Magellan Linux

  • Back to homepage
    • /[pkg-src]/trunk/kernel-alx/patches-4.4/0144-4.4.45-all-fixes.patch

    Contents of /trunk/kernel-alx/patches-4.4/0144-4.4.45-all-fixes.patch

    Parent Directory Parent Directory | Revision Log Revision Log

    Revision 2880 - (show annotations) (download)
    Mon Mar 27 13:49:20 2017 UTC (7 years, 1 month ago) by niro
    File size: 37818 byte(s) 
    linux-4.4.45
    1 diff --git a/Documentation/devicetree/bindings/clock/imx31-clock.txt b/Documentation/devicetree/bindings/clock/imx31-clock.txt
    2 index 19df842c694f..8163d565f697 100644
    3 --- a/Documentation/devicetree/bindings/clock/imx31-clock.txt
    4 +++ b/Documentation/devicetree/bindings/clock/imx31-clock.txt
    5 @@ -77,7 +77,7 @@ Examples:
    6 clks: ccm@53f80000{
    7 compatible = "fsl,imx31-ccm";
    8 reg = <0x53f80000 0x4000>;
    9 - interrupts = <0 31 0x04 0 53 0x04>;
    10 + interrupts = <31>, <53>;
    11 #clock-cells = <1>;
    12 };
    13
    14 diff --git a/Makefile b/Makefile
    15 index d6a1de0e2bd7..a3dfc73da722 100644
    16 --- a/Makefile
    17 +++ b/Makefile
    18 @@ -1,6 +1,6 @@
    19 VERSION = 4
    20 PATCHLEVEL = 4
    21 -SUBLEVEL = 44
    22 +SUBLEVEL = 45
    23 EXTRAVERSION =
    24 NAME = Blurry Fish Butt
    25
    26 diff --git a/arch/arm/boot/dts/da850-evm.dts b/arch/arm/boot/dts/da850-evm.dts
    27 index 4f935ad9f27b..6881757b03e8 100644
    28 --- a/arch/arm/boot/dts/da850-evm.dts
    29 +++ b/arch/arm/boot/dts/da850-evm.dts
    30 @@ -85,6 +85,7 @@
    31 #size-cells = <1>;
    32 compatible = "m25p64";
    33 spi-max-frequency = <30000000>;
    34 + m25p,fast-read;
    35 reg = <0>;
    36 partition@0 {
    37 label = "U-Boot-SPL";
    38 diff --git a/arch/arm/boot/dts/imx31.dtsi b/arch/arm/boot/dts/imx31.dtsi
    39 index 5fdb222636a7..cbe5fd5ed179 100644
    40 --- a/arch/arm/boot/dts/imx31.dtsi
    41 +++ b/arch/arm/boot/dts/imx31.dtsi
    42 @@ -30,11 +30,11 @@
    43 };
    44 };
    45
    46 - avic: avic-interrupt-controller@60000000 {
    47 + avic: interrupt-controller@68000000 {
    48 compatible = "fsl,imx31-avic", "fsl,avic";
    49 interrupt-controller;
    50 #interrupt-cells = <1>;
    51 - reg = <0x60000000 0x100000>;
    52 + reg = <0x68000000 0x100000>;
    53 };
    54
    55 soc {
    56 @@ -110,13 +110,6 @@
    57 interrupts = <19>;
    58 clocks = <&clks 25>;
    59 };
    60 -
    61 - clks: ccm@53f80000{
    62 - compatible = "fsl,imx31-ccm";
    63 - reg = <0x53f80000 0x4000>;
    64 - interrupts = <0 31 0x04 0 53 0x04>;
    65 - #clock-cells = <1>;
    66 - };
    67 };
    68
    69 aips@53f00000 { /* AIPS2 */
    70 @@ -126,6 +119,13 @@
    71 reg = <0x53f00000 0x100000>;
    72 ranges;
    73
    74 + clks: ccm@53f80000{
    75 + compatible = "fsl,imx31-ccm";
    76 + reg = <0x53f80000 0x4000>;
    77 + interrupts = <31>, <53>;
    78 + #clock-cells = <1>;
    79 + };
    80 +
    81 gpt: timer@53f90000 {
    82 compatible = "fsl,imx31-gpt";
    83 reg = <0x53f90000 0x4000>;
    84 diff --git a/arch/arm/boot/dts/imx6qdl-nitrogen6_max.dtsi b/arch/arm/boot/dts/imx6qdl-nitrogen6_max.dtsi
    85 index a35d54fd9cd3..ddfdb75a6e90 100644
    86 --- a/arch/arm/boot/dts/imx6qdl-nitrogen6_max.dtsi
    87 +++ b/arch/arm/boot/dts/imx6qdl-nitrogen6_max.dtsi
    88 @@ -319,8 +319,6 @@
    89 compatible = "fsl,imx6q-nitrogen6_max-sgtl5000",
    90 "fsl,imx-audio-sgtl5000";
    91 model = "imx6q-nitrogen6_max-sgtl5000";
    92 - pinctrl-names = "default";
    93 - pinctrl-0 = <&pinctrl_sgtl5000>;
    94 ssi-controller = <&ssi1>;
    95 audio-codec = <&codec>;
    96 audio-routing =
    97 @@ -401,6 +399,8 @@
    98
    99 codec: sgtl5000@0a {
    100 compatible = "fsl,sgtl5000";
    101 + pinctrl-names = "default";
    102 + pinctrl-0 = <&pinctrl_sgtl5000>;
    103 reg = <0x0a>;
    104 clocks = <&clks 201>;
    105 VDDA-supply = <&reg_2p5v>;
    106 diff --git a/arch/arm/include/asm/cputype.h b/arch/arm/include/asm/cputype.h
    107 index 85e374f873ac..e9d04f475929 100644
    108 --- a/arch/arm/include/asm/cputype.h
    109 +++ b/arch/arm/include/asm/cputype.h
    110 @@ -81,6 +81,9 @@
    111 #define ARM_CPU_XSCALE_ARCH_V2 0x4000
    112 #define ARM_CPU_XSCALE_ARCH_V3 0x6000
    113
    114 +/* Qualcomm implemented cores */
    115 +#define ARM_CPU_PART_SCORPION 0x510002d0
    116 +
    117 extern unsigned int processor_id;
    118
    119 #ifdef CONFIG_CPU_CP15
    120 diff --git a/arch/arm/kernel/hw_breakpoint.c b/arch/arm/kernel/hw_breakpoint.c
    121 index 6284779d64ee..abcbea1ae30b 100644
    122 --- a/arch/arm/kernel/hw_breakpoint.c
    123 +++ b/arch/arm/kernel/hw_breakpoint.c
    124 @@ -1066,6 +1066,22 @@ static int __init arch_hw_breakpoint_init(void)
    125 return 0;
    126 }
    127
    128 + /*
    129 + * Scorpion CPUs (at least those in APQ8060) seem to set DBGPRSR.SPD
    130 + * whenever a WFI is issued, even if the core is not powered down, in
    131 + * violation of the architecture. When DBGPRSR.SPD is set, accesses to
    132 + * breakpoint and watchpoint registers are treated as undefined, so
    133 + * this results in boot time and runtime failures when these are
    134 + * accessed and we unexpectedly take a trap.
    135 + *
    136 + * It's not clear if/how this can be worked around, so we blacklist
    137 + * Scorpion CPUs to avoid these issues.
