Magellan Linux

  • Back to homepage
    • /[pkg-src]/trunk/kernel-alx/patches-4.19/0174-4.19.75-all-fixes.patch

    Contents of /trunk/kernel-alx/patches-4.19/0174-4.19.75-all-fixes.patch

    Parent Directory Parent Directory | Revision Log Revision Log

    Revision 3471 - (show annotations) (download)
    Tue Oct 29 10:31:31 2019 UTC (4 years, 6 months ago) by niro
    File size: 84998 byte(s) 
    -linux-4.19.75
    1 diff --git a/Documentation/filesystems/overlayfs.txt b/Documentation/filesystems/overlayfs.txt
    2 index eef7d9d259e8..d7dc9c818b83 100644
    3 --- a/Documentation/filesystems/overlayfs.txt
    4 +++ b/Documentation/filesystems/overlayfs.txt
    5 @@ -302,7 +302,7 @@ beneath or above the path of another overlay lower layer path.
    6
    7 Using an upper layer path and/or a workdir path that are already used by
    8 another overlay mount is not allowed and may fail with EBUSY. Using
    9 -partially overlapping paths is not allowed but will not fail with EBUSY.
    10 +partially overlapping paths is not allowed and may fail with EBUSY.
    11 If files are accessed from two overlayfs mounts which share or overlap the
    12 upper layer and/or workdir path the behavior of the overlay is undefined,
    13 though it will not result in a crash or deadlock.
    14 diff --git a/Makefile b/Makefile
    15 index 3509e0c6e5ae..4bf6f24916bf 100644
    16 --- a/Makefile
    17 +++ b/Makefile
    18 @@ -1,7 +1,7 @@
    19 # SPDX-License-Identifier: GPL-2.0
    20 VERSION = 4
    21 PATCHLEVEL = 19
    22 -SUBLEVEL = 74
    23 +SUBLEVEL = 75
    24 EXTRAVERSION =
    25 NAME = "People's Front"
    26
    27 diff --git a/arch/arm/boot/dts/am571x-idk.dts b/arch/arm/boot/dts/am571x-idk.dts
    28 index d9a2049a1ea8..6bebedfc0f35 100644
    29 --- a/arch/arm/boot/dts/am571x-idk.dts
    30 +++ b/arch/arm/boot/dts/am571x-idk.dts
    31 @@ -98,14 +98,9 @@
    32 };
    33
    34 &mmc1 {
    35 - pinctrl-names = "default", "hs", "sdr12", "sdr25", "sdr50", "ddr50", "sdr104";
    36 + pinctrl-names = "default", "hs";
    37 pinctrl-0 = <&mmc1_pins_default_no_clk_pu>;
    38 pinctrl-1 = <&mmc1_pins_hs>;
    39 - pinctrl-2 = <&mmc1_pins_sdr12>;
    40 - pinctrl-3 = <&mmc1_pins_sdr25>;
    41 - pinctrl-4 = <&mmc1_pins_sdr50>;
    42 - pinctrl-5 = <&mmc1_pins_ddr50_rev20 &mmc1_iodelay_ddr50_conf>;
    43 - pinctrl-6 = <&mmc1_pins_sdr104 &mmc1_iodelay_sdr104_rev20_conf>;
    44 };
    45
    46 &mmc2 {
    47 diff --git a/arch/arm/boot/dts/am572x-idk.dts b/arch/arm/boot/dts/am572x-idk.dts
    48 index 3ef9111d0e8b..9235173edbd3 100644
    49 --- a/arch/arm/boot/dts/am572x-idk.dts
    50 +++ b/arch/arm/boot/dts/am572x-idk.dts
    51 @@ -20,14 +20,9 @@
    52 };
    53
    54 &mmc1 {
    55 - pinctrl-names = "default", "hs", "sdr12", "sdr25", "sdr50", "ddr50", "sdr104";
    56 + pinctrl-names = "default", "hs";
    57 pinctrl-0 = <&mmc1_pins_default_no_clk_pu>;
    58 pinctrl-1 = <&mmc1_pins_hs>;
    59 - pinctrl-2 = <&mmc1_pins_sdr12>;
    60 - pinctrl-3 = <&mmc1_pins_sdr25>;
    61 - pinctrl-4 = <&mmc1_pins_sdr50>;
    62 - pinctrl-5 = <&mmc1_pins_ddr50 &mmc1_iodelay_ddr_rev20_conf>;
    63 - pinctrl-6 = <&mmc1_pins_sdr104 &mmc1_iodelay_sdr104_rev20_conf>;
    64 };
    65
    66 &mmc2 {
    67 diff --git a/arch/arm/boot/dts/am574x-idk.dts b/arch/arm/boot/dts/am574x-idk.dts
    68 index 378dfa780ac1..ae43de3297f4 100644
    69 --- a/arch/arm/boot/dts/am574x-idk.dts
    70 +++ b/arch/arm/boot/dts/am574x-idk.dts
    71 @@ -24,14 +24,9 @@
    72 };
    73
    74 &mmc1 {
    75 - pinctrl-names = "default", "hs", "sdr12", "sdr25", "sdr50", "ddr50", "sdr104";
    76 + pinctrl-names = "default", "hs";
    77 pinctrl-0 = <&mmc1_pins_default_no_clk_pu>;
    78 pinctrl-1 = <&mmc1_pins_hs>;
    79 - pinctrl-2 = <&mmc1_pins_default>;
    80 - pinctrl-3 = <&mmc1_pins_hs>;
    81 - pinctrl-4 = <&mmc1_pins_sdr50>;
    82 - pinctrl-5 = <&mmc1_pins_ddr50 &mmc1_iodelay_ddr_conf>;
    83 - pinctrl-6 = <&mmc1_pins_ddr50 &mmc1_iodelay_sdr104_conf>;
    84 };
    85
    86 &mmc2 {
    87 diff --git a/arch/arm/boot/dts/am57xx-beagle-x15-common.dtsi b/arch/arm/boot/dts/am57xx-beagle-x15-common.dtsi
    88 index ad953113cefb..d53532b47947 100644
    89 --- a/arch/arm/boot/dts/am57xx-beagle-x15-common.dtsi
    90 +++ b/arch/arm/boot/dts/am57xx-beagle-x15-common.dtsi
    91 @@ -433,6 +433,7 @@
    92
    93 bus-width = <4>;
    94 cd-gpios = <&gpio6 27 GPIO_ACTIVE_LOW>; /* gpio 219 */
    95 + no-1-8-v;
    96 };
    97
    98 &mmc2 {
    99 diff --git a/arch/arm/boot/dts/am57xx-beagle-x15-revb1.dts b/arch/arm/boot/dts/am57xx-beagle-x15-revb1.dts
    100 index 5a77b334923d..34c69965821b 100644
    101 --- a/arch/arm/boot/dts/am57xx-beagle-x15-revb1.dts
    102 +++ b/arch/arm/boot/dts/am57xx-beagle-x15-revb1.dts
    103 @@ -19,14 +19,9 @@
    104 };
    105
    106 &mmc1 {
    107 - pinctrl-names = "default", "hs", "sdr12", "sdr25", "sdr50", "ddr50", "sdr104";
    108 + pinctrl-names = "default", "hs";
    109 pinctrl-0 = <&mmc1_pins_default>;
    110 pinctrl-1 = <&mmc1_pins_hs>;
    111 - pinctrl-2 = <&mmc1_pins_sdr12>;
    112 - pinctrl-3 = <&mmc1_pins_sdr25>;
    113 - pinctrl-4 = <&mmc1_pins_sdr50>;
    114 - pinctrl-5 = <&mmc1_pins_ddr50 &mmc1_iodelay_ddr_rev11_conf>;
    115 - pinctrl-6 = <&mmc1_pins_sdr104 &mmc1_iodelay_sdr104_rev11_conf>;
    116 vmmc-supply = <&vdd_3v3>;
    117 vqmmc-supply = <&ldo1_reg>;
    118 };
    119 diff --git a/arch/arm/boot/dts/am57xx-beagle-x15-revc.dts b/arch/arm/boot/dts/am57xx-beagle-x15-revc.dts
    120 index 17c41da3b55f..ccd99160bbdf 100644
    121 --- a/arch/arm/boot/dts/am57xx-beagle-x15-revc.dts
    122 +++ b/arch/arm/boot/dts/am57xx-beagle-x15-revc.dts
    123 @@ -19,14 +19,9 @@
    124 };
    125
    126 &mmc1 {
    127 - pinctrl-names = "default", "hs", "sdr12", "sdr25", "sdr50", "ddr50", "sdr104";
    128 + pinctrl-names = "default", "hs";
    129 pinctrl-0 = <&mmc1_pins_default>;
    130 pinctrl-1 = <&mmc1_pins_hs>;
    131 - pinctrl-2 = <&mmc1_pins_sdr12>;
    132 - pinctrl-3 = <&mmc1_pins_sdr25>;
    133 - pinctrl-4 = <&mmc1_pins_sdr50>;
    134 - pinctrl-5 = <&mmc1_pins_ddr50 &mmc1_iodelay_ddr_rev20_conf>;
    135 - pinctrl-6 = <&mmc1_pins_sdr104 &mmc1_iodelay_sdr104_rev20_conf>;
    136 vmmc-supply = <&vdd_3v3>;
    137 vqmmc-supply = <&ldo1_reg>;
    138 };
    139 diff --git a/arch/arm/boot/dts/dra74x-mmc-iodelay.dtsi b/arch/arm/boot/dts/dra74x-mmc-iodelay.dtsi
    140 index 28ebb4eb884a..214b9e6de2c3 100644
    141 --- a/arch/arm/boot/dts/dra74x-mmc-iodelay.dtsi
    142 +++ b/arch/arm/boot/dts/dra74x-mmc-iodelay.dtsi
    143 @@ -32,7 +32,7 @@
    144 *
    145 * Datamanual Revisions:
    146 *
    147 - * AM572x Silicon Revision 2.0: SPRS953B, Revised November 2016
    148 + * AM572x Silicon Revision 2.0: SPRS953F, Revised May 2019
    149 * AM572x Silicon Revision 1.1: SPRS915R, Revised November 2016
    150 *
    151 */
    152 @@ -229,45 +229,45 @@
    153
    154 mmc3_pins_default: mmc3_pins_default {
    155 pinctrl-single,pins = <
    156 - DRA7XX_CORE_IOPAD(0x377c, (PIN_INPUT_PULLUP | MUX_MODE0)) /* mmc3_clk.mmc3_clk */
    157 - DRA7XX_CORE_IOPAD(0x3780, (PIN_INPUT_PULLUP | MUX_MODE0)) /* mmc3_cmd.mmc3_cmd */
    158 - DRA7XX_CORE_IOPAD(0x3784, (PIN_INPUT_PULLUP | MUX_MODE0)) /* mmc3_dat0.mmc3_dat0 */
    159 - DRA7XX_CORE_IOPAD(0x3788, (PIN_INPUT_PULLUP | MUX_MODE0)) /* mmc3_dat1.mmc3_dat1 */
    160 - DRA7XX_CORE_IOPAD(0x378c, (PIN_INPUT_PULLUP | MUX_MODE0)) /* mmc3_dat2.mmc3_dat2 */
    161 - DRA7XX_CORE_IOPAD(0x3790, (PIN_INPUT_PULLUP | MUX_MODE0)) /* mmc3_dat3.mmc3_dat3 */
    162 + DRA7XX_CORE_IOPAD(0x377c, (PIN_INPUT_PULLUP | MODE_SELECT | MUX_MODE0)) /* mmc3_clk.mmc3_clk */
    163 + DRA7XX_CORE_IOPAD(0x3780, (PIN_INPUT_PULLUP | MODE_SELECT | MUX_MODE0)) /* mmc3_cmd.mmc3_cmd */
    164 + DRA7XX_CORE_IOPAD(0x3784, (PIN_INPUT_PULLUP | MODE_SELECT | MUX_MODE0)) /* mmc3_dat0.mmc3_dat0 */
    165 + DRA7XX_CORE_IOPAD(0x3788, (PIN_INPUT_PULLUP | MODE_SELECT | MUX_MODE0)) /* mmc3_dat1.mmc3_dat1 */
    166 + DRA7XX_CORE_IOPAD(0x378c, (PIN_INPUT_PULLUP | MODE_SELECT | MUX_MODE0)) /* mmc3_dat2.mmc3_dat2 */
    167 + DRA7XX_CORE_IOPAD(0x3790, (PIN_INPUT_PULLUP | MODE_SELECT | MUX_MODE0)) /* mmc3_dat3.mmc3_dat3 */
    168 >;
    169 };
    170
    171 mmc3_pins_hs: mmc3_pins_hs {
    172 pinctrl-single,pins = <
    173 - DRA7XX_CORE_IOPAD(0x377c, (PIN_INPUT_PULLUP | MUX_MODE0)) /* mmc3_clk.mmc3_clk */
    174 - DRA7XX_CORE_IOPAD(0x3780, (PIN_INPUT_PULLUP | MUX_MODE0)) /* mmc3_cmd.mmc3_cmd */
    175 - DRA7XX_CORE_IOPAD(0x3784, (PIN_INPUT_PULLUP | MUX_MODE0)) /* mmc3_dat0.mmc3_dat0 */
    176 - DRA7XX_CORE_IOPAD(0x3788, (PIN_INPUT_PULLUP | MUX_MODE0)) /* mmc3_dat1.mmc3_dat1 */
    177 - DRA7XX_CORE_IOPAD(0x378c, (PIN_INPUT_PULLUP | MUX_MODE0)) /* mmc3_dat2.mmc3_dat2 */
    178 - DRA7XX_CORE_IOPAD(0x3790, (PIN_INPUT_PULLUP | MUX_MODE0)) /* mmc3_dat3.mmc3_dat3 */
    179 + DRA7XX_CORE_IOPAD(0x377c, (PIN_INPUT_PULLUP | MODE_SELECT | MUX_MODE0)) /* mmc3_clk.mmc3_clk */
    180 + DRA7XX_CORE_IOPAD(0x3780, (PIN_INPUT_PULLUP | MODE_SELECT | MUX_MODE0)) /* mmc3_cmd.mmc3_cmd */
    181 + DRA7XX_CORE_IOPAD(0x3784, (PIN_INPUT_PULLUP | MODE_SELECT | MUX_MODE0)) /* mmc3_dat0.mmc3_dat0 */
    182 + DRA7XX_CORE_IOPAD(0x3788, (PIN_INPUT_PULLUP | MODE_SELECT | MUX_MODE0)) /* mmc3_dat1.mmc3_dat1 */
    183 + DRA7XX_CORE_IOPAD(0x378c, (PIN_INPUT_PULLUP | MODE_SELECT | MUX_MODE0)) /* mmc3_dat2.mmc3_dat2 */
    184 + DRA7XX_CORE_IOPAD(0x3790, (PIN_INPUT_PULLUP | MODE_SELECT | MUX_MODE0)) /* mmc3_dat3.mmc3_dat3 */
    185 >;
    186 };
    187
    188 mmc3_pins_sdr12: mmc3_pins_sdr12 {
    189 pinctrl-single,pins = <
    190 - DRA7XX_CORE_IOPAD(0x377c, (PIN_INPUT_PULLUP | MUX_MODE0)) /* mmc3_clk.mmc3_clk */
    191 - DRA7XX_CORE_IOPAD(0x3780, (PIN_INPUT_PULLUP | MUX_MODE0)) /* mmc3_cmd.mmc3_cmd */
    192 - DRA7XX_CORE_IOPAD(0x3784, (PIN_INPUT_PULLUP | MUX_MODE0)) /* mmc3_dat0.mmc3_dat0 */
    193 - DRA7XX_CORE_IOPAD(0x3788, (PIN_INPUT_PULLUP | MUX_MODE0)) /* mmc3_dat1.mmc3_dat1 */
    194 - DRA7XX_CORE_IOPAD(0x378c, (PIN_INPUT_PULLUP | MUX_MODE0)) /* mmc3_dat2.mmc3_dat2 */
    195 - DRA7XX_CORE_IOPAD(0x3790, (PIN_INPUT_PULLUP | MUX_MODE0)) /* mmc3_dat3.mmc3_dat3 */
    196 + DRA7XX_CORE_IOPAD(0x377c, (PIN_INPUT_PULLUP | MODE_SELECT | MUX_MODE0)) /* mmc3_clk.mmc3_clk */
    197 + DRA7XX_CORE_IOPAD(0x3780, (PIN_INPUT_PULLUP | MODE_SELECT | MUX_MODE0)) /* mmc3_cmd.mmc3_cmd */
    198 + DRA7XX_CORE_IOPAD(0x3784, (PIN_INPUT_PULLUP | MODE_SELECT | MUX_MODE0)) /* mmc3_dat0.mmc3_dat0 */
    199 + DRA7XX_CORE_IOPAD(0x3788, (PIN_INPUT_PULLUP | MODE_SELECT | MUX_MODE0)) /* mmc3_dat1.mmc3_dat1 */
    200 + DRA7XX_CORE_IOPAD(0x378c, (PIN_INPUT_PULLUP | MODE_SELECT | MUX_MODE0)) /* mmc3_dat2.mmc3_dat2 */
    201 + DRA7XX_CORE_IOPAD(0x3790, (PIN_INPUT_PULLUP | MODE_SELECT | MUX_MODE0)) /* mmc3_dat3.mmc3_dat3 */
    202 >;
    203 };
    204
    205 mmc3_pins_sdr25: mmc3_pins_sdr25 {
    206 pinctrl-single,pins = <
    207 - DRA7XX_CORE_IOPAD(0x377c, (PIN_INPUT_PULLUP | MUX_MODE0)) /* mmc3_clk.mmc3_clk */
    208 - DRA7XX_CORE_IOPAD(0x3780, (PIN_INPUT_PULLUP | MUX_MODE0)) /* mmc3_cmd.mmc3_cmd */
    209 - DRA7XX_CORE_IOPAD(0x3784, (PIN_INPUT_PULLUP | MUX_MODE0)) /* mmc3_dat0.mmc3_dat0 */
    210 - DRA7XX_CORE_IOPAD(0x3788, (PIN_INPUT_PULLUP | MUX_MODE0)) /* mmc3_dat1.mmc3_dat1 */
    211 - DRA7XX_CORE_IOPAD(0x378c, (PIN_INPUT_PULLUP | MUX_MODE0)) /* mmc3_dat2.mmc3_dat2 */
    212 - DRA7XX_CORE_IOPAD(0x3790, (PIN_INPUT_PULLUP | MUX_MODE0)) /* mmc3_dat3.mmc3_dat3 */
    213 + DRA7XX_CORE_IOPAD(0x377c, (PIN_INPUT_PULLUP | MODE_SELECT | MUX_MODE0)) /* mmc3_clk.mmc3_clk */
    214 + DRA7XX_CORE_IOPAD(0x3780, (PIN_INPUT_PULLUP | MODE_SELECT | MUX_MODE0)) /* mmc3_cmd.mmc3_cmd */
    215 + DRA7XX_CORE_IOPAD(0x3784, (PIN_INPUT_PULLUP | MODE_SELECT | MUX_MODE0)) /* mmc3_dat0.mmc3_dat0 */
    216 + DRA7XX_CORE_IOPAD(0x3788, (PIN_INPUT_PULLUP | MODE_SELECT | MUX_MODE0)) /* mmc3_dat1.mmc3_dat1 */
    217 + DRA7XX_CORE_IOPAD(0x378c, (PIN_INPUT_PULLUP | MODE_SELECT | MUX_MODE0)) /* mmc3_dat2.mmc3_dat2 */
    218 + DRA7XX_CORE_IOPAD(0x3790, (PIN_INPUT_PULLUP | MODE_SELECT | MUX_MODE0)) /* mmc3_dat3.mmc3_dat3 */
    219 >;
    220 };
    221
    222 diff --git a/arch/arm/mach-omap1/ams-delta-fiq-handler.S b/arch/arm/mach-omap1/ams-delta-fiq-handler.S
    223 index ddc27638ba2a..017c792be0a0 100644
    224 --- a/arch/arm/mach-omap1/ams-delta-fiq-handler.S
    225 +++ b/arch/arm/mach-omap1/ams-delta-fiq-handler.S
    226 @@ -135,6 +135,8 @@ restart:
    227 orr r11, r11, r13 @ mask all requested interrupts
    228 str r11, [r12, #OMAP1510_GPIO_INT_MASK]
    229
    230 + str r13, [r12, #OMAP1510_GPIO_INT_STATUS] @ ack all requested interrupts
    231 +
    232 ands r10, r13, #KEYBRD_CLK_MASK @ extract keyboard status - set?
