++	kobject_put(&new_slave->kobj);
+ 
+ err_undo_flags:
+ 	/* Enslave of first slave has failed and we need to fix master's mac */
+@@ -1920,7 +1945,7 @@ static int __bond_release_one(struct net_device *bond_dev,
+ 	if (!netif_is_bond_master(slave_dev))
+ 		slave_dev->priv_flags &= ~IFF_BONDING;
+ 
+-	bond_free_slave(slave);
++	kobject_put(&slave->kobj);
+ 
+ 	return 0;
+ }
+diff --git a/drivers/net/bonding/bond_sysfs_slave.c b/drivers/net/bonding/bond_sysfs_slave.c
+index 3f756fa2f603b..68bbac4715c35 100644
+--- a/drivers/net/bonding/bond_sysfs_slave.c
++++ b/drivers/net/bonding/bond_sysfs_slave.c
+@@ -125,7 +125,6 @@ static const struct slave_attribute *slave_attrs[] = {
+ };
+ 
+ #define to_slave_attr(_at) container_of(_at, struct slave_attribute, attr)
+-#define to_slave(obj)	container_of(obj, struct slave, kobj)
+ 
+ static ssize_t slave_show(struct kobject *kobj,
+ 			  struct attribute *attr, char *buf)
+@@ -136,28 +135,15 @@ static ssize_t slave_show(struct kobject *kobj,
+ 	return slave_attr->show(slave, buf);
+ }
+ 
+-static const struct sysfs_ops slave_sysfs_ops = {
++const struct sysfs_ops slave_sysfs_ops = {
+ 	.show = slave_show,
+ };
+ 
+-static struct kobj_type slave_ktype = {
+-#ifdef CONFIG_SYSFS
+-	.sysfs_ops = &slave_sysfs_ops,
+-#endif
+-};
+-
+ int bond_sysfs_slave_add(struct slave *slave)
+ {
+ 	const struct slave_attribute **a;
+ 	int err;
+ 
+-	err = kobject_init_and_add(&slave->kobj, &slave_ktype,
+-				   &(slave->dev->dev.kobj), "bonding_slave");
+-	if (err) {
+-		kobject_put(&slave->kobj);
+-		return err;
+-	}
+-
+ 	for (a = slave_attrs; *a; ++a) {
+ 		err = sysfs_create_file(&slave->kobj, &((*a)->attr));
+ 		if (err) {
+@@ -175,6 +161,4 @@ void bond_sysfs_slave_del(struct slave *slave)
+ 
+ 	for (a = slave_attrs; *a; ++a)
+ 		sysfs_remove_file(&slave->kobj, &((*a)->attr));
+-
+-	kobject_put(&slave->kobj);
+ }
+diff --git a/drivers/net/ethernet/chelsio/cxgb3/sge.c b/drivers/net/ethernet/chelsio/cxgb3/sge.c
+index e4b5b057f4178..f012649891dad 100644
+--- a/drivers/net/ethernet/chelsio/cxgb3/sge.c
++++ b/drivers/net/ethernet/chelsio/cxgb3/sge.c
+@@ -3111,6 +3111,7 @@ int t3_sge_alloc_qset(struct adapter *adapter, unsigned int id, int nports,
+ 			  GFP_KERNEL | __GFP_COMP);
+ 	if (!avail) {
+ 		CH_ALERT(adapter, "free list queue 0 initialization failed\n");
++		ret = -ENOMEM;
+ 		goto err;
+ 	}
+ 	if (avail < q->fl[0].size)
+diff --git a/drivers/net/ethernet/pasemi/pasemi_mac.c b/drivers/net/ethernet/pasemi/pasemi_mac.c
+index 48106953cf64b..56326a56068bc 100644
+--- a/drivers/net/ethernet/pasemi/pasemi_mac.c
++++ b/drivers/net/ethernet/pasemi/pasemi_mac.c
+@@ -1129,16 +1129,20 @@ static int pasemi_mac_open(struct net_device *dev)
+ 
+ 	mac->tx = pasemi_mac_setup_tx_resources(dev);
+ 
+-	if (!mac->tx)
++	if (!mac->tx) {
++		ret = -ENOMEM;
+ 		goto out_tx_ring;
++	}
+ 
+ 	/* We might already have allocated rings in case mtu was changed
+ 	 * before interface was brought up.
