Magellan Linux

  • Back to homepage
    • /[pkg-src]/trunk/kernel-alx/patches-4.4/0130-4.4.31-all-fixes.patch

    Contents of /trunk/kernel-alx/patches-4.4/0130-4.4.31-all-fixes.patch

    Parent Directory Parent Directory | Revision Log Revision Log

    Revision 2866 - (show annotations) (download)
    Mon Mar 27 13:49:10 2017 UTC (7 years, 1 month ago) by niro
    File size: 60758 byte(s) 
    linux-4.4.31
    1 diff --git a/Makefile b/Makefile
    2 index 98239d56924c..7c6f28e7a2f6 100644
    3 --- a/Makefile
    4 +++ b/Makefile
    5 @@ -1,6 +1,6 @@
    6 VERSION = 4
    7 PATCHLEVEL = 4
    8 -SUBLEVEL = 30
    9 +SUBLEVEL = 31
    10 EXTRAVERSION =
    11 NAME = Blurry Fish Butt
    12
    13 @@ -617,6 +617,7 @@ include arch/$(SRCARCH)/Makefile
    14
    15 KBUILD_CFLAGS += $(call cc-option,-fno-delete-null-pointer-checks,)
    16 KBUILD_CFLAGS += $(call cc-disable-warning,maybe-uninitialized,)
    17 +KBUILD_CFLAGS += $(call cc-disable-warning,frame-address,)
    18
    19 ifdef CONFIG_CC_OPTIMIZE_FOR_SIZE
    20 KBUILD_CFLAGS += -Os
    21 diff --git a/arch/arm/include/asm/floppy.h b/arch/arm/include/asm/floppy.h
    22 index f4882553fbb0..85a34cc8316a 100644
    23 --- a/arch/arm/include/asm/floppy.h
    24 +++ b/arch/arm/include/asm/floppy.h
    25 @@ -17,7 +17,7 @@
    26
    27 #define fd_outb(val,port) \
    28 do { \
    29 - if ((port) == FD_DOR) \
    30 + if ((port) == (u32)FD_DOR) \
    31 fd_setdor((val)); \
    32 else \
    33 outb((val),(port)); \
    34 diff --git a/arch/h8300/include/asm/thread_info.h b/arch/h8300/include/asm/thread_info.h
    35 index b408fe660cf8..3cef06875f5c 100644
    36 --- a/arch/h8300/include/asm/thread_info.h
    37 +++ b/arch/h8300/include/asm/thread_info.h
    38 @@ -31,7 +31,6 @@ struct thread_info {
    39 int cpu; /* cpu we're on */
    40 int preempt_count; /* 0 => preemptable, <0 => BUG */
    41 mm_segment_t addr_limit;
    42 - struct restart_block restart_block;
    43 };
    44
    45 /*
    46 @@ -44,9 +43,6 @@ struct thread_info {
    47 .cpu = 0, \
    48 .preempt_count = INIT_PREEMPT_COUNT, \
    49 .addr_limit = KERNEL_DS, \
    50 - .restart_block = { \
    51 - .fn = do_no_restart_syscall, \
    52 - }, \
    53 }
    54
    55 #define init_thread_info (init_thread_union.thread_info)
    56 diff --git a/arch/h8300/kernel/signal.c b/arch/h8300/kernel/signal.c
    57 index 380fffd081b2..036ad04edd2d 100644
    58 --- a/arch/h8300/kernel/signal.c
    59 +++ b/arch/h8300/kernel/signal.c
    60 @@ -79,7 +79,7 @@ restore_sigcontext(struct sigcontext *usc, int *pd0)
    61 unsigned int er0;
    62
    63 /* Always make any pending restarted system calls return -EINTR */
    64 - current_thread_info()->restart_block.fn = do_no_restart_syscall;
    65 + current->restart_block.fn = do_no_restart_syscall;
    66
    67 /* restore passed registers */
    68 #define COPY(r) do { err |= get_user(regs->r, &usc->sc_##r); } while (0)
    69 diff --git a/arch/mips/kvm/emulate.c b/arch/mips/kvm/emulate.c
    70 index 3251b206e55a..bbe56871245c 100644
    71 --- a/arch/mips/kvm/emulate.c
    72 +++ b/arch/mips/kvm/emulate.c
    73 @@ -752,15 +752,15 @@ enum emulation_result kvm_mips_emul_eret(struct kvm_vcpu *vcpu)
    74 struct mips_coproc *cop0 = vcpu->arch.cop0;
    75 enum emulation_result er = EMULATE_DONE;
    76
    77 - if (kvm_read_c0_guest_status(cop0) & ST0_EXL) {
    78 + if (kvm_read_c0_guest_status(cop0) & ST0_ERL) {
    79 + kvm_clear_c0_guest_status(cop0, ST0_ERL);
    80 + vcpu->arch.pc = kvm_read_c0_guest_errorepc(cop0);
    81 + } else if (kvm_read_c0_guest_status(cop0) & ST0_EXL) {
    82 kvm_debug("[%#lx] ERET to %#lx\n", vcpu->arch.pc,
    83 kvm_read_c0_guest_epc(cop0));
    84 kvm_clear_c0_guest_status(cop0, ST0_EXL);
    85 vcpu->arch.pc = kvm_read_c0_guest_epc(cop0);
    86
    87 - } else if (kvm_read_c0_guest_status(cop0) & ST0_ERL) {
    88 - kvm_clear_c0_guest_status(cop0, ST0_ERL);
    89 - vcpu->arch.pc = kvm_read_c0_guest_errorepc(cop0);
    90 } else {
    91 kvm_err("[%#lx] ERET when MIPS_SR_EXL|MIPS_SR_ERL == 0\n",
    92 vcpu->arch.pc);
    93 diff --git a/arch/parisc/kernel/syscall.S b/arch/parisc/kernel/syscall.S
    94 index fbafa0d0e2bf..a86b19fccb63 100644
    95 --- a/arch/parisc/kernel/syscall.S
    96 +++ b/arch/parisc/kernel/syscall.S
    97 @@ -106,8 +106,6 @@ linux_gateway_entry:
    98 mtsp %r0,%sr4 /* get kernel space into sr4 */
    99 mtsp %r0,%sr5 /* get kernel space into sr5 */
    100 mtsp %r0,%sr6 /* get kernel space into sr6 */
    101 - mfsp %sr7,%r1 /* save user sr7 */
    102 - mtsp %r1,%sr3 /* and store it in sr3 */
    103
    104 #ifdef CONFIG_64BIT
    105 /* for now we can *always* set the W bit on entry to the syscall
    106 @@ -133,6 +131,14 @@ linux_gateway_entry:
    107 depdi 0, 31, 32, %r21
    108 1:
    109 #endif
    110 +
    111 + /* We use a rsm/ssm pair to prevent sr3 from being clobbered
    112 + * by external interrupts.
    113 + */
    114 + mfsp %sr7,%r1 /* save user sr7 */
    115 + rsm PSW_SM_I, %r0 /* disable interrupts */
    116 + mtsp %r1,%sr3 /* and store it in sr3 */
    117 +
    118 mfctl %cr30,%r1
    119 xor %r1,%r30,%r30 /* ye olde xor trick */
    120 xor %r1,%r30,%r1
    121 @@ -147,6 +153,7 @@ linux_gateway_entry:
    122 */
    123
    124 mtsp %r0,%sr7 /* get kernel space into sr7 */
    125 + ssm PSW_SM_I, %r0 /* enable interrupts */
    126 STREGM %r1,FRAME_SIZE(%r30) /* save r1 (usp) here for now */
    127 mfctl %cr30,%r1 /* get task ptr in %r1 */
    128 LDREG TI_TASK(%r1),%r1
    129 diff --git a/arch/powerpc/kernel/ptrace.c b/arch/powerpc/kernel/ptrace.c
    130 index 737c0d0b53ac..b38fd081b222 100644
    131 --- a/arch/powerpc/kernel/ptrace.c
    132 +++ b/arch/powerpc/kernel/ptrace.c
    133 @@ -376,7 +376,7 @@ static int fpr_get(struct task_struct *target, const struct user_regset *regset,
    134
    135 #else
    136 BUILD_BUG_ON(offsetof(struct thread_fp_state, fpscr) !=
    137 - offsetof(struct thread_fp_state, fpr[32][0]));
    138 + offsetof(struct thread_fp_state, fpr[32]));
    139
    140 return user_regset_copyout(&pos, &count, &kbuf, &ubuf,
    141 &target->thread.fp_state, 0, -1);
    142 @@ -404,7 +404,7 @@ static int fpr_set(struct task_struct *target, const struct user_regset *regset,
    143 return 0;
    144 #else
    145 BUILD_BUG_ON(offsetof(struct thread_fp_state, fpscr) !=
    146 - offsetof(struct thread_fp_state, fpr[32][0]));
    147 + offsetof(struct thread_fp_state, fpr[32]));
    148
    149 return user_regset_copyin(&pos, &count, &kbuf, &ubuf,
    150 &target->thread.fp_state, 0, -1);
    151 diff --git a/arch/x86/include/asm/uaccess.h b/arch/x86/include/asm/uaccess.h
    152 index 09b1b0ab94b7..b8c75f3aade8 100644
    153 --- a/arch/x86/include/asm/uaccess.h
    154 +++ b/arch/x86/include/asm/uaccess.h
    155 @@ -332,7 +332,7 @@ do { \
    156 #define __get_user_asm_u64(x, ptr, retval, errret) \
    157 __get_user_asm(x, ptr, retval, "q", "", "=r", errret)
    158 #define __get_user_asm_ex_u64(x, ptr) \
    159 - __get_user_asm_ex(x, ptr, "q", "", "=r")
    160 + __get_user_asm_ex(x, ptr, "q", "", "=&r")
    161 #endif
    162
    163 #define __get_user_size(x, ptr, size, retval, errret) \
    164 @@ -375,13 +375,13 @@ do { \
    165 __chk_user_ptr(ptr); \
    166 switch (size) { \
    167 case 1: \
    168 - __get_user_asm_ex(x, ptr, "b", "b", "=q"); \
    169 + __get_user_asm_ex(x, ptr, "b", "b", "=&q"); \
    170 break; \
    171 case 2: \
    172 - __get_user_asm_ex(x, ptr, "w", "w", "=r"); \
    173 + __get_user_asm_ex(x, ptr, "w", "w", "=&r"); \
    174 break; \
    175 case 4: \
    176 - __get_user_asm_ex(x, ptr, "l", "k", "=r"); \
    177 + __get_user_asm_ex(x, ptr, "l", "k", "=&r"); \
    178 break; \
    179 case 8: \
    180 __get_user_asm_ex_u64(x, ptr); \
    181 @@ -395,7 +395,7 @@ do { \
    182 asm volatile("1: mov"itype" %1,%"rtype"0\n" \
    183 "2:\n" \
    184 _ASM_EXTABLE_EX(1b, 2b) \
    185 - : ltype(x) : "m" (__m(addr)))
    186 + : ltype(x) : "m" (__m(addr)), "0" (0))
    187
    188 #define __put_user_nocheck(x, ptr, size) \
    189 ({ \
    190 diff --git a/arch/x86/kvm/emulate.c b/arch/x86/kvm/emulate.c
    191 index b9b09fec173b..5fa652c16a50 100644
    192 --- a/arch/x86/kvm/emulate.c
    193 +++ b/arch/x86/kvm/emulate.c
    194 @@ -5033,7 +5033,7 @@ done_prefixes:
    195 /* Decode and fetch the destination operand: register or memory. */
    196 rc = decode_operand(ctxt, &ctxt->dst, (ctxt->d >> DstShift) & OpMask);
    197
    198 - if (ctxt->rip_relative)
    199 + if (ctxt->rip_relative && likely(ctxt->memopp))
    200 ctxt->memopp->addr.mem.ea = address_mask(ctxt,
    201 ctxt->memopp->addr.mem.ea + ctxt->_eip);
    202
    203 diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
    204 index d7cb9577fa31..685ef431a41d 100644
    205 --- a/arch/x86/kvm/x86.c
    206 +++ b/arch/x86/kvm/x86.c
    207 @@ -7252,10 +7252,12 @@ void kvm_put_guest_fpu(struct kvm_vcpu *vcpu)
    208
    209 void kvm_arch_vcpu_free(struct kvm_vcpu *vcpu)
    210 {
    211 + void *wbinvd_dirty_mask = vcpu->arch.wbinvd_dirty_mask;
    212 +
    213 kvmclock_reset(vcpu);
    214
    215 - free_cpumask_var(vcpu->arch.wbinvd_dirty_mask);
    216 kvm_x86_ops->vcpu_free(vcpu);
    217 + free_cpumask_var(wbinvd_dirty_mask);
    218 }
    219
    220 struct kvm_vcpu *kvm_arch_vcpu_create(struct kvm *kvm,
    221 diff --git a/arch/x86/xen/mmu.c b/arch/x86/xen/mmu.c
    222 index cb5e266a8bf7..1e56ff583459 100644
    223 --- a/arch/x86/xen/mmu.c
    224 +++ b/arch/x86/xen/mmu.c
    225 @@ -1113,7 +1113,7 @@ static void __init xen_cleanhighmap(unsigned long vaddr,
    226
    227 /* NOTE: The loop is more greedy than the cleanup_highmap variant.