    233 beq hksw @ no - try next source
    234
    235 @@ -142,7 +144,6 @@ restart:
    236 @@@@@@@@@@@@@@@@@@@@@@
    237 @ Keyboard clock FIQ mode interrupt handler
    238 @ r10 now contains KEYBRD_CLK_MASK, use it
    239 - str r10, [r12, #OMAP1510_GPIO_INT_STATUS] @ ack the interrupt
    240 bic r11, r11, r10 @ unmask it
    241 str r11, [r12, #OMAP1510_GPIO_INT_MASK]
    242
    243 diff --git a/arch/arm/mach-omap1/ams-delta-fiq.c b/arch/arm/mach-omap1/ams-delta-fiq.c
    244 index b0dc7ddf5877..b8ba763fe108 100644
    245 --- a/arch/arm/mach-omap1/ams-delta-fiq.c
    246 +++ b/arch/arm/mach-omap1/ams-delta-fiq.c
    247 @@ -73,9 +73,7 @@ static irqreturn_t deferred_fiq(int irq, void *dev_id)
    248 * interrupts default to since commit 80ac93c27441
    249 * requires interrupt already acked and unmasked.
    250 */
    251 - if (irq_chip->irq_ack)
    252 - irq_chip->irq_ack(d);
    253 - if (irq_chip->irq_unmask)
    254 + if (!WARN_ON_ONCE(!irq_chip->irq_unmask))
    255 irq_chip->irq_unmask(d);
    256 }
    257 for (; irq_counter[gpio] < fiq_count; irq_counter[gpio]++)
    258 diff --git a/arch/arm/mach-omap2/omap4-common.c b/arch/arm/mach-omap2/omap4-common.c
    259 index b226c8aaf8b1..7074cfd1ff41 100644
    260 --- a/arch/arm/mach-omap2/omap4-common.c
    261 +++ b/arch/arm/mach-omap2/omap4-common.c
    262 @@ -131,6 +131,9 @@ static int __init omap4_sram_init(void)
    263 struct device_node *np;
    264 struct gen_pool *sram_pool;
    265
    266 + if (!soc_is_omap44xx() && !soc_is_omap54xx())
    267 + return 0;
    268 +
    269 np = of_find_compatible_node(NULL, NULL, "ti,omap4-mpu");
    270 if (!np)
    271 pr_warn("%s:Unable to allocate sram needed to handle errata I688\n",
    272 diff --git a/arch/arm/mach-omap2/omap_hwmod_7xx_data.c b/arch/arm/mach-omap2/omap_hwmod_7xx_data.c
    273 index e6c7061a8e73..3547f32822b6 100644
    274 --- a/arch/arm/mach-omap2/omap_hwmod_7xx_data.c
    275 +++ b/arch/arm/mach-omap2/omap_hwmod_7xx_data.c
    276 @@ -385,7 +385,8 @@ static struct omap_hwmod dra7xx_dcan2_hwmod = {
    277 static struct omap_hwmod_class_sysconfig dra7xx_epwmss_sysc = {
    278 .rev_offs = 0x0,
    279 .sysc_offs = 0x4,
    280 - .sysc_flags = SYSC_HAS_SIDLEMODE | SYSC_HAS_SOFTRESET,
    281 + .sysc_flags = SYSC_HAS_SIDLEMODE | SYSC_HAS_SOFTRESET |
    282 + SYSC_HAS_RESET_STATUS,
    283 .idlemodes = (SIDLE_FORCE | SIDLE_NO | SIDLE_SMART),
    284 .sysc_fields = &omap_hwmod_sysc_type2,
    285 };
    286 diff --git a/arch/arm/mm/init.c b/arch/arm/mm/init.c
    287 index 0cc8e04295a4..e1d330a26921 100644
    288 --- a/arch/arm/mm/init.c
    289 +++ b/arch/arm/mm/init.c
    290 @@ -196,6 +196,11 @@ static void __init zone_sizes_init(unsigned long min, unsigned long max_low,
    291 #ifdef CONFIG_HAVE_ARCH_PFN_VALID
    292 int pfn_valid(unsigned long pfn)
    293 {
    294 + phys_addr_t addr = __pfn_to_phys(pfn);
    295 +
    296 + if (__phys_to_pfn(addr) != pfn)
    297 + return 0;
    298 +
    299 return memblock_is_map_memory(__pfn_to_phys(pfn));
    300 }
    301 EXPORT_SYMBOL(pfn_valid);
    302 @@ -713,7 +718,8 @@ static void update_sections_early(struct section_perm perms[], int n)
    303 if (t->flags & PF_KTHREAD)
    304 continue;
    305 for_each_thread(t, s)
    306 - set_section_perms(perms, n, true, s->mm);
    307 + if (s->mm)
    308 + set_section_perms(perms, n, true, s->mm);
    309 }
    310 set_section_perms(perms, n, true, current->active_mm);
    311 set_section_perms(perms, n, true, &init_mm);
    312 diff --git a/arch/arm64/kernel/cpufeature.c b/arch/arm64/kernel/cpufeature.c
    313 index 94babc3d0ec2..859d63cc99a3 100644
    314 --- a/arch/arm64/kernel/cpufeature.c
    315 +++ b/arch/arm64/kernel/cpufeature.c
    316 @@ -895,6 +895,12 @@ static bool unmap_kernel_at_el0(const struct arm64_cpu_capabilities *entry,
    317 static const struct midr_range kpti_safe_list[] = {
    318 MIDR_ALL_VERSIONS(MIDR_CAVIUM_THUNDERX2),
    319 MIDR_ALL_VERSIONS(MIDR_BRCM_VULCAN),
    320 + MIDR_ALL_VERSIONS(MIDR_CORTEX_A35),
    321 + MIDR_ALL_VERSIONS(MIDR_CORTEX_A53),
    322 + MIDR_ALL_VERSIONS(MIDR_CORTEX_A55),
    323 + MIDR_ALL_VERSIONS(MIDR_CORTEX_A57),
    324 + MIDR_ALL_VERSIONS(MIDR_CORTEX_A72),
    325 + MIDR_ALL_VERSIONS(MIDR_CORTEX_A73),
    326 { /* sentinel */ }
    327 };
    328 char const *str = "command line option";
    329 diff --git a/arch/powerpc/mm/pgtable-radix.c b/arch/powerpc/mm/pgtable-radix.c
    330 index c879979faa73..3ea4c1f107d7 100644
    331 --- a/arch/powerpc/mm/pgtable-radix.c
    332 +++ b/arch/powerpc/mm/pgtable-radix.c
    333 @@ -521,14 +521,6 @@ void __init radix__early_init_devtree(void)
    334 mmu_psize_defs[MMU_PAGE_64K].shift = 16;
    335 mmu_psize_defs[MMU_PAGE_64K].ap = 0x5;
    336 found:
    337 -#ifdef CONFIG_SPARSEMEM_VMEMMAP
    338 - if (mmu_psize_defs[MMU_PAGE_2M].shift) {
    339 - /*
    340 - * map vmemmap using 2M if available
    341 - */
    342 - mmu_vmemmap_psize = MMU_PAGE_2M;
    343 - }
    344 -#endif /* CONFIG_SPARSEMEM_VMEMMAP */
    345 return;
    346 }
    347
    348 @@ -567,7 +559,13 @@ void __init radix__early_init_mmu(void)
    349
    350 #ifdef CONFIG_SPARSEMEM_VMEMMAP
    351 /* vmemmap mapping */
    352 - mmu_vmemmap_psize = mmu_virtual_psize;
    353 + if (mmu_psize_defs[MMU_PAGE_2M].shift) {
    354 + /*
    355 + * map vmemmap using 2M if available
    356 + */
    357 + mmu_vmemmap_psize = MMU_PAGE_2M;
    358 + } else
    359 + mmu_vmemmap_psize = mmu_virtual_psize;
    360 #endif
    361 /*
    362 * initialize page table size
    363 diff --git a/arch/s390/net/bpf_jit_comp.c b/arch/s390/net/bpf_jit_comp.c
    364 index d7052cbe984f..2617e426c792 100644
    365 --- a/arch/s390/net/bpf_jit_comp.c
    366 +++ b/arch/s390/net/bpf_jit_comp.c
    367 @@ -841,7 +841,7 @@ static noinline int bpf_jit_insn(struct bpf_jit *jit, struct bpf_prog *fp, int i
    368 break;
    369 case BPF_ALU64 | BPF_NEG: /* dst = -dst */
    370 /* lcgr %dst,%dst */
    371 - EMIT4(0xb9130000, dst_reg, dst_reg);
    372 + EMIT4(0xb9030000, dst_reg, dst_reg);
    373 break;
    374 /*
    375 * BPF_FROM_BE/LE
    376 @@ -1015,8 +1015,8 @@ static noinline int bpf_jit_insn(struct bpf_jit *jit, struct bpf_prog *fp, int i
    377 /* llgf %w1,map.max_entries(%b2) */
    378 EMIT6_DISP_LH(0xe3000000, 0x0016, REG_W1, REG_0, BPF_REG_2,
    379 offsetof(struct bpf_array, map.max_entries));
    380 - /* clgrj %b3,%w1,0xa,label0: if %b3 >= %w1 goto out */
    381 - EMIT6_PCREL_LABEL(0xec000000, 0x0065, BPF_REG_3,
    382 + /* clrj %b3,%w1,0xa,label0: if (u32)%b3 >= (u32)%w1 goto out */
    383 + EMIT6_PCREL_LABEL(0xec000000, 0x0077, BPF_REG_3,
    384 REG_W1, 0, 0xa);
    385
    386 /*
    387 @@ -1042,8 +1042,10 @@ static noinline int bpf_jit_insn(struct bpf_jit *jit, struct bpf_prog *fp, int i
    388 * goto out;
    389 */
    390
    391 - /* sllg %r1,%b3,3: %r1 = index * 8 */
    392 - EMIT6_DISP_LH(0xeb000000, 0x000d, REG_1, BPF_REG_3, REG_0, 3);
    393 + /* llgfr %r1,%b3: %r1 = (u32) index */
    394 + EMIT4(0xb9160000, REG_1, BPF_REG_3);
    395 + /* sllg %r1,%r1,3: %r1 *= 8 */
    396 + EMIT6_DISP_LH(0xeb000000, 0x000d, REG_1, REG_1, REG_0, 3);
    397 /* lg %r1,prog(%b2,%r1) */
    398 EMIT6_DISP_LH(0xe3000000, 0x0004, REG_1, BPF_REG_2,
    399 REG_1, offsetof(struct bpf_array, ptrs));
    400 diff --git a/arch/x86/events/amd/ibs.c b/arch/x86/events/amd/ibs.c
    401 index d50bb4dc0650..80c6d84cad67 100644
    402 --- a/arch/x86/events/amd/ibs.c
    403 +++ b/arch/x86/events/amd/ibs.c
    404 @@ -672,10 +672,17 @@ fail:
    405
    406 throttle = perf_event_overflow(event, &data, &regs);
    407 out:
    408 - if (throttle)
    409 + if (throttle) {
    410 perf_ibs_stop(event, 0);
    411 - else
    412 - perf_ibs_enable_event(perf_ibs, hwc, period >> 4);
    413 + } else {
    414 + period >>= 4;
    415 +
    416 + if ((ibs_caps & IBS_CAPS_RDWROPCNT) &&
    417 + (*config & IBS_OP_CNT_CTL))
    418 + period |= *config & IBS_OP_CUR_CNT_RAND;
    419 +
    420 + perf_ibs_enable_event(perf_ibs, hwc, period);
    421 + }
    422
    423 perf_event_update_userpage(event);
    424
    425 diff --git a/arch/x86/events/intel/core.c b/arch/x86/events/intel/core.c
    426 index db5a2ba61753..2dd8b0d64295 100644
    427 --- a/arch/x86/events/intel/core.c
    428 +++ b/arch/x86/events/intel/core.c
    429 @@ -3319,6 +3319,11 @@ static u64 bdw_limit_period(struct perf_event *event, u64 left)
    430 return left;
    431 }
    432
    433 +static u64 nhm_limit_period(struct perf_event *event, u64 left)
    434 +{
    435 + return max(left, 32ULL);
    436 +}
    437 +
    438 PMU_FORMAT_ATTR(event, "config:0-7" );
    439 PMU_FORMAT_ATTR(umask, "config:8-15" );
    440 PMU_FORMAT_ATTR(edge, "config:18" );
    441 @@ -4115,6 +4120,7 @@ __init int intel_pmu_init(void)
    442 x86_pmu.pebs_constraints = intel_nehalem_pebs_event_constraints;
    443 x86_pmu.enable_all = intel_pmu_nhm_enable_all;
    444 x86_pmu.extra_regs = intel_nehalem_extra_regs;
    445 + x86_pmu.limit_period = nhm_limit_period;
    446
    447 x86_pmu.cpu_events = nhm_events_attrs;
    448
    449 diff --git a/arch/x86/hyperv/mmu.c b/arch/x86/hyperv/mmu.c
    450 index ef5f29f913d7..2f34d5275352 100644
    451 --- a/arch/x86/hyperv/mmu.c
    452 +++ b/arch/x86/hyperv/mmu.c
    453 @@ -37,12 +37,14 @@ static inline int fill_gva_list(u64 gva_list[], int offset,
    454 * Lower 12 bits encode the number of additional
    455 * pages to flush (in addition to the 'cur' page).