+ 	 */
+ 	if (dev->mtu > 1500 && !mac->num_cs) {
+ 		pasemi_mac_setup_csrings(mac);
+-		if (!mac->num_cs)
++		if (!mac->num_cs) {
++			ret = -ENOMEM;
+ 			goto out_tx_ring;
++		}
+ 	}
+ 
+ 	/* Zero out rmon counters */
+diff --git a/drivers/net/usb/ipheth.c b/drivers/net/usb/ipheth.c
+index 2b16a5fed9ded..0cf5324d493e8 100644
+--- a/drivers/net/usb/ipheth.c
++++ b/drivers/net/usb/ipheth.c
+@@ -70,7 +70,7 @@
+ #define IPHETH_USBINTF_SUBCLASS 253
+ #define IPHETH_USBINTF_PROTO    1
+ 
+-#define IPHETH_BUF_SIZE         1516
++#define IPHETH_BUF_SIZE         1514
+ #define IPHETH_IP_ALIGN		2	/* padding at front of URB */
+ #define IPHETH_TX_TIMEOUT       (5 * HZ)
+ 
+diff --git a/drivers/spi/spi-bcm2835.c b/drivers/spi/spi-bcm2835.c
+index 27680b3364548..dfbcaaaee66f4 100644
+--- a/drivers/spi/spi-bcm2835.c
++++ b/drivers/spi/spi-bcm2835.c
+@@ -742,7 +742,7 @@ static int bcm2835_spi_probe(struct platform_device *pdev)
+ 	struct resource *res;
+ 	int err;
+ 
+-	master = spi_alloc_master(&pdev->dev, sizeof(*bs));
++	master = devm_spi_alloc_master(&pdev->dev, sizeof(*bs));
+ 	if (!master) {
+ 		dev_err(&pdev->dev, "spi_alloc_master() failed\n");
+ 		return -ENOMEM;
+@@ -764,23 +764,20 @@ static int bcm2835_spi_probe(struct platform_device *pdev)
+ 
+ 	res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
+ 	bs->regs = devm_ioremap_resource(&pdev->dev, res);
+-	if (IS_ERR(bs->regs)) {
+-		err = PTR_ERR(bs->regs);
+-		goto out_master_put;
+-	}
++	if (IS_ERR(bs->regs))
++		return PTR_ERR(bs->regs);
+ 
+ 	bs->clk = devm_clk_get(&pdev->dev, NULL);
+ 	if (IS_ERR(bs->clk)) {
+ 		err = PTR_ERR(bs->clk);
+ 		dev_err(&pdev->dev, "could not get clk: %d\n", err);
+-		goto out_master_put;
++		return err;
+ 	}
+ 
+ 	bs->irq = platform_get_irq(pdev, 0);
+ 	if (bs->irq <= 0) {
+ 		dev_err(&pdev->dev, "could not get IRQ: %d\n", bs->irq);
+-		err = bs->irq ? bs->irq : -ENODEV;
+-		goto out_master_put;
++		return bs->irq ? bs->irq : -ENODEV;
+ 	}
+ 
+ 	clk_prepare_enable(bs->clk);
+@@ -795,21 +792,20 @@ static int bcm2835_spi_probe(struct platform_device *pdev)
+ 			       dev_name(&pdev->dev), master);
+ 	if (err) {
+ 		dev_err(&pdev->dev, "could not request IRQ: %d\n", err);
+-		goto out_clk_disable;
++		goto out_dma_release;
+ 	}
+ 
+ 	err = spi_register_master(master);
+ 	if (err) {
+ 		dev_err(&pdev->dev, "could not register SPI master: %d\n", err);
+-		goto out_clk_disable;
++		goto out_dma_release;
+ 	}
+ 
+ 	return 0;
+ 
+-out_clk_disable:
++out_dma_release:
++	bcm2835_dma_release(master);
+ 	clk_disable_unprepare(bs->clk);
+-out_master_put:
+-	spi_master_put(master);
+ 	return err;
+ }
+ 
+diff --git a/drivers/spi/spi.c b/drivers/spi/spi.c
+index 6ed2959ce4dc0..ed87f71a428d1 100644
+--- a/drivers/spi/spi.c
++++ b/drivers/spi/spi.c
+@@ -1720,6 +1720,46 @@ struct spi_master *spi_alloc_master(struct device *dev, unsigned size)
+ }
+ EXPORT_SYMBOL_GPL(spi_alloc_master);
+ 
++static void devm_spi_release_master(struct device *dev, void *master)
++{
++	spi_master_put(*(struct spi_master **)master);
++}
++
++/**
++ * devm_spi_alloc_master - resource-managed spi_alloc_master()
++ * @dev: physical device of SPI master
++ * @size: how much zeroed driver-private data to allocate
++ * Context: can sleep
++ *
++ * Allocate an SPI master and automatically release a reference on it
++ * when @dev is unbound from its driver.  Drivers are thus relieved from
++ * having to call spi_master_put().
++ *
++ * The arguments to this function are identical to spi_alloc_master().
++ *
++ * Return: the SPI master structure on success, else NULL.
++ */
++struct spi_master *devm_spi_alloc_master(struct device *dev, unsigned int size)
++{
++	struct spi_master **ptr, *master;
++
++	ptr = devres_alloc(devm_spi_release_master, sizeof(*ptr),
++			   GFP_KERNEL);
++	if (!ptr)
++		return NULL;
++
++	master = spi_alloc_master(dev, size);
++	if (master) {
++		*ptr = master;
++		devres_add(dev, ptr);
++	} else {
++		devres_free(ptr);
++	}
++
++	return master;
++}
++EXPORT_SYMBOL_GPL(devm_spi_alloc_master);
++
+ #ifdef CONFIG_OF
+ static int of_spi_register_master(struct spi_master *master)
+ {
+@@ -1899,6 +1939,11 @@ int devm_spi_register_master(struct device *dev, struct spi_master *master)
+ }
+ EXPORT_SYMBOL_GPL(devm_spi_register_master);
+ 
++static int devm_spi_match_master(struct device *dev, void *res, void *master)
++{
++	return *(struct spi_master **)res == master;
++}
++
+ static int __unregister(struct device *dev, void *null)
+ {
+ 	spi_unregister_device(to_spi_device(dev));
+@@ -1928,7 +1973,14 @@ void spi_unregister_master(struct spi_master *master)
+ 	list_del(&master->list);
+ 	mutex_unlock(&board_lock);
+ 
+-	device_unregister(&master->dev);
++	device_del(&master->dev);
++
++	/* Release the last reference on the master if its driver
++	 * has not yet been converted to devm_spi_alloc_master().