    138 + */
    139 + if (read_cpuid_part() == ARM_CPU_PART_SCORPION) {
    140 + pr_info("Scorpion CPU detected. Hardware breakpoints and watchpoints disabled\n");
    141 + return 0;
    142 + }
    143 +
    144 has_ossr = core_has_os_save_restore();
    145
    146 /* Determine how many BRPs/WRPs are available. */
    147 diff --git a/arch/arm/kernel/smp_tlb.c b/arch/arm/kernel/smp_tlb.c
    148 index 2e72be4f623e..7cb079e74010 100644
    149 --- a/arch/arm/kernel/smp_tlb.c
    150 +++ b/arch/arm/kernel/smp_tlb.c
    151 @@ -9,6 +9,7 @@
    152 */
    153 #include <linux/preempt.h>
    154 #include <linux/smp.h>
    155 +#include <linux/uaccess.h>
    156
    157 #include <asm/smp_plat.h>
    158 #include <asm/tlbflush.h>
    159 @@ -40,8 +41,11 @@ static inline void ipi_flush_tlb_mm(void *arg)
    160 static inline void ipi_flush_tlb_page(void *arg)
    161 {
    162 struct tlb_args *ta = (struct tlb_args *)arg;
    163 + unsigned int __ua_flags = uaccess_save_and_enable();
    164
    165 local_flush_tlb_page(ta->ta_vma, ta->ta_start);
    166 +
    167 + uaccess_restore(__ua_flags);
    168 }
    169
    170 static inline void ipi_flush_tlb_kernel_page(void *arg)
    171 @@ -54,8 +58,11 @@ static inline void ipi_flush_tlb_kernel_page(void *arg)
    172 static inline void ipi_flush_tlb_range(void *arg)
    173 {
    174 struct tlb_args *ta = (struct tlb_args *)arg;
    175 + unsigned int __ua_flags = uaccess_save_and_enable();
    176
    177 local_flush_tlb_range(ta->ta_vma, ta->ta_start, ta->ta_end);
    178 +
    179 + uaccess_restore(__ua_flags);
    180 }
    181
    182 static inline void ipi_flush_tlb_kernel_range(void *arg)
    183 diff --git a/arch/arm/mach-ux500/pm.c b/arch/arm/mach-ux500/pm.c
    184 index 8538910db202..a970e7fcba9e 100644
    185 --- a/arch/arm/mach-ux500/pm.c
    186 +++ b/arch/arm/mach-ux500/pm.c
    187 @@ -134,8 +134,8 @@ bool prcmu_pending_irq(void)
    188 */
    189 bool prcmu_is_cpu_in_wfi(int cpu)
    190 {
    191 - return readl(PRCM_ARM_WFI_STANDBY) & cpu ? PRCM_ARM_WFI_STANDBY_WFI1 :
    192 - PRCM_ARM_WFI_STANDBY_WFI0;
    193 + return readl(PRCM_ARM_WFI_STANDBY) &
    194 + (cpu ? PRCM_ARM_WFI_STANDBY_WFI1 : PRCM_ARM_WFI_STANDBY_WFI0);
    195 }
    196
    197 /*
    198 diff --git a/arch/arm64/include/uapi/asm/ptrace.h b/arch/arm64/include/uapi/asm/ptrace.h
    199 index 208db3df135a..3378238b5d8b 100644
    200 --- a/arch/arm64/include/uapi/asm/ptrace.h
    201 +++ b/arch/arm64/include/uapi/asm/ptrace.h
    202 @@ -76,6 +76,7 @@ struct user_fpsimd_state {
    203 __uint128_t vregs[32];
    204 __u32 fpsr;
    205 __u32 fpcr;
    206 + __u32 __reserved[2];
    207 };
    208
    209 struct user_hwdebug_state {
    210 diff --git a/arch/arm64/kernel/entry.S b/arch/arm64/kernel/entry.S
    211 index 5a3753d09e20..bd14849beb73 100644
    212 --- a/arch/arm64/kernel/entry.S
    213 +++ b/arch/arm64/kernel/entry.S
    214 @@ -562,7 +562,7 @@ el0_inv:
    215 mov x0, sp
    216 mov x1, #BAD_SYNC
    217 mov x2, x25
    218 - bl bad_mode
    219 + bl bad_el0_sync
    220 b ret_to_user
    221 ENDPROC(el0_sync)
    222
    223 diff --git a/arch/arm64/kernel/ptrace.c b/arch/arm64/kernel/ptrace.c
    224 index fc779ec6f051..55909b2208cc 100644
    225 --- a/arch/arm64/kernel/ptrace.c
    226 +++ b/arch/arm64/kernel/ptrace.c
    227 @@ -450,6 +450,8 @@ static int hw_break_set(struct task_struct *target,
    228 /* (address, ctrl) registers */
    229 limit = regset->n * regset->size;
    230 while (count && offset < limit) {
    231 + if (count < PTRACE_HBP_ADDR_SZ)
    232 + return -EINVAL;
    233 ret = user_regset_copyin(&pos, &count, &kbuf, &ubuf, &addr,
    234 offset, offset + PTRACE_HBP_ADDR_SZ);
    235 if (ret)
    236 @@ -459,6 +461,8 @@ static int hw_break_set(struct task_struct *target,
    237 return ret;
    238 offset += PTRACE_HBP_ADDR_SZ;
    239
    240 + if (!count)
    241 + break;
    242 ret = user_regset_copyin(&pos, &count, &kbuf, &ubuf, &ctrl,
    243 offset, offset + PTRACE_HBP_CTRL_SZ);
    244 if (ret)
    245 @@ -495,7 +499,7 @@ static int gpr_set(struct task_struct *target, const struct user_regset *regset,
    246 const void *kbuf, const void __user *ubuf)
    247 {
    248 int ret;
    249 - struct user_pt_regs newregs;
    250 + struct user_pt_regs newregs = task_pt_regs(target)->user_regs;
    251
    252 ret = user_regset_copyin(&pos, &count, &kbuf, &ubuf, &newregs, 0, -1);
    253 if (ret)
    254 @@ -525,7 +529,8 @@ static int fpr_set(struct task_struct *target, const struct user_regset *regset,
    255 const void *kbuf, const void __user *ubuf)
    256 {
    257 int ret;
    258 - struct user_fpsimd_state newstate;
    259 + struct user_fpsimd_state newstate =
    260 + target->thread.fpsimd_state.user_fpsimd;
    261
    262 ret = user_regset_copyin(&pos, &count, &kbuf, &ubuf, &newstate, 0, -1);
    263 if (ret)
    264 @@ -549,7 +554,7 @@ static int tls_set(struct task_struct *target, const struct user_regset *regset,
    265 const void *kbuf, const void __user *ubuf)
    266 {
    267 int ret;
    268 - unsigned long tls;
    269 + unsigned long tls = target->thread.tp_value;
    270
    271 ret = user_regset_copyin(&pos, &count, &kbuf, &ubuf, &tls, 0, -1);
    272 if (ret)
    273 @@ -575,7 +580,8 @@ static int system_call_set(struct task_struct *target,
    274 unsigned int pos, unsigned int count,
    275 const void *kbuf, const void __user *ubuf)
    276 {
    277 - int syscallno, ret;
    278 + int syscallno = task_pt_regs(target)->syscallno;
    279 + int ret;
    280
    281 ret = user_regset_copyin(&pos, &count, &kbuf, &ubuf, &syscallno, 0, -1);
    282 if (ret)
    283 @@ -847,7 +853,7 @@ static int compat_tls_set(struct task_struct *target,
    284 const void __user *ubuf)
    285 {
    286 int ret;
    287 - compat_ulong_t tls;
    288 + compat_ulong_t tls = target->thread.tp_value;
    289
    290 ret = user_regset_copyin(&pos, &count, &kbuf, &ubuf, &tls, 0, -1);
    291 if (ret)
    292 diff --git a/arch/arm64/kernel/traps.c b/arch/arm64/kernel/traps.c
    293 index e9b9b5364393..ca7f0ac5f708 100644
    294 --- a/arch/arm64/kernel/traps.c
    295 +++ b/arch/arm64/kernel/traps.c
    296 @@ -434,16 +434,33 @@ const char *esr_get_class_string(u32 esr)
    297 }
    298
    299 /*
    300 - * bad_mode handles the impossible case in the exception vector.