    456 */
    457 - if (diff >= HV_TLB_FLUSH_UNIT)
    458 + if (diff >= HV_TLB_FLUSH_UNIT) {
    459 gva_list[gva_n] |= ~PAGE_MASK;
    460 - else if (diff)
    461 + cur += HV_TLB_FLUSH_UNIT;
    462 + } else if (diff) {
    463 gva_list[gva_n] |= (diff - 1) >> PAGE_SHIFT;
    464 + cur = end;
    465 + }
    466
    467 - cur += HV_TLB_FLUSH_UNIT;
    468 gva_n++;
    469
    470 } while (cur < end);
    471 diff --git a/arch/x86/include/asm/perf_event.h b/arch/x86/include/asm/perf_event.h
    472 index 78241b736f2a..f6c4915a863e 100644
    473 --- a/arch/x86/include/asm/perf_event.h
    474 +++ b/arch/x86/include/asm/perf_event.h
    475 @@ -209,16 +209,20 @@ struct x86_pmu_capability {
    476 #define IBSCTL_LVT_OFFSET_VALID (1ULL<<8)
    477 #define IBSCTL_LVT_OFFSET_MASK 0x0F
    478
    479 -/* ibs fetch bits/masks */
    480 +/* IBS fetch bits/masks */
    481 #define IBS_FETCH_RAND_EN (1ULL<<57)
    482 #define IBS_FETCH_VAL (1ULL<<49)
    483 #define IBS_FETCH_ENABLE (1ULL<<48)
    484 #define IBS_FETCH_CNT 0xFFFF0000ULL
    485 #define IBS_FETCH_MAX_CNT 0x0000FFFFULL
    486
    487 -/* ibs op bits/masks */
    488 -/* lower 4 bits of the current count are ignored: */
    489 -#define IBS_OP_CUR_CNT (0xFFFF0ULL<<32)
    490 +/*
    491 + * IBS op bits/masks
    492 + * The lower 7 bits of the current count are random bits
    493 + * preloaded by hardware and ignored in software
    494 + */
    495 +#define IBS_OP_CUR_CNT (0xFFF80ULL<<32)
    496 +#define IBS_OP_CUR_CNT_RAND (0x0007FULL<<32)
    497 #define IBS_OP_CNT_CTL (1ULL<<19)
    498 #define IBS_OP_VAL (1ULL<<18)
    499 #define IBS_OP_ENABLE (1ULL<<17)
    500 diff --git a/arch/x86/include/asm/uaccess.h b/arch/x86/include/asm/uaccess.h
    501 index 4111edb3188e..971830341061 100644
    502 --- a/arch/x86/include/asm/uaccess.h
    503 +++ b/arch/x86/include/asm/uaccess.h
    504 @@ -451,8 +451,10 @@ do { \
    505 ({ \
    506 int __gu_err; \
    507 __inttype(*(ptr)) __gu_val; \
    508 + __typeof__(ptr) __gu_ptr = (ptr); \
    509 + __typeof__(size) __gu_size = (size); \
    510 __uaccess_begin_nospec(); \
    511 - __get_user_size(__gu_val, (ptr), (size), __gu_err, -EFAULT); \
    512 + __get_user_size(__gu_val, __gu_ptr, __gu_size, __gu_err, -EFAULT); \
    513 __uaccess_end(); \
    514 (x) = (__force __typeof__(*(ptr)))__gu_val; \
    515 __builtin_expect(__gu_err, 0); \
    516 diff --git a/arch/x86/kernel/apic/io_apic.c b/arch/x86/kernel/apic/io_apic.c
    517 index 4077e309e5c4..ab22eded61d2 100644
    518 --- a/arch/x86/kernel/apic/io_apic.c
    519 +++ b/arch/x86/kernel/apic/io_apic.c
    520 @@ -2432,7 +2432,13 @@ unsigned int arch_dynirq_lower_bound(unsigned int from)
    521 * dmar_alloc_hwirq() may be called before setup_IO_APIC(), so use
    522 * gsi_top if ioapic_dynirq_base hasn't been initialized yet.
    523 */
    524 - return ioapic_initialized ? ioapic_dynirq_base : gsi_top;
    525 + if (!ioapic_initialized)
    526 + return gsi_top;
    527 + /*
    528 + * For DT enabled machines ioapic_dynirq_base is irrelevant and not
    529 + * updated. So simply return @from if ioapic_dynirq_base == 0.
    530 + */
    531 + return ioapic_dynirq_base ? : from;
    532 }
    533
    534 #ifdef CONFIG_X86_32
    535 diff --git a/drivers/atm/Kconfig b/drivers/atm/Kconfig
    536 index 2e2efa577437..8c37294f1d1e 100644
    537 --- a/drivers/atm/Kconfig
    538 +++ b/drivers/atm/Kconfig
    539 @@ -200,7 +200,7 @@ config ATM_NICSTAR_USE_SUNI
    540 make the card work).
    541
    542 config ATM_NICSTAR_USE_IDT77105
    543 - bool "Use IDT77015 PHY driver (25Mbps)"
    544 + bool "Use IDT77105 PHY driver (25Mbps)"
    545 depends on ATM_NICSTAR
    546 help
    547 Support for the PHYsical layer chip in ForeRunner LE25 cards. In
    548 diff --git a/drivers/block/floppy.c b/drivers/block/floppy.c
    549 index 4a9a4d12721a..e71589e244fb 100644
    550 --- a/drivers/block/floppy.c
    551 +++ b/drivers/block/floppy.c
    552 @@ -3791,7 +3791,7 @@ static int compat_getdrvprm(int drive,
    553 v.native_format = UDP->native_format;
    554 mutex_unlock(&floppy_mutex);
    555
    556 - if (copy_from_user(arg, &v, sizeof(struct compat_floppy_drive_params)))
    557 + if (copy_to_user(arg, &v, sizeof(struct compat_floppy_drive_params)))
    558 return -EFAULT;
    559 return 0;
    560 }
    561 @@ -3827,7 +3827,7 @@ static int compat_getdrvstat(int drive, bool poll,
    562 v.bufblocks = UDRS->bufblocks;
    563 mutex_unlock(&floppy_mutex);
    564
    565 - if (copy_from_user(arg, &v, sizeof(struct compat_floppy_drive_struct)))
    566 + if (copy_to_user(arg, &v, sizeof(struct compat_floppy_drive_struct)))
    567 return -EFAULT;
    568 return 0;
    569 Eintr:
    570 diff --git a/drivers/bus/ti-sysc.c b/drivers/bus/ti-sysc.c
    571 index e4fe954e63a9..e95b26319cd9 100644
    572 --- a/drivers/bus/ti-sysc.c
    573 +++ b/drivers/bus/ti-sysc.c
    574 @@ -1022,10 +1022,7 @@ static int sysc_init_sysc_mask(struct sysc *ddata)
    575 if (error)
    576 return 0;
    577
    578 - if (val)
    579 - ddata->cfg.sysc_val = val & ddata->cap->sysc_mask;
    580 - else
    581 - ddata->cfg.sysc_val = ddata->cap->sysc_mask;
    582 + ddata->cfg.sysc_val = val & ddata->cap->sysc_mask;
    583
    584 return 0;
    585 }
    586 @@ -1688,7 +1685,7 @@ static int sysc_probe(struct platform_device *pdev)
    587
    588 error = sysc_init_dts_quirks(ddata);
    589 if (error)
    590 - goto unprepare;
    591 + return error;
    592
    593 error = sysc_get_clocks(ddata);
    594 if (error)
    595 @@ -1696,27 +1693,27 @@ static int sysc_probe(struct platform_device *pdev)
    596
    597 error = sysc_map_and_check_registers(ddata);
    598 if (error)
    599 - goto unprepare;
    600 + return error;
    601
    602 error = sysc_init_sysc_mask(ddata);
    603 if (error)
    604 - goto unprepare;
    605 + return error;
    606
    607 error = sysc_init_idlemodes(ddata);
    608 if (error)
    609 - goto unprepare;
    610 + return error;
    611
    612 error = sysc_init_syss_mask(ddata);
    613 if (error)
    614 - goto unprepare;
    615 + return error;
    616
    617 error = sysc_init_pdata(ddata);
    618 if (error)
    619 - goto unprepare;
    620 + return error;
    621
    622 error = sysc_init_resets(ddata);
    623 if (error)
    624 - return error;
    625 + goto unprepare;
    626
    627 pm_runtime_enable(ddata->dev);
    628 error = sysc_init_module(ddata);
    629 diff --git a/drivers/dma/ti/dma-crossbar.c b/drivers/dma/ti/dma-crossbar.c
    630 index 9272b173c746..6574cb5a12fe 100644
    631 --- a/drivers/dma/ti/dma-crossbar.c
    632 +++ b/drivers/dma/ti/dma-crossbar.c
    633 @@ -395,8 +395,10 @@ static int ti_dra7_xbar_probe(struct platform_device *pdev)
    634
    635 ret = of_property_read_u32_array(node, pname, (u32 *)rsv_events,
    636 nelm * 2);
    637 - if (ret)
    638 + if (ret) {
    639 + kfree(rsv_events);
    640 return ret;
    641 + }
    642
    643 for (i = 0; i < nelm; i++) {
    644 ti_dra7_xbar_reserve(rsv_events[i][0], rsv_events[i][1],
    645 diff --git a/drivers/dma/ti/omap-dma.c b/drivers/dma/ti/omap-dma.c
    646 index aeb9c29e5255..c192bdc30aae 100644
    647 --- a/drivers/dma/ti/omap-dma.c
    648 +++ b/drivers/dma/ti/omap-dma.c
    649 @@ -1543,8 +1543,10 @@ static int omap_dma_probe(struct platform_device *pdev)
    650
    651 rc = devm_request_irq(&pdev->dev, irq, omap_dma_irq,
    652 IRQF_SHARED, "omap-dma-engine", od);
    653 - if (rc)
    654 + if (rc) {
    655 + omap_dma_free(od);
    656 return rc;
    657 + }
    658 }
    659
    660 if (omap_dma_glbl_read(od, CAPS_0) & CAPS_0_SUPPORT_LL123)
    661 diff --git a/drivers/firmware/google/vpd.c b/drivers/firmware/google/vpd.c
    662 index 1aa67bb5d8c0..ebd3ffc7ca00 100644
    663 --- a/drivers/firmware/google/vpd.c
    664 +++ b/drivers/firmware/google/vpd.c
    665 @@ -100,8 +100,8 @@ static int vpd_section_check_key_name(const u8 *key, s32 key_len)
    666 return VPD_OK;
    667 }
    668
    669 -static int vpd_section_attrib_add(const u8 *key, s32 key_len,
    670 - const u8 *value, s32 value_len,
    671 +static int vpd_section_attrib_add(const u8 *key, u32 key_len,
    672 + const u8 *value, u32 value_len,
    673 void *arg)
    674 {
    675 int ret;
    676 diff --git a/drivers/firmware/google/vpd_decode.c b/drivers/firmware/google/vpd_decode.c
    677 index 943acaa8aa76..e75abe9fa122 100644
    678 --- a/drivers/firmware/google/vpd_decode.c
    679 +++ b/drivers/firmware/google/vpd_decode.c
    680 @@ -19,8 +19,8 @@
    681
    682 #include "vpd_decode.h"
    683
    684 -static int vpd_decode_len(const s32 max_len, const u8 *in,
    685 - s32 *length, s32 *decoded_len)
    686 +static int vpd_decode_len(const u32 max_len, const u8 *in,
    687 + u32 *length, u32 *decoded_len)
    688 {
    689 u8 more;
    690 int i = 0;
    691 @@ -40,18 +40,39 @@ static int vpd_decode_len(const s32 max_len, const u8 *in,
    692 } while (more);
    693
    694 *decoded_len = i;
    695 + return VPD_OK;
    696 +}
    697 +
    698 +static int vpd_decode_entry(const u32 max_len, const u8 *input_buf,
    699 + u32 *_consumed, const u8 **entry, u32 *entry_len)
    700 +{
    701 + u32 decoded_len;
    702 + u32 consumed = *_consumed;
    703 +
    704 + if (vpd_decode_len(max_len - consumed, &input_buf[consumed],
    705 + entry_len, &decoded_len) != VPD_OK)
    706 + return VPD_FAIL;
    707 + if (max_len - consumed < decoded_len)
    708 + return VPD_FAIL;
    709 +
    710 + consumed += decoded_len;
    711 + *entry = input_buf + consumed;
    712 +
    713 + /* entry_len is untrusted data and must be checked again. */
    714 + if (max_len - consumed < *entry_len)
    715 + return VPD_FAIL;
    716
    717 + consumed += decoded_len;
    718 + *_consumed = consumed;
    719 return VPD_OK;
    720 }
    721
    722 -int vpd_decode_string(const s32 max_len, const u8 *input_buf, s32 *consumed,
    723 +int vpd_decode_string(const u32 max_len, const u8 *input_buf, u32 *consumed,
    724 vpd_decode_callback callback, void *callback_arg)
    725 {
    726 int type;
    727 - int res;
    728 - s32 key_len;
    729 - s32 value_len;
    730 - s32 decoded_len;
    731 + u32 key_len;
    732 + u32 value_len;
    733 const u8 *key;
    734 const u8 *value;
    735
    736 @@ -66,26 +87,14 @@ int vpd_decode_string(const s32 max_len, const u8 *input_buf, s32 *consumed,
    737 case VPD_TYPE_STRING:
    738 (*consumed)++;
    739
    740 - /* key */
    741 - res = vpd_decode_len(max_len - *consumed, &input_buf[*consumed],
    742 - &key_len, &decoded_len);
    743 - if (res != VPD_OK || *consumed + decoded_len >= max_len)
    744 + if (vpd_decode_entry(max_len, input_buf, consumed, &key,
    745 + &key_len) != VPD_OK)
    746 return VPD_FAIL;
    747
    748 - *consumed += decoded_len;
    749 - key = &input_buf[*consumed];
    750 - *consumed += key_len;
    751 -
    752 - /* value */
    753 - res = vpd_decode_len(max_len - *consumed, &input_buf[*consumed],
    754 - &value_len, &decoded_len);
    755 - if (res != VPD_OK || *consumed + decoded_len > max_len)
    756 + if (vpd_decode_entry(max_len, input_buf, consumed, &value,
    757 + &value_len) != VPD_OK)
    758 return VPD_FAIL;
    759
    760 - *consumed += decoded_len;
    761 - value = &input_buf[*consumed];
    762 - *consumed += value_len;
    763 -
    764 if (type == VPD_TYPE_STRING)
    765 return callback(key, key_len, value, value_len,
    766 callback_arg);
    767 diff --git a/drivers/firmware/google/vpd_decode.h b/drivers/firmware/google/vpd_decode.h
    768 index be3d62c5ca2f..e921456b8e78 100644
    769 --- a/drivers/firmware/google/vpd_decode.h
    770 +++ b/drivers/firmware/google/vpd_decode.h
    771 @@ -33,8 +33,8 @@ enum {
    772 };
    773
    774 /* Callback for vpd_decode_string to invoke. */
    775 -typedef int vpd_decode_callback(const u8 *key, s32 key_len,
    776 - const u8 *value, s32 value_len,
    777 +typedef int vpd_decode_callback(const u8 *key, u32 key_len,
    778 + const u8 *value, u32 value_len,
    779 void *arg);
    780
    781 /*
    782 @@ -52,7 +52,7 @@ typedef int vpd_decode_callback(const u8 *key, s32 key_len,
    783 * If one entry is successfully decoded, sends it to callback and returns the
    784 * result.