    228 * We include the PMD passed in on _both_ boundaries. */
    229 - for (; vaddr <= vaddr_end && (pmd < (level2_kernel_pgt + PAGE_SIZE));
    230 + for (; vaddr <= vaddr_end && (pmd < (level2_kernel_pgt + PTRS_PER_PMD));
    231 pmd++, vaddr += PMD_SIZE) {
    232 if (pmd_none(*pmd))
    233 continue;
    234 diff --git a/drivers/android/binder.c b/drivers/android/binder.c
    235 index 7d00b7a015ea..47ddfefe2443 100644
    236 --- a/drivers/android/binder.c
    237 +++ b/drivers/android/binder.c
    238 @@ -1003,7 +1003,7 @@ static int binder_dec_node(struct binder_node *node, int strong, int internal)
    239
    240
    241 static struct binder_ref *binder_get_ref(struct binder_proc *proc,
    242 - uint32_t desc)
    243 + u32 desc, bool need_strong_ref)
    244 {
    245 struct rb_node *n = proc->refs_by_desc.rb_node;
    246 struct binder_ref *ref;
    247 @@ -1011,12 +1011,16 @@ static struct binder_ref *binder_get_ref(struct binder_proc *proc,
    248 while (n) {
    249 ref = rb_entry(n, struct binder_ref, rb_node_desc);
    250
    251 - if (desc < ref->desc)
    252 + if (desc < ref->desc) {
    253 n = n->rb_left;
    254 - else if (desc > ref->desc)
    255 + } else if (desc > ref->desc) {
    256 n = n->rb_right;
    257 - else
    258 + } else if (need_strong_ref && !ref->strong) {
    259 + binder_user_error("tried to use weak ref as strong ref\n");
    260 + return NULL;
    261 + } else {
    262 return ref;
    263 + }
    264 }
    265 return NULL;
    266 }
    267 @@ -1286,7 +1290,10 @@ static void binder_transaction_buffer_release(struct binder_proc *proc,
    268 } break;
    269 case BINDER_TYPE_HANDLE:
    270 case BINDER_TYPE_WEAK_HANDLE: {
    271 - struct binder_ref *ref = binder_get_ref(proc, fp->handle);
    272 + struct binder_ref *ref;
    273 +
    274 + ref = binder_get_ref(proc, fp->handle,
    275 + fp->type == BINDER_TYPE_HANDLE);
    276
    277 if (ref == NULL) {
    278 pr_err("transaction release %d bad handle %d\n",
    279 @@ -1380,7 +1387,7 @@ static void binder_transaction(struct binder_proc *proc,
    280 if (tr->target.handle) {
    281 struct binder_ref *ref;
    282
    283 - ref = binder_get_ref(proc, tr->target.handle);
    284 + ref = binder_get_ref(proc, tr->target.handle, true);
    285 if (ref == NULL) {
    286 binder_user_error("%d:%d got transaction to invalid handle\n",
    287 proc->pid, thread->pid);
    288 @@ -1571,7 +1578,9 @@ static void binder_transaction(struct binder_proc *proc,
    289 fp->type = BINDER_TYPE_HANDLE;
    290 else
    291 fp->type = BINDER_TYPE_WEAK_HANDLE;
    292 + fp->binder = 0;
    293 fp->handle = ref->desc;
    294 + fp->cookie = 0;
    295 binder_inc_ref(ref, fp->type == BINDER_TYPE_HANDLE,
    296 &thread->todo);
    297
    298 @@ -1583,7 +1592,10 @@ static void binder_transaction(struct binder_proc *proc,
    299 } break;
    300 case BINDER_TYPE_HANDLE:
    301 case BINDER_TYPE_WEAK_HANDLE: {
    302 - struct binder_ref *ref = binder_get_ref(proc, fp->handle);
    303 + struct binder_ref *ref;
    304 +
    305 + ref = binder_get_ref(proc, fp->handle,
    306 + fp->type == BINDER_TYPE_HANDLE);
    307
    308 if (ref == NULL) {
    309 binder_user_error("%d:%d got transaction with invalid handle, %d\n",
    310 @@ -1618,7 +1630,9 @@ static void binder_transaction(struct binder_proc *proc,
    311 return_error = BR_FAILED_REPLY;
    312 goto err_binder_get_ref_for_node_failed;
    313 }
    314 + fp->binder = 0;
    315 fp->handle = new_ref->desc;
    316 + fp->cookie = 0;
    317 binder_inc_ref(new_ref, fp->type == BINDER_TYPE_HANDLE, NULL);
    318 trace_binder_transaction_ref_to_ref(t, ref,
    319 new_ref);
    320 @@ -1672,6 +1686,7 @@ static void binder_transaction(struct binder_proc *proc,
    321 binder_debug(BINDER_DEBUG_TRANSACTION,
    322 " fd %d -> %d\n", fp->handle, target_fd);
    323 /* TODO: fput? */
    324 + fp->binder = 0;
    325 fp->handle = target_fd;
    326 } break;
    327
    328 @@ -1794,7 +1809,9 @@ static int binder_thread_write(struct binder_proc *proc,
    329 ref->desc);
    330 }
    331 } else
    332 - ref = binder_get_ref(proc, target);
    333 + ref = binder_get_ref(proc, target,
    334 + cmd == BC_ACQUIRE ||
    335 + cmd == BC_RELEASE);
    336 if (ref == NULL) {
    337 binder_user_error("%d:%d refcount change on invalid ref %d\n",
    338 proc->pid, thread->pid, target);
    339 @@ -1990,7 +2007,7 @@ static int binder_thread_write(struct binder_proc *proc,
    340 if (get_user(cookie, (binder_uintptr_t __user *)ptr))
    341 return -EFAULT;
    342 ptr += sizeof(binder_uintptr_t);
    343 - ref = binder_get_ref(proc, target);
    344 + ref = binder_get_ref(proc, target, false);
    345 if (ref == NULL) {
    346 binder_user_error("%d:%d %s invalid ref %d\n",
    347 proc->pid, thread->pid,
    348 diff --git a/drivers/char/virtio_console.c b/drivers/char/virtio_console.c
    349 index d2406fe25533..090183f812be 100644
    350 --- a/drivers/char/virtio_console.c
    351 +++ b/drivers/char/virtio_console.c
    352 @@ -1533,19 +1533,29 @@ static void remove_port_data(struct port *port)
    353 spin_lock_irq(&port->inbuf_lock);
    354 /* Remove unused data this port might have received. */
    355 discard_port_data(port);
    356 + spin_unlock_irq(&port->inbuf_lock);
    357
    358 /* Remove buffers we queued up for the Host to send us data in. */
    359 - while ((buf = virtqueue_detach_unused_buf(port->in_vq)))
    360 - free_buf(buf, true);
    361 - spin_unlock_irq(&port->inbuf_lock);
    362 + do {
    363 + spin_lock_irq(&port->inbuf_lock);
    364 + buf = virtqueue_detach_unused_buf(port->in_vq);
    365 + spin_unlock_irq(&port->inbuf_lock);
    366 + if (buf)
    367 + free_buf(buf, true);
    368 + } while (buf);
    369
    370 spin_lock_irq(&port->outvq_lock);
    371 reclaim_consumed_buffers(port);
    372 + spin_unlock_irq(&port->outvq_lock);
    373
    374 /* Free pending buffers from the out-queue. */
    375 - while ((buf = virtqueue_detach_unused_buf(port->out_vq)))
    376 - free_buf(buf, true);
    377 - spin_unlock_irq(&port->outvq_lock);
    378 + do {
    379 + spin_lock_irq(&port->outvq_lock);
    380 + buf = virtqueue_detach_unused_buf(port->out_vq);
    381 + spin_unlock_irq(&port->outvq_lock);
    382 + if (buf)
    383 + free_buf(buf, true);
    384 + } while (buf);
    385 }
    386
    387 /*
    388 diff --git a/drivers/firewire/net.c b/drivers/firewire/net.c
    389 index f4ea80d602f7..b9d2f76a0cf7 100644
    390 --- a/drivers/firewire/net.c
    391 +++ b/drivers/firewire/net.c
    392 @@ -73,13 +73,13 @@ struct rfc2734_header {
    393
    394 #define fwnet_get_hdr_lf(h) (((h)->w0 & 0xc0000000) >> 30)
    395 #define fwnet_get_hdr_ether_type(h) (((h)->w0 & 0x0000ffff))
    396 -#define fwnet_get_hdr_dg_size(h) (((h)->w0 & 0x0fff0000) >> 16)
    397 +#define fwnet_get_hdr_dg_size(h) ((((h)->w0 & 0x0fff0000) >> 16) + 1)
    398 #define fwnet_get_hdr_fg_off(h) (((h)->w0 & 0x00000fff))
    399 #define fwnet_get_hdr_dgl(h) (((h)->w1 & 0xffff0000) >> 16)
    400
    401 -#define fwnet_set_hdr_lf(lf) ((lf) << 30)
    402 +#define fwnet_set_hdr_lf(lf) ((lf) << 30)
    403 #define fwnet_set_hdr_ether_type(et) (et)
    404 -#define fwnet_set_hdr_dg_size(dgs) ((dgs) << 16)
    405 +#define fwnet_set_hdr_dg_size(dgs) (((dgs) - 1) << 16)
    406 #define fwnet_set_hdr_fg_off(fgo) (fgo)
    407
    408 #define fwnet_set_hdr_dgl(dgl) ((dgl) << 16)
    409 @@ -578,6 +578,9 @@ static int fwnet_incoming_packet(struct fwnet_device *dev, __be32 *buf, int len,
    410 int retval;
    411 u16 ether_type;
    412
    413 + if (len <= RFC2374_UNFRAG_HDR_SIZE)
    414 + return 0;
    415 +
    416 hdr.w0 = be32_to_cpu(buf[0]);
    417 lf = fwnet_get_hdr_lf(&hdr);
    418 if (lf == RFC2374_HDR_UNFRAG) {
    419 @@ -602,7 +605,12 @@ static int fwnet_incoming_packet(struct fwnet_device *dev, __be32 *buf, int len,
    420 return fwnet_finish_incoming_packet(net, skb, source_node_id,
    421 is_broadcast, ether_type);
    422 }
    423 +
    424 /* A datagram fragment has been received, now the fun begins. */
    425 +
    426 + if (len <= RFC2374_FRAG_HDR_SIZE)
    427 + return 0;
    428 +
    429 hdr.w1 = ntohl(buf[1]);
    430 buf += 2;
    431 len -= RFC2374_FRAG_HDR_SIZE;
    432 @@ -614,7 +622,10 @@ static int fwnet_incoming_packet(struct fwnet_device *dev, __be32 *buf, int len,
    433 fg_off = fwnet_get_hdr_fg_off(&hdr);
    434 }
    435 datagram_label = fwnet_get_hdr_dgl(&hdr);
    436 - dg_size = fwnet_get_hdr_dg_size(&hdr); /* ??? + 1 */
    437 + dg_size = fwnet_get_hdr_dg_size(&hdr);
    438 +
    439 + if (fg_off + len > dg_size)
    440 + return 0;
    441
    442 spin_lock_irqsave(&dev->lock, flags);
    443
    444 @@ -722,6 +733,22 @@ static void fwnet_receive_packet(struct fw_card *card, struct fw_request *r,
    445 fw_send_response(card, r, rcode);
    446 }
    447
    448 +static int gasp_source_id(__be32 *p)
    449 +{
    450 + return be32_to_cpu(p[0]) >> 16;
    451 +}
    452 +
    453 +static u32 gasp_specifier_id(__be32 *p)
    454 +{
    455 + return (be32_to_cpu(p[0]) & 0xffff) << 8 |
    456 + (be32_to_cpu(p[1]) & 0xff000000) >> 24;
    457 +}
    458 +
    459 +static u32 gasp_version(__be32 *p)
    460 +{
    461 + return be32_to_cpu(p[1]) & 0xffffff;
    462 +}
    463 +
    464 static void fwnet_receive_broadcast(struct fw_iso_context *context,
    465 u32 cycle, size_t header_length, void *header, void *data)
    466 {
    467 @@ -731,9 +758,6 @@ static void fwnet_receive_broadcast(struct fw_iso_context *context,
    468 __be32 *buf_ptr;
    469 int retval;
    470 u32 length;
    471 - u16 source_node_id;
    472 - u32 specifier_id;
    473 - u32 ver;
    474 unsigned long offset;
    475 unsigned long flags;
    476
    477 @@ -750,22 +774,17 @@ static void fwnet_receive_broadcast(struct fw_iso_context *context,
    478
    479 spin_unlock_irqrestore(&dev->lock, flags);
    480
    481 - specifier_id = (be32_to_cpu(buf_ptr[0]) & 0xffff) << 8
    482 - | (be32_to_cpu(buf_ptr[1]) & 0xff000000) >> 24;
    483 - ver = be32_to_cpu(buf_ptr[1]) & 0xffffff;
    484 - source_node_id = be32_to_cpu(buf_ptr[0]) >> 16;
    485 -
    486 - if (specifier_id == IANA_SPECIFIER_ID &&
    487 - (ver == RFC2734_SW_VERSION
    488 + if (length > IEEE1394_GASP_HDR_SIZE &&