    301 + * bad_mode handles the impossible case in the exception vector. This is always
    302 + * fatal.
    303 */
    304 asmlinkage void bad_mode(struct pt_regs *regs, int reason, unsigned int esr)
    305 {
    306 - siginfo_t info;
    307 - void __user *pc = (void __user *)instruction_pointer(regs);
    308 console_verbose();
    309
    310 pr_crit("Bad mode in %s handler detected, code 0x%08x -- %s\n",
    311 handler[reason], esr, esr_get_class_string(esr));
    312 +
    313 + die("Oops - bad mode", regs, 0);
    314 + local_irq_disable();
    315 + panic("bad mode");
    316 +}
    317 +
    318 +/*
    319 + * bad_el0_sync handles unexpected, but potentially recoverable synchronous
    320 + * exceptions taken from EL0. Unlike bad_mode, this returns.
    321 + */
    322 +asmlinkage void bad_el0_sync(struct pt_regs *regs, int reason, unsigned int esr)
    323 +{
    324 + siginfo_t info;
    325 + void __user *pc = (void __user *)instruction_pointer(regs);
    326 + console_verbose();
    327 +
    328 + pr_crit("Bad EL0 synchronous exception detected on CPU%d, code 0x%08x -- %s\n",
    329 + smp_processor_id(), esr, esr_get_class_string(esr));
    330 __show_regs(regs);
    331
    332 info.si_signo = SIGILL;
    333 @@ -451,7 +468,10 @@ asmlinkage void bad_mode(struct pt_regs *regs, int reason, unsigned int esr)
    334 info.si_code = ILL_ILLOPC;
    335 info.si_addr = pc;
    336
    337 - arm64_notify_die("Oops - bad mode", regs, &info, 0);
    338 + current->thread.fault_address = 0;
    339 + current->thread.fault_code = 0;
    340 +
    341 + force_sig_info(info.si_signo, &info, current);
    342 }
    343
    344 void __pte_error(const char *file, int line, unsigned long val)
    345 diff --git a/arch/x86/kernel/apic/io_apic.c b/arch/x86/kernel/apic/io_apic.c
    346 index fdb0fbfb1197..aaacbd667212 100644
    347 --- a/arch/x86/kernel/apic/io_apic.c
    348 +++ b/arch/x86/kernel/apic/io_apic.c
    349 @@ -1875,6 +1875,7 @@ static struct irq_chip ioapic_chip __read_mostly = {
    350 .irq_ack = irq_chip_ack_parent,
    351 .irq_eoi = ioapic_ack_level,
    352 .irq_set_affinity = ioapic_set_affinity,
    353 + .irq_retrigger = irq_chip_retrigger_hierarchy,
    354 .flags = IRQCHIP_SKIP_SET_WAKE,
    355 };
    356
    357 @@ -1886,6 +1887,7 @@ static struct irq_chip ioapic_ir_chip __read_mostly = {
    358 .irq_ack = irq_chip_ack_parent,
    359 .irq_eoi = ioapic_ir_ack_level,
    360 .irq_set_affinity = ioapic_set_affinity,
    361 + .irq_retrigger = irq_chip_retrigger_hierarchy,
    362 .flags = IRQCHIP_SKIP_SET_WAKE,
    363 };
    364
    365 diff --git a/arch/x86/kernel/mcount_64.S b/arch/x86/kernel/mcount_64.S
    366 index 87e1762e2bca..5d9afbcb6074 100644
    367 --- a/arch/x86/kernel/mcount_64.S
    368 +++ b/arch/x86/kernel/mcount_64.S
    369 @@ -180,7 +180,8 @@ GLOBAL(ftrace_graph_call)
    370 jmp ftrace_stub
    371 #endif
    372
    373 -GLOBAL(ftrace_stub)
    374 +/* This is weak to keep gas from relaxing the jumps */
    375 +WEAK(ftrace_stub)
    376 retq
    377 END(ftrace_caller)
    378
    379 diff --git a/arch/x86/pci/acpi.c b/arch/x86/pci/acpi.c
    380 index 3cd69832d7f4..3961103e9176 100644
    381 --- a/arch/x86/pci/acpi.c
    382 +++ b/arch/x86/pci/acpi.c
    383 @@ -114,6 +114,16 @@ static const struct dmi_system_id pci_crs_quirks[] __initconst = {
    384 DMI_MATCH(DMI_BIOS_VERSION, "6JET85WW (1.43 )"),
    385 },
    386 },
    387 + /* https://bugzilla.kernel.org/show_bug.cgi?id=42606 */
    388 + {
    389 + .callback = set_nouse_crs,
    390 + .ident = "Supermicro X8DTH",
    391 + .matches = {
    392 + DMI_MATCH(DMI_SYS_VENDOR, "Supermicro"),
    393 + DMI_MATCH(DMI_PRODUCT_NAME, "X8DTH-i/6/iF/6F"),
    394 + DMI_MATCH(DMI_BIOS_VERSION, "2.0a"),
    395 + },
    396 + },
    397
    398 /* https://bugzilla.kernel.org/show_bug.cgi?id=15362 */
    399 {
    400 diff --git a/drivers/clocksource/exynos_mct.c b/drivers/clocksource/exynos_mct.c
    401 index ff44082a0827..47f8aafe3344 100644
    402 --- a/drivers/clocksource/exynos_mct.c
    403 +++ b/drivers/clocksource/exynos_mct.c
    404 @@ -482,6 +482,7 @@ static void exynos4_local_timer_stop(struct mct_clock_event_device *mevt)
    405 if (mct_int_type == MCT_INT_SPI) {
    406 if (evt->irq != -1)
    407 disable_irq_nosync(evt->irq);
    408 + exynos4_mct_write(0x1, mevt->base + MCT_L_INT_CSTAT_OFFSET);
    409 } else {
    410 disable_percpu_irq(mct_irqs[MCT_L0_IRQ]);
    411 }
    412 diff --git a/drivers/dma/pl330.c b/drivers/dma/pl330.c
    413 index 17ee758b419f..8250950aab8b 100644
    414 --- a/drivers/dma/pl330.c
    415 +++ b/drivers/dma/pl330.c
    416 @@ -445,6 +445,9 @@ struct dma_pl330_chan {
    417
    418 /* for cyclic capability */
    419 bool cyclic;
    420 +
    421 + /* for runtime pm tracking */
    422 + bool active;
    423 };
    424
    425 struct pl330_dmac {
    426 @@ -1994,6 +1997,7 @@ static void pl330_tasklet(unsigned long data)
    427 _stop(pch->thread);
    428 spin_unlock(&pch->thread->dmac->lock);
    429 power_down = true;
    430 + pch->active = false;
    431 } else {
    432 /* Make sure the PL330 Channel thread is active */
    433 spin_lock(&pch->thread->dmac->lock);
    434 @@ -2015,6 +2019,7 @@ static void pl330_tasklet(unsigned long data)
    435 desc->status = PREP;
    436 list_move_tail(&desc->node, &pch->work_list);
    437 if (power_down) {
    438 + pch->active = true;
    439 spin_lock(&pch->thread->dmac->lock);
    440 _start(pch->thread);
    441 spin_unlock(&pch->thread->dmac->lock);
    442 @@ -2129,6 +2134,7 @@ static int pl330_terminate_all(struct dma_chan *chan)
    443 unsigned long flags;
    444 struct pl330_dmac *pl330 = pch->dmac;
    445 LIST_HEAD(list);
    446 + bool power_down = false;
    447
    448 pm_runtime_get_sync(pl330->ddma.dev);
    449 spin_lock_irqsave(&pch->lock, flags);
    450 @@ -2139,6 +2145,8 @@ static int pl330_terminate_all(struct dma_chan *chan)
    451 pch->thread->req[0].desc = NULL;
    452 pch->thread->req[1].desc = NULL;
    453 pch->thread->req_running = -1;
    454 + power_down = pch->active;
    455 + pch->active = false;
    456
    457 /* Mark all desc done */
    458 list_for_each_entry(desc, &pch->submitted_list, node) {
    459 @@ -2156,6 +2164,8 @@ static int pl330_terminate_all(struct dma_chan *chan)
    460 list_splice_tail_init(&pch->completed_list, &pl330->desc_pool);
    461 spin_unlock_irqrestore(&pch->lock, flags);
    462 pm_runtime_mark_last_busy(pl330->ddma.dev);
    463 + if (power_down)
    464 + pm_runtime_put_autosuspend(pl330->ddma.dev);
    465 pm_runtime_put_autosuspend(pl330->ddma.dev);
    466
    467 return 0;
    468 @@ -2302,6 +2312,7 @@ static void pl330_issue_pending(struct dma_chan *chan)
    469 * updated on work_list emptiness status.