    785 */
    786 -int vpd_decode_string(const s32 max_len, const u8 *input_buf, s32 *consumed,
    787 +int vpd_decode_string(const u32 max_len, const u8 *input_buf, u32 *consumed,
    788 vpd_decode_callback callback, void *callback_arg);
    789
    790 #endif /* __VPD_DECODE_H */
    791 diff --git a/drivers/fpga/altera-ps-spi.c b/drivers/fpga/altera-ps-spi.c
    792 index 24b25c626036..4925cae7dcdd 100644
    793 --- a/drivers/fpga/altera-ps-spi.c
    794 +++ b/drivers/fpga/altera-ps-spi.c
    795 @@ -207,7 +207,7 @@ static int altera_ps_write_complete(struct fpga_manager *mgr,
    796 return -EIO;
    797 }
    798
    799 - if (!IS_ERR(conf->confd)) {
    800 + if (conf->confd) {
    801 if (!gpiod_get_raw_value_cansleep(conf->confd)) {
    802 dev_err(&mgr->dev, "CONF_DONE is inactive!\n");
    803 return -EIO;
    804 @@ -265,10 +265,13 @@ static int altera_ps_probe(struct spi_device *spi)
    805 return PTR_ERR(conf->status);
    806 }
    807
    808 - conf->confd = devm_gpiod_get(&spi->dev, "confd", GPIOD_IN);
    809 + conf->confd = devm_gpiod_get_optional(&spi->dev, "confd", GPIOD_IN);
    810 if (IS_ERR(conf->confd)) {
    811 - dev_warn(&spi->dev, "Not using confd gpio: %ld\n",
    812 - PTR_ERR(conf->confd));
    813 + dev_err(&spi->dev, "Failed to get confd gpio: %ld\n",
    814 + PTR_ERR(conf->confd));
    815 + return PTR_ERR(conf->confd);
    816 + } else if (!conf->confd) {
    817 + dev_warn(&spi->dev, "Not using confd gpio");
    818 }
    819
    820 /* Register manager with unique name */
    821 diff --git a/drivers/hid/wacom_sys.c b/drivers/hid/wacom_sys.c
    822 index 9cd4705b74bd..5a2d5140c1f4 100644
    823 --- a/drivers/hid/wacom_sys.c
    824 +++ b/drivers/hid/wacom_sys.c
    825 @@ -282,14 +282,16 @@ static void wacom_feature_mapping(struct hid_device *hdev,
    826 /* leave touch_max as is if predefined */
    827 if (!features->touch_max) {
    828 /* read manually */
    829 - data = kzalloc(2, GFP_KERNEL);
    830 + n = hid_report_len(field->report);
    831 + data = hid_alloc_report_buf(field->report, GFP_KERNEL);
    832 if (!data)
    833 break;
    834 data[0] = field->report->id;
    835 ret = wacom_get_report(hdev, HID_FEATURE_REPORT,
    836 - data, 2, WAC_CMD_RETRIES);
    837 - if (ret == 2) {
    838 - features->touch_max = data[1];
    839 + data, n, WAC_CMD_RETRIES);
    840 + if (ret == n) {
    841 + ret = hid_report_raw_event(hdev,
    842 + HID_FEATURE_REPORT, data, n, 0);
    843 } else {
    844 features->touch_max = 16;
    845 hid_warn(hdev, "wacom_feature_mapping: "
    846 diff --git a/drivers/hid/wacom_wac.c b/drivers/hid/wacom_wac.c
    847 index 50ef7b6cd195..6f5c838f9d47 100644
    848 --- a/drivers/hid/wacom_wac.c
    849 +++ b/drivers/hid/wacom_wac.c
    850 @@ -2533,6 +2533,7 @@ static void wacom_wac_finger_event(struct hid_device *hdev,
    851 struct wacom *wacom = hid_get_drvdata(hdev);
    852 struct wacom_wac *wacom_wac = &wacom->wacom_wac;
    853 unsigned equivalent_usage = wacom_equivalent_usage(usage->hid);
    854 + struct wacom_features *features = &wacom->wacom_wac.features;
    855
    856 switch (equivalent_usage) {
    857 case HID_GD_X:
    858 @@ -2553,6 +2554,9 @@ static void wacom_wac_finger_event(struct hid_device *hdev,
    859 case HID_DG_TIPSWITCH:
    860 wacom_wac->hid_data.tipswitch = value;
    861 break;
    862 + case HID_DG_CONTACTMAX:
    863 + features->touch_max = value;
    864 + return;
    865 }
    866
    867
    868 diff --git a/drivers/i2c/busses/i2c-designware-slave.c b/drivers/i2c/busses/i2c-designware-slave.c
    869 index e7f9305b2dd9..f5f001738df5 100644
    870 --- a/drivers/i2c/busses/i2c-designware-slave.c
    871 +++ b/drivers/i2c/busses/i2c-designware-slave.c
    872 @@ -94,6 +94,7 @@ static int i2c_dw_unreg_slave(struct i2c_client *slave)
    873
    874 dev->disable_int(dev);
    875 dev->disable(dev);
    876 + synchronize_irq(dev->irq);
    877 dev->slave = NULL;
    878 pm_runtime_put(dev->dev);
    879
    880 diff --git a/drivers/infiniband/core/cma.c b/drivers/infiniband/core/cma.c
    881 index 39dc7be56884..6257be21cbed 100644
    882 --- a/drivers/infiniband/core/cma.c
    883 +++ b/drivers/infiniband/core/cma.c
    884 @@ -1723,8 +1723,8 @@ void rdma_destroy_id(struct rdma_cm_id *id)
    885 mutex_lock(&id_priv->handler_mutex);
    886 mutex_unlock(&id_priv->handler_mutex);
    887
    888 + rdma_restrack_del(&id_priv->res);
    889 if (id_priv->cma_dev) {
    890 - rdma_restrack_del(&id_priv->res);
    891 if (rdma_cap_ib_cm(id_priv->id.device, 1)) {
    892 if (id_priv->cm_id.ib)
    893 ib_destroy_cm_id(id_priv->cm_id.ib);
    894 @@ -3463,10 +3463,9 @@ int rdma_bind_addr(struct rdma_cm_id *id, struct sockaddr *addr)
    895
    896 return 0;
    897 err2:
    898 - if (id_priv->cma_dev) {
    899 - rdma_restrack_del(&id_priv->res);
    900 + rdma_restrack_del(&id_priv->res);
    901 + if (id_priv->cma_dev)
    902 cma_release_dev(id_priv);
    903 - }
    904 err1:
    905 cma_comp_exch(id_priv, RDMA_CM_ADDR_BOUND, RDMA_CM_IDLE);
    906 return ret;
    907 diff --git a/drivers/infiniband/core/restrack.c b/drivers/infiniband/core/restrack.c
    908 index 3b7fa0ccaa08..f67fa24b3aff 100644
    909 --- a/drivers/infiniband/core/restrack.c
    910 +++ b/drivers/infiniband/core/restrack.c
    911 @@ -209,7 +209,7 @@ void rdma_restrack_del(struct rdma_restrack_entry *res)
    912 struct ib_device *dev;
    913
    914 if (!res->valid)
    915 - return;
    916 + goto out;
    917
    918 dev = res_to_dev(res);
    919 if (!dev)
    920 @@ -222,8 +222,10 @@ void rdma_restrack_del(struct rdma_restrack_entry *res)
    921 down_write(&dev->res.rwsem);
    922 hash_del(&res->node);
    923 res->valid = false;
    924 + up_write(&dev->res.rwsem);
    925 +
    926 +out:
    927 if (res->task)
    928 put_task_struct(res->task);
    929 - up_write(&dev->res.rwsem);
    930 }
    931 EXPORT_SYMBOL(rdma_restrack_del);
    932 diff --git a/drivers/input/mouse/elan_i2c_core.c b/drivers/input/mouse/elan_i2c_core.c
    933 index f9525d6f0bfe..ae012639ae1d 100644
    934 --- a/drivers/input/mouse/elan_i2c_core.c
    935 +++ b/drivers/input/mouse/elan_i2c_core.c
    936 @@ -1358,7 +1358,7 @@ static const struct acpi_device_id elan_acpi_id[] = {
    937 { "ELAN0618", 0 },
    938 { "ELAN0619", 0 },
    939 { "ELAN061A", 0 },
    940 - { "ELAN061B", 0 },
    941 +/* { "ELAN061B", 0 }, not working on the Lenovo Legion Y7000 */
    942 { "ELAN061C", 0 },
    943 { "ELAN061D", 0 },
    944 { "ELAN061E", 0 },
    945 diff --git a/drivers/iommu/amd_iommu.c b/drivers/iommu/amd_iommu.c
    946 index 8d9920ff4134..69c269dc4f1b 100644
    947 --- a/drivers/iommu/amd_iommu.c
    948 +++ b/drivers/iommu/amd_iommu.c
    949 @@ -1153,6 +1153,17 @@ static void amd_iommu_flush_tlb_all(struct amd_iommu *iommu)
    950 iommu_completion_wait(iommu);
    951 }
    952
    953 +static void amd_iommu_flush_tlb_domid(struct amd_iommu *iommu, u32 dom_id)
    954 +{
    955 + struct iommu_cmd cmd;
    956 +
    957 + build_inv_iommu_pages(&cmd, 0, CMD_INV_IOMMU_ALL_PAGES_ADDRESS,
    958 + dom_id, 1);
    959 + iommu_queue_command(iommu, &cmd);
    960 +
    961 + iommu_completion_wait(iommu);
    962 +}
    963 +
    964 static void amd_iommu_flush_all(struct amd_iommu *iommu)
    965 {
    966 struct iommu_cmd cmd;
    967 @@ -1329,18 +1340,21 @@ static void domain_flush_devices(struct protection_domain *domain)
    968 * another level increases the size of the address space by 9 bits to a size up
    969 * to 64 bits.
    970 */
    971 -static bool increase_address_space(struct protection_domain *domain,
    972 +static void increase_address_space(struct protection_domain *domain,
    973 gfp_t gfp)
    974 {
    975 + unsigned long flags;
    976 u64 *pte;
    977
    978 - if (domain->mode == PAGE_MODE_6_LEVEL)
    979 + spin_lock_irqsave(&domain->lock, flags);
    980 +
    981 + if (WARN_ON_ONCE(domain->mode == PAGE_MODE_6_LEVEL))
    982 /* address space already 64 bit large */
    983 - return false;
    984 + goto out;
    985
    986 pte = (void *)get_zeroed_page(gfp);
    987 if (!pte)
    988 - return false;
    989 + goto out;
    990
    991 *pte = PM_LEVEL_PDE(domain->mode,
    992 iommu_virt_to_phys(domain->pt_root));
    993 @@ -1348,7 +1362,10 @@ static bool increase_address_space(struct protection_domain *domain,
    994 domain->mode += 1;
    995 domain->updated = true;
    996
    997 - return true;
    998 +out:
    999 + spin_unlock_irqrestore(&domain->lock, flags);
    1000 +
    1001 + return;
    1002 }
    1003
    1004 static u64 *alloc_pte(struct protection_domain *domain,
    1005 @@ -1838,6 +1855,7 @@ static void set_dte_entry(u16 devid, struct protection_domain *domain,
    1006 {
    1007 u64 pte_root = 0;
    1008 u64 flags = 0;
    1009 + u32 old_domid;
    1010
    1011 if (domain->mode != PAGE_MODE_NONE)
    1012 pte_root = iommu_virt_to_phys(domain->pt_root);
    1013 @@ -1887,8 +1905,20 @@ static void set_dte_entry(u16 devid, struct protection_domain *domain,
    1014 flags &= ~DEV_DOMID_MASK;
    1015 flags |= domain->id;
    1016
    1017 + old_domid = amd_iommu_dev_table[devid].data[1] & DEV_DOMID_MASK;
    1018 amd_iommu_dev_table[devid].data[1] = flags;
    1019 amd_iommu_dev_table[devid].data[0] = pte_root;
    1020 +
    1021 + /*
    1022 + * A kdump kernel might be replacing a domain ID that was copied from
    1023 + * the previous kernel--if so, it needs to flush the translation cache
    1024 + * entries for the old domain ID that is being overwritten
    1025 + */
    1026 + if (old_domid) {
    1027 + struct amd_iommu *iommu = amd_iommu_rlookup_table[devid];
    1028 +
    1029 + amd_iommu_flush_tlb_domid(iommu, old_domid);
    1030 + }
    1031 }
    1032
    1033 static void clear_dte_entry(u16 devid)
    1034 diff --git a/drivers/media/usb/dvb-usb/technisat-usb2.c b/drivers/media/usb/dvb-usb/technisat-usb2.c
    1035 index 18d0f8f5283f..8d8e9f56a8be 100644
    1036 --- a/drivers/media/usb/dvb-usb/technisat-usb2.c
    1037 +++ b/drivers/media/usb/dvb-usb/technisat-usb2.c
    1038 @@ -607,10 +607,9 @@ static int technisat_usb2_frontend_attach(struct dvb_usb_adapter *a)
    1039 static int technisat_usb2_get_ir(struct dvb_usb_device *d)
    1040 {
    1041 struct technisat_usb2_state *state = d->priv;
    1042 - u8 *buf = state->buf;
    1043 - u8 *b;
    1044 - int ret;
    1045 struct ir_raw_event ev;
    1046 + u8 *buf = state->buf;
    1047 + int i, ret;
    1048
    1049 buf[0] = GET_IR_DATA_VENDOR_REQUEST;
    1050 buf[1] = 0x08;
    1051 @@ -646,26 +645,25 @@ unlock:
    1052 return 0; /* no key pressed */
    1053
    1054 /* decoding */
    1055 - b = buf+1;
    1056
    1057 #if 0
    1058 deb_rc("RC: %d ", ret);
    1059 - debug_dump(b, ret, deb_rc);
    1060 + debug_dump(buf + 1, ret, deb_rc);
    1061 #endif
    1062
    1063 ev.pulse = 0;
    1064 - while (1) {
    1065 - ev.pulse = !ev.pulse;
    1066 - ev.duration = (*b * FIRMWARE_CLOCK_DIVISOR * FIRMWARE_CLOCK_TICK) / 1000;
    1067 - ir_raw_event_store(d->rc_dev, &ev);
    1068 -
    1069 - b++;
    1070 - if (*b == 0xff) {
    1071 + for (i = 1; i < ARRAY_SIZE(state->buf); i++) {
    1072 + if (buf[i] == 0xff) {
    1073 ev.pulse = 0;
    1074 ev.duration = 888888*2;
    1075 ir_raw_event_store(d->rc_dev, &ev);
    1076 break;
    1077 }
    1078 +
    1079 + ev.pulse = !ev.pulse;
    1080 + ev.duration = (buf[i] * FIRMWARE_CLOCK_DIVISOR *
    1081 + FIRMWARE_CLOCK_TICK) / 1000;
    1082 + ir_raw_event_store(d->rc_dev, &ev);
    1083 }
    1084
    1085 ir_raw_event_handle(d->rc_dev);
    1086 diff --git a/drivers/media/usb/tm6000/tm6000-dvb.c b/drivers/media/usb/tm6000/tm6000-dvb.c
    1087 index 3a4e545c6037..3db2fd7f5d7c 100644
    1088 --- a/drivers/media/usb/tm6000/tm6000-dvb.c
    1089 +++ b/drivers/media/usb/tm6000/tm6000-dvb.c
    1090 @@ -105,6 +105,7 @@ static void tm6000_urb_received(struct urb *urb)
    1091 printk(KERN_ERR "tm6000: error %s\n", __func__);
    1092 kfree(urb->transfer_buffer);
    1093 usb_free_urb(urb);
    1094 + dev->dvb->bulk_urb = NULL;
    1095 }
    1096 }
    1097 }
    1098 @@ -135,6 +136,7 @@ static int tm6000_start_stream(struct tm6000_core *dev)
    1099 dvb->bulk_urb->transfer_buffer = kzalloc(size, GFP_KERNEL);
    1100 if (!dvb->bulk_urb->transfer_buffer) {
    1101 usb_free_urb(dvb->bulk_urb);
    1102 + dvb->bulk_urb = NULL;
    1103 return -ENOMEM;
    1104 }
    1105
    1106 @@ -161,6 +163,7 @@ static int tm6000_start_stream(struct tm6000_core *dev)
    1107
    1108 kfree(dvb->bulk_urb->transfer_buffer);
    1109 usb_free_urb(dvb->bulk_urb);
    1110 + dvb->bulk_urb = NULL;
    1111 return ret;
    1112 }
    1113
    1114 diff --git a/drivers/net/ethernet/amd/xgbe/xgbe-main.c b/drivers/net/ethernet/amd/xgbe/xgbe-main.c
    1115 index b41f23679a08..7ce9c69e9c44 100644
    1116 --- a/drivers/net/ethernet/amd/xgbe/xgbe-main.c
    1117 +++ b/drivers/net/ethernet/amd/xgbe/xgbe-main.c
    1118 @@ -469,13 +469,19 @@ static int __init xgbe_mod_init(void)
    1119
    1120 ret = xgbe_platform_init();
    1121 if (ret)
    1122 - return ret;
    1123 + goto err_platform_init;
    1124
    1125 ret = xgbe_pci_init();
    1126 if (ret)
    1127 - return ret;
    1128 + goto err_pci_init;
    1129
    1130 return 0;
    1131 +
    1132 +err_pci_init:
    1133 + xgbe_platform_exit();
    1134 +err_platform_init:
    1135 + unregister_netdevice_notifier(&xgbe_netdev_notifier);
    1136 + return ret;
    1137 }
    1138
    1139 static void __exit xgbe_mod_exit(void)
    1140 diff --git a/drivers/net/ethernet/aquantia/atlantic/aq_vec.c b/drivers/net/ethernet/aquantia/atlantic/aq_vec.c
    1141 index d335c334fa56..82582fa54d5d 100644
    1142 --- a/drivers/net/ethernet/aquantia/atlantic/aq_vec.c
    1143 +++ b/drivers/net/ethernet/aquantia/atlantic/aq_vec.c
    1144 @@ -89,6 +89,7 @@ static int aq_vec_poll(struct napi_struct *napi, int budget)
    1145 }
    1146 }
    1147
    1148 +err_exit:
    1149 if (!was_tx_cleaned)
    1150 work_done = budget;
    1151
    1152 @@ -98,7 +99,7 @@ static int aq_vec_poll(struct napi_struct *napi, int budget)