++	 */
++	if (!devres_find(master->dev.parent, devm_spi_release_master,
++			 devm_spi_match_master, master))
++		put_device(&master->dev);
+ }
+ EXPORT_SYMBOL_GPL(spi_unregister_master);
+ 
+diff --git a/drivers/tty/tty_io.c b/drivers/tty/tty_io.c
+index b7effcfee91d8..dff507cd0250f 100644
+--- a/drivers/tty/tty_io.c
++++ b/drivers/tty/tty_io.c
+@@ -537,8 +537,8 @@ static void __proc_set_tty(struct tty_struct *tty)
+ 	put_pid(tty->session);
+ 	put_pid(tty->pgrp);
+ 	tty->pgrp = get_pid(task_pgrp(current));
+-	spin_unlock_irqrestore(&tty->ctrl_lock, flags);
+ 	tty->session = get_pid(task_session(current));
++	spin_unlock_irqrestore(&tty->ctrl_lock, flags);
+ 	if (current->signal->tty) {
+ 		tty_debug(tty, "current tty %s not NULL!!\n",
+ 			  current->signal->tty->name);
+@@ -929,21 +929,24 @@ void disassociate_ctty(int on_exit)
+ 	spin_lock_irq(&current->sighand->siglock);
+ 	put_pid(current->signal->tty_old_pgrp);
+ 	current->signal->tty_old_pgrp = NULL;
+-
+ 	tty = tty_kref_get(current->signal->tty);
++	spin_unlock_irq(&current->sighand->siglock);
++
+ 	if (tty) {
+ 		unsigned long flags;
++
++		tty_lock(tty);
+ 		spin_lock_irqsave(&tty->ctrl_lock, flags);
+ 		put_pid(tty->session);
+ 		put_pid(tty->pgrp);
+ 		tty->session = NULL;
+ 		tty->pgrp = NULL;
+ 		spin_unlock_irqrestore(&tty->ctrl_lock, flags);
++		tty_unlock(tty);
+ 		tty_kref_put(tty);
+ 	} else
+ 		tty_debug_hangup(tty, "no current tty\n");
+ 
+-	spin_unlock_irq(&current->sighand->siglock);
+ 	/* Now clear signal->tty under the lock */
+ 	read_lock(&tasklist_lock);
+ 	session_clear_tty(task_session(current));
+@@ -2601,14 +2604,19 @@ static int tiocspgrp(struct tty_struct *tty, struct tty_struct *real_tty, pid_t
+ 		return -ENOTTY;
+ 	if (retval)
+ 		return retval;
+-	if (!current->signal->tty ||
+-	    (current->signal->tty != real_tty) ||
+-	    (real_tty->session != task_session(current)))
+-		return -ENOTTY;
++
+ 	if (get_user(pgrp_nr, p))
+ 		return -EFAULT;
+ 	if (pgrp_nr < 0)
+ 		return -EINVAL;
++
++	spin_lock_irq(&real_tty->ctrl_lock);
++	if (!current->signal->tty ||
++	    (current->signal->tty != real_tty) ||
++	    (real_tty->session != task_session(current))) {
++		retval = -ENOTTY;
++		goto out_unlock_ctrl;
++	}
+ 	rcu_read_lock();
+ 	pgrp = find_vpid(pgrp_nr);
+ 	retval = -ESRCH;
+@@ -2618,12 +2626,12 @@ static int tiocspgrp(struct tty_struct *tty, struct tty_struct *real_tty, pid_t
+ 	if (session_of_pgrp(pgrp) != task_session(current))
+ 		goto out_unlock;
+ 	retval = 0;
+-	spin_lock_irq(&tty->ctrl_lock);
+ 	put_pid(real_tty->pgrp);
+ 	real_tty->pgrp = get_pid(pgrp);
+-	spin_unlock_irq(&tty->ctrl_lock);
+ out_unlock:
+ 	rcu_read_unlock();
++out_unlock_ctrl:
++	spin_unlock_irq(&real_tty->ctrl_lock);
+ 	return retval;
+ }
+ 
+@@ -2635,21 +2643,31 @@ out_unlock:
+  *
+  *	Obtain the session id of the tty. If there is no session
+  *	return an error.
+- *
+- *	Locking: none. Reference to current->signal->tty is safe.
+  */
+ 
+ static int tiocgsid(struct tty_struct *tty, struct tty_struct *real_tty, pid_t __user *p)
+ {
++	unsigned long flags;
++	pid_t sid;
++
+ 	/*
+ 	 * (tty == real_tty) is a cheap way of
+ 	 * testing if the tty is NOT a master pty.
+ 	*/
+ 	if (tty == real_tty && current->signal->tty != real_tty)
+ 		return -ENOTTY;
++
++	spin_lock_irqsave(&real_tty->ctrl_lock, flags);
+ 	if (!real_tty->session)
+-		return -ENOTTY;
+-	return put_user(pid_vnr(real_tty->session), p);
++		goto err;
++	sid = pid_vnr(real_tty->session);
++	spin_unlock_irqrestore(&real_tty->ctrl_lock, flags);
++
++	return put_user(sid, p);
++
++err:
++	spin_unlock_irqrestore(&real_tty->ctrl_lock, flags);
++	return -ENOTTY;
+ }
+ 
+ /**
+@@ -3061,10 +3079,14 @@ void __do_SAK(struct tty_struct *tty)
+ 	struct task_struct *g, *p;
+ 	struct pid *session;
+ 	int		i;
++	unsigned long flags;
+ 
+ 	if (!tty)
+ 		return;
+-	session = tty->session;
++
++	spin_lock_irqsave(&tty->ctrl_lock, flags);
++	session = get_pid(tty->session);
++	spin_unlock_irqrestore(&tty->ctrl_lock, flags);
+ 
+ 	tty_ldisc_flush(tty);
+ 
+@@ -3100,6 +3122,7 @@ void __do_SAK(struct tty_struct *tty)
+ 		task_unlock(p);
