Magellan Linux

  • Back to homepage
    • /[pkg-src]/trunk/kernel-alx/patches-4.9/0197-4.9.98-all-fixes.patch

    Annotation of /trunk/kernel-alx/patches-4.9/0197-4.9.98-all-fixes.patch

    Parent Directory Parent Directory | Revision Log Revision Log

    Revision 3174 - (hide annotations) (download)
    Wed Aug 8 14:17:28 2018 UTC (5 years, 10 months ago) by niro
    File size: 75989 byte(s) 
    -linux-4.9.98
    1 niro 3174 diff --git a/Makefile b/Makefile
    2     index ee3e943c3bd9..96d770488ae6 100644
    3     --- a/Makefile
    4     +++ b/Makefile
    5     @@ -1,6 +1,6 @@
    6     VERSION = 4
    7     PATCHLEVEL = 9
    8     -SUBLEVEL = 97
    9     +SUBLEVEL = 98
    10     EXTRAVERSION =
    11     NAME = Roaring Lionus
    12    
    13     diff --git a/arch/powerpc/kernel/eeh_driver.c b/arch/powerpc/kernel/eeh_driver.c
    14     index 6ef8f0bceacd..27843665da9e 100644
    15     --- a/arch/powerpc/kernel/eeh_driver.c
    16     +++ b/arch/powerpc/kernel/eeh_driver.c
    17     @@ -207,18 +207,18 @@ static void *eeh_report_error(void *data, void *userdata)
    18    
    19     if (!dev || eeh_dev_removed(edev) || eeh_pe_passed(edev->pe))
    20     return NULL;
    21     +
    22     + device_lock(&dev->dev);
    23     dev->error_state = pci_channel_io_frozen;
    24    
    25     driver = eeh_pcid_get(dev);
    26     - if (!driver) return NULL;
    27     + if (!driver) goto out_no_dev;
    28    
    29     eeh_disable_irq(dev);
    30    
    31     if (!driver->err_handler ||
    32     - !driver->err_handler->error_detected) {
    33     - eeh_pcid_put(dev);
    34     - return NULL;
    35     - }
    36     + !driver->err_handler->error_detected)
    37     + goto out;
    38    
    39     rc = driver->err_handler->error_detected(dev, pci_channel_io_frozen);
    40    
    41     @@ -227,7 +227,10 @@ static void *eeh_report_error(void *data, void *userdata)
    42     if (*res == PCI_ERS_RESULT_NONE) *res = rc;
    43    
    44     edev->in_error = true;
    45     +out:
    46     eeh_pcid_put(dev);
    47     +out_no_dev:
    48     + device_unlock(&dev->dev);
    49     return NULL;
    50     }
    51    
    52     @@ -250,15 +253,14 @@ static void *eeh_report_mmio_enabled(void *data, void *userdata)
    53     if (!dev || eeh_dev_removed(edev) || eeh_pe_passed(edev->pe))
    54     return NULL;
    55    
    56     + device_lock(&dev->dev);
    57     driver = eeh_pcid_get(dev);
    58     - if (!driver) return NULL;
    59     + if (!driver) goto out_no_dev;
    60    
    61     if (!driver->err_handler ||
    62     !driver->err_handler->mmio_enabled ||
    63     - (edev->mode & EEH_DEV_NO_HANDLER)) {
    64     - eeh_pcid_put(dev);
    65     - return NULL;
    66     - }
    67     + (edev->mode & EEH_DEV_NO_HANDLER))
    68     + goto out;
    69    
    70     rc = driver->err_handler->mmio_enabled(dev);
    71    
    72     @@ -266,7 +268,10 @@ static void *eeh_report_mmio_enabled(void *data, void *userdata)
    73     if (rc == PCI_ERS_RESULT_NEED_RESET) *res = rc;
    74     if (*res == PCI_ERS_RESULT_NONE) *res = rc;
    75    
    76     +out:
    77     eeh_pcid_put(dev);
    78     +out_no_dev:
    79     + device_unlock(&dev->dev);
    80     return NULL;
    81     }
    82    
    83     @@ -289,20 +294,20 @@ static void *eeh_report_reset(void *data, void *userdata)
    84    
    85     if (!dev || eeh_dev_removed(edev) || eeh_pe_passed(edev->pe))
    86     return NULL;
    87     +
    88     + device_lock(&dev->dev);
    89     dev->error_state = pci_channel_io_normal;
    90    
    91     driver = eeh_pcid_get(dev);
    92     - if (!driver) return NULL;
    93     + if (!driver) goto out_no_dev;
    94    
    95     eeh_enable_irq(dev);
    96    
    97     if (!driver->err_handler ||
    98     !driver->err_handler->slot_reset ||
    99     (edev->mode & EEH_DEV_NO_HANDLER) ||
    100     - (!edev->in_error)) {
    101     - eeh_pcid_put(dev);
    102     - return NULL;
    103     - }
    104     + (!edev->in_error))
    105     + goto out;
    106    
    107     rc = driver->err_handler->slot_reset(dev);