    489 + gasp_specifier_id(buf_ptr) == IANA_SPECIFIER_ID &&
    490 + (gasp_version(buf_ptr) == RFC2734_SW_VERSION
    491 #if IS_ENABLED(CONFIG_IPV6)
    492 - || ver == RFC3146_SW_VERSION
    493 + || gasp_version(buf_ptr) == RFC3146_SW_VERSION
    494 #endif
    495 - )) {
    496 - buf_ptr += 2;
    497 - length -= IEEE1394_GASP_HDR_SIZE;
    498 - fwnet_incoming_packet(dev, buf_ptr, length, source_node_id,
    499 + ))
    500 + fwnet_incoming_packet(dev, buf_ptr + 2,
    501 + length - IEEE1394_GASP_HDR_SIZE,
    502 + gasp_source_id(buf_ptr),
    503 context->card->generation, true);
    504 - }
    505
    506 packet.payload_length = dev->rcv_buffer_size;
    507 packet.interrupt = 1;
    508 diff --git a/drivers/gpu/drm/drm_dp_mst_topology.c b/drivers/gpu/drm/drm_dp_mst_topology.c
    509 index 2485fb652716..7cb2815e815e 100644
    510 --- a/drivers/gpu/drm/drm_dp_mst_topology.c
    511 +++ b/drivers/gpu/drm/drm_dp_mst_topology.c
    512 @@ -909,6 +909,7 @@ static void drm_dp_destroy_port(struct kref *kref)
    513 /* no need to clean up vcpi
    514 * as if we have no connector we never setup a vcpi */
    515 drm_dp_port_teardown_pdt(port, port->pdt);
    516 + port->pdt = DP_PEER_DEVICE_NONE;
    517 }
    518 kfree(port);
    519 }
    520 @@ -1154,7 +1155,9 @@ static void drm_dp_add_port(struct drm_dp_mst_branch *mstb,
    521 drm_dp_put_port(port);
    522 goto out;
    523 }
    524 - if (port->port_num >= DP_MST_LOGICAL_PORT_0) {
    525 + if ((port->pdt == DP_PEER_DEVICE_DP_LEGACY_CONV ||
    526 + port->pdt == DP_PEER_DEVICE_SST_SINK) &&
    527 + port->port_num >= DP_MST_LOGICAL_PORT_0) {
    528 port->cached_edid = drm_get_edid(port->connector, &port->aux.ddc);
    529 drm_mode_connector_set_tile_property(port->connector);
    530 }
    531 @@ -2872,6 +2875,7 @@ static void drm_dp_destroy_connector_work(struct work_struct *work)
    532 mgr->cbs->destroy_connector(mgr, port->connector);
    533
    534 drm_dp_port_teardown_pdt(port, port->pdt);
    535 + port->pdt = DP_PEER_DEVICE_NONE;
    536
    537 if (!port->input && port->vcpi.vcpi > 0) {
    538 drm_dp_mst_reset_vcpi_slots(mgr, port);
    539 diff --git a/drivers/gpu/drm/exynos/exynos_drm_core.c b/drivers/gpu/drm/exynos/exynos_drm_core.c
    540 index 7f55ba6771c6..011211e4167d 100644
    541 --- a/drivers/gpu/drm/exynos/exynos_drm_core.c
    542 +++ b/drivers/gpu/drm/exynos/exynos_drm_core.c
    543 @@ -101,7 +101,7 @@ int exynos_drm_subdrv_open(struct drm_device *dev, struct drm_file *file)
    544 return 0;
    545
    546 err:
    547 - list_for_each_entry_reverse(subdrv, &subdrv->list, list) {
    548 + list_for_each_entry_continue_reverse(subdrv, &exynos_drm_subdrv_list, list) {
    549 if (subdrv->close)
    550 subdrv->close(dev, subdrv->dev, file);
    551 }
    552 diff --git a/drivers/gpu/drm/radeon/ni.c b/drivers/gpu/drm/radeon/ni.c
    553 index 158872eb78e4..a3a321208fd8 100644
    554 --- a/drivers/gpu/drm/radeon/ni.c
    555 +++ b/drivers/gpu/drm/radeon/ni.c
    556 @@ -1396,9 +1396,7 @@ static void cayman_pcie_gart_fini(struct radeon_device *rdev)
    557 void cayman_cp_int_cntl_setup(struct radeon_device *rdev,
    558 int ring, u32 cp_int_cntl)
    559 {
    560 - u32 srbm_gfx_cntl = RREG32(SRBM_GFX_CNTL) & ~3;
    561 -
    562 - WREG32(SRBM_GFX_CNTL, srbm_gfx_cntl | (ring & 3));
    563 + WREG32(SRBM_GFX_CNTL, RINGID(ring));
    564 WREG32(CP_INT_CNTL, cp_int_cntl);
    565 }
    566
    567 diff --git a/drivers/gpu/drm/radeon/radeon_dp_auxch.c b/drivers/gpu/drm/radeon/radeon_dp_auxch.c
    568 index db64e0062689..3b0c229d7dcd 100644
    569 --- a/drivers/gpu/drm/radeon/radeon_dp_auxch.c
    570 +++ b/drivers/gpu/drm/radeon/radeon_dp_auxch.c
    571 @@ -105,7 +105,7 @@ radeon_dp_aux_transfer_native(struct drm_dp_aux *aux, struct drm_dp_aux_msg *msg
    572
    573 tmp &= AUX_HPD_SEL(0x7);
    574 tmp |= AUX_HPD_SEL(chan->rec.hpd);
    575 - tmp |= AUX_EN | AUX_LS_READ_EN | AUX_HPD_DISCON(0x1);
    576 + tmp |= AUX_EN | AUX_LS_READ_EN;
    577
    578 WREG32(AUX_CONTROL + aux_offset[instance], tmp);
    579
    580 diff --git a/drivers/gpu/drm/radeon/si_dpm.c b/drivers/gpu/drm/radeon/si_dpm.c
    581 index 472e0771832e..10191b935937 100644
    582 --- a/drivers/gpu/drm/radeon/si_dpm.c
    583 +++ b/drivers/gpu/drm/radeon/si_dpm.c
    584 @@ -2999,6 +2999,49 @@ static void si_apply_state_adjust_rules(struct radeon_device *rdev,
    585 int i;
    586 struct si_dpm_quirk *p = si_dpm_quirk_list;
    587
    588 + /* limit all SI kickers */
    589 + if (rdev->family == CHIP_PITCAIRN) {
    590 + if ((rdev->pdev->revision == 0x81) ||
    591 + (rdev->pdev->device == 0x6810) ||
    592 + (rdev->pdev->device == 0x6811) ||
    593 + (rdev->pdev->device == 0x6816) ||
    594 + (rdev->pdev->device == 0x6817) ||
    595 + (rdev->pdev->device == 0x6806))
    596 + max_mclk = 120000;
    597 + } else if (rdev->family == CHIP_VERDE) {
    598 + if ((rdev->pdev->revision == 0x81) ||
    599 + (rdev->pdev->revision == 0x83) ||
    600 + (rdev->pdev->revision == 0x87) ||
    601 + (rdev->pdev->device == 0x6820) ||
    602 + (rdev->pdev->device == 0x6821) ||
    603 + (rdev->pdev->device == 0x6822) ||
    604 + (rdev->pdev->device == 0x6823) ||
    605 + (rdev->pdev->device == 0x682A) ||
    606 + (rdev->pdev->device == 0x682B)) {
    607 + max_sclk = 75000;
    608 + max_mclk = 80000;
    609 + }
    610 + } else if (rdev->family == CHIP_OLAND) {
    611 + if ((rdev->pdev->revision == 0xC7) ||
    612 + (rdev->pdev->revision == 0x80) ||
    613 + (rdev->pdev->revision == 0x81) ||
    614 + (rdev->pdev->revision == 0x83) ||
    615 + (rdev->pdev->device == 0x6604) ||
    616 + (rdev->pdev->device == 0x6605)) {
    617 + max_sclk = 75000;
    618 + max_mclk = 80000;
    619 + }
    620 + } else if (rdev->family == CHIP_HAINAN) {
    621 + if ((rdev->pdev->revision == 0x81) ||
    622 + (rdev->pdev->revision == 0x83) ||
    623 + (rdev->pdev->revision == 0xC3) ||
    624 + (rdev->pdev->device == 0x6664) ||
    625 + (rdev->pdev->device == 0x6665) ||
    626 + (rdev->pdev->device == 0x6667)) {
    627 + max_sclk = 75000;
    628 + max_mclk = 80000;
    629 + }
    630 + }
    631 /* Apply dpm quirks */
    632 while (p && p->chip_device != 0) {
    633 if (rdev->pdev->vendor == p->chip_vendor &&
    634 @@ -3011,16 +3054,6 @@ static void si_apply_state_adjust_rules(struct radeon_device *rdev,
    635 }
    636 ++p;
    637 }
    638 - /* limit mclk on all R7 370 parts for stability */
    639 - if (rdev->pdev->device == 0x6811 &&
    640 - rdev->pdev->revision == 0x81)
    641 - max_mclk = 120000;
    642 - /* limit sclk/mclk on Jet parts for stability */
    643 - if (rdev->pdev->device == 0x6665 &&
    644 - rdev->pdev->revision == 0xc3) {
    645 - max_sclk = 75000;
    646 - max_mclk = 80000;
    647 - }
    648
    649 if (rps->vce_active) {
    650 rps->evclk = rdev->pm.dpm.vce_states[rdev->pm.dpm.vce_level].evclk;
    651 diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h
    652 index 909ab0176ef2..e37030624165 100644
    653 --- a/drivers/hid/hid-ids.h
    654 +++ b/drivers/hid/hid-ids.h
    655 @@ -168,6 +168,7 @@
    656 #define USB_DEVICE_ID_ATEN_4PORTKVM 0x2205
    657 #define USB_DEVICE_ID_ATEN_4PORTKVMC 0x2208
    658 #define USB_DEVICE_ID_ATEN_CS682 0x2213
    659 +#define USB_DEVICE_ID_ATEN_CS692 0x8021
    660
    661 #define USB_VENDOR_ID_ATMEL 0x03eb
    662 #define USB_DEVICE_ID_ATMEL_MULTITOUCH 0x211c
    663 diff --git a/drivers/hid/usbhid/hid-quirks.c b/drivers/hid/usbhid/hid-quirks.c
    664 index dc8e6adf95a4..6ca6ab00fa93 100644
    665 --- a/drivers/hid/usbhid/hid-quirks.c
    666 +++ b/drivers/hid/usbhid/hid-quirks.c
    667 @@ -61,6 +61,7 @@ static const struct hid_blacklist {
    668 { USB_VENDOR_ID_ATEN, USB_DEVICE_ID_ATEN_4PORTKVM, HID_QUIRK_NOGET },
    669 { USB_VENDOR_ID_ATEN, USB_DEVICE_ID_ATEN_4PORTKVMC, HID_QUIRK_NOGET },
    670 { USB_VENDOR_ID_ATEN, USB_DEVICE_ID_ATEN_CS682, HID_QUIRK_NOGET },
    671 + { USB_VENDOR_ID_ATEN, USB_DEVICE_ID_ATEN_CS692, HID_QUIRK_NOGET },
    672 { USB_VENDOR_ID_CH, USB_DEVICE_ID_CH_FIGHTERSTICK, HID_QUIRK_NOGET },
    673 { USB_VENDOR_ID_CH, USB_DEVICE_ID_CH_COMBATSTICK, HID_QUIRK_NOGET },
    674 { USB_VENDOR_ID_CH, USB_DEVICE_ID_CH_FLIGHT_SIM_ECLIPSE_YOKE, HID_QUIRK_NOGET },
    675 diff --git a/drivers/hv/hv_util.c b/drivers/hv/hv_util.c
    676 index 7994ec2e4151..41f5896224bd 100644
    677 --- a/drivers/hv/hv_util.c
    678 +++ b/drivers/hv/hv_util.c
    679 @@ -283,10 +283,14 @@ static void heartbeat_onchannelcallback(void *context)
    680 u8 *hbeat_txf_buf = util_heartbeat.recv_buffer;
    681 struct icmsg_negotiate *negop = NULL;
    682
    683 - vmbus_recvpacket(channel, hbeat_txf_buf,
    684 - PAGE_SIZE, &recvlen, &requestid);
    685 + while (1) {
    686 +
    687 + vmbus_recvpacket(channel, hbeat_txf_buf,
    688 + PAGE_SIZE, &recvlen, &requestid);
    689 +
    690 + if (!recvlen)
    691 + break;
    692
    693 - if (recvlen > 0) {
    694 icmsghdrp = (struct icmsg_hdr *)&hbeat_txf_buf[
    695 sizeof(struct vmbuspipe_hdr)];
    696
    697 diff --git a/drivers/i2c/busses/i2c-xgene-slimpro.c b/drivers/i2c/busses/i2c-xgene-slimpro.c
    698 index 4233f5695352..3c38029e3fe9 100644
    699 --- a/drivers/i2c/busses/i2c-xgene-slimpro.c
    700 +++ b/drivers/i2c/busses/i2c-xgene-slimpro.c
    701 @@ -105,7 +105,7 @@ struct slimpro_i2c_dev {
    702 struct mbox_chan *mbox_chan;
    703 struct mbox_client mbox_client;
    704 struct completion rd_complete;
    705 - u8 dma_buffer[I2C_SMBUS_BLOCK_MAX];
    706 + u8 dma_buffer[I2C_SMBUS_BLOCK_MAX + 1]; /* dma_buffer[0] is used for length */
    707 u32 *resp_msg;
    708 };
    709
    710 diff --git a/drivers/i2c/i2c-core.c b/drivers/i2c/i2c-core.c
    711 index ba8eb087f224..d625167357cc 100644
    712 --- a/drivers/i2c/i2c-core.c
    713 +++ b/drivers/i2c/i2c-core.c
    714 @@ -1876,6 +1876,7 @@ int i2c_register_driver(struct module *owner, struct i2c_driver *driver)
    715 /* add the driver to the list of i2c drivers in the driver core */
    716 driver->driver.owner = owner;
    717 driver->driver.bus = &i2c_bus_type;
    718 + INIT_LIST_HEAD(&driver->clients);
    719
    720 /* When registration returns, the driver core
    721 * will have called probe() for all matching-but-unbound devices.