    1153 1U << self->aq_ring_param.vec_idx);
    1154 }
    1155 }
    1156 -err_exit:
    1157 +
    1158 return work_done;
    1159 }
    1160
    1161 diff --git a/drivers/net/ethernet/ibm/ibmvnic.c b/drivers/net/ethernet/ibm/ibmvnic.c
    1162 index 255de7d68cd3..5a57be66a487 100644
    1163 --- a/drivers/net/ethernet/ibm/ibmvnic.c
    1164 +++ b/drivers/net/ethernet/ibm/ibmvnic.c
    1165 @@ -1998,6 +1998,10 @@ static void __ibmvnic_reset(struct work_struct *work)
    1166
    1167 rwi = get_next_rwi(adapter);
    1168 while (rwi) {
    1169 + if (adapter->state == VNIC_REMOVING ||
    1170 + adapter->state == VNIC_REMOVED)
    1171 + goto out;
    1172 +
    1173 if (adapter->force_reset_recovery) {
    1174 adapter->force_reset_recovery = false;
    1175 rc = do_hard_reset(adapter, rwi, reset_state);
    1176 @@ -2022,7 +2026,7 @@ static void __ibmvnic_reset(struct work_struct *work)
    1177 netdev_dbg(adapter->netdev, "Reset failed\n");
    1178 free_all_rwi(adapter);
    1179 }
    1180 -
    1181 +out:
    1182 adapter->resetting = false;
    1183 if (we_lock_rtnl)
    1184 rtnl_unlock();
    1185 diff --git a/drivers/net/ethernet/marvell/sky2.c b/drivers/net/ethernet/marvell/sky2.c
    1186 index 4ade864c8d53..d013f30019b6 100644
    1187 --- a/drivers/net/ethernet/marvell/sky2.c
    1188 +++ b/drivers/net/ethernet/marvell/sky2.c
    1189 @@ -4954,6 +4954,13 @@ static const struct dmi_system_id msi_blacklist[] = {
    1190 DMI_MATCH(DMI_BOARD_NAME, "P6T"),
    1191 },
    1192 },
    1193 + {
    1194 + .ident = "ASUS P6X",
    1195 + .matches = {
    1196 + DMI_MATCH(DMI_BOARD_VENDOR, "ASUSTeK Computer INC."),
    1197 + DMI_MATCH(DMI_BOARD_NAME, "P6X"),
    1198 + },
    1199 + },
    1200 {}
    1201 };
    1202
    1203 diff --git a/drivers/net/ethernet/qlogic/qed/qed_main.c b/drivers/net/ethernet/qlogic/qed/qed_main.c
    1204 index cf3b0e3dc350..637687b766ff 100644
    1205 --- a/drivers/net/ethernet/qlogic/qed/qed_main.c
    1206 +++ b/drivers/net/ethernet/qlogic/qed/qed_main.c
    1207 @@ -1150,7 +1150,7 @@ static int qed_slowpath_start(struct qed_dev *cdev,
    1208 &drv_version);
    1209 if (rc) {
    1210 DP_NOTICE(cdev, "Failed sending drv version command\n");
    1211 - return rc;
    1212 + goto err4;
    1213 }
    1214 }
    1215
    1216 @@ -1158,6 +1158,8 @@ static int qed_slowpath_start(struct qed_dev *cdev,
    1217
    1218 return 0;
    1219
    1220 +err4:
    1221 + qed_ll2_dealloc_if(cdev);
    1222 err3:
    1223 qed_hw_stop(cdev);
    1224 err2:
    1225 diff --git a/drivers/net/ethernet/seeq/sgiseeq.c b/drivers/net/ethernet/seeq/sgiseeq.c
    1226 index 696037d5ac3d..ad557f457b2c 100644
    1227 --- a/drivers/net/ethernet/seeq/sgiseeq.c
    1228 +++ b/drivers/net/ethernet/seeq/sgiseeq.c
    1229 @@ -793,15 +793,16 @@ static int sgiseeq_probe(struct platform_device *pdev)
    1230 printk(KERN_ERR "Sgiseeq: Cannot register net device, "
    1231 "aborting.\n");
    1232 err = -ENODEV;
    1233 - goto err_out_free_page;
    1234 + goto err_out_free_attrs;
    1235 }
    1236
    1237 printk(KERN_INFO "%s: %s %pM\n", dev->name, sgiseeqstr, dev->dev_addr);
    1238
    1239 return 0;
    1240
    1241 -err_out_free_page:
    1242 - free_page((unsigned long) sp->srings);
    1243 +err_out_free_attrs:
    1244 + dma_free_attrs(&pdev->dev, sizeof(*sp->srings), sp->srings,
    1245 + sp->srings_dma, DMA_ATTR_NON_CONSISTENT);
    1246 err_out_free_dev:
    1247 free_netdev(dev);
    1248
    1249 diff --git a/drivers/net/ieee802154/mac802154_hwsim.c b/drivers/net/ieee802154/mac802154_hwsim.c
    1250 index f1ed1744801c..be1f1a86bcd6 100644
    1251 --- a/drivers/net/ieee802154/mac802154_hwsim.c
    1252 +++ b/drivers/net/ieee802154/mac802154_hwsim.c
    1253 @@ -821,7 +821,7 @@ static int hwsim_add_one(struct genl_info *info, struct device *dev,
    1254 err = hwsim_subscribe_all_others(phy);
    1255 if (err < 0) {
    1256 mutex_unlock(&hwsim_phys_lock);
    1257 - goto err_reg;
    1258 + goto err_subscribe;
    1259 }
    1260 }
    1261 list_add_tail(&phy->list, &hwsim_phys);
    1262 @@ -831,6 +831,8 @@ static int hwsim_add_one(struct genl_info *info, struct device *dev,
    1263
    1264 return idx;
    1265
    1266 +err_subscribe:
    1267 + ieee802154_unregister_hw(phy->hw);
    1268 err_reg:
    1269 kfree(pib);
    1270 err_pib:
    1271 @@ -920,9 +922,9 @@ static __init int hwsim_init_module(void)
    1272 return 0;
    1273
    1274 platform_drv:
    1275 - genl_unregister_family(&hwsim_genl_family);
    1276 -platform_dev:
    1277 platform_device_unregister(mac802154hwsim_dev);
    1278 +platform_dev:
    1279 + genl_unregister_family(&hwsim_genl_family);
    1280 return rc;
    1281 }
    1282
    1283 diff --git a/drivers/net/usb/r8152.c b/drivers/net/usb/r8152.c
    1284 index f1b5201cc320..a065a6184f7e 100644
    1285 --- a/drivers/net/usb/r8152.c
    1286 +++ b/drivers/net/usb/r8152.c
    1287 @@ -788,8 +788,11 @@ int get_registers(struct r8152 *tp, u16 value, u16 index, u16 size, void *data)
    1288 ret = usb_control_msg(tp->udev, usb_rcvctrlpipe(tp->udev, 0),
    1289 RTL8152_REQ_GET_REGS, RTL8152_REQT_READ,
    1290 value, index, tmp, size, 500);
    1291 + if (ret < 0)
    1292 + memset(data, 0xff, size);
    1293 + else
    1294 + memcpy(data, tmp, size);
    1295
    1296 - memcpy(data, tmp, size);
    1297 kfree(tmp);
    1298
    1299 return ret;
    1300 diff --git a/drivers/net/wireless/marvell/mwifiex/ie.c b/drivers/net/wireless/marvell/mwifiex/ie.c
    1301 index 801a2d7b020a..a3f4a5e92105 100644
    1302 --- a/drivers/net/wireless/marvell/mwifiex/ie.c
    1303 +++ b/drivers/net/wireless/marvell/mwifiex/ie.c
    1304 @@ -241,6 +241,9 @@ static int mwifiex_update_vs_ie(const u8 *ies, int ies_len,
    1305 }
    1306
    1307 vs_ie = (struct ieee_types_header *)vendor_ie;
    1308 + if (le16_to_cpu(ie->ie_length) + vs_ie->len + 2 >
    1309 + IEEE_MAX_IE_SIZE)
    1310 + return -EINVAL;
    1311 memcpy(ie->ie_buffer + le16_to_cpu(ie->ie_length),
    1312 vs_ie, vs_ie->len + 2);
    1313 le16_unaligned_add_cpu(&ie->ie_length, vs_ie->len + 2);
    1314 diff --git a/drivers/net/wireless/marvell/mwifiex/uap_cmd.c b/drivers/net/wireless/marvell/mwifiex/uap_cmd.c
    1315 index 18f7d9bf30b2..0939a8c8f3ab 100644
    1316 --- a/drivers/net/wireless/marvell/mwifiex/uap_cmd.c
    1317 +++ b/drivers/net/wireless/marvell/mwifiex/uap_cmd.c
    1318 @@ -265,6 +265,8 @@ mwifiex_set_uap_rates(struct mwifiex_uap_bss_param *bss_cfg,
    1319
    1320 rate_ie = (void *)cfg80211_find_ie(WLAN_EID_SUPP_RATES, var_pos, len);
    1321 if (rate_ie) {
    1322 + if (rate_ie->len > MWIFIEX_SUPPORTED_RATES)
    1323 + return;
    1324 memcpy(bss_cfg->rates, rate_ie + 1, rate_ie->len);
    1325 rate_len = rate_ie->len;
    1326 }
    1327 @@ -272,8 +274,11 @@ mwifiex_set_uap_rates(struct mwifiex_uap_bss_param *bss_cfg,
    1328 rate_ie = (void *)cfg80211_find_ie(WLAN_EID_EXT_SUPP_RATES,
    1329 params->beacon.tail,
    1330 params->beacon.tail_len);
    1331 - if (rate_ie)
    1332 + if (rate_ie) {
    1333 + if (rate_ie->len > MWIFIEX_SUPPORTED_RATES - rate_len)
    1334 + return;
    1335 memcpy(bss_cfg->rates + rate_len, rate_ie + 1, rate_ie->len);
    1336 + }
    1337
    1338 return;
    1339 }
    1340 @@ -391,6 +396,8 @@ mwifiex_set_wmm_params(struct mwifiex_private *priv,
    1341 params->beacon.tail_len);
    1342 if (vendor_ie) {
    1343 wmm_ie = vendor_ie;
    1344 + if (*(wmm_ie + 1) > sizeof(struct mwifiex_types_wmm_info))
    1345 + return;
    1346 memcpy(&bss_cfg->wmm_info, wmm_ie +
    1347 sizeof(struct ieee_types_header), *(wmm_ie + 1));
    1348 priv->wmm_enabled = 1;
    1349 diff --git a/drivers/net/xen-netfront.c b/drivers/net/xen-netfront.c
    1350 index 5b97cc946d70..a2a4c19bc95e 100644
    1351 --- a/drivers/net/xen-netfront.c
    1352 +++ b/drivers/net/xen-netfront.c
    1353 @@ -909,7 +909,7 @@ static RING_IDX xennet_fill_frags(struct netfront_queue *queue,
    1354 __pskb_pull_tail(skb, pull_to - skb_headlen(skb));
    1355 }
    1356 if (unlikely(skb_shinfo(skb)->nr_frags >= MAX_SKB_FRAGS)) {
    1357 - queue->rx.rsp_cons = ++cons;
    1358 + queue->rx.rsp_cons = ++cons + skb_queue_len(list);
    1359 kfree_skb(nskb);
    1360 return ~0U;
    1361 }
    1362 diff --git a/drivers/pci/controller/dwc/pcie-kirin.c b/drivers/pci/controller/dwc/pcie-kirin.c
    1363 index 5352e0c3be82..9b599296205d 100644
    1364 --- a/drivers/pci/controller/dwc/pcie-kirin.c
    1365 +++ b/drivers/pci/controller/dwc/pcie-kirin.c
    1366 @@ -467,8 +467,8 @@ static int kirin_pcie_add_msi(struct dw_pcie *pci,
    1367 return 0;
    1368 }
    1369
    1370 -static int __init kirin_add_pcie_port(struct dw_pcie *pci,
    1371 - struct platform_device *pdev)
    1372 +static int kirin_add_pcie_port(struct dw_pcie *pci,
    1373 + struct platform_device *pdev)
    1374 {
    1375 int ret;
    1376
    1377 diff --git a/drivers/phy/renesas/phy-rcar-gen3-usb2.c b/drivers/phy/renesas/phy-rcar-gen3-usb2.c
    1378 index fb8f05e39cf7..6fb2b6969590 100644
    1379 --- a/drivers/phy/renesas/phy-rcar-gen3-usb2.c
    1380 +++ b/drivers/phy/renesas/phy-rcar-gen3-usb2.c
    1381 @@ -66,6 +66,7 @@
    1382 USB2_OBINT_IDDIGCHG)
    1383
    1384 /* VBCTRL */
    1385 +#define USB2_VBCTRL_OCCLREN BIT(16)
    1386 #define USB2_VBCTRL_DRVVBUSSEL BIT(8)
    1387
    1388 /* LINECTRL1 */
    1389 @@ -289,6 +290,7 @@ static void rcar_gen3_init_otg(struct rcar_gen3_chan *ch)
    1390 u32 val;
    1391
    1392 val = readl(usb2_base + USB2_VBCTRL);
    1393 + val &= ~USB2_VBCTRL_OCCLREN;
    1394 writel(val | USB2_VBCTRL_DRVVBUSSEL, usb2_base + USB2_VBCTRL);
    1395 writel(USB2_OBINT_BITS, usb2_base + USB2_OBINTSTA);
    1396 val = readl(usb2_base + USB2_OBINTEN);
    1397 diff --git a/drivers/tty/serial/atmel_serial.c b/drivers/tty/serial/atmel_serial.c
    1398 index 1cb80fe5f95c..dd8949e8fcd7 100644
    1399 --- a/drivers/tty/serial/atmel_serial.c
    1400 +++ b/drivers/tty/serial/atmel_serial.c
    1401 @@ -1270,7 +1270,6 @@ atmel_handle_transmit(struct uart_port *port, unsigned int pending)
    1402
    1403 atmel_port->hd_start_rx = false;
    1404 atmel_start_rx(port);
    1405 - return;
    1406 }
    1407
    1408 atmel_tasklet_schedule(atmel_port, &atmel_port->tasklet_tx);
    1409 diff --git a/drivers/tty/serial/sprd_serial.c b/drivers/tty/serial/sprd_serial.c
    1410 index 828f1143859c..2774af86763e 100644
    1411 --- a/drivers/tty/serial/sprd_serial.c
    1412 +++ b/drivers/tty/serial/sprd_serial.c
    1413 @@ -232,7 +232,7 @@ static inline void sprd_rx(struct uart_port *port)
    1414
    1415 if (lsr & (SPRD_LSR_BI | SPRD_LSR_PE |
    1416 SPRD_LSR_FE | SPRD_LSR_OE))
    1417 - if (handle_lsr_errors(port, &lsr, &flag))
    1418 + if (handle_lsr_errors(port, &flag, &lsr))
    1419 continue;
    1420 if (uart_handle_sysrq_char(port, ch))
    1421 continue;
    1422 diff --git a/drivers/usb/core/config.c b/drivers/usb/core/config.c
    1423 index e723ddd79bcf..921ad6998dec 100644
    1424 --- a/drivers/usb/core/config.c
    1425 +++ b/drivers/usb/core/config.c
    1426 @@ -925,7 +925,7 @@ int usb_get_bos_descriptor(struct usb_device *dev)
    1427 struct usb_bos_descriptor *bos;
    1428 struct usb_dev_cap_header *cap;
    1429 struct usb_ssp_cap_descriptor *ssp_cap;
    1430 - unsigned char *buffer;
    1431 + unsigned char *buffer, *buffer0;
    1432 int length, total_len, num, i, ssac;
    1433 __u8 cap_type;
    1434 int ret;
    1435 @@ -970,10 +970,12 @@ int usb_get_bos_descriptor(struct usb_device *dev)
    1436 ret = -ENOMSG;
    1437 goto err;
    1438 }
    1439 +
    1440 + buffer0 = buffer;
    1441 total_len -= length;
    1442 + buffer += length;
    1443
    1444 for (i = 0; i < num; i++) {
    1445 - buffer += length;
    1446 cap = (struct usb_dev_cap_header *)buffer;
    1447
    1448 if (total_len < sizeof(*cap) || total_len < cap->bLength) {
    1449 @@ -987,8 +989,6 @@ int usb_get_bos_descriptor(struct usb_device *dev)
    1450 break;
    1451 }
    1452
    1453 - total_len -= length;
    1454 -
    1455 if (cap->bDescriptorType != USB_DT_DEVICE_CAPABILITY) {
    1456 dev_warn(ddev, "descriptor type invalid, skip\n");
    1457 continue;
    1458 @@ -1023,7 +1023,11 @@ int usb_get_bos_descriptor(struct usb_device *dev)
    1459 default:
    1460 break;
    1461 }
    1462 +
    1463 + total_len -= length;
    1464 + buffer += length;
    1465 }
    1466 + dev->bos->desc->wTotalLength = cpu_to_le16(buffer - buffer0);
    1467
    1468 return 0;
    1469
    1470 diff --git a/drivers/usb/host/xhci-tegra.c b/drivers/usb/host/xhci-tegra.c
    1471 index b1cce989bd12..fe37dacc695f 100644
    1472 --- a/drivers/usb/host/xhci-tegra.c
    1473 +++ b/drivers/usb/host/xhci-tegra.c
    1474 @@ -1148,6 +1148,16 @@ static int tegra_xusb_probe(struct platform_device *pdev)
    1475
    1476 tegra_xusb_ipfs_config(tegra, regs);
    1477
    1478 + /*
    1479 + * The XUSB Falcon microcontroller can only address 40 bits, so set
    1480 + * the DMA mask accordingly.
    1481 + */
    1482 + err = dma_set_mask_and_coherent(tegra->dev, DMA_BIT_MASK(40));
    1483 + if (err < 0) {
    1484 + dev_err(&pdev->dev, "failed to set DMA mask: %d\n", err);
    1485 + goto put_rpm;
    1486 + }
    1487 +
    1488 err = tegra_xusb_load_firmware(tegra);
    1489 if (err < 0) {
    1490 dev_err(&pdev->dev, "failed to load firmware: %d\n", err);
    1491 diff --git a/fs/binfmt_elf.c b/fs/binfmt_elf.c
    1492 index efae2fb0930a..9a47e4e5dea0 100644
    1493 --- a/fs/binfmt_elf.c
    1494 +++ b/fs/binfmt_elf.c
    1495 @@ -1137,6 +1137,17 @@ static int load_elf_binary(struct linux_binprm *bprm)
    1496 current->mm->start_stack = bprm->p;
    1497
    1498 if ((current->flags & PF_RANDOMIZE) && (randomize_va_space > 1)) {
    1499 + /*
    1500 + * For architectures with ELF randomization, when executing
    1501 + * a loader directly (i.e. no interpreter listed in ELF
    1502 + * headers), move the brk area out of the mmap region
    1503 + * (since it grows up, and may collide early with the stack
    1504 + * growing down), and into the unused ELF_ET_DYN_BASE region.