    108     if ((*res == PCI_ERS_RESULT_NONE) ||
    109     @@ -310,7 +315,10 @@ static void *eeh_report_reset(void *data, void *userdata)
    110     if (*res == PCI_ERS_RESULT_DISCONNECT &&
    111     rc == PCI_ERS_RESULT_NEED_RESET) *res = rc;
    112    
    113     +out:
    114     eeh_pcid_put(dev);
    115     +out_no_dev:
    116     + device_unlock(&dev->dev);
    117     return NULL;
    118     }
    119    
    120     @@ -361,10 +369,12 @@ static void *eeh_report_resume(void *data, void *userdata)
    121    
    122     if (!dev || eeh_dev_removed(edev) || eeh_pe_passed(edev->pe))
    123     return NULL;
    124     +
    125     + device_lock(&dev->dev);
    126     dev->error_state = pci_channel_io_normal;
    127    
    128     driver = eeh_pcid_get(dev);
    129     - if (!driver) return NULL;
    130     + if (!driver) goto out_no_dev;
    131    
    132     was_in_error = edev->in_error;
    133     edev->in_error = false;
    134     @@ -374,13 +384,15 @@ static void *eeh_report_resume(void *data, void *userdata)
    135     !driver->err_handler->resume ||
    136     (edev->mode & EEH_DEV_NO_HANDLER) || !was_in_error) {
    137     edev->mode &= ~EEH_DEV_NO_HANDLER;
    138     - eeh_pcid_put(dev);
    139     - return NULL;
    140     + goto out;
    141     }
    142    
    143     driver->err_handler->resume(dev);
    144    
    145     +out:
    146     eeh_pcid_put(dev);
    147     +out_no_dev:
    148     + device_unlock(&dev->dev);
    149     return NULL;
    150     }
    151    
    152     @@ -400,22 +412,25 @@ static void *eeh_report_failure(void *data, void *userdata)
    153    
    154     if (!dev || eeh_dev_removed(edev) || eeh_pe_passed(edev->pe))
    155     return NULL;
    156     +
    157     + device_lock(&dev->dev);
    158     dev->error_state = pci_channel_io_perm_failure;
    159    
    160     driver = eeh_pcid_get(dev);
    161     - if (!driver) return NULL;
    162     + if (!driver) goto out_no_dev;
    163    
    164     eeh_disable_irq(dev);
    165    
    166     if (!driver->err_handler ||
    167     - !driver->err_handler->error_detected) {
    168     - eeh_pcid_put(dev);
    169     - return NULL;
    170     - }
    171     + !driver->err_handler->error_detected)
    172     + goto out;
    173    
    174     driver->err_handler->error_detected(dev, pci_channel_io_perm_failure);
    175    
    176     +out:
    177     eeh_pcid_put(dev);
    178     +out_no_dev:
    179     + device_unlock(&dev->dev);
    180     return NULL;
    181     }
    182    
    183     diff --git a/arch/powerpc/platforms/powernv/opal-rtc.c b/arch/powerpc/platforms/powernv/opal-rtc.c
    184     index f8868864f373..aa2a5139462e 100644
    185     --- a/arch/powerpc/platforms/powernv/opal-rtc.c
    186     +++ b/arch/powerpc/platforms/powernv/opal-rtc.c
    187     @@ -48,10 +48,12 @@ unsigned long __init opal_get_boot_time(void)
    188    
    189     while (rc == OPAL_BUSY || rc == OPAL_BUSY_EVENT) {
    190     rc = opal_rtc_read(&__y_m_d, &__h_m_s_ms);
    191     - if (rc == OPAL_BUSY_EVENT)
    192     + if (rc == OPAL_BUSY_EVENT) {
    193     + mdelay(OPAL_BUSY_DELAY_MS);
    194     opal_poll_events(NULL);
    195     - else if (rc == OPAL_BUSY)
    196     - mdelay(10);
    197     + } else if (rc == OPAL_BUSY) {
    198     + mdelay(OPAL_BUSY_DELAY_MS);
    199     + }
    200     }
    201     if (rc != OPAL_SUCCESS)
    202     return 0;
    203     diff --git a/arch/x86/include/uapi/asm/msgbuf.h b/arch/x86/include/uapi/asm/msgbuf.h
    204     index 809134c644a6..90ab9a795b49 100644
    205     --- a/arch/x86/include/uapi/asm/msgbuf.h
    206     +++ b/arch/x86/include/uapi/asm/msgbuf.h
    207     @@ -1 +1,32 @@
    208     +/* SPDX-License-Identifier: GPL-2.0 WITH Linux-syscall-note */
    209     +#ifndef __ASM_X64_MSGBUF_H
    210     +#define __ASM_X64_MSGBUF_H
    211     +
    212     +#if !defined(__x86_64__) || !defined(__ILP32__)
    213     #include <asm-generic/msgbuf.h>
    214     +#else
    215     +/*
    216     + * The msqid64_ds structure for x86 architecture with x32 ABI.