    470 */
    471 WARN_ON(list_empty(&pch->submitted_list));
    472 + pch->active = true;
    473 pm_runtime_get_sync(pch->dmac->ddma.dev);
    474 }
    475 list_splice_tail_init(&pch->submitted_list, &pch->work_list);
    476 diff --git a/drivers/hid/hid-corsair.c b/drivers/hid/hid-corsair.c
    477 index bcefb9ebb026..88be56321610 100644
    478 --- a/drivers/hid/hid-corsair.c
    479 +++ b/drivers/hid/hid-corsair.c
    480 @@ -148,26 +148,36 @@ static enum led_brightness k90_backlight_get(struct led_classdev *led_cdev)
    481 struct usb_interface *usbif = to_usb_interface(dev->parent);
    482 struct usb_device *usbdev = interface_to_usbdev(usbif);
    483 int brightness;
    484 - char data[8];
    485 + char *data;
    486 +
    487 + data = kmalloc(8, GFP_KERNEL);
    488 + if (!data)
    489 + return -ENOMEM;
    490
    491 ret = usb_control_msg(usbdev, usb_rcvctrlpipe(usbdev, 0),
    492 K90_REQUEST_STATUS,
    493 USB_DIR_IN | USB_TYPE_VENDOR |
    494 USB_RECIP_DEVICE, 0, 0, data, 8,
    495 USB_CTRL_SET_TIMEOUT);
    496 - if (ret < 0) {
    497 + if (ret < 5) {
    498 dev_warn(dev, "Failed to get K90 initial state (error %d).\n",
    499 ret);
    500 - return -EIO;
    501 + ret = -EIO;
    502 + goto out;
    503 }
    504 brightness = data[4];
    505 if (brightness < 0 || brightness > 3) {
    506 dev_warn(dev,
    507 "Read invalid backlight brightness: %02hhx.\n",
    508 data[4]);
    509 - return -EIO;
    510 + ret = -EIO;
    511 + goto out;
    512 }
    513 - return brightness;
    514 + ret = brightness;
    515 +out:
    516 + kfree(data);
    517 +
    518 + return ret;
    519 }
    520
    521 static enum led_brightness k90_record_led_get(struct led_classdev *led_cdev)
    522 @@ -253,17 +263,22 @@ static ssize_t k90_show_macro_mode(struct device *dev,
    523 struct usb_interface *usbif = to_usb_interface(dev->parent);
    524 struct usb_device *usbdev = interface_to_usbdev(usbif);
    525 const char *macro_mode;
    526 - char data[8];
    527 + char *data;
    528 +
    529 + data = kmalloc(2, GFP_KERNEL);
    530 + if (!data)
    531 + return -ENOMEM;
    532
    533 ret = usb_control_msg(usbdev, usb_rcvctrlpipe(usbdev, 0),
    534 K90_REQUEST_GET_MODE,
    535 USB_DIR_IN | USB_TYPE_VENDOR |
    536 USB_RECIP_DEVICE, 0, 0, data, 2,
    537 USB_CTRL_SET_TIMEOUT);
    538 - if (ret < 0) {
    539 + if (ret < 1) {
    540 dev_warn(dev, "Failed to get K90 initial mode (error %d).\n",
    541 ret);
    542 - return -EIO;
    543 + ret = -EIO;
    544 + goto out;
    545 }
    546
    547 switch (data[0]) {
    548 @@ -277,10 +292,15 @@ static ssize_t k90_show_macro_mode(struct device *dev,
    549 default:
    550 dev_warn(dev, "K90 in unknown mode: %02hhx.\n",
    551 data[0]);
    552 - return -EIO;
    553 + ret = -EIO;
    554 + goto out;
    555 }
    556
    557 - return snprintf(buf, PAGE_SIZE, "%s\n", macro_mode);
    558 + ret = snprintf(buf, PAGE_SIZE, "%s\n", macro_mode);
    559 +out:
    560 + kfree(data);
    561 +
    562 + return ret;
    563 }
    564
    565 static ssize_t k90_store_macro_mode(struct device *dev,
    566 @@ -320,26 +340,36 @@ static ssize_t k90_show_current_profile(struct device *dev,
    567 struct usb_interface *usbif = to_usb_interface(dev->parent);
    568 struct usb_device *usbdev = interface_to_usbdev(usbif);
    569 int current_profile;
    570 - char data[8];
    571 + char *data;
    572 +
    573 + data = kmalloc(8, GFP_KERNEL);
    574 + if (!data)
    575 + return -ENOMEM;
    576
    577 ret = usb_control_msg(usbdev, usb_rcvctrlpipe(usbdev, 0),
    578 K90_REQUEST_STATUS,
    579 USB_DIR_IN | USB_TYPE_VENDOR |
    580 USB_RECIP_DEVICE, 0, 0, data, 8,
    581 USB_CTRL_SET_TIMEOUT);
    582 - if (ret < 0) {
    583 + if (ret < 8) {
    584 dev_warn(dev, "Failed to get K90 initial state (error %d).\n",
    585 ret);
    586 - return -EIO;
    587 + ret = -EIO;
    588 + goto out;
    589 }
    590 current_profile = data[7];
    591 if (current_profile < 1 || current_profile > 3) {
    592 dev_warn(dev, "Read invalid current profile: %02hhx.\n",
    593 data[7]);
    594 - return -EIO;
    595 + ret = -EIO;
    596 + goto out;
    597 }
    598
    599 - return snprintf(buf, PAGE_SIZE, "%d\n", current_profile);
    600 + ret = snprintf(buf, PAGE_SIZE, "%d\n", current_profile);
    601 +out:
    602 + kfree(data);
    603 +
    604 + return ret;
    605 }
    606
    607 static ssize_t k90_store_current_profile(struct device *dev,
    608 diff --git a/drivers/infiniband/hw/mlx4/ah.c b/drivers/infiniband/hw/mlx4/ah.c
    609 index c007c766c61e..fc21bdbb8b32 100644
    610 --- a/drivers/infiniband/hw/mlx4/ah.c
    611 +++ b/drivers/infiniband/hw/mlx4/ah.c
    612 @@ -113,7 +113,9 @@ static struct ib_ah *create_iboe_ah(struct ib_pd *pd, struct ib_ah_attr *ah_attr
    613 !(1 << ah->av.eth.stat_rate & dev->caps.stat_rate_support))
    614 --ah->av.eth.stat_rate;
    615 }
    616 -
    617 + ah->av.eth.sl_tclass_flowlabel |=
    618 + cpu_to_be32((ah_attr->grh.traffic_class << 20) |
    619 + ah_attr->grh.flow_label);
    620 /*
    621 * HW requires multicast LID so we just choose one.