+ 	} while_each_thread(g, p);
+ 	read_unlock(&tasklist_lock);
++	put_pid(session);
+ #endif
+ }
+ 
+diff --git a/drivers/usb/gadget/function/f_fs.c b/drivers/usb/gadget/function/f_fs.c
+index f5f4a99274178..deb0a87cd03b7 100644
+--- a/drivers/usb/gadget/function/f_fs.c
++++ b/drivers/usb/gadget/function/f_fs.c
+@@ -1034,7 +1034,7 @@ static long ffs_epfile_ioctl(struct file *file, unsigned code,
+ 		case FUNCTIONFS_ENDPOINT_DESC:
+ 		{
+ 			int desc_idx;
+-			struct usb_endpoint_descriptor *desc;
++			struct usb_endpoint_descriptor desc1, *desc;
+ 
+ 			switch (epfile->ffs->gadget->speed) {
+ 			case USB_SPEED_SUPER:
+@@ -1046,10 +1046,12 @@ static long ffs_epfile_ioctl(struct file *file, unsigned code,
+ 			default:
+ 				desc_idx = 0;
+ 			}
++
+ 			desc = epfile->ep->descs[desc_idx];
++			memcpy(&desc1, desc, desc->bLength);
+ 
+ 			spin_unlock_irq(&epfile->ffs->eps_lock);
+-			ret = copy_to_user((void *)value, desc, sizeof(*desc));
++			ret = copy_to_user((void *)value, &desc1, desc1.bLength);
+ 			if (ret)
+ 				ret = -EFAULT;
+ 			return ret;
+diff --git a/drivers/usb/serial/ch341.c b/drivers/usb/serial/ch341.c
+index 3ec59c2b4f65a..c3d82cabbe65c 100644
+--- a/drivers/usb/serial/ch341.c
++++ b/drivers/usb/serial/ch341.c
+@@ -70,10 +70,11 @@
+ 
+ 
+ static const struct usb_device_id id_table[] = {
+-	{ USB_DEVICE(0x4348, 0x5523) },
++	{ USB_DEVICE(0x1a86, 0x5512) },
++	{ USB_DEVICE(0x1a86, 0x5523) },
+ 	{ USB_DEVICE(0x1a86, 0x7522) },
+ 	{ USB_DEVICE(0x1a86, 0x7523) },
+-	{ USB_DEVICE(0x1a86, 0x5523) },
++	{ USB_DEVICE(0x4348, 0x5523) },
+ 	{ },
+ };
+ MODULE_DEVICE_TABLE(usb, id_table);
+diff --git a/drivers/usb/serial/kl5kusb105.c b/drivers/usb/serial/kl5kusb105.c
+index 83c823d32ff96..7b006fd4de0e6 100644
+--- a/drivers/usb/serial/kl5kusb105.c
++++ b/drivers/usb/serial/kl5kusb105.c
+@@ -293,12 +293,12 @@ static int  klsi_105_open(struct tty_struct *tty, struct usb_serial_port *port)
+ 	priv->cfg.unknown2 = cfg->unknown2;
+ 	spin_unlock_irqrestore(&priv->lock, flags);
+ 
++	kfree(cfg);
++
+ 	/* READ_ON and urb submission */
+ 	rc = usb_serial_generic_open(tty, port);
+-	if (rc) {
+-		retval = rc;
+-		goto err_free_cfg;
+-	}
++	if (rc)
++		return rc;
+ 
+ 	rc = usb_control_msg(port->serial->dev,
+ 			     usb_sndctrlpipe(port->serial->dev, 0),
+@@ -341,8 +341,6 @@ err_disable_read:
+ 			     KLSI_TIMEOUT);
+ err_generic_close:
+ 	usb_serial_generic_close(port);
+-err_free_cfg:
+-	kfree(cfg);
+ 
+ 	return retval;
+ }
+diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c
+index 34ac1265afe46..e8643612e9a39 100644
+--- a/drivers/usb/serial/option.c
++++ b/drivers/usb/serial/option.c
+@@ -419,6 +419,7 @@ static void option_instat_callback(struct urb *urb);
+ #define CINTERION_PRODUCT_PH8			0x0053
+ #define CINTERION_PRODUCT_AHXX			0x0055
+ #define CINTERION_PRODUCT_PLXX			0x0060
++#define CINTERION_PRODUCT_EXS82			0x006c
+ #define CINTERION_PRODUCT_PH8_2RMNET		0x0082
+ #define CINTERION_PRODUCT_PH8_AUDIO		0x0083
+ #define CINTERION_PRODUCT_AHXX_2RMNET		0x0084
+@@ -1885,6 +1886,7 @@ static const struct usb_device_id option_ids[] = {
+ 	{ USB_DEVICE_INTERFACE_CLASS(CINTERION_VENDOR_ID, CINTERION_PRODUCT_AHXX_AUDIO, 0xff) },
+ 	{ USB_DEVICE_INTERFACE_CLASS(CINTERION_VENDOR_ID, CINTERION_PRODUCT_CLS8, 0xff),
+ 	  .driver_info = RSVD(0) | RSVD(4) },
++	{ USB_DEVICE_INTERFACE_CLASS(CINTERION_VENDOR_ID, CINTERION_PRODUCT_EXS82, 0xff) },
+ 	{ USB_DEVICE(CINTERION_VENDOR_ID, CINTERION_PRODUCT_HC28_MDM) },
+ 	{ USB_DEVICE(CINTERION_VENDOR_ID, CINTERION_PRODUCT_HC28_MDMNET) },
+ 	{ USB_DEVICE(SIEMENS_VENDOR_ID, CINTERION_PRODUCT_HC25_MDM) },
+@@ -2031,12 +2033,13 @@ static const struct usb_device_id option_ids[] = {
+ 	  .driver_info = RSVD(0) | RSVD(1) | RSVD(6) },
+ 	{ USB_DEVICE(0x0489, 0xe0b5),						/* Foxconn T77W968 ESIM */
+ 	  .driver_info = RSVD(0) | RSVD(1) | RSVD(6) },
+-	{ USB_DEVICE(0x1508, 0x1001),						/* Fibocom NL668 */
++	{ USB_DEVICE(0x1508, 0x1001),						/* Fibocom NL668 (IOT version) */
+ 	  .driver_info = RSVD(4) | RSVD(5) | RSVD(6) },
+ 	{ USB_DEVICE(0x2cb7, 0x0104),						/* Fibocom NL678 series */