    217     + *
    218     + * On x86-32 and x86-64 we can just use the generic definition, but
    219     + * x32 uses the same binary layout as x86_64, which is differnet
    220     + * from other 32-bit architectures.
    221     + */
    222     +
    223     +struct msqid64_ds {
    224     + struct ipc64_perm msg_perm;
    225     + __kernel_time_t msg_stime; /* last msgsnd time */
    226     + __kernel_time_t msg_rtime; /* last msgrcv time */
    227     + __kernel_time_t msg_ctime; /* last change time */
    228     + __kernel_ulong_t msg_cbytes; /* current number of bytes on queue */
    229     + __kernel_ulong_t msg_qnum; /* number of messages in queue */
    230     + __kernel_ulong_t msg_qbytes; /* max number of bytes on queue */
    231     + __kernel_pid_t msg_lspid; /* pid of last msgsnd */
    232     + __kernel_pid_t msg_lrpid; /* last receive pid */
    233     + __kernel_ulong_t __unused4;
    234     + __kernel_ulong_t __unused5;
    235     +};
    236     +
    237     +#endif
    238     +
    239     +#endif /* __ASM_GENERIC_MSGBUF_H */
    240     diff --git a/arch/x86/include/uapi/asm/shmbuf.h b/arch/x86/include/uapi/asm/shmbuf.h
    241     index 83c05fc2de38..644421f3823b 100644
    242     --- a/arch/x86/include/uapi/asm/shmbuf.h
    243     +++ b/arch/x86/include/uapi/asm/shmbuf.h
    244     @@ -1 +1,43 @@
    245     +/* SPDX-License-Identifier: GPL-2.0 WITH Linux-syscall-note */
    246     +#ifndef __ASM_X86_SHMBUF_H
    247     +#define __ASM_X86_SHMBUF_H
    248     +
    249     +#if !defined(__x86_64__) || !defined(__ILP32__)
    250     #include <asm-generic/shmbuf.h>
    251     +#else
    252     +/*
    253     + * The shmid64_ds structure for x86 architecture with x32 ABI.
    254     + *
    255     + * On x86-32 and x86-64 we can just use the generic definition, but
    256     + * x32 uses the same binary layout as x86_64, which is differnet
    257     + * from other 32-bit architectures.