    722 @@ -1886,7 +1887,6 @@ int i2c_register_driver(struct module *owner, struct i2c_driver *driver)
    723
    724 pr_debug("i2c-core: driver [%s] registered\n", driver->driver.name);
    725
    726 - INIT_LIST_HEAD(&driver->clients);
    727 /* Walk the adapters that are already present */
    728 i2c_for_each_dev(driver, __process_new_driver);
    729
    730 diff --git a/drivers/input/serio/i8042-x86ia64io.h b/drivers/input/serio/i8042-x86ia64io.h
    731 index f4bfb4b2d50a..073246c7d163 100644
    732 --- a/drivers/input/serio/i8042-x86ia64io.h
    733 +++ b/drivers/input/serio/i8042-x86ia64io.h
    734 @@ -877,6 +877,13 @@ static const struct dmi_system_id __initconst i8042_dmi_kbdreset_table[] = {
    735 DMI_MATCH(DMI_PRODUCT_NAME, "P34"),
    736 },
    737 },
    738 + {
    739 + /* Schenker XMG C504 - Elantech touchpad */
    740 + .matches = {
    741 + DMI_MATCH(DMI_SYS_VENDOR, "XMG"),
    742 + DMI_MATCH(DMI_PRODUCT_NAME, "C504"),
    743 + },
    744 + },
    745 { }
    746 };
    747
    748 diff --git a/drivers/md/dm-raid1.c b/drivers/md/dm-raid1.c
    749 index f2a363a89629..115bd3846c3f 100644
    750 --- a/drivers/md/dm-raid1.c
    751 +++ b/drivers/md/dm-raid1.c
    752 @@ -1288,6 +1288,7 @@ static int mirror_end_io(struct dm_target *ti, struct bio *bio, int error)
    753
    754 dm_bio_restore(bd, bio);
    755 bio_record->details.bi_bdev = NULL;
    756 + bio->bi_error = 0;
    757
    758 queue_bio(ms, bio, rw);
    759 return DM_ENDIO_INCOMPLETE;
    760 diff --git a/drivers/md/dm.c b/drivers/md/dm.c
    761 index 84aa8b1d0480..3384a3eef917 100644
    762 --- a/drivers/md/dm.c
    763 +++ b/drivers/md/dm.c
    764 @@ -2260,8 +2260,6 @@ static void cleanup_mapped_device(struct mapped_device *md)
    765 if (md->bs)
    766 bioset_free(md->bs);
    767
    768 - cleanup_srcu_struct(&md->io_barrier);
    769 -
    770 if (md->disk) {
    771 spin_lock(&_minor_lock);
    772 md->disk->private_data = NULL;
    773 @@ -2273,6 +2271,8 @@ static void cleanup_mapped_device(struct mapped_device *md)
    774 if (md->queue)
    775 blk_cleanup_queue(md->queue);
    776
    777 + cleanup_srcu_struct(&md->io_barrier);
    778 +
    779 if (md->bdev) {
    780 bdput(md->bdev);
    781 md->bdev = NULL;
    782 diff --git a/drivers/misc/genwqe/card_utils.c b/drivers/misc/genwqe/card_utils.c
    783 index 222367cc8c81..524660510599 100644
    784 --- a/drivers/misc/genwqe/card_utils.c
    785 +++ b/drivers/misc/genwqe/card_utils.c
    786 @@ -352,17 +352,27 @@ int genwqe_alloc_sync_sgl(struct genwqe_dev *cd, struct genwqe_sgl *sgl,
    787 if (copy_from_user(sgl->lpage, user_addr + user_size -
    788 sgl->lpage_size, sgl->lpage_size)) {
    789 rc = -EFAULT;
    790 - goto err_out1;
    791 + goto err_out2;
    792 }
    793 }
    794 return 0;
    795
    796 + err_out2:
    797 + __genwqe_free_consistent(cd, PAGE_SIZE, sgl->lpage,
    798 + sgl->lpage_dma_addr);
    799 + sgl->lpage = NULL;
    800 + sgl->lpage_dma_addr = 0;
    801 err_out1:
    802 __genwqe_free_consistent(cd, PAGE_SIZE, sgl->fpage,
    803 sgl->fpage_dma_addr);
    804 + sgl->fpage = NULL;
    805 + sgl->fpage_dma_addr = 0;
    806 err_out:
    807 __genwqe_free_consistent(cd, sgl->sgl_size, sgl->sgl,
    808 sgl->sgl_dma_addr);
    809 + sgl->sgl = NULL;
    810 + sgl->sgl_dma_addr = 0;
    811 + sgl->sgl_size = 0;
    812 return -ENOMEM;
    813 }
    814
    815 diff --git a/drivers/misc/mei/hw-txe.c b/drivers/misc/mei/hw-txe.c
    816 index bae680c648ff..396d75d9fb11 100644
    817 --- a/drivers/misc/mei/hw-txe.c
    818 +++ b/drivers/misc/mei/hw-txe.c
    819 @@ -972,11 +972,13 @@ static bool mei_txe_check_and_ack_intrs(struct mei_device *dev, bool do_ack)
    820 hisr = mei_txe_br_reg_read(hw, HISR_REG);
    821
    822 aliveness = mei_txe_aliveness_get(dev);
    823 - if (hhisr & IPC_HHIER_SEC && aliveness)
    824 + if (hhisr & IPC_HHIER_SEC && aliveness) {
    825 ipc_isr = mei_txe_sec_reg_read_silent(hw,
    826 SEC_IPC_HOST_INT_STATUS_REG);
    827 - else
    828 + } else {
    829 ipc_isr = 0;
    830 + hhisr &= ~IPC_HHIER_SEC;
    831 + }
    832
    833 generated = generated ||
    834 (hisr & HISR_INT_STS_MSK) ||
    835 diff --git a/drivers/mmc/host/dw_mmc-pltfm.c b/drivers/mmc/host/dw_mmc-pltfm.c
    836 index 81bdeeb05a4d..7dcfb1d5034f 100644
    837 --- a/drivers/mmc/host/dw_mmc-pltfm.c
    838 +++ b/drivers/mmc/host/dw_mmc-pltfm.c
    839 @@ -59,12 +59,13 @@ int dw_mci_pltfm_register(struct platform_device *pdev,
    840 host->pdata = pdev->dev.platform_data;
    841
    842 regs = platform_get_resource(pdev, IORESOURCE_MEM, 0);
    843 - /* Get registers' physical base address */
    844 - host->phy_regs = regs->start;
    845 host->regs = devm_ioremap_resource(&pdev->dev, regs);
    846 if (IS_ERR(host->regs))
    847 return PTR_ERR(host->regs);
    848
    849 + /* Get registers' physical base address */
    850 + host->phy_regs = regs->start;
    851 +
    852 platform_set_drvdata(pdev, host);
    853 return dw_mci_probe(host);
    854 }
    855 diff --git a/drivers/mtd/ubi/fastmap.c b/drivers/mtd/ubi/fastmap.c
    856 index 990898b9dc72..bba7dd1b5ebf 100644
    857 --- a/drivers/mtd/ubi/fastmap.c
    858 +++ b/drivers/mtd/ubi/fastmap.c
    859 @@ -513,10 +513,11 @@ static int scan_pool(struct ubi_device *ubi, struct ubi_attach_info *ai,
    860 unsigned long long ec = be64_to_cpu(ech->ec);
    861 unmap_peb(ai, pnum);
    862 dbg_bld("Adding PEB to free: %i", pnum);
    863 +
    864 if (err == UBI_IO_FF_BITFLIPS)
    865 - add_aeb(ai, free, pnum, ec, 1);
    866 - else
    867 - add_aeb(ai, free, pnum, ec, 0);
    868 + scrub = 1;
    869 +
    870 + add_aeb(ai, free, pnum, ec, scrub);
    871 continue;
    872 } else if (err == 0 || err == UBI_IO_BITFLIPS) {
    873 dbg_bld("Found non empty PEB:%i in pool", pnum);
    874 @@ -748,11 +749,11 @@ static int ubi_attach_fastmap(struct ubi_device *ubi,
    875 fmvhdr->vol_type,
    876 be32_to_cpu(fmvhdr->last_eb_bytes));
    877
    878 - if (!av)
    879 - goto fail_bad;
    880 - if (PTR_ERR(av) == -EINVAL) {
    881 - ubi_err(ubi, "volume (ID %i) already exists",
    882 - fmvhdr->vol_id);
    883 + if (IS_ERR(av)) {
    884 + if (PTR_ERR(av) == -EEXIST)
    885 + ubi_err(ubi, "volume (ID %i) already exists",
    886 + fmvhdr->vol_id);
    887 +
    888 goto fail_bad;
    889 }
    890
    891 diff --git a/drivers/net/ethernet/smsc/smc91x.c b/drivers/net/ethernet/smsc/smc91x.c
    892 index 8c44cf6ff7a2..23a038810083 100644
    893 --- a/drivers/net/ethernet/smsc/smc91x.c
    894 +++ b/drivers/net/ethernet/smsc/smc91x.c
    895 @@ -540,7 +540,7 @@ static inline void smc_rcv(struct net_device *dev)
    896 #define smc_special_lock(lock, flags) spin_lock_irqsave(lock, flags)
    897 #define smc_special_unlock(lock, flags) spin_unlock_irqrestore(lock, flags)
    898 #else
    899 -#define smc_special_trylock(lock, flags) (flags == flags)
    900 +#define smc_special_trylock(lock, flags) ((void)flags, true)
    901 #define smc_special_lock(lock, flags) do { flags = 0; } while (0)
    902 #define smc_special_unlock(lock, flags) do { flags = 0; } while (0)
    903 #endif
    904 diff --git a/drivers/pwm/core.c b/drivers/pwm/core.c
    905 index 7831bc6b51dd..ec84ff8ad1b4 100644
    906 --- a/drivers/pwm/core.c
    907 +++ b/drivers/pwm/core.c
    908 @@ -321,6 +321,8 @@ int pwmchip_remove(struct pwm_chip *chip)
    909 unsigned int i;
    910 int ret = 0;
    911
    912 + pwmchip_sysfs_unexport_children(chip);
    913 +
    914 mutex_lock(&pwm_lock);
    915
    916 for (i = 0; i < chip->npwm; i++) {
    917 diff --git a/drivers/pwm/sysfs.c b/drivers/pwm/sysfs.c
    918 index 9c90886f4123..c20163b92991 100644
    919 --- a/drivers/pwm/sysfs.c
    920 +++ b/drivers/pwm/sysfs.c
    921 @@ -350,6 +350,24 @@ void pwmchip_sysfs_unexport(struct pwm_chip *chip)
    922 }
    923 }
    924
    925 +void pwmchip_sysfs_unexport_children(struct pwm_chip *chip)
    926 +{
    927 + struct device *parent;
    928 + unsigned int i;
    929 +
    930 + parent = class_find_device(&pwm_class, NULL, chip,
    931 + pwmchip_sysfs_match);
    932 + if (!parent)
    933 + return;
    934 +
    935 + for (i = 0; i < chip->npwm; i++) {
    936 + struct pwm_device *pwm = &chip->pwms[i];
    937 +
    938 + if (test_bit(PWMF_EXPORTED, &pwm->flags))
    939 + pwm_unexport_child(parent, pwm);
    940 + }
    941 +}
    942 +
    943 static int __init pwm_sysfs_init(void)
    944 {