+ 	  .driver_info = RSVD(4) | RSVD(5) },
+ 	{ USB_DEVICE_INTERFACE_CLASS(0x2cb7, 0x0105, 0xff),			/* Fibocom NL678 series */
+ 	  .driver_info = RSVD(6) },
++	{ USB_DEVICE_INTERFACE_CLASS(0x2cb7, 0x01a0, 0xff) },			/* Fibocom NL668-AM/NL652-EU (laptop MBIM) */
+ 	{ USB_DEVICE_INTERFACE_CLASS(0x305a, 0x1404, 0xff) },			/* GosunCn GM500 RNDIS */
+ 	{ USB_DEVICE_INTERFACE_CLASS(0x305a, 0x1405, 0xff) },			/* GosunCn GM500 MBIM */
+ 	{ USB_DEVICE_INTERFACE_CLASS(0x305a, 0x1406, 0xff) },			/* GosunCn GM500 ECM/NCM */
+diff --git a/fs/btrfs/ctree.c b/fs/btrfs/ctree.c
+index 3fa0515d76851..85b64475d8083 100644
+--- a/fs/btrfs/ctree.c
++++ b/fs/btrfs/ctree.c
+@@ -1129,6 +1129,8 @@ static noinline int __btrfs_cow_block(struct btrfs_trans_handle *trans,
+ 
+ 	ret = update_ref_for_cow(trans, root, buf, cow, &last_ref);
+ 	if (ret) {
++		btrfs_tree_unlock(cow);
++		free_extent_buffer(cow);
+ 		btrfs_abort_transaction(trans, root, ret);
+ 		return ret;
+ 	}
+@@ -1136,6 +1138,8 @@ static noinline int __btrfs_cow_block(struct btrfs_trans_handle *trans,
+ 	if (test_bit(BTRFS_ROOT_REF_COWS, &root->state)) {
+ 		ret = btrfs_reloc_cow_block(trans, root, buf, cow);
+ 		if (ret) {
++			btrfs_tree_unlock(cow);
++			free_extent_buffer(cow);
+ 			btrfs_abort_transaction(trans, root, ret);
+ 			return ret;
+ 		}
+@@ -1174,6 +1178,8 @@ static noinline int __btrfs_cow_block(struct btrfs_trans_handle *trans,
+ 		if (last_ref) {
+ 			ret = tree_mod_log_free_eb(root->fs_info, buf);
+ 			if (ret) {
++				btrfs_tree_unlock(cow);
++				free_extent_buffer(cow);
+ 				btrfs_abort_transaction(trans, root, ret);
+ 				return ret;
+ 			}
+diff --git a/fs/btrfs/volumes.c b/fs/btrfs/volumes.c
+index cd1e9411f9269..d6383d362e271 100644
+--- a/fs/btrfs/volumes.c
++++ b/fs/btrfs/volumes.c
+@@ -2357,9 +2357,6 @@ int btrfs_init_new_device(struct btrfs_root *root, char *device_path)
+ 	btrfs_set_super_num_devices(root->fs_info->super_copy,
+ 				    tmp + 1);
+ 
+-	/* add sysfs device entry */
+-	btrfs_sysfs_add_device_link(root->fs_info->fs_devices, device);
+-
+ 	/*
+ 	 * we've got more storage, clear any full flags on the space
+ 	 * infos
+@@ -2367,6 +2364,10 @@ int btrfs_init_new_device(struct btrfs_root *root, char *device_path)
+ 	btrfs_clear_space_info_full(root->fs_info);
+ 
+ 	unlock_chunks(root);
++
++	/* add sysfs device entry */
++	btrfs_sysfs_add_device_link(root->fs_info->fs_devices, device);
++
+ 	mutex_unlock(&root->fs_info->fs_devices->device_list_mutex);
+ 
+ 	if (seeding_dev) {
+diff --git a/fs/cifs/connect.c b/fs/cifs/connect.c
+index f4ef8d6ea8edc..71c9ed70aa683 100644
+--- a/fs/cifs/connect.c
++++ b/fs/cifs/connect.c
+@@ -783,6 +783,8 @@ static void clean_demultiplex_info(struct TCP_Server_Info *server)
+ 	list_del_init(&server->tcp_ses_list);
+ 	spin_unlock(&cifs_tcp_ses_lock);
+ 
++	cancel_delayed_work_sync(&server->echo);
++
+ 	spin_lock(&GlobalMid_Lock);
+ 	server->tcpStatus = CifsExiting;
+ 	spin_unlock(&GlobalMid_Lock);
+diff --git a/fs/gfs2/rgrp.c b/fs/gfs2/rgrp.c
+index faa5e0e2c4493..dd0d8c1bf5c5a 100644
+--- a/fs/gfs2/rgrp.c
++++ b/fs/gfs2/rgrp.c
+@@ -1017,6 +1017,10 @@ static int gfs2_ri_update(struct gfs2_inode *ip)
+ 	if (error < 0)
+ 		return error;
+ 
++	if (RB_EMPTY_ROOT(&sdp->sd_rindex_tree)) {
++		fs_err(sdp, "no resource groups found in the file system.\n");
++		return -ENOENT;
++	}
+ 	set_rgrp_preferences(sdp);
+ 
+ 	sdp->sd_rindex_uptodate = 1;
+diff --git a/include/linux/if_vlan.h b/include/linux/if_vlan.h
+index dd676ba758ee7..40429b818b457 100644
+--- a/include/linux/if_vlan.h
++++ b/include/linux/if_vlan.h
+@@ -30,6 +30,8 @@
+ #define VLAN_ETH_DATA_LEN	1500	/* Max. octets in payload	 */
+ #define VLAN_ETH_FRAME_LEN	1518	/* Max. octets in frame sans FCS */
+ 
++#define VLAN_MAX_DEPTH	8		/* Max. number of nested VLAN tags parsed */
++
+ /*
+  * 	struct vlan_hdr - vlan header
+  * 	@h_vlan_TCI: priority and VLAN ID
+@@ -478,10 +480,10 @@ static inline int vlan_get_tag(const struct sk_buff *skb, u16 *vlan_tci)
+  * Returns the EtherType of the packet, regardless of whether it is
+  * vlan encapsulated (normal or hardware accelerated) or not.