    622 */
    623 @@ -121,7 +123,7 @@ static struct ib_ah *create_iboe_ah(struct ib_pd *pd, struct ib_ah_attr *ah_attr
    624 ah->av.ib.dlid = cpu_to_be16(0xc000);
    625
    626 memcpy(ah->av.eth.dgid, ah_attr->grh.dgid.raw, 16);
    627 - ah->av.eth.sl_tclass_flowlabel = cpu_to_be32(ah_attr->sl << 29);
    628 + ah->av.eth.sl_tclass_flowlabel |= cpu_to_be32(ah_attr->sl << 29);
    629
    630 return &ah->ibah;
    631 }
    632 diff --git a/drivers/infiniband/hw/mlx4/main.c b/drivers/infiniband/hw/mlx4/main.c
    633 index 97d6878f9938..77ddf2fa8625 100644
    634 --- a/drivers/infiniband/hw/mlx4/main.c
    635 +++ b/drivers/infiniband/hw/mlx4/main.c
    636 @@ -630,9 +630,11 @@ static int eth_link_query_port(struct ib_device *ibdev, u8 port,
    637 if (err)
    638 goto out;
    639
    640 - props->active_width = (((u8 *)mailbox->buf)[5] == 0x40) ?
    641 - IB_WIDTH_4X : IB_WIDTH_1X;
    642 - props->active_speed = IB_SPEED_QDR;
    643 + props->active_width = (((u8 *)mailbox->buf)[5] == 0x40) ||
    644 + (((u8 *)mailbox->buf)[5] == 0x20 /*56Gb*/) ?
    645 + IB_WIDTH_4X : IB_WIDTH_1X;
    646 + props->active_speed = (((u8 *)mailbox->buf)[5] == 0x20 /*56Gb*/) ?
    647 + IB_SPEED_FDR : IB_SPEED_QDR;
    648 props->port_cap_flags = IB_PORT_CM_SUP | IB_PORT_IP_BASED_GIDS;
    649 props->gid_tbl_len = mdev->dev->caps.gid_table_len[port];
    650 props->max_msg_sz = mdev->dev->caps.max_msg_sz;
    651 @@ -2401,14 +2403,19 @@ static void *mlx4_ib_add(struct mlx4_dev *dev)
    652 goto err_steer_qp_release;
    653 }
    654
    655 - bitmap_zero(ibdev->ib_uc_qpns_bitmap, ibdev->steer_qpn_count);
    656 -
    657 - err = mlx4_FLOW_STEERING_IB_UC_QP_RANGE(
    658 - dev, ibdev->steer_qpn_base,
    659 - ibdev->steer_qpn_base +
    660 - ibdev->steer_qpn_count - 1);
    661 - if (err)
    662 - goto err_steer_free_bitmap;
    663 + if (dev->caps.flags2 & MLX4_DEV_CAP_FLAG2_DMFS_IPOIB) {
    664 + bitmap_zero(ibdev->ib_uc_qpns_bitmap,
    665 + ibdev->steer_qpn_count);
    666 + err = mlx4_FLOW_STEERING_IB_UC_QP_RANGE(
    667 + dev, ibdev->steer_qpn_base,
    668 + ibdev->steer_qpn_base +
    669 + ibdev->steer_qpn_count - 1);
    670 + if (err)
    671 + goto err_steer_free_bitmap;
    672 + } else {
    673 + bitmap_fill(ibdev->ib_uc_qpns_bitmap,
    674 + ibdev->steer_qpn_count);
    675 + }
    676 }
    677
    678 for (j = 1; j <= ibdev->dev->caps.num_ports; j++)
    679 diff --git a/drivers/infiniband/hw/mlx4/qp.c b/drivers/infiniband/hw/mlx4/qp.c
    680 index f350f2d61c15..1c8b7c22c822 100644
    681 --- a/drivers/infiniband/hw/mlx4/qp.c
    682 +++ b/drivers/infiniband/hw/mlx4/qp.c
    683 @@ -1207,7 +1207,8 @@ int mlx4_ib_destroy_qp(struct ib_qp *qp)
    684 if (is_qp0(dev, mqp))
    685 mlx4_CLOSE_PORT(dev->dev, mqp->port);
    686
    687 - if (dev->qp1_proxy[mqp->port - 1] == mqp) {
    688 + if (mqp->mlx4_ib_qp_type == MLX4_IB_QPT_PROXY_GSI &&
    689 + dev->qp1_proxy[mqp->port - 1] == mqp) {
    690 mutex_lock(&dev->qp1_proxy_lock[mqp->port - 1]);
    691 dev->qp1_proxy[mqp->port - 1] = NULL;
    692 mutex_unlock(&dev->qp1_proxy_lock[mqp->port - 1]);
    693 diff --git a/drivers/infiniband/hw/mlx5/mr.c b/drivers/infiniband/hw/mlx5/mr.c
    694 index 6000f7aeede9..3399271c235b 100644
    695 --- a/drivers/infiniband/hw/mlx5/mr.c
    696 +++ b/drivers/infiniband/hw/mlx5/mr.c
    697 @@ -614,6 +614,33 @@ int mlx5_mr_cache_init(struct mlx5_ib_dev *dev)
    698 return 0;
    699 }
    700
    701 +static void wait_for_async_commands(struct mlx5_ib_dev *dev)
    702 +{
    703 + struct mlx5_mr_cache *cache = &dev->cache;
    704 + struct mlx5_cache_ent *ent;
    705 + int total = 0;
    706 + int i;
    707 + int j;
    708 +
    709 + for (i = 0; i < MAX_MR_CACHE_ENTRIES; i++) {
    710 + ent = &cache->ent[i];
    711 + for (j = 0 ; j < 1000; j++) {
    712 + if (!ent->pending)
    713 + break;
    714 + msleep(50);
    715 + }
    716 + }
    717 + for (i = 0; i < MAX_MR_CACHE_ENTRIES; i++) {
    718 + ent = &cache->ent[i];
    719 + total += ent->pending;
    720 + }
    721 +
    722 + if (total)
    723 + mlx5_ib_warn(dev, "aborted while there are %d pending mr requests\n", total);
    724 + else
    725 + mlx5_ib_warn(dev, "done with all pending requests\n");
    726 +}
    727 +
    728 int mlx5_mr_cache_cleanup(struct mlx5_ib_dev *dev)
    729 {
    730 int i;
    731 @@ -627,6 +654,7 @@ int mlx5_mr_cache_cleanup(struct mlx5_ib_dev *dev)
    732 clean_keys(dev, i);
    733
    734 destroy_workqueue(dev->cache.wq);
    735 + wait_for_async_commands(dev);
    736 del_timer_sync(&dev->delay_timer);
    737
    738 return 0;
    739 diff --git a/drivers/infiniband/ulp/ipoib/ipoib_cm.c b/drivers/infiniband/ulp/ipoib/ipoib_cm.c
    740 index 8ca75af0e6d1..de5e2b01ab05 100644
    741 --- a/drivers/infiniband/ulp/ipoib/ipoib_cm.c
    742 +++ b/drivers/infiniband/ulp/ipoib/ipoib_cm.c
    743 @@ -1035,8 +1035,6 @@ static struct ib_qp *ipoib_cm_create_tx_qp(struct net_device *dev, struct ipoib_
    744
    745 tx_qp = ib_create_qp(priv->pd, &attr);
    746 if (PTR_ERR(tx_qp) == -EINVAL) {
    747 - ipoib_warn(priv, "can't use GFP_NOIO for QPs on device %s, using GFP_KERNEL\n",
    748 - priv->ca->name);
    749 attr.create_flags &= ~IB_QP_CREATE_USE_GFP_NOIO;
    750 tx_qp = ib_create_qp(priv->pd, &attr);
    751 }
    752 diff --git a/drivers/media/platform/blackfin/ppi.c b/drivers/media/platform/blackfin/ppi.c
    753 index cff63e511e6d..b8f3d9fa66e9 100644
    754 --- a/drivers/media/platform/blackfin/ppi.c
    755 +++ b/drivers/media/platform/blackfin/ppi.c
    756 @@ -214,6 +214,8 @@ static int ppi_set_params(struct ppi_if *ppi, struct ppi_params *params)
    757 if (params->dlen > 24 || params->dlen <= 0)
    758 return -EINVAL;