    945 return class_register(&pwm_class);
    946 diff --git a/drivers/scsi/arcmsr/arcmsr_hba.c b/drivers/scsi/arcmsr/arcmsr_hba.c
    947 index 8db9f3a5844d..7aa01c1960ea 100644
    948 --- a/drivers/scsi/arcmsr/arcmsr_hba.c
    949 +++ b/drivers/scsi/arcmsr/arcmsr_hba.c
    950 @@ -2545,18 +2545,9 @@ static int arcmsr_queue_command_lck(struct scsi_cmnd *cmd,
    951 struct AdapterControlBlock *acb = (struct AdapterControlBlock *) host->hostdata;
    952 struct CommandControlBlock *ccb;
    953 int target = cmd->device->id;
    954 - int lun = cmd->device->lun;
    955 - uint8_t scsicmd = cmd->cmnd[0];
    956 cmd->scsi_done = done;
    957 cmd->host_scribble = NULL;
    958 cmd->result = 0;
    959 - if ((scsicmd == SYNCHRONIZE_CACHE) ||(scsicmd == SEND_DIAGNOSTIC)){
    960 - if(acb->devstate[target][lun] == ARECA_RAID_GONE) {
    961 - cmd->result = (DID_NO_CONNECT << 16);
    962 - }
    963 - cmd->scsi_done(cmd);
    964 - return 0;
    965 - }
    966 if (target == 16) {
    967 /* virtual device for iop message transfer */
    968 arcmsr_handle_virtual_command(acb, cmd);
    969 diff --git a/drivers/scsi/megaraid/megaraid_sas_base.c b/drivers/scsi/megaraid/megaraid_sas_base.c
    970 index 278e10cd771f..17c440b9d086 100644
    971 --- a/drivers/scsi/megaraid/megaraid_sas_base.c
    972 +++ b/drivers/scsi/megaraid/megaraid_sas_base.c
    973 @@ -1688,16 +1688,13 @@ megasas_queue_command(struct Scsi_Host *shost, struct scsi_cmnd *scmd)
    974 goto out_done;
    975 }
    976
    977 - switch (scmd->cmnd[0]) {
    978 - case SYNCHRONIZE_CACHE:
    979 - /*
    980 - * FW takes care of flush cache on its own
    981 - * No need to send it down
    982 - */
    983 + /*
    984 + * FW takes care of flush cache on its own for Virtual Disk.
    985 + * No need to send it down for VD. For JBOD send SYNCHRONIZE_CACHE to FW.
    986 + */
    987 + if ((scmd->cmnd[0] == SYNCHRONIZE_CACHE) && MEGASAS_IS_LOGICAL(scmd)) {
    988 scmd->result = DID_OK << 16;
    989 goto out_done;
    990 - default:
    991 - break;
    992 }
    993
    994 if (instance->instancet->build_and_issue_cmd(instance, scmd)) {
    995 diff --git a/drivers/scsi/scsi_debug.c b/drivers/scsi/scsi_debug.c
    996 index d09d60293c27..e357a393d56e 100644
    997 --- a/drivers/scsi/scsi_debug.c
    998 +++ b/drivers/scsi/scsi_debug.c
    999 @@ -4981,6 +4981,7 @@ static void __exit scsi_debug_exit(void)
    1000 bus_unregister(&pseudo_lld_bus);
    1001 root_device_unregister(pseudo_primary);
    1002
    1003 + vfree(map_storep);
    1004 vfree(dif_storep);
    1005 vfree(fake_storep);
    1006 }
    1007 diff --git a/drivers/tty/vt/vt.c b/drivers/tty/vt/vt.c
    1008 index 136ebaaa9cc0..5ab54ef4f304 100644
    1009 --- a/drivers/tty/vt/vt.c
    1010 +++ b/drivers/tty/vt/vt.c
    1011 @@ -872,10 +872,15 @@ static int vc_do_resize(struct tty_struct *tty, struct vc_data *vc,
    1012 if (new_cols == vc->vc_cols && new_rows == vc->vc_rows)
    1013 return 0;
    1014
    1015 + if (new_screen_size > (4 << 20))
    1016 + return -EINVAL;
    1017 newscreen = kmalloc(new_screen_size, GFP_USER);
    1018 if (!newscreen)
    1019 return -ENOMEM;
    1020
    1021 + if (vc == sel_cons)
    1022 + clear_selection();
    1023 +
    1024 old_rows = vc->vc_rows;
    1025 old_row_size = vc->vc_size_row;
    1026
    1027 @@ -1173,7 +1178,7 @@ static void csi_J(struct vc_data *vc, int vpar)
    1028 break;
    1029 case 3: /* erase scroll-back buffer (and whole display) */
    1030 scr_memsetw(vc->vc_screenbuf, vc->vc_video_erase_char,
    1031 - vc->vc_screenbuf_size >> 1);
    1032 + vc->vc_screenbuf_size);
    1033 set_origin(vc);
    1034 if (CON_IS_VISIBLE(vc))
    1035 update_screen(vc);
    1036 diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c
    1037 index fb79dca9484b..5ae2b7d3a74a 100644
    1038 --- a/drivers/usb/dwc3/gadget.c
    1039 +++ b/drivers/usb/dwc3/gadget.c
    1040 @@ -2845,7 +2845,7 @@ err3:
    1041 kfree(dwc->setup_buf);
    1042
    1043 err2:
    1044 - dma_free_coherent(dwc->dev, sizeof(*dwc->ep0_trb),
    1045 + dma_free_coherent(dwc->dev, sizeof(*dwc->ep0_trb) * 2,
    1046 dwc->ep0_trb, dwc->ep0_trb_addr);
    1047
    1048 err1:
    1049 @@ -2869,7 +2869,7 @@ void dwc3_gadget_exit(struct dwc3 *dwc)
    1050
    1051 kfree(dwc->setup_buf);
    1052
    1053 - dma_free_coherent(dwc->dev, sizeof(*dwc->ep0_trb),
    1054 + dma_free_coherent(dwc->dev, sizeof(*dwc->ep0_trb) * 2,
    1055 dwc->ep0_trb, dwc->ep0_trb_addr);
    1056
    1057 dma_free_coherent(dwc->dev, sizeof(*dwc->ctrl_req),
    1058 diff --git a/drivers/usb/gadget/function/u_ether.c b/drivers/usb/gadget/function/u_ether.c
    1059 index 6554322af2c1..b644248f4b8e 100644
    1060 --- a/drivers/usb/gadget/function/u_ether.c
    1061 +++ b/drivers/usb/gadget/function/u_ether.c
    1062 @@ -596,8 +596,9 @@ static netdev_tx_t eth_start_xmit(struct sk_buff *skb,
    1063
    1064 /* throttle high/super speed IRQ rate back slightly */
    1065 if (gadget_is_dualspeed(dev->gadget))
    1066 - req->no_interrupt = (dev->gadget->speed == USB_SPEED_HIGH ||
    1067 - dev->gadget->speed == USB_SPEED_SUPER)
    1068 + req->no_interrupt = (((dev->gadget->speed == USB_SPEED_HIGH ||
    1069 + dev->gadget->speed == USB_SPEED_SUPER)) &&
    1070 + !list_empty(&dev->tx_reqs))
    1071 ? ((atomic_read(&dev->tx_qlen) % dev->qmult) != 0)
    1072 : 0;
    1073
    1074 diff --git a/drivers/usb/host/ohci-hcd.c b/drivers/usb/host/ohci-hcd.c
    1075 index 760cb57e954e..9d1192aea9d0 100644
    1076 --- a/drivers/usb/host/ohci-hcd.c
    1077 +++ b/drivers/usb/host/ohci-hcd.c
    1078 @@ -72,7 +72,7 @@
    1079 static const char hcd_name [] = "ohci_hcd";
    1080
    1081 #define STATECHANGE_DELAY msecs_to_jiffies(300)
    1082 -#define IO_WATCHDOG_DELAY msecs_to_jiffies(250)
    1083 +#define IO_WATCHDOG_DELAY msecs_to_jiffies(275)
    1084
    1085 #include "ohci.h"
    1086 #include "pci-quirks.h"
    1087 diff --git a/drivers/usb/host/xhci-hub.c b/drivers/usb/host/xhci-hub.c
    1088 index 1da876605e4d..b9d6940479da 100644
    1089 --- a/drivers/usb/host/xhci-hub.c
    1090 +++ b/drivers/usb/host/xhci-hub.c
    1091 @@ -1157,7 +1157,7 @@ int xhci_hub_control(struct usb_hcd *hcd, u16 typeReq, u16 wValue,
    1092 xhci_set_link_state(xhci, port_array, wIndex,
    1093 XDEV_RESUME);
    1094 spin_unlock_irqrestore(&xhci->lock, flags);
    1095 - msleep(20);
    1096 + msleep(USB_RESUME_TIMEOUT);
    1097 spin_lock_irqsave(&xhci->lock, flags);
    1098 xhci_set_link_state(xhci, port_array, wIndex,
    1099 XDEV_U0);
    1100 @@ -1401,7 +1401,7 @@ int xhci_bus_resume(struct usb_hcd *hcd)
    1101
    1102 if (need_usb2_u3_exit) {
    1103 spin_unlock_irqrestore(&xhci->lock, flags);
    1104 - msleep(20);
    1105 + msleep(USB_RESUME_TIMEOUT);
    1106 spin_lock_irqsave(&xhci->lock, flags);
    1107 }
    1108
    1109 diff --git a/drivers/usb/host/xhci-pci.c b/drivers/usb/host/xhci-pci.c
    1110 index 963867c2c1d5..cf147ccac7d3 100644
    1111 --- a/drivers/usb/host/xhci-pci.c
    1112 +++ b/drivers/usb/host/xhci-pci.c
    1113 @@ -45,6 +45,7 @@
    1114
    1115 #define PCI_DEVICE_ID_INTEL_LYNXPOINT_XHCI 0x8c31
    1116 #define PCI_DEVICE_ID_INTEL_LYNXPOINT_LP_XHCI 0x9c31
    1117 +#define PCI_DEVICE_ID_INTEL_WILDCATPOINT_LP_XHCI 0x9cb1
    1118 #define PCI_DEVICE_ID_INTEL_CHERRYVIEW_XHCI 0x22b5
    1119 #define PCI_DEVICE_ID_INTEL_SUNRISEPOINT_H_XHCI 0xa12f
    1120 #define PCI_DEVICE_ID_INTEL_SUNRISEPOINT_LP_XHCI 0x9d2f
    1121 @@ -154,7 +155,8 @@ static void xhci_pci_quirks(struct device *dev, struct xhci_hcd *xhci)
    1122 xhci->quirks |= XHCI_SPURIOUS_REBOOT;
    1123 }
    1124 if (pdev->vendor == PCI_VENDOR_ID_INTEL &&
    1125 - pdev->device == PCI_DEVICE_ID_INTEL_LYNXPOINT_LP_XHCI) {
    1126 + (pdev->device == PCI_DEVICE_ID_INTEL_LYNXPOINT_LP_XHCI ||
    1127 + pdev->device == PCI_DEVICE_ID_INTEL_WILDCATPOINT_LP_XHCI)) {
    1128 xhci->quirks |= XHCI_SPURIOUS_REBOOT;
    1129 xhci->quirks |= XHCI_SPURIOUS_WAKEUP;
    1130 }
    1131 diff --git a/drivers/usb/serial/cp210x.c b/drivers/usb/serial/cp210x.c
    1132 index 6eccded3bc33..976195e748a3 100644
    1133 --- a/drivers/usb/serial/cp210x.c
    1134 +++ b/drivers/usb/serial/cp210x.c
    1135 @@ -845,7 +845,9 @@ static int cp210x_tiocmget(struct tty_struct *tty)
    1136 unsigned int control;
    1137 int result;
    1138
    1139 - cp210x_get_config(port, CP210X_GET_MDMSTS, &control, 1);