    1505 + */
    1506 + if (IS_ENABLED(CONFIG_ARCH_HAS_ELF_RANDOMIZE) && !interpreter)
    1507 + current->mm->brk = current->mm->start_brk =
    1508 + ELF_ET_DYN_BASE;
    1509 +
    1510 current->mm->brk = current->mm->start_brk =
    1511 arch_randomize_brk(current->mm);
    1512 #ifdef compat_brk_randomized
    1513 diff --git a/fs/cifs/connect.c b/fs/cifs/connect.c
    1514 index 208430bb66fc..c290e231f918 100644
    1515 --- a/fs/cifs/connect.c
    1516 +++ b/fs/cifs/connect.c
    1517 @@ -2756,6 +2756,7 @@ static int
    1518 cifs_set_cifscreds(struct smb_vol *vol, struct cifs_ses *ses)
    1519 {
    1520 int rc = 0;
    1521 + int is_domain = 0;
    1522 const char *delim, *payload;
    1523 char *desc;
    1524 ssize_t len;
    1525 @@ -2803,6 +2804,7 @@ cifs_set_cifscreds(struct smb_vol *vol, struct cifs_ses *ses)
    1526 rc = PTR_ERR(key);
    1527 goto out_err;
    1528 }
    1529 + is_domain = 1;
    1530 }
    1531
    1532 down_read(&key->sem);
    1533 @@ -2860,6 +2862,26 @@ cifs_set_cifscreds(struct smb_vol *vol, struct cifs_ses *ses)
    1534 goto out_key_put;
    1535 }
    1536
    1537 + /*
    1538 + * If we have a domain key then we must set the domainName in the
    1539 + * for the request.
    1540 + */
    1541 + if (is_domain && ses->domainName) {
    1542 + vol->domainname = kstrndup(ses->domainName,
    1543 + strlen(ses->domainName),
    1544 + GFP_KERNEL);
    1545 + if (!vol->domainname) {
    1546 + cifs_dbg(FYI, "Unable to allocate %zd bytes for "
    1547 + "domain\n", len);
    1548 + rc = -ENOMEM;
    1549 + kfree(vol->username);
    1550 + vol->username = NULL;
    1551 + kzfree(vol->password);
    1552 + vol->password = NULL;
    1553 + goto out_key_put;
    1554 + }
    1555 + }
    1556 +
    1557 out_key_put:
    1558 up_read(&key->sem);
    1559 key_put(key);
    1560 diff --git a/fs/nfs/dir.c b/fs/nfs/dir.c
    1561 index 71b2e390becf..b8d686087952 100644
    1562 --- a/fs/nfs/dir.c
    1563 +++ b/fs/nfs/dir.c
    1564 @@ -1486,7 +1486,7 @@ static int nfs_finish_open(struct nfs_open_context *ctx,
    1565 if (S_ISREG(file->f_path.dentry->d_inode->i_mode))
    1566 nfs_file_set_open_context(file, ctx);
    1567 else
    1568 - err = -ESTALE;
    1569 + err = -EOPENSTALE;
    1570 out:
    1571 return err;
    1572 }
    1573 diff --git a/fs/nfs/nfs4file.c b/fs/nfs/nfs4file.c
    1574 index 61abbb087ed1..75d3cf86f172 100644
    1575 --- a/fs/nfs/nfs4file.c
    1576 +++ b/fs/nfs/nfs4file.c
    1577 @@ -73,13 +73,13 @@ nfs4_file_open(struct inode *inode, struct file *filp)
    1578 if (IS_ERR(inode)) {
    1579 err = PTR_ERR(inode);
    1580 switch (err) {
    1581 - case -EPERM:
    1582 - case -EACCES:
    1583 - case -EDQUOT:
    1584 - case -ENOSPC:
    1585 - case -EROFS:
    1586 - goto out_put_ctx;
    1587 default:
    1588 + goto out_put_ctx;
    1589 + case -ENOENT:
    1590 + case -ESTALE:
    1591 + case -EISDIR:
    1592 + case -ENOTDIR:
    1593 + case -ELOOP:
    1594 goto out_drop;
    1595 }
    1596 }
    1597 diff --git a/fs/nfs/pagelist.c b/fs/nfs/pagelist.c
    1598 index d23ea74b5d20..9cf59e2622f8 100644
    1599 --- a/fs/nfs/pagelist.c
    1600 +++ b/fs/nfs/pagelist.c
    1601 @@ -567,7 +567,7 @@ static void nfs_pgio_rpcsetup(struct nfs_pgio_header *hdr,
    1602 }
    1603
    1604 hdr->res.fattr = &hdr->fattr;
    1605 - hdr->res.count = count;
    1606 + hdr->res.count = 0;
    1607 hdr->res.eof = 0;
    1608 hdr->res.verf = &hdr->verf;
    1609 nfs_fattr_init(&hdr->fattr);
    1610 diff --git a/fs/nfs/proc.c b/fs/nfs/proc.c
    1611 index e0c257bd62b9..0e0335e77ce6 100644
    1612 --- a/fs/nfs/proc.c
    1613 +++ b/fs/nfs/proc.c
    1614 @@ -594,7 +594,8 @@ static int nfs_read_done(struct rpc_task *task, struct nfs_pgio_header *hdr)
    1615 /* Emulate the eof flag, which isn't normally needed in NFSv2
    1616 * as it is guaranteed to always return the file attributes
    1617 */
    1618 - if (hdr->args.offset + hdr->res.count >= hdr->res.fattr->size)
    1619 + if ((hdr->res.count == 0 && hdr->args.count > 0) ||
    1620 + hdr->args.offset + hdr->res.count >= hdr->res.fattr->size)
    1621 hdr->res.eof = 1;
    1622 }
    1623 return 0;
    1624 @@ -615,8 +616,10 @@ static int nfs_proc_pgio_rpc_prepare(struct rpc_task *task,
    1625
    1626 static int nfs_write_done(struct rpc_task *task, struct nfs_pgio_header *hdr)
    1627 {
    1628 - if (task->tk_status >= 0)
    1629 + if (task->tk_status >= 0) {
    1630 + hdr->res.count = hdr->args.count;
    1631 nfs_writeback_update_inode(hdr);
    1632 + }
    1633 return 0;
    1634 }
    1635
    1636 diff --git a/fs/overlayfs/ovl_entry.h b/fs/overlayfs/ovl_entry.h
    1637 index 6ed1ace8f8b3..1a1adc697c55 100644
    1638 --- a/fs/overlayfs/ovl_entry.h
    1639 +++ b/fs/overlayfs/ovl_entry.h
    1640 @@ -69,6 +69,7 @@ struct ovl_fs {
    1641 bool workdir_locked;
    1642 /* Traps in ovl inode cache */
    1643 struct inode *upperdir_trap;
    1644 + struct inode *workbasedir_trap;
    1645 struct inode *workdir_trap;
    1646 struct inode *indexdir_trap;
    1647 /* Inode numbers in all layers do not use the high xino_bits */
    1648 diff --git a/fs/overlayfs/super.c b/fs/overlayfs/super.c
    1649 index 2d028c02621f..127df4a85c8a 100644
    1650 --- a/fs/overlayfs/super.c
    1651 +++ b/fs/overlayfs/super.c
    1652 @@ -217,6 +217,7 @@ static void ovl_free_fs(struct ovl_fs *ofs)
    1653 {
    1654 unsigned i;
    1655
    1656 + iput(ofs->workbasedir_trap);
    1657 iput(ofs->indexdir_trap);
    1658 iput(ofs->workdir_trap);
    1659 iput(ofs->upperdir_trap);
    1660 @@ -1007,6 +1008,25 @@ static int ovl_setup_trap(struct super_block *sb, struct dentry *dir,
    1661 return 0;
    1662 }
    1663
    1664 +/*
    1665 + * Determine how we treat concurrent use of upperdir/workdir based on the
    1666 + * index feature. This is papering over mount leaks of container runtimes,
    1667 + * for example, an old overlay mount is leaked and now its upperdir is
    1668 + * attempted to be used as a lower layer in a new overlay mount.
    1669 + */
    1670 +static int ovl_report_in_use(struct ovl_fs *ofs, const char *name)
    1671 +{
    1672 + if (ofs->config.index) {
    1673 + pr_err("overlayfs: %s is in-use as upperdir/workdir of another mount, mount with '-o index=off' to override exclusive upperdir protection.\n",
    1674 + name);
    1675 + return -EBUSY;
    1676 + } else {
    1677 + pr_warn("overlayfs: %s is in-use as upperdir/workdir of another mount, accessing files from both mounts will result in undefined behavior.\n",
    1678 + name);
    1679 + return 0;
    1680 + }
    1681 +}
    1682 +
    1683 static int ovl_get_upper(struct super_block *sb, struct ovl_fs *ofs,
    1684 struct path *upperpath)
    1685 {
    1686 @@ -1044,14 +1064,12 @@ static int ovl_get_upper(struct super_block *sb, struct ovl_fs *ofs,
    1687 upper_mnt->mnt_flags &= ~(MNT_NOATIME | MNT_NODIRATIME | MNT_RELATIME);
    1688 ofs->upper_mnt = upper_mnt;
    1689
    1690 - err = -EBUSY;
    1691 if (ovl_inuse_trylock(ofs->upper_mnt->mnt_root)) {
    1692 ofs->upperdir_locked = true;
    1693 - } else if (ofs->config.index) {
    1694 - pr_err("overlayfs: upperdir is in-use by another mount, mount with '-o index=off' to override exclusive upperdir protection.\n");
    1695 - goto out;
    1696 } else {
    1697 - pr_warn("overlayfs: upperdir is in-use by another mount, accessing files from both mounts will result in undefined behavior.\n");
    1698 + err = ovl_report_in_use(ofs, "upperdir");
    1699 + if (err)
    1700 + goto out;
    1701 }
    1702
    1703 err = 0;
    1704 @@ -1161,16 +1179,19 @@ static int ovl_get_workdir(struct super_block *sb, struct ovl_fs *ofs,
    1705
    1706 ofs->workbasedir = dget(workpath.dentry);
    1707
    1708 - err = -EBUSY;
    1709 if (ovl_inuse_trylock(ofs->workbasedir)) {
    1710 ofs->workdir_locked = true;
    1711 - } else if (ofs->config.index) {
    1712 - pr_err("overlayfs: workdir is in-use by another mount, mount with '-o index=off' to override exclusive workdir protection.\n");
    1713 - goto out;
    1714 } else {
    1715 - pr_warn("overlayfs: workdir is in-use by another mount, accessing files from both mounts will result in undefined behavior.\n");
    1716 + err = ovl_report_in_use(ofs, "workdir");
    1717 + if (err)
    1718 + goto out;
    1719 }
    1720
    1721 + err = ovl_setup_trap(sb, ofs->workbasedir, &ofs->workbasedir_trap,
    1722 + "workdir");
    1723 + if (err)
    1724 + goto out;
    1725 +
    1726 err = ovl_make_workdir(sb, ofs, &workpath);
    1727
    1728 out:
    1729 @@ -1289,16 +1310,16 @@ static int ovl_get_lower_layers(struct super_block *sb, struct ovl_fs *ofs,
    1730 if (err < 0)
    1731 goto out;
    1732
    1733 - err = -EBUSY;
    1734 - if (ovl_is_inuse(stack[i].dentry)) {
    1735 - pr_err("overlayfs: lowerdir is in-use as upperdir/workdir\n");
    1736 - goto out;
    1737 - }
    1738 -
    1739 err = ovl_setup_trap(sb, stack[i].dentry, &trap, "lowerdir");
    1740 if (err)
    1741 goto out;
    1742
    1743 + if (ovl_is_inuse(stack[i].dentry)) {
    1744 + err = ovl_report_in_use(ofs, "lowerdir");
    1745 + if (err)
    1746 + goto out;
    1747 + }
    1748 +
    1749 mnt = clone_private_mount(&stack[i]);
    1750 err = PTR_ERR(mnt);
    1751 if (IS_ERR(mnt)) {
    1752 @@ -1445,8 +1466,8 @@ out_err:
    1753 * - another layer of this overlayfs instance
    1754 * - upper/work dir of any overlayfs instance
    1755 */
    1756 -static int ovl_check_layer(struct super_block *sb, struct dentry *dentry,
    1757 - const char *name)
    1758 +static int ovl_check_layer(struct super_block *sb, struct ovl_fs *ofs,
    1759 + struct dentry *dentry, const char *name)
    1760 {
    1761 struct dentry *next = dentry, *parent;
    1762 int err = 0;
    1763 @@ -1458,13 +1479,11 @@ static int ovl_check_layer(struct super_block *sb, struct dentry *dentry,
    1764
    1765 /* Walk back ancestors to root (inclusive) looking for traps */
    1766 while (!err && parent != next) {
    1767 - if (ovl_is_inuse(parent)) {
    1768 - err = -EBUSY;
    1769 - pr_err("overlayfs: %s path overlapping in-use upperdir/workdir\n",
    1770 - name);
    1771 - } else if (ovl_lookup_trap_inode(sb, parent)) {
    1772 + if (ovl_lookup_trap_inode(sb, parent)) {
    1773 err = -ELOOP;
    1774 pr_err("overlayfs: overlapping %s path\n", name);
    1775 + } else if (ovl_is_inuse(parent)) {
    1776 + err = ovl_report_in_use(ofs, name);
    1777 }
    1778 next = parent;
    1779 parent = dget_parent(next);
    1780 @@ -1485,7 +1504,8 @@ static int ovl_check_overlapping_layers(struct super_block *sb,
    1781 int i, err;
    1782
    1783 if (ofs->upper_mnt) {
    1784 - err = ovl_check_layer(sb, ofs->upper_mnt->mnt_root, "upperdir");
    1785 + err = ovl_check_layer(sb, ofs, ofs->upper_mnt->mnt_root,
    1786 + "upperdir");
    1787 if (err)
    1788 return err;
    1789
    1790 @@ -1496,13 +1516,14 @@ static int ovl_check_overlapping_layers(struct super_block *sb,
    1791 * workbasedir. In that case, we already have their traps in
    1792 * inode cache and we will catch that case on lookup.
    1793 */
    1794 - err = ovl_check_layer(sb, ofs->workbasedir, "workdir");
    1795 + err = ovl_check_layer(sb, ofs, ofs->workbasedir, "workdir");
    1796 if (err)
    1797 return err;
    1798 }
    1799
    1800 for (i = 0; i < ofs->numlower; i++) {
    1801 - err = ovl_check_layer(sb, ofs->lower_layers[i].mnt->mnt_root,
    1802 + err = ovl_check_layer(sb, ofs,
    1803 + ofs->lower_layers[i].mnt->mnt_root,
    1804 "lowerdir");
    1805 if (err)
    1806 return err;
    1807 diff --git a/include/net/sock_reuseport.h b/include/net/sock_reuseport.h
    1808 index 8a5f70c7cdf2..5e69fba181bc 100644
    1809 --- a/include/net/sock_reuseport.h
    1810 +++ b/include/net/sock_reuseport.h
    1811 @@ -21,7 +21,8 @@ struct sock_reuseport {
    1812 unsigned int synq_overflow_ts;
    1813 /* ID stays the same even after the size of socks[] grows. */
    1814 unsigned int reuseport_id;
    1815 - bool bind_inany;
    1816 + unsigned int bind_inany:1;
    1817 + unsigned int has_conns:1;
    1818 struct bpf_prog __rcu *prog; /* optional BPF sock selector */
    1819 struct sock *socks[0]; /* array of sock pointers */
    1820 };
    1821 @@ -35,6 +36,24 @@ extern struct sock *reuseport_select_sock(struct sock *sk,
    1822 struct sk_buff *skb,
    1823 int hdr_len);
    1824 extern int reuseport_attach_prog(struct sock *sk, struct bpf_prog *prog);
    1825 +
    1826 +static inline bool reuseport_has_conns(struct sock *sk, bool set)
    1827 +{
    1828 + struct sock_reuseport *reuse;
    1829 + bool ret = false;
    1830 +
    1831 + rcu_read_lock();
    1832 + reuse = rcu_dereference(sk->sk_reuseport_cb);
    1833 + if (reuse) {
    1834 + if (set)
    1835 + reuse->has_conns = 1;
    1836 + ret = reuse->has_conns;
    1837 + }
    1838 + rcu_read_unlock();
    1839 +
    1840 + return ret;
    1841 +}
    1842 +
    1843 int reuseport_get_id(struct sock_reuseport *reuse);
    1844
    1845 #endif /* _SOCK_REUSEPORT_H */
    1846 diff --git a/include/uapi/linux/netfilter/xt_nfacct.h b/include/uapi/linux/netfilter/xt_nfacct.h
    1847 index 5c8a4d760ee3..b5123ab8d54a 100644
    1848 --- a/include/uapi/linux/netfilter/xt_nfacct.h
    1849 +++ b/include/uapi/linux/netfilter/xt_nfacct.h
    1850 @@ -11,4 +11,9 @@ struct xt_nfacct_match_info {
    1851 struct nf_acct *nfacct;
    1852 };
    1853
    1854 +struct xt_nfacct_match_info_v1 {
    1855 + char name[NFACCT_NAME_MAX];
    1856 + struct nf_acct *nfacct __attribute__((aligned(8)));
    1857 +};
    1858 +
    1859 #endif /* _XT_NFACCT_MATCH_H */
    1860 diff --git a/kernel/kallsyms.c b/kernel/kallsyms.c
    1861 index 02a0b01380d8..ed87dac8378c 100644
    1862 --- a/kernel/kallsyms.c
    1863 +++ b/kernel/kallsyms.c
    1864 @@ -262,8 +262,10 @@ int kallsyms_lookup_size_offset(unsigned long addr, unsigned long *symbolsize,
    1865 {
    1866 char namebuf[KSYM_NAME_LEN];
    1867
    1868 - if (is_ksym_addr(addr))
    1869 - return !!get_symbol_pos(addr, symbolsize, offset);
    1870 + if (is_ksym_addr(addr)) {
    1871 + get_symbol_pos(addr, symbolsize, offset);
    1872 + return 1;
    1873 + }
    1874 return !!module_address_lookup(addr, symbolsize, offset, NULL, namebuf) ||
    1875 !!__bpf_address_lookup(addr, symbolsize, offset, namebuf);
    1876 }
    1877 diff --git a/net/batman-adv/bat_v_ogm.c b/net/batman-adv/bat_v_ogm.c
    1878 index 2948b41b06d4..d241ccc0ca02 100644
    1879 --- a/net/batman-adv/bat_v_ogm.c
    1880 +++ b/net/batman-adv/bat_v_ogm.c
    1881 @@ -643,17 +643,23 @@ batadv_v_ogm_process_per_outif(struct batadv_priv *bat_priv,
    1882 * batadv_v_ogm_aggr_packet() - checks if there is another OGM aggregated
    1883 * @buff_pos: current position in the skb
    1884 * @packet_len: total length of the skb
    1885 - * @tvlv_len: tvlv length of the previously considered OGM
    1886 + * @ogm2_packet: potential OGM2 in buffer
    1887 *
    1888 * Return: true if there is enough space for another OGM, false otherwise.