+  */
+-static inline __be16 __vlan_get_protocol(struct sk_buff *skb, __be16 type,
++static inline __be16 __vlan_get_protocol(const struct sk_buff *skb, __be16 type,
+ 					 int *depth)
+ {
+-	unsigned int vlan_depth = skb->mac_len;
++	unsigned int vlan_depth = skb->mac_len, parse_depth = VLAN_MAX_DEPTH;
+ 
+ 	/* if type is 802.1Q/AD then the header should already be
+ 	 * present at mac_len - VLAN_HLEN (if mac_len > 0), or at
+@@ -496,13 +498,12 @@ static inline __be16 __vlan_get_protocol(struct sk_buff *skb, __be16 type,
+ 			vlan_depth = ETH_HLEN;
+ 		}
+ 		do {
+-			struct vlan_hdr *vh;
++			struct vlan_hdr vhdr, *vh;
+ 
+-			if (unlikely(!pskb_may_pull(skb,
+-						    vlan_depth + VLAN_HLEN)))
++			vh = skb_header_pointer(skb, vlan_depth, sizeof(vhdr), &vhdr);
++			if (unlikely(!vh || !--parse_depth))
+ 				return 0;
+ 
+-			vh = (struct vlan_hdr *)(skb->data + vlan_depth);
+ 			type = vh->h_vlan_encapsulated_proto;
+ 			vlan_depth += VLAN_HLEN;
+ 		} while (type == htons(ETH_P_8021Q) ||
+@@ -522,11 +523,25 @@ static inline __be16 __vlan_get_protocol(struct sk_buff *skb, __be16 type,
+  * Returns the EtherType of the packet, regardless of whether it is
+  * vlan encapsulated (normal or hardware accelerated) or not.
+  */
+-static inline __be16 vlan_get_protocol(struct sk_buff *skb)
++static inline __be16 vlan_get_protocol(const struct sk_buff *skb)
+ {
+ 	return __vlan_get_protocol(skb, skb->protocol, NULL);
+ }
+ 
++/* A getter for the SKB protocol field which will handle VLAN tags consistently
++ * whether VLAN acceleration is enabled or not.
++ */
++static inline __be16 skb_protocol(const struct sk_buff *skb, bool skip_vlan)
++{
++	if (!skip_vlan)
++		/* VLAN acceleration strips the VLAN header from the skb and
++		 * moves it to skb->vlan_proto
++		 */
++		return skb_vlan_tag_present(skb) ? skb->vlan_proto : skb->protocol;
++
++	return vlan_get_protocol(skb);
++}
++
+ static inline void vlan_set_encap_proto(struct sk_buff *skb,
+ 					struct vlan_hdr *vhdr)
+ {
+diff --git a/include/linux/spi/spi.h b/include/linux/spi/spi.h
+index cce80e6dc7d11..f5d387140c469 100644
+--- a/include/linux/spi/spi.h
++++ b/include/linux/spi/spi.h
+@@ -568,6 +568,8 @@ extern void spi_finalize_current_transfer(struct spi_master *master);
+ /* the spi driver core manages memory for the spi_master classdev */
+ extern struct spi_master *
+ spi_alloc_master(struct device *host, unsigned size);
++extern struct spi_master *
++devm_spi_alloc_master(struct device *dev, unsigned int size);
+ 
+ extern int spi_register_master(struct spi_master *master);
+ extern int devm_spi_register_master(struct device *dev,
+diff --git a/include/linux/tty.h b/include/linux/tty.h
+index e5b15a83c8d72..5d4f5806da46e 100644
+--- a/include/linux/tty.h
++++ b/include/linux/tty.h
+@@ -280,6 +280,10 @@ struct tty_struct {
+ 	struct termiox *termiox;	/* May be NULL for unsupported */
+ 	char name[64];
+ 	struct pid *pgrp;		/* Protected by ctrl lock */
++	/*
++	 * Writes protected by both ctrl lock and legacy mutex, readers must use
++	 * at least one of them.
++	 */
+ 	struct pid *session;
+ 	unsigned long flags;
+ 	int count;
+diff --git a/include/net/bonding.h b/include/net/bonding.h
+index 6fbfc21b27b16..1d85c5179fa8d 100644
+--- a/include/net/bonding.h
++++ b/include/net/bonding.h
+@@ -181,6 +181,11 @@ struct slave {
+ 	struct rtnl_link_stats64 slave_stats;
+ };
+ 
++static inline struct slave *to_slave(struct kobject *kobj)
++{
++	return container_of(kobj, struct slave, kobj);
++}
++
+ struct bond_up_slave {
+ 	unsigned int	count;
+ 	struct rcu_head rcu;
+@@ -667,6 +672,9 @@ extern struct bond_parm_tbl ad_select_tbl[];
+ /* exported from bond_netlink.c */
+ extern struct rtnl_link_ops bond_link_ops;
+ 
++/* exported from bond_sysfs_slave.c */
++extern const struct sysfs_ops slave_sysfs_ops;
++
+ static inline void bond_tx_drop(struct net_device *dev, struct sk_buff *skb)
+ {
+ 	atomic_long_inc(&dev->tx_dropped);
+diff --git a/include/net/inet_ecn.h b/include/net/inet_ecn.h
+index dce2d586d9cec..245d999c0eac8 100644
+--- a/include/net/inet_ecn.h
++++ b/include/net/inet_ecn.h
+@@ -3,6 +3,7 @@
+ 
+ #include <linux/ip.h>
+ #include <linux/skbuff.h>
++#include <linux/if_vlan.h>
+ 
+ #include <net/inet_sock.h>
+ #include <net/dsfield.h>
+diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c
+index e4a0c0308b507..b34462b6d653f 100644
+--- a/kernel/trace/trace.c
++++ b/kernel/trace/trace.c
+@@ -1706,7 +1706,7 @@ void trace_buffer_unlock_commit(struct trace_array *tr,
+ 	__buffer_unlock_commit(buffer, event);
+ 
+ 	ftrace_trace_stack(tr, buffer, flags, 6, pc, NULL);
+-	ftrace_trace_userstack(buffer, flags, pc);
++	ftrace_trace_userstack(tr, buffer, flags, pc);
+ }
+ EXPORT_SYMBOL_GPL(trace_buffer_unlock_commit);
+ 
+@@ -1768,7 +1768,7 @@ void trace_buffer_unlock_commit_regs(struct trace_array *tr,
+ 	 * two. They are that meaningful.