    258     + */
    259     +
    260     +struct shmid64_ds {
    261     + struct ipc64_perm shm_perm; /* operation perms */
    262     + size_t shm_segsz; /* size of segment (bytes) */
    263     + __kernel_time_t shm_atime; /* last attach time */
    264     + __kernel_time_t shm_dtime; /* last detach time */
    265     + __kernel_time_t shm_ctime; /* last change time */
    266     + __kernel_pid_t shm_cpid; /* pid of creator */
    267     + __kernel_pid_t shm_lpid; /* pid of last operator */
    268     + __kernel_ulong_t shm_nattch; /* no. of current attaches */
    269     + __kernel_ulong_t __unused4;
    270     + __kernel_ulong_t __unused5;
    271     +};
    272     +
    273     +struct shminfo64 {
    274     + __kernel_ulong_t shmmax;
    275     + __kernel_ulong_t shmmin;
    276     + __kernel_ulong_t shmmni;
    277     + __kernel_ulong_t shmseg;
    278     + __kernel_ulong_t shmall;
    279     + __kernel_ulong_t __unused1;
    280     + __kernel_ulong_t __unused2;
    281     + __kernel_ulong_t __unused3;
    282     + __kernel_ulong_t __unused4;
    283     +};
    284     +
    285     +#endif
    286     +
    287     +#endif /* __ASM_X86_SHMBUF_H */
    288     diff --git a/arch/x86/kernel/cpu/microcode/intel.c b/arch/x86/kernel/cpu/microcode/intel.c
    289     index 4bcd30c87531..79291d6fb301 100644
    290     --- a/arch/x86/kernel/cpu/microcode/intel.c
    291     +++ b/arch/x86/kernel/cpu/microcode/intel.c
    292     @@ -474,7 +474,6 @@ static void show_saved_mc(void)
    293     */
    294     static void save_mc_for_early(u8 *mc)
    295     {
    296     -#ifdef CONFIG_HOTPLUG_CPU
    297     /* Synchronization during CPU hotplug. */
    298     static DEFINE_MUTEX(x86_cpu_microcode_mutex);
    299    
    300     @@ -521,7 +520,6 @@ static void save_mc_for_early(u8 *mc)
    301    
    302     out:
    303     mutex_unlock(&x86_cpu_microcode_mutex);
    304     -#endif
    305     }
    306    
    307     static bool __init load_builtin_intel_microcode(struct cpio_data *cp)
    308     diff --git a/arch/x86/kernel/smpboot.c b/arch/x86/kernel/smpboot.c
    309     index e803d72ef525..83929cc47a4b 100644
    310     --- a/arch/x86/kernel/smpboot.c
    311     +++ b/arch/x86/kernel/smpboot.c
    312     @@ -1591,6 +1591,8 @@ static inline void mwait_play_dead(void)
    313     void *mwait_ptr;
    314     int i;
    315    
    316     + if (boot_cpu_data.x86_vendor == X86_VENDOR_AMD)
    317     + return;
    318     if (!this_cpu_has(X86_FEATURE_MWAIT))
    319     return;
    320     if (!this_cpu_has(X86_FEATURE_CLFLUSH))
    321     diff --git a/crypto/drbg.c b/crypto/drbg.c
    322     index 942ddff68408..4bb5f93c94cd 100644
    323     --- a/crypto/drbg.c
    324     +++ b/crypto/drbg.c
    325     @@ -1134,8 +1134,10 @@ static inline void drbg_dealloc_state(struct drbg_state *drbg)
    326     if (!drbg)
    327     return;
    328     kzfree(drbg->Vbuf);
    329     + drbg->Vbuf = NULL;
    330     drbg->V = NULL;
    331     kzfree(drbg->Cbuf);
    332     + drbg->Cbuf = NULL;
    333     drbg->C = NULL;
    334     kzfree(drbg->scratchpadbuf);
    335     drbg->scratchpadbuf = NULL;
    336     diff --git a/drivers/amba/bus.c b/drivers/amba/bus.c
    337     index a56fa2a1e9aa..93888ccb4e26 100644
    338     --- a/drivers/amba/bus.c
    339     +++ b/drivers/amba/bus.c
    340     @@ -69,11 +69,12 @@ static ssize_t driver_override_show(struct device *_dev,
    341     struct device_attribute *attr, char *buf)
    342     {
    343     struct amba_device *dev = to_amba_device(_dev);
    344     + ssize_t len;
    345    
    346     - if (!dev->driver_override)
    347     - return 0;
    348     -
    349     - return sprintf(buf, "%s\n", dev->driver_override);
    350     + device_lock(_dev);
    351     + len = sprintf(buf, "%s\n", dev->driver_override);
    352     + device_unlock(_dev);
    353     + return len;
    354     }
    355    
    356     static ssize_t driver_override_store(struct device *_dev,
    357     @@ -81,9 +82,10 @@ static ssize_t driver_override_store(struct device *_dev,