    1889 */
    1890 -static bool batadv_v_ogm_aggr_packet(int buff_pos, int packet_len,
    1891 - __be16 tvlv_len)
    1892 +static bool
    1893 +batadv_v_ogm_aggr_packet(int buff_pos, int packet_len,
    1894 + const struct batadv_ogm2_packet *ogm2_packet)
    1895 {
    1896 int next_buff_pos = 0;
    1897
    1898 - next_buff_pos += buff_pos + BATADV_OGM2_HLEN;
    1899 - next_buff_pos += ntohs(tvlv_len);
    1900 + /* check if there is enough space for the header */
    1901 + next_buff_pos += buff_pos + sizeof(*ogm2_packet);
    1902 + if (next_buff_pos > packet_len)
    1903 + return false;
    1904 +
    1905 + /* check if there is enough space for the optional TVLV */
    1906 + next_buff_pos += ntohs(ogm2_packet->tvlv_len);
    1907
    1908 return (next_buff_pos <= packet_len) &&
    1909 (next_buff_pos <= BATADV_MAX_AGGREGATION_BYTES);
    1910 @@ -830,7 +836,7 @@ int batadv_v_ogm_packet_recv(struct sk_buff *skb,
    1911 ogm_packet = (struct batadv_ogm2_packet *)skb->data;
    1912
    1913 while (batadv_v_ogm_aggr_packet(ogm_offset, skb_headlen(skb),
    1914 - ogm_packet->tvlv_len)) {
    1915 + ogm_packet)) {
    1916 batadv_v_ogm_process(skb, ogm_offset, if_incoming);
    1917
    1918 ogm_offset += BATADV_OGM2_HLEN;
    1919 diff --git a/net/bridge/netfilter/ebtables.c b/net/bridge/netfilter/ebtables.c
    1920 index 62ffc989a44a..7d249afa1466 100644
    1921 --- a/net/bridge/netfilter/ebtables.c
    1922 +++ b/net/bridge/netfilter/ebtables.c
    1923 @@ -225,7 +225,7 @@ unsigned int ebt_do_table(struct sk_buff *skb,
    1924 return NF_DROP;
    1925 }
    1926
    1927 - ADD_COUNTER(*(counter_base + i), 1, skb->len);
    1928 + ADD_COUNTER(*(counter_base + i), skb->len, 1);
    1929
    1930 /* these should only watch: not modify, nor tell us
    1931 * what to do with the packet
    1932 @@ -963,8 +963,8 @@ static void get_counters(const struct ebt_counter *oldcounters,
    1933 continue;
    1934 counter_base = COUNTER_BASE(oldcounters, nentries, cpu);
    1935 for (i = 0; i < nentries; i++)
    1936 - ADD_COUNTER(counters[i], counter_base[i].pcnt,
    1937 - counter_base[i].bcnt);
    1938 + ADD_COUNTER(counters[i], counter_base[i].bcnt,
    1939 + counter_base[i].pcnt);
    1940 }
    1941 }
    1942
    1943 @@ -1289,7 +1289,7 @@ static int do_update_counters(struct net *net, const char *name,
    1944
    1945 /* we add to the counters of the first cpu */
    1946 for (i = 0; i < num_counters; i++)
    1947 - ADD_COUNTER(t->private->counters[i], tmp[i].pcnt, tmp[i].bcnt);
    1948 + ADD_COUNTER(t->private->counters[i], tmp[i].bcnt, tmp[i].pcnt);
    1949
    1950 write_unlock_bh(&t->lock);
    1951 ret = 0;
    1952 diff --git a/net/core/filter.c b/net/core/filter.c
    1953 index c996380f2959..e6fa88506c00 100644
    1954 --- a/net/core/filter.c
    1955 +++ b/net/core/filter.c
    1956 @@ -7234,13 +7234,13 @@ sk_reuseport_is_valid_access(int off, int size,
    1957 return size == size_default;
    1958
    1959 /* Fields that allow narrowing */
    1960 - case offsetof(struct sk_reuseport_md, eth_protocol):
    1961 + case bpf_ctx_range(struct sk_reuseport_md, eth_protocol):
    1962 if (size < FIELD_SIZEOF(struct sk_buff, protocol))
    1963 return false;
    1964 /* fall through */
    1965 - case offsetof(struct sk_reuseport_md, ip_protocol):
    1966 - case offsetof(struct sk_reuseport_md, bind_inany):
    1967 - case offsetof(struct sk_reuseport_md, len):
    1968 + case bpf_ctx_range(struct sk_reuseport_md, ip_protocol):
    1969 + case bpf_ctx_range(struct sk_reuseport_md, bind_inany):
    1970 + case bpf_ctx_range(struct sk_reuseport_md, len):
    1971 bpf_ctx_record_field_size(info, size_default);
    1972 return bpf_ctx_narrow_access_ok(off, size, size_default);
    1973
    1974 diff --git a/net/core/sock_reuseport.c b/net/core/sock_reuseport.c
    1975 index ba5cba56f574..fd38cf1d2b02 100644
    1976 --- a/net/core/sock_reuseport.c
    1977 +++ b/net/core/sock_reuseport.c
    1978 @@ -292,8 +292,19 @@ struct sock *reuseport_select_sock(struct sock *sk,
    1979
    1980 select_by_hash:
    1981 /* no bpf or invalid bpf result: fall back to hash usage */
    1982 - if (!sk2)
    1983 - sk2 = reuse->socks[reciprocal_scale(hash, socks)];
    1984 + if (!sk2) {
    1985 + int i, j;
    1986 +
    1987 + i = j = reciprocal_scale(hash, socks);
    1988 + while (reuse->socks[i]->sk_state == TCP_ESTABLISHED) {
    1989 + i++;
    1990 + if (i >= reuse->num_socks)
    1991 + i = 0;
    1992 + if (i == j)
    1993 + goto out;
    1994 + }
    1995 + sk2 = reuse->socks[i];
    1996 + }
    1997 }
    1998
    1999 out:
    2000 diff --git a/net/ipv4/datagram.c b/net/ipv4/datagram.c
    2001 index f915abff1350..80107a6a2c4a 100644
    2002 --- a/net/ipv4/datagram.c
    2003 +++ b/net/ipv4/datagram.c
    2004 @@ -19,6 +19,7 @@
    2005 #include <net/sock.h>
    2006 #include <net/route.h>
    2007 #include <net/tcp_states.h>
    2008 +#include <net/sock_reuseport.h>
    2009
    2010 int __ip4_datagram_connect(struct sock *sk, struct sockaddr *uaddr, int addr_len)
    2011 {
    2012 @@ -73,6 +74,7 @@ int __ip4_datagram_connect(struct sock *sk, struct sockaddr *uaddr, int addr_len
    2013 }
    2014 inet->inet_daddr = fl4->daddr;
    2015 inet->inet_dport = usin->sin_port;
    2016 + reuseport_has_conns(sk, true);
    2017 sk->sk_state = TCP_ESTABLISHED;
    2018 sk_set_txhash(sk);
    2019 inet->inet_id = jiffies;
    2020 diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c
    2021 index 6ab68b06fa39..2085fc0046de 100644
    2022 --- a/net/ipv4/udp.c
    2023 +++ b/net/ipv4/udp.c
    2024 @@ -443,12 +443,13 @@ static struct sock *udp4_lib_lookup2(struct net *net,
    2025 score = compute_score(sk, net, saddr, sport,
    2026 daddr, hnum, dif, sdif, exact_dif);
    2027 if (score > badness) {
    2028 - if (sk->sk_reuseport) {
    2029 + if (sk->sk_reuseport &&
    2030 + sk->sk_state != TCP_ESTABLISHED) {
    2031 hash = udp_ehashfn(net, daddr, hnum,
    2032 saddr, sport);
    2033 result = reuseport_select_sock(sk, hash, skb,
    2034 sizeof(struct udphdr));
    2035 - if (result)
    2036 + if (result && !reuseport_has_conns(sk, false))
    2037 return result;
    2038 }
    2039 badness = score;
    2040 diff --git a/net/ipv6/datagram.c b/net/ipv6/datagram.c
    2041 index cb24850d2c7f..971a0fdf1fbc 100644
    2042 --- a/net/ipv6/datagram.c
    2043 +++ b/net/ipv6/datagram.c
    2044 @@ -31,6 +31,7 @@
    2045 #include <net/ip6_route.h>
    2046 #include <net/tcp_states.h>
    2047 #include <net/dsfield.h>
    2048 +#include <net/sock_reuseport.h>
    2049
    2050 #include <linux/errqueue.h>
    2051 #include <linux/uaccess.h>
    2052 @@ -258,6 +259,7 @@ ipv4_connected:
    2053 goto out;
    2054 }
    2055
    2056 + reuseport_has_conns(sk, true);
    2057 sk->sk_state = TCP_ESTABLISHED;
    2058 sk_set_txhash(sk);
    2059 out:
    2060 diff --git a/net/ipv6/ip6_gre.c b/net/ipv6/ip6_gre.c
    2061 index a53ef079a539..a23516e22056 100644
    2062 --- a/net/ipv6/ip6_gre.c
    2063 +++ b/net/ipv6/ip6_gre.c
    2064 @@ -988,7 +988,7 @@ static netdev_tx_t ip6erspan_tunnel_xmit(struct sk_buff *skb,
    2065 if (unlikely(!tun_info ||
    2066 !(tun_info->mode & IP_TUNNEL_INFO_TX) ||
    2067 ip_tunnel_info_af(tun_info) != AF_INET6))
    2068 - return -EINVAL;
    2069 + goto tx_err;
    2070
    2071 key = &tun_info->key;
    2072 memset(&fl6, 0, sizeof(fl6));
    2073 diff --git a/net/ipv6/udp.c b/net/ipv6/udp.c
    2074 index 164f1d01273c..3a27c04ff62f 100644
    2075 --- a/net/ipv6/udp.c
    2076 +++ b/net/ipv6/udp.c
    2077 @@ -177,13 +177,14 @@ static struct sock *udp6_lib_lookup2(struct net *net,
    2078 score = compute_score(sk, net, saddr, sport,
    2079 daddr, hnum, dif, sdif, exact_dif);
    2080 if (score > badness) {
    2081 - if (sk->sk_reuseport) {
    2082 + if (sk->sk_reuseport &&
    2083 + sk->sk_state != TCP_ESTABLISHED) {
    2084 hash = udp6_ehashfn(net, daddr, hnum,
    2085 saddr, sport);
    2086
    2087 result = reuseport_select_sock(sk, hash, skb,
    2088 sizeof(struct udphdr));
    2089 - if (result)
    2090 + if (result && !reuseport_has_conns(sk, false))
    2091 return result;
    2092 }
    2093 result = sk;
    2094 diff --git a/net/netfilter/nf_conntrack_ftp.c b/net/netfilter/nf_conntrack_ftp.c
    2095 index a11c304fb771..efc14c7b4f8e 100644
    2096 --- a/net/netfilter/nf_conntrack_ftp.c
    2097 +++ b/net/netfilter/nf_conntrack_ftp.c
    2098 @@ -323,7 +323,7 @@ static int find_pattern(const char *data, size_t dlen,
    2099 i++;
    2100 }
    2101
    2102 - pr_debug("Skipped up to `%c'!\n", skip);
    2103 + pr_debug("Skipped up to 0x%hhx delimiter!\n", skip);
    2104
    2105 *numoff = i;
    2106 *numlen = getnum(data + i, dlen - i, cmd, term, numoff);
    2107 diff --git a/net/netfilter/nf_flow_table_core.c b/net/netfilter/nf_flow_table_core.c
    2108 index 5df7486bb416..8ade40512944 100644
    2109 --- a/net/netfilter/nf_flow_table_core.c
    2110 +++ b/net/netfilter/nf_flow_table_core.c
    2111 @@ -203,7 +203,7 @@ int flow_offload_add(struct nf_flowtable *flow_table, struct flow_offload *flow)
    2112 return err;
    2113 }
    2114
    2115 - flow->timeout = (u32)jiffies;
    2116 + flow->timeout = (u32)jiffies + NF_FLOW_TIMEOUT;
    2117 return 0;
    2118 }
    2119 EXPORT_SYMBOL_GPL(flow_offload_add);
    2120 diff --git a/net/netfilter/nft_flow_offload.c b/net/netfilter/nft_flow_offload.c
    2121 index 69decbe2c988..1ef8cb789c41 100644
    2122 --- a/net/netfilter/nft_flow_offload.c
    2123 +++ b/net/netfilter/nft_flow_offload.c
    2124 @@ -149,6 +149,11 @@ static int nft_flow_offload_validate(const struct nft_ctx *ctx,
    2125 return nft_chain_validate_hooks(ctx->chain, hook_mask);
    2126 }
    2127
    2128 +static const struct nla_policy nft_flow_offload_policy[NFTA_FLOW_MAX + 1] = {
    2129 + [NFTA_FLOW_TABLE_NAME] = { .type = NLA_STRING,
    2130 + .len = NFT_NAME_MAXLEN - 1 },
    2131 +};
    2132 +
    2133 static int nft_flow_offload_init(const struct nft_ctx *ctx,
    2134 const struct nft_expr *expr,
    2135 const struct nlattr * const tb[])
    2136 @@ -207,6 +212,7 @@ static const struct nft_expr_ops nft_flow_offload_ops = {
    2137 static struct nft_expr_type nft_flow_offload_type __read_mostly = {
    2138 .name = "flow_offload",
    2139 .ops = &nft_flow_offload_ops,
    2140 + .policy = nft_flow_offload_policy,
    2141 .maxattr = NFTA_FLOW_MAX,
    2142 .owner = THIS_MODULE,
    2143 };
    2144 diff --git a/net/netfilter/xt_nfacct.c b/net/netfilter/xt_nfacct.c
    2145 index 6b56f4170860..3241fee9f2a1 100644
    2146 --- a/net/netfilter/xt_nfacct.c
    2147 +++ b/net/netfilter/xt_nfacct.c
    2148 @@ -57,25 +57,39 @@ nfacct_mt_destroy(const struct xt_mtdtor_param *par)
    2149 nfnl_acct_put(info->nfacct);
    2150 }
    2151
    2152 -static struct xt_match nfacct_mt_reg __read_mostly = {
    2153 - .name = "nfacct",
    2154 - .family = NFPROTO_UNSPEC,
    2155 - .checkentry = nfacct_mt_checkentry,
    2156 - .match = nfacct_mt,
    2157 - .destroy = nfacct_mt_destroy,
    2158 - .matchsize = sizeof(struct xt_nfacct_match_info),
    2159 - .usersize = offsetof(struct xt_nfacct_match_info, nfacct),
    2160 - .me = THIS_MODULE,
    2161 +static struct xt_match nfacct_mt_reg[] __read_mostly = {
    2162 + {
    2163 + .name = "nfacct",
    2164 + .revision = 0,
    2165 + .family = NFPROTO_UNSPEC,
    2166 + .checkentry = nfacct_mt_checkentry,
    2167 + .match = nfacct_mt,
    2168 + .destroy = nfacct_mt_destroy,
    2169 + .matchsize = sizeof(struct xt_nfacct_match_info),
    2170 + .usersize = offsetof(struct xt_nfacct_match_info, nfacct),
    2171 + .me = THIS_MODULE,
    2172 + },
    2173 + {
    2174 + .name = "nfacct",
    2175 + .revision = 1,
    2176 + .family = NFPROTO_UNSPEC,
    2177 + .checkentry = nfacct_mt_checkentry,
    2178 + .match = nfacct_mt,
    2179 + .destroy = nfacct_mt_destroy,
    2180 + .matchsize = sizeof(struct xt_nfacct_match_info_v1),
    2181 + .usersize = offsetof(struct xt_nfacct_match_info_v1, nfacct),
    2182 + .me = THIS_MODULE,
    2183 + },
    2184 };
    2185
    2186 static int __init nfacct_mt_init(void)
    2187 {
    2188 - return xt_register_match(&nfacct_mt_reg);
    2189 + return xt_register_matches(nfacct_mt_reg, ARRAY_SIZE(nfacct_mt_reg));
    2190 }
    2191
    2192 static void __exit nfacct_mt_exit(void)
    2193 {