    759 pctrl = devm_pinctrl_get(ppi->dev);
    760 + if (IS_ERR(pctrl))
    761 + return PTR_ERR(pctrl);
    762 pstate = pinctrl_lookup_state(pctrl,
    763 pin_state[(params->dlen + 7) / 8 - 1]);
    764 if (pinctrl_select_state(pctrl, pstate))
    765 diff --git a/drivers/media/rc/ite-cir.c b/drivers/media/rc/ite-cir.c
    766 index 0f301903aa6f..63165d324fff 100644
    767 --- a/drivers/media/rc/ite-cir.c
    768 +++ b/drivers/media/rc/ite-cir.c
    769 @@ -263,6 +263,8 @@ static void ite_set_carrier_params(struct ite_dev *dev)
    770
    771 if (allowance > ITE_RXDCR_MAX)
    772 allowance = ITE_RXDCR_MAX;
    773 +
    774 + use_demodulator = true;
    775 }
    776 }
    777
    778 diff --git a/drivers/mmc/host/mxs-mmc.c b/drivers/mmc/host/mxs-mmc.c
    779 index 44ecebd1ea8c..c8b8ac66ff7e 100644
    780 --- a/drivers/mmc/host/mxs-mmc.c
    781 +++ b/drivers/mmc/host/mxs-mmc.c
    782 @@ -309,6 +309,9 @@ static void mxs_mmc_ac(struct mxs_mmc_host *host)
    783 cmd0 = BF_SSP(cmd->opcode, CMD0_CMD);
    784 cmd1 = cmd->arg;
    785
    786 + if (cmd->opcode == MMC_STOP_TRANSMISSION)
    787 + cmd0 |= BM_SSP_CMD0_APPEND_8CYC;
    788 +
    789 if (host->sdio_irq_en) {
    790 ctrl0 |= BM_SSP_CTRL0_SDIO_IRQ_CHECK;
    791 cmd0 |= BM_SSP_CMD0_CONT_CLKING_EN | BM_SSP_CMD0_SLOW_CLKING_EN;
    792 @@ -417,8 +420,7 @@ static void mxs_mmc_adtc(struct mxs_mmc_host *host)
    793 ssp->base + HW_SSP_BLOCK_SIZE);
    794 }
    795
    796 - if ((cmd->opcode == MMC_STOP_TRANSMISSION) ||
    797 - (cmd->opcode == SD_IO_RW_EXTENDED))
    798 + if (cmd->opcode == SD_IO_RW_EXTENDED)
    799 cmd0 |= BM_SSP_CMD0_APPEND_8CYC;
    800
    801 cmd1 = cmd->arg;
    802 diff --git a/drivers/mtd/nand/Kconfig b/drivers/mtd/nand/Kconfig
    803 index 289664089cf3..8f49f8aeff1a 100644
    804 --- a/drivers/mtd/nand/Kconfig
    805 +++ b/drivers/mtd/nand/Kconfig
    806 @@ -527,7 +527,7 @@ config MTD_NAND_FSMC
    807 Flexible Static Memory Controller (FSMC)
    808
    809 config MTD_NAND_XWAY
    810 - tristate "Support for NAND on Lantiq XWAY SoC"
    811 + bool "Support for NAND on Lantiq XWAY SoC"
    812 depends on LANTIQ && SOC_TYPE_XWAY
    813 select MTD_NAND_PLATFORM
    814 help
    815 diff --git a/drivers/net/ieee802154/atusb.c b/drivers/net/ieee802154/atusb.c
    816 index 199a94a9c8bc..3a429f1a8002 100644
    817 --- a/drivers/net/ieee802154/atusb.c
    818 +++ b/drivers/net/ieee802154/atusb.c
    819 @@ -110,13 +110,26 @@ static int atusb_read_reg(struct atusb *atusb, uint8_t reg)
    820 {
    821 struct usb_device *usb_dev = atusb->usb_dev;
    822 int ret;
    823 + uint8_t *buffer;
    824 uint8_t value;
    825
    826 + buffer = kmalloc(1, GFP_KERNEL);
    827 + if (!buffer)
    828 + return -ENOMEM;
    829 +
    830 dev_dbg(&usb_dev->dev, "atusb: reg = 0x%x\n", reg);
    831 ret = atusb_control_msg(atusb, usb_rcvctrlpipe(usb_dev, 0),
    832 ATUSB_REG_READ, ATUSB_REQ_FROM_DEV,
    833 - 0, reg, &value, 1, 1000);
    834 - return ret >= 0 ? value : ret;
    835 + 0, reg, buffer, 1, 1000);
    836 +
    837 + if (ret >= 0) {
    838 + value = buffer[0];
    839 + kfree(buffer);
    840 + return value;
    841 + } else {
    842 + kfree(buffer);
    843 + return ret;
    844 + }
    845 }
    846
    847 static int atusb_write_subreg(struct atusb *atusb, uint8_t reg, uint8_t mask,
    848 @@ -517,9 +530,13 @@ static struct ieee802154_ops atusb_ops = {
    849 static int atusb_get_and_show_revision(struct atusb *atusb)
    850 {
    851 struct usb_device *usb_dev = atusb->usb_dev;
    852 - unsigned char buffer[3];
    853 + unsigned char *buffer;
    854 int ret;
    855
    856 + buffer = kmalloc(3, GFP_KERNEL);
    857 + if (!buffer)
    858 + return -ENOMEM;
    859 +
    860 /* Get a couple of the ATMega Firmware values */
    861 ret = atusb_control_msg(atusb, usb_rcvctrlpipe(usb_dev, 0),
    862 ATUSB_ID, ATUSB_REQ_FROM_DEV, 0, 0,
    863 @@ -535,15 +552,20 @@ static int atusb_get_and_show_revision(struct atusb *atusb)
    864 dev_info(&usb_dev->dev, "Please update to version 0.2 or newer");
    865 }
    866
    867 + kfree(buffer);
    868 return ret;
    869 }
    870
    871 static int atusb_get_and_show_build(struct atusb *atusb)
    872 {
    873 struct usb_device *usb_dev = atusb->usb_dev;
    874 - char build[ATUSB_BUILD_SIZE + 1];
    875 + char *build;
    876 int ret;
    877
    878 + build = kmalloc(ATUSB_BUILD_SIZE + 1, GFP_KERNEL);
    879 + if (!build)
    880 + return -ENOMEM;
    881 +
    882 ret = atusb_control_msg(atusb, usb_rcvctrlpipe(usb_dev, 0),
    883 ATUSB_BUILD, ATUSB_REQ_FROM_DEV, 0, 0,
    884 build, ATUSB_BUILD_SIZE, 1000);
    885 @@ -552,6 +574,7 @@ static int atusb_get_and_show_build(struct atusb *atusb)
    886 dev_info(&usb_dev->dev, "Firmware: build %s\n", build);
    887 }
    888
    889 + kfree(build);
    890 return ret;
    891 }
    892
    893 diff --git a/drivers/pci/probe.c b/drivers/pci/probe.c
    894 index b5843c255263..71d9a6d1bd56 100644
    895 --- a/drivers/pci/probe.c
    896 +++ b/drivers/pci/probe.c
    897 @@ -1019,6 +1019,7 @@ void set_pcie_port_type(struct pci_dev *pdev)
    898 pos = pci_find_capability(pdev, PCI_CAP_ID_EXP);
    899 if (!pos)
    900 return;
    901 +
    902 pdev->pcie_cap = pos;
    903 pci_read_config_word(pdev, pos + PCI_EXP_FLAGS, &reg16);
    904 pdev->pcie_flags_reg = reg16;
    905 @@ -1026,13 +1027,14 @@ void set_pcie_port_type(struct pci_dev *pdev)
    906 pdev->pcie_mpss = reg16 & PCI_EXP_DEVCAP_PAYLOAD;
    907
    908 /*
    909 - * A Root Port is always the upstream end of a Link. No PCIe
    910 - * component has two Links. Two Links are connected by a Switch
    911 - * that has a Port on each Link and internal logic to connect the
    912 - * two Ports.