    1140 + result = cp210x_get_config(port, CP210X_GET_MDMSTS, &control, 1);
    1141 + if (result)
    1142 + return result;
    1143
    1144 result = ((control & CONTROL_DTR) ? TIOCM_DTR : 0)
    1145 |((control & CONTROL_RTS) ? TIOCM_RTS : 0)
    1146 diff --git a/drivers/usb/serial/ftdi_sio.c b/drivers/usb/serial/ftdi_sio.c
    1147 index 8c48c9d83d48..494167fe6a2c 100644
    1148 --- a/drivers/usb/serial/ftdi_sio.c
    1149 +++ b/drivers/usb/serial/ftdi_sio.c
    1150 @@ -986,7 +986,8 @@ static const struct usb_device_id id_table_combined[] = {
    1151 /* ekey Devices */
    1152 { USB_DEVICE(FTDI_VID, FTDI_EKEY_CONV_USB_PID) },
    1153 /* Infineon Devices */
    1154 - { USB_DEVICE_INTERFACE_NUMBER(INFINEON_VID, INFINEON_TRIBOARD_PID, 1) },
    1155 + { USB_DEVICE_INTERFACE_NUMBER(INFINEON_VID, INFINEON_TRIBOARD_TC1798_PID, 1) },
    1156 + { USB_DEVICE_INTERFACE_NUMBER(INFINEON_VID, INFINEON_TRIBOARD_TC2X7_PID, 1) },
    1157 /* GE Healthcare devices */
    1158 { USB_DEVICE(GE_HEALTHCARE_VID, GE_HEALTHCARE_NEMO_TRACKER_PID) },
    1159 /* Active Research (Actisense) devices */
    1160 diff --git a/drivers/usb/serial/ftdi_sio_ids.h b/drivers/usb/serial/ftdi_sio_ids.h
    1161 index f87a938cf005..21011c0a4c64 100644
    1162 --- a/drivers/usb/serial/ftdi_sio_ids.h
    1163 +++ b/drivers/usb/serial/ftdi_sio_ids.h
    1164 @@ -626,8 +626,9 @@
    1165 /*
    1166 * Infineon Technologies
    1167 */
    1168 -#define INFINEON_VID 0x058b
    1169 -#define INFINEON_TRIBOARD_PID 0x0028 /* DAS JTAG TriBoard TC1798 V1.0 */
    1170 +#define INFINEON_VID 0x058b
    1171 +#define INFINEON_TRIBOARD_TC1798_PID 0x0028 /* DAS JTAG TriBoard TC1798 V1.0 */
    1172 +#define INFINEON_TRIBOARD_TC2X7_PID 0x0043 /* DAS JTAG TriBoard TC2X7 V1.0 */
    1173
    1174 /*
    1175 * Acton Research Corp.
    1176 diff --git a/drivers/usb/serial/usb-serial.c b/drivers/usb/serial/usb-serial.c
    1177 index a0ca291bc07f..e7e29c797824 100644
    1178 --- a/drivers/usb/serial/usb-serial.c
    1179 +++ b/drivers/usb/serial/usb-serial.c
    1180 @@ -1077,7 +1077,8 @@ static int usb_serial_probe(struct usb_interface *interface,
    1181
    1182 serial->disconnected = 0;
    1183
    1184 - usb_serial_console_init(serial->port[0]->minor);
    1185 + if (num_ports > 0)
    1186 + usb_serial_console_init(serial->port[0]->minor);
    1187 exit:
    1188 module_put(type->driver.owner);
    1189 return 0;
    1190 diff --git a/drivers/virtio/virtio_ring.c b/drivers/virtio/virtio_ring.c
    1191 index dc2b94142f53..a01a41a41269 100644
    1192 --- a/drivers/virtio/virtio_ring.c
    1193 +++ b/drivers/virtio/virtio_ring.c
    1194 @@ -548,7 +548,8 @@ void virtqueue_disable_cb(struct virtqueue *_vq)
    1195
    1196 if (!(vq->avail_flags_shadow & VRING_AVAIL_F_NO_INTERRUPT)) {
    1197 vq->avail_flags_shadow |= VRING_AVAIL_F_NO_INTERRUPT;
    1198 - vq->vring.avail->flags = cpu_to_virtio16(_vq->vdev, vq->avail_flags_shadow);
    1199 + if (!vq->event)
    1200 + vq->vring.avail->flags = cpu_to_virtio16(_vq->vdev, vq->avail_flags_shadow);
    1201 }
    1202
    1203 }
    1204 @@ -580,7 +581,8 @@ unsigned virtqueue_enable_cb_prepare(struct virtqueue *_vq)
    1205 * entry. Always do both to keep code simple. */
    1206 if (vq->avail_flags_shadow & VRING_AVAIL_F_NO_INTERRUPT) {
    1207 vq->avail_flags_shadow &= ~VRING_AVAIL_F_NO_INTERRUPT;
    1208 - vq->vring.avail->flags = cpu_to_virtio16(_vq->vdev, vq->avail_flags_shadow);
    1209 + if (!vq->event)
    1210 + vq->vring.avail->flags = cpu_to_virtio16(_vq->vdev, vq->avail_flags_shadow);
    1211 }
    1212 vring_used_event(&vq->vring) = cpu_to_virtio16(_vq->vdev, last_used_idx = vq->last_used_idx);
    1213 END_USE(vq);
    1214 @@ -648,10 +650,11 @@ bool virtqueue_enable_cb_delayed(struct virtqueue *_vq)
    1215 * more to do. */
    1216 /* Depending on the VIRTIO_RING_F_USED_EVENT_IDX feature, we need to
    1217 * either clear the flags bit or point the event index at the next
    1218 - * entry. Always do both to keep code simple. */
    1219 + * entry. Always update the event index to keep code simple. */
    1220 if (vq->avail_flags_shadow & VRING_AVAIL_F_NO_INTERRUPT) {
    1221 vq->avail_flags_shadow &= ~VRING_AVAIL_F_NO_INTERRUPT;
    1222 - vq->vring.avail->flags = cpu_to_virtio16(_vq->vdev, vq->avail_flags_shadow);
    1223 + if (!vq->event)
    1224 + vq->vring.avail->flags = cpu_to_virtio16(_vq->vdev, vq->avail_flags_shadow);
    1225 }
    1226 /* TODO: tune this threshold */
    1227 bufs = (u16)(vq->avail_idx_shadow - vq->last_used_idx) * 3 / 4;
    1228 @@ -770,7 +773,8 @@ struct virtqueue *vring_new_virtqueue(unsigned int index,
    1229 /* No callback? Tell other side not to bother us. */
    1230 if (!callback) {
    1231 vq->avail_flags_shadow |= VRING_AVAIL_F_NO_INTERRUPT;
    1232 - vq->vring.avail->flags = cpu_to_virtio16(vdev, vq->avail_flags_shadow);
    1233 + if (!vq->event)
    1234 + vq->vring.avail->flags = cpu_to_virtio16(vdev, vq->avail_flags_shadow);
    1235 }
    1236
    1237 /* Put everything in free lists. */
    1238 diff --git a/fs/btrfs/tree-log.c b/fs/btrfs/tree-log.c
    1239 index 1415f6d58633..f7441193bf35 100644
    1240 --- a/fs/btrfs/tree-log.c
    1241 +++ b/fs/btrfs/tree-log.c
    1242 @@ -2696,14 +2696,12 @@ static inline void btrfs_remove_all_log_ctxs(struct btrfs_root *root,
    1243 int index, int error)
    1244 {
    1245 struct btrfs_log_ctx *ctx;
    1246 + struct btrfs_log_ctx *safe;
    1247
    1248 - if (!error) {
    1249 - INIT_LIST_HEAD(&root->log_ctxs[index]);
    1250 - return;
    1251 - }
    1252 -
    1253 - list_for_each_entry(ctx, &root->log_ctxs[index], list)
    1254 + list_for_each_entry_safe(ctx, safe, &root->log_ctxs[index], list) {
    1255 + list_del_init(&ctx->list);
    1256 ctx->log_ret = error;
    1257 + }
    1258
    1259 INIT_LIST_HEAD(&root->log_ctxs[index]);
    1260 }
    1261 @@ -2944,13 +2942,9 @@ int btrfs_sync_log(struct btrfs_trans_handle *trans,
    1262 mutex_unlock(&root->log_mutex);
    1263
    1264 out_wake_log_root:
    1265 - /*
    1266 - * We needn't get log_mutex here because we are sure all
    1267 - * the other tasks are blocked.
    1268 - */
    1269 + mutex_lock(&log_root_tree->log_mutex);
    1270 btrfs_remove_all_log_ctxs(log_root_tree, index2, ret);
    1271
    1272 - mutex_lock(&log_root_tree->log_mutex);
    1273 log_root_tree->log_transid_committed++;
    1274 atomic_set(&log_root_tree->log_commit[index2], 0);
    1275 mutex_unlock(&log_root_tree->log_mutex);
    1276 @@ -2961,10 +2955,8 @@ out_wake_log_root:
    1277 if (waitqueue_active(&log_root_tree->log_commit_wait[index2]))
    1278 wake_up(&log_root_tree->log_commit_wait[index2]);
    1279 out:
    1280 - /* See above. */
    1281 - btrfs_remove_all_log_ctxs(root, index1, ret);
    1282 -
    1283 mutex_lock(&root->log_mutex);
    1284 + btrfs_remove_all_log_ctxs(root, index1, ret);
    1285 root->log_transid_committed++;
    1286 atomic_set(&root->log_commit[index1], 0);
    1287 mutex_unlock(&root->log_mutex);
    1288 diff --git a/fs/overlayfs/copy_up.c b/fs/overlayfs/copy_up.c
    1289 index ea0dd9ee138d..63a0d0ba36de 100644
    1290 --- a/fs/overlayfs/copy_up.c
    1291 +++ b/fs/overlayfs/copy_up.c
    1292 @@ -139,6 +139,8 @@ static int ovl_copy_up_data(struct path *old, struct path *new, loff_t len)
    1293 len -= bytes;
    1294 }
    1295
    1296 + if (!error)
    1297 + error = vfs_fsync(new_file, 0);
    1298 fput(new_file);
    1299 out_fput:
    1300 fput(old_file);
    1301 diff --git a/fs/ubifs/dir.c b/fs/ubifs/dir.c
    1302 index e49bd2808bf3..f5d5ee43ae6e 100644
    1303 --- a/fs/ubifs/dir.c
    1304 +++ b/fs/ubifs/dir.c
    1305 @@ -350,7 +350,7 @@ static unsigned int vfs_dent_type(uint8_t type)
    1306 */
    1307 static int ubifs_readdir(struct file *file, struct dir_context *ctx)
    1308 {
    1309 - int err;
    1310 + int err = 0;
    1311 struct qstr nm;
    1312 union ubifs_key key;
    1313 struct ubifs_dent_node *dent;
    1314 @@ -452,14 +452,20 @@ out:
    1315 kfree(file->private_data);
    1316 file->private_data = NULL;
    1317
    1318 - if (err != -ENOENT) {
    1319 + if (err != -ENOENT)
    1320 ubifs_err(c, "cannot find next direntry, error %d", err);
    1321 - return err;
    1322 - }
    1323 + else
    1324 + /*
    1325 + * -ENOENT is a non-fatal error in this context, the TNC uses
    1326 + * it to indicate that the cursor moved past the current directory
    1327 + * and readdir() has to stop.