+ 	 */
+ 	ftrace_trace_stack(tr, buffer, flags, regs ? 0 : 4, pc, regs);
+-	ftrace_trace_userstack(buffer, flags, pc);
++	ftrace_trace_userstack(tr, buffer, flags, pc);
+ }
+ EXPORT_SYMBOL_GPL(trace_buffer_unlock_commit_regs);
+ 
+@@ -1941,14 +1941,15 @@ void trace_dump_stack(int skip)
+ static DEFINE_PER_CPU(int, user_stack_count);
+ 
+ void
+-ftrace_trace_userstack(struct ring_buffer *buffer, unsigned long flags, int pc)
++ftrace_trace_userstack(struct trace_array *tr,
++		       struct ring_buffer *buffer, unsigned long flags, int pc)
+ {
+ 	struct trace_event_call *call = &event_user_stack;
+ 	struct ring_buffer_event *event;
+ 	struct userstack_entry *entry;
+ 	struct stack_trace trace;
+ 
+-	if (!(global_trace.trace_flags & TRACE_ITER_USERSTACKTRACE))
++	if (!(tr->trace_flags & TRACE_ITER_USERSTACKTRACE))
+ 		return;
+ 
+ 	/*
+diff --git a/kernel/trace/trace.h b/kernel/trace/trace.h
+index cd0d8cc7163e1..7150892c692ac 100644
+--- a/kernel/trace/trace.h
++++ b/kernel/trace/trace.h
+@@ -656,13 +656,15 @@ void update_max_tr_single(struct trace_array *tr,
+ #endif /* CONFIG_TRACER_MAX_TRACE */
+ 
+ #ifdef CONFIG_STACKTRACE
+-void ftrace_trace_userstack(struct ring_buffer *buffer, unsigned long flags,
++void ftrace_trace_userstack(struct trace_array *tr,
++			    struct ring_buffer *buffer, unsigned long flags,
+ 			    int pc);
+ 
+ void __trace_stack(struct trace_array *tr, unsigned long flags, int skip,
+ 		   int pc);
+ #else
+-static inline void ftrace_trace_userstack(struct ring_buffer *buffer,
++static inline void ftrace_trace_userstack(struct trace_array *tr,
++					  struct ring_buffer *buffer,
+ 					  unsigned long flags, int pc)
+ {
+ }
+diff --git a/mm/huge_memory.c b/mm/huge_memory.c
+index f38d24bb8a1bc..6404e4fcb4ed6 100644
+--- a/mm/huge_memory.c
++++ b/mm/huge_memory.c
+@@ -824,7 +824,6 @@ int do_huge_pmd_anonymous_page(struct mm_struct *mm, struct vm_area_struct *vma,
+ 		spinlock_t *ptl;
+ 		pgtable_t pgtable;
+ 		struct page *zero_page;
+-		bool set;
+ 		int ret;
+ 		pgtable = pte_alloc_one(mm, haddr);
+ 		if (unlikely(!pgtable))
+@@ -837,10 +836,11 @@ int do_huge_pmd_anonymous_page(struct mm_struct *mm, struct vm_area_struct *vma,
+ 		}
+ 		ptl = pmd_lock(mm, pmd);
+ 		ret = 0;
+-		set = false;
+ 		if (pmd_none(*pmd)) {
+ 			if (userfaultfd_missing(vma)) {
+ 				spin_unlock(ptl);
++				pte_free(mm, pgtable);
++				put_huge_zero_page();
+ 				ret = handle_userfault(vma, address, flags,
+ 						       VM_UFFD_MISSING);
+ 				VM_BUG_ON(ret & VM_FAULT_FALLBACK);
+@@ -849,11 +849,9 @@ int do_huge_pmd_anonymous_page(struct mm_struct *mm, struct vm_area_struct *vma,
+ 						   haddr, pmd,
+ 						   zero_page);
+ 				spin_unlock(ptl);
+-				set = true;
+ 			}
+-		} else
++		} else {
+ 			spin_unlock(ptl);
+-		if (!set) {
+ 			pte_free(mm, pgtable);
+ 			put_huge_zero_page();
+ 		}
+diff --git a/net/bridge/br_netfilter_hooks.c b/net/bridge/br_netfilter_hooks.c
+index 6c84c9b8d60b5..24eea13035557 100644
+--- a/net/bridge/br_netfilter_hooks.c
++++ b/net/bridge/br_netfilter_hooks.c
+@@ -711,6 +711,11 @@ static int br_nf_dev_queue_xmit(struct net *net, struct sock *sk, struct sk_buff
+ 	mtu_reserved = nf_bridge_mtu_reduction(skb);
+ 	mtu = skb->dev->mtu;
+ 
++	if (nf_bridge->pkt_otherhost) {
++		skb->pkt_type = PACKET_OTHERHOST;
++		nf_bridge->pkt_otherhost = false;
++	}
++
+ 	if (nf_bridge->frag_max_size && nf_bridge->frag_max_size < mtu)
+ 		mtu = nf_bridge->frag_max_size;
+ 
+@@ -804,8 +809,6 @@ static unsigned int br_nf_post_routing(void *priv,
+ 	else
+ 		return NF_ACCEPT;
+ 
+-	/* We assume any code from br_dev_queue_push_xmit onwards doesn't care
+-	 * about the value of skb->pkt_type. */
+ 	if (skb->pkt_type == PACKET_OTHERHOST) {
+ 		skb->pkt_type = PACKET_HOST;
+ 		nf_bridge->pkt_otherhost = true;
+diff --git a/net/iucv/af_iucv.c b/net/iucv/af_iucv.c
+index f94107e27b5ed..78a4b9dd61679 100644
+--- a/net/iucv/af_iucv.c
++++ b/net/iucv/af_iucv.c
+@@ -1724,7 +1724,7 @@ static int iucv_callback_connreq(struct iucv_path *path,
+ 	}
+ 
+ 	/* Create the new socket */
+-	nsk = iucv_sock_alloc(NULL, sk->sk_type, GFP_ATOMIC, 0);
++	nsk = iucv_sock_alloc(NULL, sk->sk_protocol, GFP_ATOMIC, 0);
+ 	if (!nsk) {
+ 		err = pr_iucv->path_sever(path, user_data);
+ 		iucv_path_free(path);