    913 + * A Root Port or a PCI-to-PCIe bridge is always the upstream end
    914 + * of a Link. No PCIe component has two Links. Two Links are
    915 + * connected by a Switch that has a Port on each Link and internal
    916 + * logic to connect the two Ports.
    917 */
    918 type = pci_pcie_type(pdev);
    919 - if (type == PCI_EXP_TYPE_ROOT_PORT)
    920 + if (type == PCI_EXP_TYPE_ROOT_PORT ||
    921 + type == PCI_EXP_TYPE_PCIE_BRIDGE)
    922 pdev->has_secondary_link = 1;
    923 else if (type == PCI_EXP_TYPE_UPSTREAM ||
    924 type == PCI_EXP_TYPE_DOWNSTREAM) {
    925 diff --git a/drivers/scsi/qla2xxx/qla_os.c b/drivers/scsi/qla2xxx/qla_os.c
    926 index c44cbf46221c..3588a56aabb4 100644
    927 --- a/drivers/scsi/qla2xxx/qla_os.c
    928 +++ b/drivers/scsi/qla2xxx/qla_os.c
    929 @@ -3365,7 +3365,7 @@ qla2x00_mem_alloc(struct qla_hw_data *ha, uint16_t req_len, uint16_t rsp_len,
    930 sizeof(struct ct6_dsd), 0,
    931 SLAB_HWCACHE_ALIGN, NULL);
    932 if (!ctx_cachep)
    933 - goto fail_free_gid_list;
    934 + goto fail_free_srb_mempool;
    935 }
    936 ha->ctx_mempool = mempool_create_slab_pool(SRB_MIN_REQ,
    937 ctx_cachep);
    938 @@ -3518,7 +3518,7 @@ qla2x00_mem_alloc(struct qla_hw_data *ha, uint16_t req_len, uint16_t rsp_len,
    939 ha->loop_id_map = kzalloc(BITS_TO_LONGS(LOOPID_MAP_SIZE) * sizeof(long),
    940 GFP_KERNEL);
    941 if (!ha->loop_id_map)
    942 - goto fail_async_pd;
    943 + goto fail_loop_id_map;
    944 else {
    945 qla2x00_set_reserved_loop_ids(ha);
    946 ql_dbg_pci(ql_dbg_init, ha->pdev, 0x0123,
    947 @@ -3527,6 +3527,8 @@ qla2x00_mem_alloc(struct qla_hw_data *ha, uint16_t req_len, uint16_t rsp_len,
    948
    949 return 0;
    950
    951 +fail_loop_id_map:
    952 + dma_pool_free(ha->s_dma_pool, ha->async_pd, ha->async_pd_dma);
    953 fail_async_pd:
    954 dma_pool_free(ha->s_dma_pool, ha->ex_init_cb, ha->ex_init_cb_dma);
    955 fail_ex_init_cb:
    956 @@ -3554,6 +3556,10 @@ fail_free_ms_iocb:
    957 dma_pool_free(ha->s_dma_pool, ha->ms_iocb, ha->ms_iocb_dma);
    958 ha->ms_iocb = NULL;
    959 ha->ms_iocb_dma = 0;
    960 +
    961 + if (ha->sns_cmd)
    962 + dma_free_coherent(&ha->pdev->dev, sizeof(struct sns_cmd_pkt),
    963 + ha->sns_cmd, ha->sns_cmd_dma);
    964 fail_dma_pool:
    965 if (IS_QLA82XX(ha) || ql2xenabledif) {
    966 dma_pool_destroy(ha->fcp_cmnd_dma_pool);
    967 @@ -3571,10 +3577,12 @@ fail_free_nvram:
    968 kfree(ha->nvram);
    969 ha->nvram = NULL;
    970 fail_free_ctx_mempool:
    971 - mempool_destroy(ha->ctx_mempool);
    972 + if (ha->ctx_mempool)
    973 + mempool_destroy(ha->ctx_mempool);
    974 ha->ctx_mempool = NULL;
    975 fail_free_srb_mempool:
    976 - mempool_destroy(ha->srb_mempool);
    977 + if (ha->srb_mempool)
    978 + mempool_destroy(ha->srb_mempool);
    979 ha->srb_mempool = NULL;
    980 fail_free_gid_list:
    981 dma_free_coherent(&ha->pdev->dev, qla2x00_gid_list_size(ha),
    982 diff --git a/fs/ceph/mds_client.c b/fs/ceph/mds_client.c
    983 index e7b130a637f9..239bc9cba28c 100644
    984 --- a/fs/ceph/mds_client.c
    985 +++ b/fs/ceph/mds_client.c
    986 @@ -274,12 +274,13 @@ static int parse_reply_info_extra(void **p, void *end,
    987 struct ceph_mds_reply_info_parsed *info,
    988 u64 features)
    989 {
    990 - if (info->head->op == CEPH_MDS_OP_GETFILELOCK)
    991 + u32 op = le32_to_cpu(info->head->op);
    992 +
    993 + if (op == CEPH_MDS_OP_GETFILELOCK)
    994 return parse_reply_info_filelock(p, end, info, features);
    995 - else if (info->head->op == CEPH_MDS_OP_READDIR ||
    996 - info->head->op == CEPH_MDS_OP_LSSNAP)
    997 + else if (op == CEPH_MDS_OP_READDIR || op == CEPH_MDS_OP_LSSNAP)
    998 return parse_reply_info_dir(p, end, info, features);
    999 - else if (info->head->op == CEPH_MDS_OP_CREATE)
    1000 + else if (op == CEPH_MDS_OP_CREATE)
    1001 return parse_reply_info_create(p, end, info, features);
    1002 else
    1003 return -EIO;
    1004 diff --git a/fs/fuse/dev.c b/fs/fuse/dev.c
    1005 index ebb5e37455a0..9096d44eb221 100644
    1006 --- a/fs/fuse/dev.c
    1007 +++ b/fs/fuse/dev.c
    1008 @@ -2083,7 +2083,6 @@ static void end_requests(struct fuse_conn *fc, struct list_head *head)
    1009 struct fuse_req *req;
    1010 req = list_entry(head->next, struct fuse_req, list);
    1011 req->out.h.error = -ECONNABORTED;
    1012 - clear_bit(FR_PENDING, &req->flags);
    1013 clear_bit(FR_SENT, &req->flags);
    1014 list_del_init(&req->list);
    1015 request_end(fc, req);
    1016 @@ -2161,6 +2160,8 @@ void fuse_abort_conn(struct fuse_conn *fc)
    1017 spin_lock(&fiq->waitq.lock);
    1018 fiq->connected = 0;
    1019 list_splice_init(&fiq->pending, &to_end2);
    1020 + list_for_each_entry(req, &to_end2, list)
    1021 + clear_bit(FR_PENDING, &req->flags);
    1022 while (forget_pending(fiq))
    1023 kfree(dequeue_forget(fiq, 1, NULL));
    1024 wake_up_all_locked(&fiq->waitq);
    1025 diff --git a/fs/posix_acl.c b/fs/posix_acl.c
    1026 index a60d3cc5b55d..993bb3b5f4d5 100644
    1027 --- a/fs/posix_acl.c
    1028 +++ b/fs/posix_acl.c
    1029 @@ -903,11 +903,10 @@ int simple_set_acl(struct inode *inode, struct posix_acl *acl, int type)
    1030 int error;
    1031
    1032 if (type == ACL_TYPE_ACCESS) {
    1033 - error = posix_acl_equiv_mode(acl, &inode->i_mode);
    1034 - if (error < 0)
    1035 - return 0;
    1036 - if (error == 0)
    1037 - acl = NULL;
    1038 + error = posix_acl_update_mode(inode,
    1039 + &inode->i_mode, &acl);
    1040 + if (error)
    1041 + return error;
    1042 }
    1043
    1044 inode->i_ctime = CURRENT_TIME;
    1045 diff --git a/fs/ubifs/tnc.c b/fs/ubifs/tnc.c
    1046 index fa9a20cc60d6..fe5e8d4970ae 100644
    1047 --- a/fs/ubifs/tnc.c
    1048 +++ b/fs/ubifs/tnc.c
    1049 @@ -34,6 +34,11 @@
    1050 #include <linux/slab.h>
    1051 #include "ubifs.h"
    1052
    1053 +static int try_read_node(const struct ubifs_info *c, void *buf, int type,
    1054 + int len, int lnum, int offs);
    1055 +static int fallible_read_node(struct ubifs_info *c, const union ubifs_key *key,
    1056 + struct ubifs_zbranch *zbr, void *node);
    1057 +
    1058 /*
    1059 * Returned codes of 'matches_name()' and 'fallible_matches_name()' functions.