    1328 + */
    1329 + err = 0;
    1330 +
    1331
    1332 /* 2 is a special value indicating that there are no more direntries */
    1333 ctx->pos = 2;
    1334 - return 0;
    1335 + return err;
    1336 }
    1337
    1338 /* Free saved readdir() state when the directory is closed */
    1339 diff --git a/fs/xfs/libxfs/xfs_dquot_buf.c b/fs/xfs/libxfs/xfs_dquot_buf.c
    1340 index 3cc3cf767474..ac9a003dd29a 100644
    1341 --- a/fs/xfs/libxfs/xfs_dquot_buf.c
    1342 +++ b/fs/xfs/libxfs/xfs_dquot_buf.c
    1343 @@ -191,8 +191,7 @@ xfs_dquot_buf_verify_crc(
    1344 if (mp->m_quotainfo)
    1345 ndquots = mp->m_quotainfo->qi_dqperchunk;
    1346 else
    1347 - ndquots = xfs_calc_dquots_per_chunk(
    1348 - XFS_BB_TO_FSB(mp, bp->b_length));
    1349 + ndquots = xfs_calc_dquots_per_chunk(bp->b_length);
    1350
    1351 for (i = 0; i < ndquots; i++, d++) {
    1352 if (!xfs_verify_cksum((char *)d, sizeof(struct xfs_dqblk),
    1353 diff --git a/include/linux/pwm.h b/include/linux/pwm.h
    1354 index cfc3ed46cad2..aa8736d5b2f3 100644
    1355 --- a/include/linux/pwm.h
    1356 +++ b/include/linux/pwm.h
    1357 @@ -331,6 +331,7 @@ static inline void pwm_remove_table(struct pwm_lookup *table, size_t num)
    1358 #ifdef CONFIG_PWM_SYSFS
    1359 void pwmchip_sysfs_export(struct pwm_chip *chip);
    1360 void pwmchip_sysfs_unexport(struct pwm_chip *chip);
    1361 +void pwmchip_sysfs_unexport_children(struct pwm_chip *chip);
    1362 #else
    1363 static inline void pwmchip_sysfs_export(struct pwm_chip *chip)
    1364 {
    1365 @@ -339,6 +340,10 @@ static inline void pwmchip_sysfs_export(struct pwm_chip *chip)
    1366 static inline void pwmchip_sysfs_unexport(struct pwm_chip *chip)
    1367 {
    1368 }
    1369 +
    1370 +static inline void pwmchip_sysfs_unexport_children(struct pwm_chip *chip)
    1371 +{
    1372 +}
    1373 #endif /* CONFIG_PWM_SYSFS */
    1374
    1375 #endif /* __LINUX_PWM_H */
    1376 diff --git a/kernel/cgroup.c b/kernel/cgroup.c
    1377 index a3424f28aaf4..127c63e02d52 100644
    1378 --- a/kernel/cgroup.c
    1379 +++ b/kernel/cgroup.c
    1380 @@ -236,6 +236,9 @@ static int cgroup_addrm_files(struct cgroup_subsys_state *css,
    1381 */
    1382 static bool cgroup_ssid_enabled(int ssid)
    1383 {
    1384 + if (CGROUP_SUBSYS_COUNT == 0)
    1385 + return false;
    1386 +
    1387 return static_key_enabled(cgroup_subsys_enabled_key[ssid]);
    1388 }
    1389
    1390 diff --git a/mm/cma.c b/mm/cma.c
    1391 index ea506eb18cd6..bd0e1412475e 100644
    1392 --- a/mm/cma.c
    1393 +++ b/mm/cma.c
    1394 @@ -183,7 +183,8 @@ int __init cma_init_reserved_mem(phys_addr_t base, phys_addr_t size,
    1395 return -EINVAL;
    1396
    1397 /* ensure minimal alignment required by mm core */
    1398 - alignment = PAGE_SIZE << max(MAX_ORDER - 1, pageblock_order);
    1399 + alignment = PAGE_SIZE <<
    1400 + max_t(unsigned long, MAX_ORDER - 1, pageblock_order);
    1401
    1402 /* alignment should be aligned with order_per_bit */
    1403 if (!IS_ALIGNED(alignment >> PAGE_SHIFT, 1 << order_per_bit))
    1404 @@ -266,8 +267,8 @@ int __init cma_declare_contiguous(phys_addr_t base,
    1405 * migratetype page by page allocator's buddy algorithm. In the case,
    1406 * you couldn't get a contiguous memory, which is not what we want.
    1407 */
    1408 - alignment = max(alignment,
    1409 - (phys_addr_t)PAGE_SIZE << max(MAX_ORDER - 1, pageblock_order));
    1410 + alignment = max(alignment, (phys_addr_t)PAGE_SIZE <<
    1411 + max_t(unsigned long, MAX_ORDER - 1, pageblock_order));
    1412 base = ALIGN(base, alignment);
    1413 size = ALIGN(size, alignment);
    1414 limit &= ~(alignment - 1);
    1415 diff --git a/mm/list_lru.c b/mm/list_lru.c
    1416 index afc71ea9a381..5d8dffd5b57c 100644
    1417 --- a/mm/list_lru.c
    1418 +++ b/mm/list_lru.c
    1419 @@ -554,6 +554,8 @@ int __list_lru_init(struct list_lru *lru, bool memcg_aware,
    1420 err = memcg_init_list_lru(lru, memcg_aware);
    1421 if (err) {
    1422 kfree(lru->node);
    1423 + /* Do this so a list_lru_destroy() doesn't crash: */
    1424 + lru->node = NULL;
    1425 goto out;
    1426 }
    1427
    1428 diff --git a/mm/memcontrol.c b/mm/memcontrol.c
    1429 index 6b90d184e9c0..5d9c8a3136bc 100644
    1430 --- a/mm/memcontrol.c
    1431 +++ b/mm/memcontrol.c
    1432 @@ -2055,6 +2055,15 @@ retry:
    1433 current->flags & PF_EXITING))
    1434 goto force;
    1435
    1436 + /*
    1437 + * Prevent unbounded recursion when reclaim operations need to
    1438 + * allocate memory. This might exceed the limits temporarily,
    1439 + * but we prefer facilitating memory reclaim and getting back
    1440 + * under the limit over triggering OOM kills in these cases.
    1441 + */
    1442 + if (unlikely(current->flags & PF_MEMALLOC))
    1443 + goto force;
    1444 +
    1445 if (unlikely(task_in_memcg_oom(current)))
    1446 goto nomem;
    1447
    1448 diff --git a/mm/vmscan.c b/mm/vmscan.c
    1449 index 0838e9f02b11..de1c59d8daa3 100644
    1450 --- a/mm/vmscan.c
    1451 +++ b/mm/vmscan.c
    1452 @@ -2910,7 +2910,9 @@ unsigned long try_to_free_mem_cgroup_pages(struct mem_cgroup *memcg,
    1453 sc.may_writepage,
    1454 sc.gfp_mask);
    1455
    1456 + current->flags |= PF_MEMALLOC;
    1457 nr_reclaimed = do_try_to_free_pages(zonelist, &sc);
    1458 + current->flags &= ~PF_MEMALLOC;
    1459
    1460 trace_mm_vmscan_memcg_reclaim_end(nr_reclaimed);
    1461
    1462 diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c
    1463 index a3bb8f7f5fc5..2b528389409f 100644
    1464 --- a/net/mac80211/rx.c
    1465 +++ b/net/mac80211/rx.c
    1466 @@ -2203,16 +2203,22 @@ ieee80211_rx_h_amsdu(struct ieee80211_rx_data *rx)
    1467 if (!(status->rx_flags & IEEE80211_RX_AMSDU))
    1468 return RX_CONTINUE;
    1469
    1470 - if (ieee80211_has_a4(hdr->frame_control) &&
    1471 - rx->sdata->vif.type == NL80211_IFTYPE_AP_VLAN &&
    1472 - !rx->sdata->u.vlan.sta)
    1473 - return RX_DROP_UNUSABLE;
    1474 + if (unlikely(ieee80211_has_a4(hdr->frame_control))) {
    1475 + switch (rx->sdata->vif.type) {
    1476 + case NL80211_IFTYPE_AP_VLAN:
    1477 + if (!rx->sdata->u.vlan.sta)
    1478 + return RX_DROP_UNUSABLE;
    1479 + break;
    1480 + case NL80211_IFTYPE_STATION:
    1481 + if (!rx->sdata->u.mgd.use_4addr)
    1482 + return RX_DROP_UNUSABLE;
    1483 + break;
    1484 + default:
    1485 + return RX_DROP_UNUSABLE;
    1486 + }
    1487 + }
    1488
    1489 - if (is_multicast_ether_addr(hdr->addr1) &&
    1490 - ((rx->sdata->vif.type == NL80211_IFTYPE_AP_VLAN &&
    1491 - rx->sdata->u.vlan.sta) ||
    1492 - (rx->sdata->vif.type == NL80211_IFTYPE_STATION &&
    1493 - rx->sdata->u.mgd.use_4addr)))
    1494 + if (is_multicast_ether_addr(hdr->addr1))
    1495 return RX_DROP_UNUSABLE;
    1496
    1497 skb->dev = dev;
    1498 diff --git a/security/keys/proc.c b/security/keys/proc.c
    1499 index f0611a6368cd..b9f531c9e4fa 100644
    1500 --- a/security/keys/proc.c
    1501 +++ b/security/keys/proc.c
    1502 @@ -181,7 +181,7 @@ static int proc_keys_show(struct seq_file *m, void *v)
    1503 struct timespec now;
    1504 unsigned long timo;
    1505 key_ref_t key_ref, skey_ref;
    1506 - char xbuf[12];
    1507 + char xbuf[16];
    1508 int rc;
    1509
    1510 struct keyring_search_context ctx = {
    1511 diff --git a/sound/pci/hda/hda_controller.c b/sound/pci/hda/hda_controller.c
    1512 index 22dbfa563919..5baf8b56b6e7 100644
    1513 --- a/sound/pci/hda/hda_controller.c
    1514 +++ b/sound/pci/hda/hda_controller.c
    1515 @@ -956,7 +956,7 @@ irqreturn_t azx_interrupt(int irq, void *dev_id)
    1516 status = azx_readb(chip, RIRBSTS);
    1517 if (status & RIRB_INT_MASK) {
    1518 if (status & RIRB_INT_RESPONSE) {
    1519 - if (chip->driver_caps & AZX_DCAPS_RIRB_PRE_DELAY)
    1520 + if (chip->driver_caps & AZX_DCAPS_CTX_WORKAROUND)
    1521 udelay(80);
    1522 snd_hdac_bus_update_rirb(bus);
    1523 }
    1524 @@ -1055,11 +1055,6 @@ int azx_bus_init(struct azx *chip, const char *model,
    1525 if (chip->driver_caps & AZX_DCAPS_CORBRP_SELF_CLEAR)
    1526 bus->core.corbrp_self_clear = true;
    1527
    1528 - if (chip->driver_caps & AZX_DCAPS_RIRB_DELAY) {
    1529 - dev_dbg(chip->card->dev, "Enable delay in RIRB handling\n");
    1530 - bus->needs_damn_long_delay = 1;
    1531 - }
    1532 -