    358     const char *buf, size_t count)
    359     {
    360     struct amba_device *dev = to_amba_device(_dev);
    361     - char *driver_override, *old = dev->driver_override, *cp;
    362     + char *driver_override, *old, *cp;
    363    
    364     - if (count > PATH_MAX)
    365     + /* We need to keep extra room for a newline */
    366     + if (count >= (PAGE_SIZE - 1))
    367     return -EINVAL;
    368    
    369     driver_override = kstrndup(buf, count, GFP_KERNEL);
    370     @@ -94,12 +96,15 @@ static ssize_t driver_override_store(struct device *_dev,
    371     if (cp)
    372     *cp = '\0';
    373    
    374     + device_lock(_dev);
    375     + old = dev->driver_override;
    376     if (strlen(driver_override)) {
    377     dev->driver_override = driver_override;
    378     } else {
    379     kfree(driver_override);
    380     dev->driver_override = NULL;
    381     }
    382     + device_unlock(_dev);
    383    
    384     kfree(old);
    385    
    386     diff --git a/drivers/char/random.c b/drivers/char/random.c
    387     index 8d08a8062904..ddeac4eefd0a 100644
    388     --- a/drivers/char/random.c
    389     +++ b/drivers/char/random.c
    390     @@ -259,6 +259,7 @@
    391     #include <linux/kmemcheck.h>
    392     #include <linux/workqueue.h>
    393     #include <linux/irq.h>
    394     +#include <linux/ratelimit.h>
    395     #include <linux/syscalls.h>
    396     #include <linux/completion.h>
    397     #include <linux/uuid.h>
    398     @@ -444,6 +445,16 @@ static void _crng_backtrack_protect(struct crng_state *crng,
    399     __u8 tmp[CHACHA20_BLOCK_SIZE], int used);
    400     static void process_random_ready_list(void);
    401    
    402     +static struct ratelimit_state unseeded_warning =
    403     + RATELIMIT_STATE_INIT("warn_unseeded_randomness", HZ, 3);
    404     +static struct ratelimit_state urandom_warning =
    405     + RATELIMIT_STATE_INIT("warn_urandom_randomness", HZ, 3);
    406     +
    407     +static int ratelimit_disable __read_mostly;
    408     +
    409     +module_param_named(ratelimit_disable, ratelimit_disable, int, 0644);
    410     +MODULE_PARM_DESC(ratelimit_disable, "Disable random ratelimit suppression");
    411     +
    412     /**********************************************************************
    413     *
    414     * OS independent entropy store. Here are the functions which handle
    415     @@ -819,6 +830,39 @@ static int crng_fast_load(const char *cp, size_t len)
    416     return 1;
    417     }
    418    
    419     +#ifdef CONFIG_NUMA
    420     +static void do_numa_crng_init(struct work_struct *work)
    421     +{
    422     + int i;
    423     + struct crng_state *crng;
    424     + struct crng_state **pool;
    425     +
    426     + pool = kcalloc(nr_node_ids, sizeof(*pool), GFP_KERNEL|__GFP_NOFAIL);
    427     + for_each_online_node(i) {
    428     + crng = kmalloc_node(sizeof(struct crng_state),
    429     + GFP_KERNEL | __GFP_NOFAIL, i);
    430     + spin_lock_init(&crng->lock);
    431     + crng_initialize(crng);
    432     + pool[i] = crng;
    433     + }
    434     + mb();
    435     + if (cmpxchg(&crng_node_pool, NULL, pool)) {
    436     + for_each_node(i)
    437     + kfree(pool[i]);
    438     + kfree(pool);
    439     + }
    440     +}
    441     +
    442     +static DECLARE_WORK(numa_crng_init_work, do_numa_crng_init);
    443     +
    444     +static void numa_crng_init(void)
    445     +{
    446     + schedule_work(&numa_crng_init_work);
    447     +}
    448     +#else
    449     +static void numa_crng_init(void) {}
    450     +#endif
    451     +
    452     static void crng_reseed(struct crng_state *crng, struct entropy_store *r)
    453     {
    454     unsigned long flags;
    455     @@ -848,10 +892,23 @@ static void crng_reseed(struct crng_state *crng, struct entropy_store *r)
    456     memzero_explicit(&buf, sizeof(buf));
    457     crng->init_time = jiffies;