    1060 * @NAME_LESS: name corresponding to the first argument is less than second
    1061 @@ -402,7 +407,19 @@ static int tnc_read_node_nm(struct ubifs_info *c, struct ubifs_zbranch *zbr,
    1062 return 0;
    1063 }
    1064
    1065 - err = ubifs_tnc_read_node(c, zbr, node);
    1066 + if (c->replaying) {
    1067 + err = fallible_read_node(c, &zbr->key, zbr, node);
    1068 + /*
    1069 + * When the node was not found, return -ENOENT, 0 otherwise.
    1070 + * Negative return codes stay as-is.
    1071 + */
    1072 + if (err == 0)
    1073 + err = -ENOENT;
    1074 + else if (err == 1)
    1075 + err = 0;
    1076 + } else {
    1077 + err = ubifs_tnc_read_node(c, zbr, node);
    1078 + }
    1079 if (err)
    1080 return err;
    1081
    1082 @@ -2766,7 +2783,11 @@ struct ubifs_dent_node *ubifs_tnc_next_ent(struct ubifs_info *c,
    1083 if (nm->name) {
    1084 if (err) {
    1085 /* Handle collisions */
    1086 - err = resolve_collision(c, key, &znode, &n, nm);
    1087 + if (c->replaying)
    1088 + err = fallible_resolve_collision(c, key, &znode, &n,
    1089 + nm, 0);
    1090 + else
    1091 + err = resolve_collision(c, key, &znode, &n, nm);
    1092 dbg_tnc("rc returned %d, znode %p, n %d",
    1093 err, znode, n);
    1094 if (unlikely(err < 0))
    1095 diff --git a/net/sunrpc/auth_gss/svcauth_gss.c b/net/sunrpc/auth_gss/svcauth_gss.c
    1096 index 4605dc73def6..033fec307528 100644
    1097 --- a/net/sunrpc/auth_gss/svcauth_gss.c
    1098 +++ b/net/sunrpc/auth_gss/svcauth_gss.c
    1099 @@ -1481,7 +1481,7 @@ svcauth_gss_accept(struct svc_rqst *rqstp, __be32 *authp)
    1100 case RPC_GSS_PROC_DESTROY:
    1101 if (gss_write_verf(rqstp, rsci->mechctx, gc->gc_seq))
    1102 goto auth_err;
    1103 - rsci->h.expiry_time = get_seconds();
    1104 + rsci->h.expiry_time = seconds_since_boot();
    1105 set_bit(CACHE_NEGATIVE, &rsci->h.flags);
    1106 if (resv->iov_len + 4 > PAGE_SIZE)
    1107 goto drop;
    1108 diff --git a/net/sunrpc/xprtrdma/svc_rdma_recvfrom.c b/net/sunrpc/xprtrdma/svc_rdma_recvfrom.c
    1109 index ff4f01e527ec..d4e0d648bcea 100644
    1110 --- a/net/sunrpc/xprtrdma/svc_rdma_recvfrom.c
    1111 +++ b/net/sunrpc/xprtrdma/svc_rdma_recvfrom.c
    1112 @@ -346,8 +346,6 @@ int rdma_read_chunk_frmr(struct svcxprt_rdma *xprt,
    1113 atomic_inc(&rdma_stat_read);
    1114 return ret;
    1115 err:
    1116 - ib_dma_unmap_sg(xprt->sc_cm_id->device,
    1117 - frmr->sg, frmr->sg_nents, frmr->direction);
    1118 svc_rdma_put_context(ctxt, 0);
    1119 svc_rdma_put_frmr(xprt, frmr);
    1120 return ret;
    1121 diff --git a/tools/perf/util/trace-event-scripting.c b/tools/perf/util/trace-event-scripting.c
    1122 index 9df61059a85d..a2fd6e79d5a5 100644
    1123 --- a/tools/perf/util/trace-event-scripting.c
    1124 +++ b/tools/perf/util/trace-event-scripting.c
    1125 @@ -95,7 +95,8 @@ static void register_python_scripting(struct scripting_ops *scripting_ops)
    1126 if (err)
    1127 die("error registering py script extension");
    1128
    1129 - scripting_context = malloc(sizeof(struct scripting_context));
    1130 + if (scripting_context == NULL)
    1131 + scripting_context = malloc(sizeof(*scripting_context));
    1132 }
    1133
    1134 #ifdef NO_LIBPYTHON
    1135 @@ -159,7 +160,8 @@ static void register_perl_scripting(struct scripting_ops *scripting_ops)
    1136 if (err)
    1137 die("error registering pl script extension");
    1138
    1139 - scripting_context = malloc(sizeof(struct scripting_context));
    1140 + if (scripting_context == NULL)
    1141 + scripting_context = malloc(sizeof(*scripting_context));
    1142 }
    1143
    1144 #ifdef NO_LIBPERL
    1145 diff --git a/tools/testing/selftests/powerpc/pmu/ebb/pmc56_overflow_test.c b/tools/testing/selftests/powerpc/pmu/ebb/pmc56_overflow_test.c
    1146 index c22860ab9733..30e1ac62e8cb 100644
    1147 --- a/tools/testing/selftests/powerpc/pmu/ebb/pmc56_overflow_test.c
    1148 +++ b/tools/testing/selftests/powerpc/pmu/ebb/pmc56_overflow_test.c
    1149 @@ -66,7 +66,7 @@ int pmc56_overflow(void)
    1150
    1151 FAIL_IF(ebb_event_enable(&event));
    1152
    1153 - mtspr(SPRN_PMC1, pmc_sample_period(sample_period));
    1154 + mtspr(SPRN_PMC2, pmc_sample_period(sample_period));
    1155 mtspr(SPRN_PMC5, 0);
    1156 mtspr(SPRN_PMC6, 0);
    1157