    2194 - xt_unregister_match(&nfacct_mt_reg);
    2195 + xt_unregister_matches(nfacct_mt_reg, ARRAY_SIZE(nfacct_mt_reg));
    2196 }
    2197
    2198 module_init(nfacct_mt_init);
    2199 diff --git a/net/netfilter/xt_physdev.c b/net/netfilter/xt_physdev.c
    2200 index 05f00fb20b04..cd15ea79e3e2 100644
    2201 --- a/net/netfilter/xt_physdev.c
    2202 +++ b/net/netfilter/xt_physdev.c
    2203 @@ -104,11 +104,9 @@ static int physdev_mt_check(const struct xt_mtchk_param *par)
    2204 if (info->bitmask & (XT_PHYSDEV_OP_OUT | XT_PHYSDEV_OP_ISOUT) &&
    2205 (!(info->bitmask & XT_PHYSDEV_OP_BRIDGED) ||
    2206 info->invert & XT_PHYSDEV_OP_BRIDGED) &&
    2207 - par->hook_mask & ((1 << NF_INET_LOCAL_OUT) |
    2208 - (1 << NF_INET_FORWARD) | (1 << NF_INET_POST_ROUTING))) {
    2209 + par->hook_mask & (1 << NF_INET_LOCAL_OUT)) {
    2210 pr_info_ratelimited("--physdev-out and --physdev-is-out only supported in the FORWARD and POSTROUTING chains with bridged traffic\n");
    2211 - if (par->hook_mask & (1 << NF_INET_LOCAL_OUT))
    2212 - return -EINVAL;
    2213 + return -EINVAL;
    2214 }
    2215
    2216 if (!brnf_probed) {
    2217 diff --git a/net/sched/sch_generic.c b/net/sched/sch_generic.c
    2218 index 875f521bce0d..30e32df5f84a 100644
    2219 --- a/net/sched/sch_generic.c
    2220 +++ b/net/sched/sch_generic.c
    2221 @@ -947,9 +947,13 @@ void qdisc_free(struct Qdisc *qdisc)
    2222
    2223 void qdisc_destroy(struct Qdisc *qdisc)
    2224 {
    2225 - const struct Qdisc_ops *ops = qdisc->ops;
    2226 + const struct Qdisc_ops *ops;
    2227 struct sk_buff *skb, *tmp;
    2228
    2229 + if (!qdisc)
    2230 + return;
    2231 + ops = qdisc->ops;
    2232 +
    2233 if (qdisc->flags & TCQ_F_BUILTIN ||
    2234 !refcount_dec_and_test(&qdisc->refcnt))
    2235 return;
    2236 diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
    2237 index 2a85bff6a8f3..6168db3c35e4 100644
    2238 --- a/net/wireless/nl80211.c
    2239 +++ b/net/wireless/nl80211.c
    2240 @@ -10270,9 +10270,11 @@ static int cfg80211_cqm_rssi_update(struct cfg80211_registered_device *rdev,
    2241 hyst = wdev->cqm_config->rssi_hyst;
    2242 n = wdev->cqm_config->n_rssi_thresholds;
    2243
    2244 - for (i = 0; i < n; i++)
    2245 + for (i = 0; i < n; i++) {
    2246 + i = array_index_nospec(i, n);
    2247 if (last < wdev->cqm_config->rssi_thresholds[i])
    2248 break;
    2249 + }
    2250
    2251 low_index = i - 1;
    2252 if (low_index >= 0) {
    2253 diff --git a/net/xdp/xdp_umem.c b/net/xdp/xdp_umem.c
    2254 index a3b037fbfecd..8cab91c482ff 100644
    2255 --- a/net/xdp/xdp_umem.c
    2256 +++ b/net/xdp/xdp_umem.c
    2257 @@ -322,7 +322,7 @@ static int xdp_umem_reg(struct xdp_umem *umem, struct xdp_umem_reg *mr)
    2258 umem->pages = kcalloc(umem->npgs, sizeof(*umem->pages), GFP_KERNEL);
    2259 if (!umem->pages) {
    2260 err = -ENOMEM;
    2261 - goto out_account;
    2262 + goto out_pin;
    2263 }
    2264
    2265 for (i = 0; i < umem->npgs; i++)
    2266 @@ -330,6 +330,8 @@ static int xdp_umem_reg(struct xdp_umem *umem, struct xdp_umem_reg *mr)
    2267
    2268 return 0;
    2269
    2270 +out_pin:
    2271 + xdp_umem_unpin_pages(umem);
    2272 out_account:
    2273 xdp_umem_unaccount_pages(umem);
    2274 return err;
    2275 diff --git a/security/keys/request_key_auth.c b/security/keys/request_key_auth.c
    2276 index 5e515791ccd1..1d34b2a5f485 100644
    2277 --- a/security/keys/request_key_auth.c
    2278 +++ b/security/keys/request_key_auth.c
    2279 @@ -71,6 +71,9 @@ static void request_key_auth_describe(const struct key *key,
    2280 {
    2281 struct request_key_auth *rka = get_request_key_auth(key);
    2282
    2283 + if (!rka)
    2284 + return;
    2285 +
    2286 seq_puts(m, "key:");
    2287 seq_puts(m, key->description);
    2288 if (key_is_positive(key))
    2289 @@ -88,6 +91,9 @@ static long request_key_auth_read(const struct key *key,
    2290 size_t datalen;
    2291 long ret;
    2292
    2293 + if (!rka)
    2294 + return -EKEYREVOKED;
    2295 +
    2296 datalen = rka->callout_len;
    2297 ret = datalen;
    2298
    2299 diff --git a/tools/bpf/bpftool/prog.c b/tools/bpf/bpftool/prog.c
    2300 index bbba0d61570f..4f9611af4642 100644
    2301 --- a/tools/bpf/bpftool/prog.c
    2302 +++ b/tools/bpf/bpftool/prog.c
    2303 @@ -381,7 +381,9 @@ static int do_show(int argc, char **argv)
    2304 if (fd < 0)
    2305 return -1;
    2306
    2307 - return show_prog(fd);
    2308 + err = show_prog(fd);
    2309 + close(fd);
    2310 + return err;
    2311 }
    2312
    2313 if (argc)
    2314 diff --git a/tools/power/x86/turbostat/turbostat.c b/tools/power/x86/turbostat/turbostat.c
    2315 index fbb53c952b73..71cf7e77291a 100644
    2316 --- a/tools/power/x86/turbostat/turbostat.c
    2317 +++ b/tools/power/x86/turbostat/turbostat.c
    2318 @@ -4953,7 +4953,7 @@ int initialize_counters(int cpu_id)
    2319
    2320 void allocate_output_buffer()
    2321 {
    2322 - output_buffer = calloc(1, (1 + topo.num_cpus) * 1024);
    2323 + output_buffer = calloc(1, (1 + topo.num_cpus) * 2048);
    2324 outp = output_buffer;
    2325 if (outp == NULL)
    2326 err(-1, "calloc output buffer");
    2327 diff --git a/tools/power/x86/x86_energy_perf_policy/x86_energy_perf_policy.c b/tools/power/x86/x86_energy_perf_policy/x86_energy_perf_policy.c
    2328 index 65bbe627a425..2aba622d1c5a 100644
    2329 --- a/tools/power/x86/x86_energy_perf_policy/x86_energy_perf_policy.c
    2330 +++ b/tools/power/x86/x86_energy_perf_policy/x86_energy_perf_policy.c
    2331 @@ -546,7 +546,7 @@ void cmdline(int argc, char **argv)
    2332
    2333 progname = argv[0];
    2334
    2335 - while ((opt = getopt_long_only(argc, argv, "+a:c:dD:E:e:f:m:M:rt:u:vw",
    2336 + while ((opt = getopt_long_only(argc, argv, "+a:c:dD:E:e:f:m:M:rt:u:vw:",
    2337 long_options, &option_index)) != -1) {
    2338 switch (opt) {
    2339 case 'a':
    2340 @@ -1260,6 +1260,15 @@ void probe_dev_msr(void)
    2341 if (system("/sbin/modprobe msr > /dev/null 2>&1"))
    2342 err(-5, "no /dev/cpu/0/msr, Try \"# modprobe msr\" ");
    2343 }
    2344 +
    2345 +static void get_cpuid_or_exit(unsigned int leaf,
    2346 + unsigned int *eax, unsigned int *ebx,
    2347 + unsigned int *ecx, unsigned int *edx)
    2348 +{
    2349 + if (!__get_cpuid(leaf, eax, ebx, ecx, edx))
    2350 + errx(1, "Processor not supported\n");
    2351 +}
    2352 +
    2353 /*
    2354 * early_cpuid()
    2355 * initialize turbo_is_enabled, has_hwp, has_epb
    2356 @@ -1267,15 +1276,10 @@ void probe_dev_msr(void)
    2357 */
    2358 void early_cpuid(void)
    2359 {
    2360 - unsigned int eax, ebx, ecx, edx, max_level;
    2361 + unsigned int eax, ebx, ecx, edx;
    2362 unsigned int fms, family, model;
    2363
    2364 - __get_cpuid(0, &max_level, &ebx, &ecx, &edx);
    2365 -
    2366 - if (max_level < 6)
    2367 - errx(1, "Processor not supported\n");
    2368 -
    2369 - __get_cpuid(1, &fms, &ebx, &ecx, &edx);
    2370 + get_cpuid_or_exit(1, &fms, &ebx, &ecx, &edx);
    2371 family = (fms >> 8) & 0xf;
    2372 model = (fms >> 4) & 0xf;
    2373 if (family == 6 || family == 0xf)
    2374 @@ -1289,7 +1293,7 @@ void early_cpuid(void)
    2375 bdx_highest_ratio = msr & 0xFF;
    2376 }
    2377
    2378 - __get_cpuid(0x6, &eax, &ebx, &ecx, &edx);
    2379 + get_cpuid_or_exit(0x6, &eax, &ebx, &ecx, &edx);
    2380 turbo_is_enabled = (eax >> 1) & 1;
    2381 has_hwp = (eax >> 7) & 1;
    2382 has_epb = (ecx >> 3) & 1;
    2383 @@ -1307,7 +1311,7 @@ void parse_cpuid(void)
    2384
    2385 eax = ebx = ecx = edx = 0;
    2386
    2387 - __get_cpuid(0, &max_level, &ebx, &ecx, &edx);
    2388 + get_cpuid_or_exit(0, &max_level, &ebx, &ecx, &edx);
    2389
    2390 if (ebx == 0x756e6547 && edx == 0x49656e69 && ecx == 0x6c65746e)
    2391 genuine_intel = 1;
    2392 @@ -1316,7 +1320,7 @@ void parse_cpuid(void)
    2393 fprintf(stderr, "CPUID(0): %.4s%.4s%.4s ",
    2394 (char *)&ebx, (char *)&edx, (char *)&ecx);
    2395
    2396 - __get_cpuid(1, &fms, &ebx, &ecx, &edx);
    2397 + get_cpuid_or_exit(1, &fms, &ebx, &ecx, &edx);
    2398 family = (fms >> 8) & 0xf;
    2399 model = (fms >> 4) & 0xf;
    2400 stepping = fms & 0xf;
    2401 @@ -1341,7 +1345,7 @@ void parse_cpuid(void)
    2402 errx(1, "CPUID: no MSR");
    2403
    2404
    2405 - __get_cpuid(0x6, &eax, &ebx, &ecx, &edx);
    2406 + get_cpuid_or_exit(0x6, &eax, &ebx, &ecx, &edx);
    2407 /* turbo_is_enabled already set */
    2408 /* has_hwp already set */
    2409 has_hwp_notify = eax & (1 << 8);
    2410 diff --git a/tools/testing/selftests/bpf/test_sock.c b/tools/testing/selftests/bpf/test_sock.c
    2411 index b8ebe2f58074..e9567122070a 100644
    2412 --- a/tools/testing/selftests/bpf/test_sock.c
    2413 +++ b/tools/testing/selftests/bpf/test_sock.c
    2414 @@ -13,6 +13,7 @@
    2415 #include <bpf/bpf.h>
    2416
    2417 #include "cgroup_helpers.h"
    2418 +#include "bpf_endian.h"
    2419 #include "bpf_rlimit.h"
    2420 #include "bpf_util.h"
    2421
    2422 @@ -231,7 +232,8 @@ static struct sock_test tests[] = {
    2423 /* if (ip == expected && port == expected) */
    2424 BPF_LDX_MEM(BPF_W, BPF_REG_7, BPF_REG_6,
    2425 offsetof(struct bpf_sock, src_ip6[3])),
    2426 - BPF_JMP_IMM(BPF_JNE, BPF_REG_7, 0x01000000, 4),
    2427 + BPF_JMP_IMM(BPF_JNE, BPF_REG_7,
    2428 + __bpf_constant_ntohl(0x00000001), 4),
    2429 BPF_LDX_MEM(BPF_W, BPF_REG_7, BPF_REG_6,
    2430 offsetof(struct bpf_sock, src_port)),
    2431 BPF_JMP_IMM(BPF_JNE, BPF_REG_7, 0x2001, 2),
    2432 @@ -260,7 +262,8 @@ static struct sock_test tests[] = {
    2433 /* if (ip == expected && port == expected) */
    2434 BPF_LDX_MEM(BPF_W, BPF_REG_7, BPF_REG_6,
    2435 offsetof(struct bpf_sock, src_ip4)),
    2436 - BPF_JMP_IMM(BPF_JNE, BPF_REG_7, 0x0100007F, 4),
    2437 + BPF_JMP_IMM(BPF_JNE, BPF_REG_7,
    2438 + __bpf_constant_ntohl(0x7F000001), 4),
    2439 BPF_LDX_MEM(BPF_W, BPF_REG_7, BPF_REG_6,
    2440 offsetof(struct bpf_sock, src_port)),
    2441 BPF_JMP_IMM(BPF_JNE, BPF_REG_7, 0x1002, 2),
    2442 diff --git a/virt/kvm/coalesced_mmio.c b/virt/kvm/coalesced_mmio.c
    2443 index 9e65feb6fa58..b9336693c87e 100644
    2444 --- a/virt/kvm/coalesced_mmio.c
    2445 +++ b/virt/kvm/coalesced_mmio.c
    2446 @@ -40,7 +40,7 @@ static int coalesced_mmio_in_range(struct kvm_coalesced_mmio_dev *dev,
    2447 return 1;
    2448 }
    2449
    2450 -static int coalesced_mmio_has_room(struct kvm_coalesced_mmio_dev *dev)
    2451 +static int coalesced_mmio_has_room(struct kvm_coalesced_mmio_dev *dev, u32 last)
    2452 {
    2453 struct kvm_coalesced_mmio_ring *ring;
    2454 unsigned avail;
    2455 @@ -52,7 +52,7 @@ static int coalesced_mmio_has_room(struct kvm_coalesced_mmio_dev *dev)
    2456 * there is always one unused entry in the buffer
    2457 */
    2458 ring = dev->kvm->coalesced_mmio_ring;
    2459 - avail = (ring->first - ring->last - 1) % KVM_COALESCED_MMIO_MAX;
    2460 + avail = (ring->first - last - 1) % KVM_COALESCED_MMIO_MAX;
    2461 if (avail == 0) {
    2462 /* full */
    2463 return 0;
    2464 @@ -67,24 +67,27 @@ static int coalesced_mmio_write(struct kvm_vcpu *vcpu,
    2465 {
    2466 struct kvm_coalesced_mmio_dev *dev = to_mmio(this);
    2467 struct kvm_coalesced_mmio_ring *ring = dev->kvm->coalesced_mmio_ring;
    2468 + __u32 insert;
    2469
    2470 if (!coalesced_mmio_in_range(dev, addr, len))
    2471 return -EOPNOTSUPP;
    2472
    2473 spin_lock(&dev->kvm->ring_lock);
    2474
    2475 - if (!coalesced_mmio_has_room(dev)) {
    2476 + insert = READ_ONCE(ring->last);
    2477 + if (!coalesced_mmio_has_room(dev, insert) ||
    2478 + insert >= KVM_COALESCED_MMIO_MAX) {
    2479 spin_unlock(&dev->kvm->ring_lock);
    2480 return -EOPNOTSUPP;
    2481 }
    2482
    2483 /* copy data in first free entry of the ring */
    2484
    2485 - ring->coalesced_mmio[ring->last].phys_addr = addr;
    2486 - ring->coalesced_mmio[ring->last].len = len;
    2487 - memcpy(ring->coalesced_mmio[ring->last].data, val, len);
    2488 + ring->coalesced_mmio[insert].phys_addr = addr;
    2489 + ring->coalesced_mmio[insert].len = len;
    2490 + memcpy(ring->coalesced_mmio[insert].data, val, len);
    2491 smp_wmb();
    2492 - ring->last = (ring->last + 1) % KVM_COALESCED_MMIO_MAX;
    2493 + ring->last = (insert + 1) % KVM_COALESCED_MMIO_MAX;
    2494 spin_unlock(&dev->kvm->ring_lock);
    2495 return 0;
    2496 }