    458     if (crng == &primary_crng && crng_init < 2) {
    459     + numa_crng_init();
    460     crng_init = 2;
    461     process_random_ready_list();
    462     wake_up_interruptible(&crng_init_wait);
    463     pr_notice("random: crng init done\n");
    464     + if (unseeded_warning.missed) {
    465     + pr_notice("random: %d get_random_xx warning(s) missed "
    466     + "due to ratelimiting\n",
    467     + unseeded_warning.missed);
    468     + unseeded_warning.missed = 0;
    469     + }
    470     + if (urandom_warning.missed) {
    471     + pr_notice("random: %d urandom warning(s) missed "
    472     + "due to ratelimiting\n",
    473     + urandom_warning.missed);
    474     + urandom_warning.missed = 0;
    475     + }
    476     }
    477     spin_unlock_irqrestore(&crng->lock, flags);
    478     }
    479     @@ -1661,29 +1718,14 @@ static void init_std_data(struct entropy_store *r)
    480     */
    481     static int rand_initialize(void)
    482     {
    483     -#ifdef CONFIG_NUMA
    484     - int i;
    485     - struct crng_state *crng;
    486     - struct crng_state **pool;
    487     -#endif
    488     -
    489     init_std_data(&input_pool);
    490     init_std_data(&blocking_pool);
    491     crng_initialize(&primary_crng);
    492     crng_global_init_time = jiffies;
    493     -
    494     -#ifdef CONFIG_NUMA
    495     - pool = kcalloc(nr_node_ids, sizeof(*pool), GFP_KERNEL|__GFP_NOFAIL);
    496     - for_each_online_node(i) {
    497     - crng = kmalloc_node(sizeof(struct crng_state),
    498     - GFP_KERNEL | __GFP_NOFAIL, i);
    499     - spin_lock_init(&crng->lock);
    500     - crng_initialize(crng);
    501     - pool[i] = crng;
    502     + if (ratelimit_disable) {
    503     + urandom_warning.interval = 0;
    504     + unseeded_warning.interval = 0;
    505     }
    506     - mb();
    507     - crng_node_pool = pool;
    508     -#endif
    509     return 0;
    510     }
    511     early_initcall(rand_initialize);
    512     @@ -1751,9 +1793,10 @@ urandom_read(struct file *file, char __user *buf, size_t nbytes, loff_t *ppos)
    513    
    514     if (!crng_ready() && maxwarn > 0) {
    515     maxwarn--;
    516     - printk(KERN_NOTICE "random: %s: uninitialized urandom read "
    517     - "(%zd bytes read)\n",
    518     - current->comm, nbytes);
    519     + if (__ratelimit(&urandom_warning))
    520     + printk(KERN_NOTICE "random: %s: uninitialized "
    521     + "urandom read (%zd bytes read)\n",
    522     + current->comm, nbytes);
    523     spin_lock_irqsave(&primary_crng.lock, flags);
    524     crng_init_cnt = 0;
    525     spin_unlock_irqrestore(&primary_crng.lock, flags);
    526     diff --git a/drivers/char/virtio_console.c b/drivers/char/virtio_console.c
    527     index 8f890c1aca57..8c0017d48571 100644
    528     --- a/drivers/char/virtio_console.c
    529     +++ b/drivers/char/virtio_console.c
    530     @@ -1405,7 +1405,6 @@ static int add_port(struct ports_device *portdev, u32 id)
    531     {
    532     char debugfs_name[16];
    533     struct port *port;
    534     - struct port_buffer *buf;
    535     dev_t devt;
    536     unsigned int nr_added_bufs;
    537     int err;
    538     @@ -1516,8 +1515,6 @@ static int add_port(struct ports_device *portdev, u32 id)
    539     return 0;
    540    
    541     free_inbufs:
    542     - while ((buf = virtqueue_detach_unused_buf(port->in_vq)))
    543     - free_buf(buf, true);
    544     free_device:
    545     device_destroy(pdrvdata.class, port->dev->devt);
    546     free_cdev:
    547     @@ -1542,34 +1539,14 @@ static void remove_port(struct kref *kref)
    548    
    549     static void remove_port_data(struct port *port)
    550     {
    551     - struct port_buffer *buf;
    552     -
    553     spin_lock_irq(&port->inbuf_lock);
    554     /* Remove unused data this port might have received. */
    555     discard_port_data(port);
    556     spin_unlock_irq(&port->inbuf_lock);
    557    
    558     - /* Remove buffers we queued up for the Host to send us data in. */