+@@ -1934,7 +1934,7 @@ static int afiucv_hs_callback_syn(struct sock *sk, struct sk_buff *skb)
+ 		goto out;
+ 	}
+ 
+-	nsk = iucv_sock_alloc(NULL, sk->sk_type, GFP_ATOMIC, 0);
++	nsk = iucv_sock_alloc(NULL, sk->sk_protocol, GFP_ATOMIC, 0);
+ 	bh_lock_sock(sk);
+ 	if ((sk->sk_state != IUCV_LISTEN) ||
+ 	    sk_acceptq_is_full(sk) ||
+diff --git a/net/rose/rose_loopback.c b/net/rose/rose_loopback.c
+index 344456206b70b..0f371e50d9c4e 100644
+--- a/net/rose/rose_loopback.c
++++ b/net/rose/rose_loopback.c
+@@ -99,10 +99,19 @@ static void rose_loopback_timer(unsigned long param)
+ 		}
+ 
+ 		if (frametype == ROSE_CALL_REQUEST) {
+-			if ((dev = rose_dev_get(dest)) != NULL) {
+-				if (rose_rx_call_request(skb, dev, rose_loopback_neigh, lci_o) == 0)
+-					kfree_skb(skb);
+-			} else {
++			if (!rose_loopback_neigh->dev) {
++				kfree_skb(skb);
++				continue;
++			}
++
++			dev = rose_dev_get(dest);
++			if (!dev) {
++				kfree_skb(skb);
++				continue;
++			}
++
++			if (rose_rx_call_request(skb, dev, rose_loopback_neigh, lci_o) == 0) {
++				dev_put(dev);
+ 				kfree_skb(skb);
+ 			}
+ 		} else {
+diff --git a/net/x25/af_x25.c b/net/x25/af_x25.c
+index dd9a0cff22877..a9fd95d10e84a 100644
+--- a/net/x25/af_x25.c
++++ b/net/x25/af_x25.c
+@@ -679,7 +679,8 @@ static int x25_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len)
+ 	int len, i, rc = 0;
+ 
+ 	if (addr_len != sizeof(struct sockaddr_x25) ||
+-	    addr->sx25_family != AF_X25) {
++	    addr->sx25_family != AF_X25 ||
++	    strnlen(addr->sx25_addr.x25_addr, X25_ADDR_LEN) == X25_ADDR_LEN) {
+ 		rc = -EINVAL;
+ 		goto out;
+ 	}
+@@ -773,7 +774,8 @@ static int x25_connect(struct socket *sock, struct sockaddr *uaddr,
+ 
+ 	rc = -EINVAL;
+ 	if (addr_len != sizeof(struct sockaddr_x25) ||
+-	    addr->sx25_family != AF_X25)
++	    addr->sx25_family != AF_X25 ||
++	    strnlen(addr->sx25_addr.x25_addr, X25_ADDR_LEN) == X25_ADDR_LEN)
+ 		goto out;
+ 
+ 	rc = -ENETUNREACH;
+diff --git a/sound/pci/hda/hda_generic.c b/sound/pci/hda/hda_generic.c
+index 7cd1047a4edf3..dcefb12557f1f 100644
+--- a/sound/pci/hda/hda_generic.c
++++ b/sound/pci/hda/hda_generic.c
+@@ -1344,16 +1344,20 @@ static int try_assign_dacs(struct hda_codec *codec, int num_outs,
+ 		struct nid_path *path;
+ 		hda_nid_t pin = pins[i];
+ 
+-		path = snd_hda_get_path_from_idx(codec, path_idx[i]);
+-		if (path) {
+-			badness += assign_out_path_ctls(codec, path);
+-			continue;
++		if (!spec->obey_preferred_dacs) {
++			path = snd_hda_get_path_from_idx(codec, path_idx[i]);
++			if (path) {
++				badness += assign_out_path_ctls(codec, path);
++				continue;
++			}
+ 		}
+ 
+ 		dacs[i] = get_preferred_dac(codec, pin);
+ 		if (dacs[i]) {
+ 			if (is_dac_already_used(codec, dacs[i]))
+ 				badness += bad->shared_primary;
++		} else if (spec->obey_preferred_dacs) {
++			badness += BAD_NO_PRIMARY_DAC;
+ 		}
+ 
+ 		if (!dacs[i])
+diff --git a/sound/pci/hda/hda_generic.h b/sound/pci/hda/hda_generic.h
+index 25f2397c29f72..37cc6c8505ee2 100644
+--- a/sound/pci/hda/hda_generic.h
++++ b/sound/pci/hda/hda_generic.h
+@@ -229,6 +229,7 @@ struct hda_gen_spec {
+ 	unsigned int add_jack_modes:1; /* add i/o jack mode enum ctls */
+ 	unsigned int power_down_unused:1; /* power down unused widgets */
+ 	unsigned int dac_min_mute:1; /* minimal = mute for DACs */
++	unsigned int obey_preferred_dacs:1; /* obey preferred_dacs assignment */
+ 
+ 	/* other internal flags */
+ 	unsigned int no_analog:1; /* digital I/O only */
+diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
+index 0d6de70b4e082..df6f8e904eb62 100644
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -378,6 +378,7 @@ static void alc_fill_eapd_coef(struct hda_codec *codec)
+ 			alc_update_coef_idx(codec, 0x7, 1<<5, 0);
+ 		break;
+ 	case 0x10ec0892:
++	case 0x10ec0897:
+ 		alc_update_coef_idx(codec, 0x7, 1<<5, 0);
+ 		break;
+ 	case 0x10ec0899:
+@@ -7342,6 +7343,7 @@ static const struct hda_device_id snd_hda_id_realtek[] = {
+ 	HDA_CODEC_ENTRY(0x10ec0888, "ALC888", patch_alc882),
+ 	HDA_CODEC_ENTRY(0x10ec0889, "ALC889", patch_alc882),
+ 	HDA_CODEC_ENTRY(0x10ec0892, "ALC892", patch_alc662),
++	HDA_CODEC_ENTRY(0x10ec0897, "ALC897", patch_alc662),
+ 	HDA_CODEC_ENTRY(0x10ec0899, "ALC898", patch_alc882),
+ 	HDA_CODEC_ENTRY(0x10ec0900, "ALC1150", patch_alc882),
+ 	{} /* terminator */