    1533 if (chip->driver_caps & AZX_DCAPS_4K_BDLE_BOUNDARY)
    1534 bus->core.align_bdle_4k = true;
    1535
    1536 diff --git a/sound/pci/hda/hda_controller.h b/sound/pci/hda/hda_controller.h
    1537 index 7b635d68cfe1..b17539537b2e 100644
    1538 --- a/sound/pci/hda/hda_controller.h
    1539 +++ b/sound/pci/hda/hda_controller.h
    1540 @@ -32,8 +32,8 @@
    1541 #define AZX_DCAPS_NO_MSI (1 << 9) /* No MSI support */
    1542 #define AZX_DCAPS_SNOOP_MASK (3 << 10) /* snoop type mask */
    1543 #define AZX_DCAPS_SNOOP_OFF (1 << 12) /* snoop default off */
    1544 -#define AZX_DCAPS_RIRB_DELAY (1 << 13) /* Long delay in read loop */
    1545 -#define AZX_DCAPS_RIRB_PRE_DELAY (1 << 14) /* Put a delay before read */
    1546 +/* 13 unused */
    1547 +/* 14 unused */
    1548 #define AZX_DCAPS_CTX_WORKAROUND (1 << 15) /* X-Fi workaround */
    1549 #define AZX_DCAPS_POSFIX_LPIB (1 << 16) /* Use LPIB as default */
    1550 #define AZX_DCAPS_POSFIX_VIA (1 << 17) /* Use VIACOMBO as default */
    1551 diff --git a/sound/pci/hda/hda_intel.c b/sound/pci/hda/hda_intel.c
    1552 index d4671973d889..ad4a1e9a3ae1 100644
    1553 --- a/sound/pci/hda/hda_intel.c
    1554 +++ b/sound/pci/hda/hda_intel.c
    1555 @@ -334,8 +334,7 @@ enum {
    1556
    1557 /* quirks for Nvidia */
    1558 #define AZX_DCAPS_PRESET_NVIDIA \
    1559 - (AZX_DCAPS_RIRB_DELAY | AZX_DCAPS_NO_MSI | /*AZX_DCAPS_ALIGN_BUFSIZE |*/ \
    1560 - AZX_DCAPS_NO_64BIT | AZX_DCAPS_CORBRP_SELF_CLEAR |\
    1561 + (AZX_DCAPS_NO_MSI | AZX_DCAPS_CORBRP_SELF_CLEAR |\
    1562 AZX_DCAPS_SNOOP_TYPE(NVIDIA))
    1563
    1564 #define AZX_DCAPS_PRESET_CTHDA \
    1565 @@ -1637,6 +1636,11 @@ static int azx_create(struct snd_card *card, struct pci_dev *pci,
    1566 return err;
    1567 }
    1568
    1569 + if (chip->driver_type == AZX_DRIVER_NVIDIA) {
    1570 + dev_dbg(chip->card->dev, "Enable delay in RIRB handling\n");
    1571 + chip->bus.needs_damn_long_delay = 1;
    1572 + }
    1573 +
    1574 err = snd_device_new(card, SNDRV_DEV_LOWLEVEL, chip, &ops);
    1575 if (err < 0) {
    1576 dev_err(card->dev, "Error creating device [card]!\n");
    1577 @@ -1720,6 +1724,10 @@ static int azx_first_init(struct azx *chip)
    1578 }
    1579 }
    1580
    1581 + /* NVidia hardware normally only supports up to 40 bits of DMA */
    1582 + if (chip->pci->vendor == PCI_VENDOR_ID_NVIDIA)
    1583 + dma_bits = 40;
    1584 +
    1585 /* disable 64bit DMA address on some devices */
    1586 if (chip->driver_caps & AZX_DCAPS_NO_64BIT) {
    1587 dev_dbg(card->dev, "Disabling 64bit DMA\n");
    1588 @@ -2406,14 +2414,12 @@ static const struct pci_device_id azx_ids[] = {
    1589 .class = PCI_CLASS_MULTIMEDIA_HD_AUDIO << 8,
    1590 .class_mask = 0xffffff,
    1591 .driver_data = AZX_DRIVER_CTX | AZX_DCAPS_CTX_WORKAROUND |
    1592 - AZX_DCAPS_NO_64BIT |
    1593 - AZX_DCAPS_RIRB_PRE_DELAY | AZX_DCAPS_POSFIX_LPIB },
    1594 + AZX_DCAPS_NO_64BIT | AZX_DCAPS_POSFIX_LPIB },
    1595 #else
    1596 /* this entry seems still valid -- i.e. without emu20kx chip */
    1597 { PCI_DEVICE(0x1102, 0x0009),
    1598 .driver_data = AZX_DRIVER_CTX | AZX_DCAPS_CTX_WORKAROUND |
    1599 - AZX_DCAPS_NO_64BIT |
    1600 - AZX_DCAPS_RIRB_PRE_DELAY | AZX_DCAPS_POSFIX_LPIB },
    1601 + AZX_DCAPS_NO_64BIT | AZX_DCAPS_POSFIX_LPIB },
    1602 #endif
    1603 /* CM8888 */
    1604 { PCI_DEVICE(0x13f6, 0x5011),
    1605 diff --git a/sound/pci/hda/hda_tegra.c b/sound/pci/hda/hda_tegra.c
    1606 index 58c0aad37284..17fd81736d3d 100644
    1607 --- a/sound/pci/hda/hda_tegra.c
    1608 +++ b/sound/pci/hda/hda_tegra.c
    1609 @@ -464,6 +464,8 @@ static int hda_tegra_create(struct snd_card *card,
    1610 if (err < 0)
    1611 return err;
    1612
    1613 + chip->bus.needs_damn_long_delay = 1;
    1614 +
    1615 err = snd_device_new(card, SNDRV_DEV_LOWLEVEL, chip, &ops);
    1616 if (err < 0) {
    1617 dev_err(card->dev, "Error creating device\n");
    1618 @@ -481,8 +483,7 @@ MODULE_DEVICE_TABLE(of, hda_tegra_match);
    1619
    1620 static int hda_tegra_probe(struct platform_device *pdev)
    1621 {
    1622 - const unsigned int driver_flags = AZX_DCAPS_RIRB_DELAY |
    1623 - AZX_DCAPS_CORBRP_SELF_CLEAR;
    1624 + const unsigned int driver_flags = AZX_DCAPS_CORBRP_SELF_CLEAR;
    1625 struct snd_card *card;
    1626 struct azx *chip;
    1627 struct hda_tegra *hda;
    1628 diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
    1629 index b1fa50aed888..f0986cac82f1 100644
    1630 --- a/sound/pci/hda/patch_realtek.c
    1631 +++ b/sound/pci/hda/patch_realtek.c
    1632 @@ -5793,8 +5793,6 @@ static const struct hda_model_fixup alc269_fixup_models[] = {
    1633 #define ALC295_STANDARD_PINS \
    1634 {0x12, 0xb7a60130}, \
    1635 {0x14, 0x90170110}, \
    1636 - {0x17, 0x21014020}, \
    1637 - {0x18, 0x21a19030}, \
    1638 {0x21, 0x04211020}
    1639
    1640 #define ALC298_STANDARD_PINS \
    1641 @@ -5841,11 +5839,19 @@ static const struct snd_hda_pin_quirk alc269_pin_fixup_tbl[] = {
    1642 {0x1b, 0x02011020},
    1643 {0x21, 0x0221101f}),
    1644 SND_HDA_PIN_QUIRK(0x10ec0255, 0x1028, "Dell", ALC255_FIXUP_DELL1_MIC_NO_PRESENCE,
    1645 + {0x14, 0x90170110},
    1646 + {0x1b, 0x01011020},
    1647 + {0x21, 0x0221101f}),
    1648 + SND_HDA_PIN_QUIRK(0x10ec0255, 0x1028, "Dell", ALC255_FIXUP_DELL1_MIC_NO_PRESENCE,
    1649 {0x14, 0x90170130},
    1650 {0x1b, 0x01014020},
    1651 {0x21, 0x0221103f}),
    1652 SND_HDA_PIN_QUIRK(0x10ec0255, 0x1028, "Dell", ALC255_FIXUP_DELL1_MIC_NO_PRESENCE,
    1653 {0x14, 0x90170130},
    1654 + {0x1b, 0x01011020},
    1655 + {0x21, 0x0221103f}),
    1656 + SND_HDA_PIN_QUIRK(0x10ec0255, 0x1028, "Dell", ALC255_FIXUP_DELL1_MIC_NO_PRESENCE,
    1657 + {0x14, 0x90170130},
    1658 {0x1b, 0x02011020},
    1659 {0x21, 0x0221103f}),
    1660 SND_HDA_PIN_QUIRK(0x10ec0255, 0x1028, "Dell", ALC255_FIXUP_DELL1_MIC_NO_PRESENCE,
    1661 @@ -6021,7 +6027,13 @@ static const struct snd_hda_pin_quirk alc269_pin_fixup_tbl[] = {
    1662 ALC292_STANDARD_PINS,
    1663 {0x13, 0x90a60140}),
    1664 SND_HDA_PIN_QUIRK(0x10ec0295, 0x1028, "Dell", ALC269_FIXUP_DELL1_MIC_NO_PRESENCE,
    1665 - ALC295_STANDARD_PINS),
    1666 + ALC295_STANDARD_PINS,
    1667 + {0x17, 0x21014020},
    1668 + {0x18, 0x21a19030}),
    1669 + SND_HDA_PIN_QUIRK(0x10ec0295, 0x1028, "Dell", ALC269_FIXUP_DELL1_MIC_NO_PRESENCE,
    1670 + ALC295_STANDARD_PINS,
    1671 + {0x17, 0x21014040},
    1672 + {0x18, 0x21a19050}),
    1673 SND_HDA_PIN_QUIRK(0x10ec0298, 0x1028, "Dell", ALC298_FIXUP_DELL1_MIC_NO_PRESENCE,
    1674 ALC298_STANDARD_PINS,
    1675 {0x17, 0x90170110}),
    1676 diff --git a/sound/usb/quirks-table.h b/sound/usb/quirks-table.h
    1677 index c60a776e815d..8a59d4782a0f 100644
    1678 --- a/sound/usb/quirks-table.h
    1679 +++ b/sound/usb/quirks-table.h
    1680 @@ -2907,6 +2907,23 @@ AU0828_DEVICE(0x2040, 0x7260, "Hauppauge", "HVR-950Q"),
    1681 AU0828_DEVICE(0x2040, 0x7213, "Hauppauge", "HVR-950Q"),
    1682 AU0828_DEVICE(0x2040, 0x7270, "Hauppauge", "HVR-950Q"),
    1683
    1684 +/* Syntek STK1160 */
    1685 +{
    1686 + .match_flags = USB_DEVICE_ID_MATCH_DEVICE |
    1687 + USB_DEVICE_ID_MATCH_INT_CLASS |
    1688 + USB_DEVICE_ID_MATCH_INT_SUBCLASS,
    1689 + .idVendor = 0x05e1,
    1690 + .idProduct = 0x0408,
    1691 + .bInterfaceClass = USB_CLASS_AUDIO,
    1692 + .bInterfaceSubClass = USB_SUBCLASS_AUDIOCONTROL,
    1693 + .driver_info = (unsigned long) &(const struct snd_usb_audio_quirk) {
    1694 + .vendor_name = "Syntek",
    1695 + .product_name = "STK1160",
    1696 + .ifnum = QUIRK_ANY_INTERFACE,
    1697 + .type = QUIRK_AUDIO_ALIGN_TRANSFER
    1698 + }
    1699 +},
    1700 +
    1701 /* Digidesign Mbox */
    1702 {
    1703 /* Thanks to Clemens Ladisch <clemens@ladisch.de> */
    1704 diff --git a/tools/perf/Makefile.perf b/tools/perf/Makefile.perf
    1705 index 0d19d5447d6c..929a32ba15f5 100644
    1706 --- a/tools/perf/Makefile.perf
    1707 +++ b/tools/perf/Makefile.perf
    1708 @@ -420,7 +420,7 @@ $(LIBTRACEEVENT)-clean:
    1709 $(call QUIET_CLEAN, libtraceevent)
    1710 $(Q)$(MAKE) -C $(TRACE_EVENT_DIR) O=$(OUTPUT) clean >/dev/null
    1711
    1712 -install-traceevent-plugins: $(LIBTRACEEVENT)
    1713 +install-traceevent-plugins: libtraceevent_plugins
    1714 $(Q)$(MAKE) -C $(TRACE_EVENT_DIR) $(LIBTRACEEVENT_FLAGS) O=$(OUTPUT) install_plugins
    1715
    1716 $(LIBAPI): fixdep FORCE