    559     - do {
    560     - spin_lock_irq(&port->inbuf_lock);
    561     - buf = virtqueue_detach_unused_buf(port->in_vq);
    562     - spin_unlock_irq(&port->inbuf_lock);
    563     - if (buf)
    564     - free_buf(buf, true);
    565     - } while (buf);
    566     -
    567     spin_lock_irq(&port->outvq_lock);
    568     reclaim_consumed_buffers(port);
    569     spin_unlock_irq(&port->outvq_lock);
    570     -
    571     - /* Free pending buffers from the out-queue. */
    572     - do {
    573     - spin_lock_irq(&port->outvq_lock);
    574     - buf = virtqueue_detach_unused_buf(port->out_vq);
    575     - spin_unlock_irq(&port->outvq_lock);
    576     - if (buf)
    577     - free_buf(buf, true);
    578     - } while (buf);
    579     }
    580    
    581     /*
    582     @@ -1794,13 +1771,24 @@ static void control_work_handler(struct work_struct *work)
    583     spin_unlock(&portdev->c_ivq_lock);
    584     }
    585    
    586     +static void flush_bufs(struct virtqueue *vq, bool can_sleep)
    587     +{
    588     + struct port_buffer *buf;
    589     + unsigned int len;
    590     +
    591     + while ((buf = virtqueue_get_buf(vq, &len)))
    592     + free_buf(buf, can_sleep);
    593     +}
    594     +
    595     static void out_intr(struct virtqueue *vq)
    596     {
    597     struct port *port;
    598    
    599     port = find_port_by_vq(vq->vdev->priv, vq);
    600     - if (!port)
    601     + if (!port) {
    602     + flush_bufs(vq, false);
    603     return;
    604     + }
    605    
    606     wake_up_interruptible(&port->waitqueue);
    607     }
    608     @@ -1811,8 +1799,10 @@ static void in_intr(struct virtqueue *vq)
    609     unsigned long flags;
    610    
    611     port = find_port_by_vq(vq->vdev->priv, vq);
    612     - if (!port)
    613     + if (!port) {
    614     + flush_bufs(vq, false);
    615     return;
    616     + }
    617    
    618     spin_lock_irqsave(&port->inbuf_lock, flags);
    619     port->inbuf = get_inbuf(port);
    620     @@ -1987,6 +1977,15 @@ static const struct file_operations portdev_fops = {
    621    
    622     static void remove_vqs(struct ports_device *portdev)
    623     {
    624     + struct virtqueue *vq;
    625     +
    626     + virtio_device_for_each_vq(portdev->vdev, vq) {
    627     + struct port_buffer *buf;
    628     +
    629     + flush_bufs(vq, true);
    630     + while ((buf = virtqueue_detach_unused_buf(vq)))
    631     + free_buf(buf, true);
    632     + }
    633     portdev->vdev->config->del_vqs(portdev->vdev);
    634     kfree(portdev->in_vqs);
    635     kfree(portdev->out_vqs);
    636     diff --git a/drivers/cpufreq/powernv-cpufreq.c b/drivers/cpufreq/powernv-cpufreq.c
    637     index 6fb3cd24c1b6..a1d7fa48229d 100644
    638     --- a/drivers/cpufreq/powernv-cpufreq.c
    639     +++ b/drivers/cpufreq/powernv-cpufreq.c
    640     @@ -599,6 +599,16 @@ void gpstate_timer_handler(unsigned long data)
    641    
    642     if (!spin_trylock(&gpstates->gpstate_lock))
    643     return;
    644     + /*
    645     + * If the timer has migrated to the different cpu then bring
    646     + * it back to one of the policy->cpus
    647     + */
    648     + if (!cpumask_test_cpu(raw_smp_processor_id(), policy->cpus)) {
    649     + gpstates->timer.expires = jiffies + msecs_to_jiffies(1);
    650     + add_timer_on(&gpstates->timer, cpumask_first(policy->cpus));
    651     + spin_unlock(&gpstates->gpstate_lock);
    652     + return;
    653     + }
    654    
    655     gpstates->last_sampled_time += time_diff;
    656     gpstates->elapsed_time += time_diff;
    657     @@ -626,10 +636,8 @@ void gpstate_timer_handler(unsigned long data)
    658     gpstates->last_gpstate_idx = pstate_to_idx(freq_data.gpstate_id);
    659     gpstates->last_lpstate_idx = pstate_to_idx(freq_data.pstate_id);
    660    
    661     + set_pstate(&freq_data);
    662     spin_unlock(&gpstates->gpstate_lock);
    663     -
    664     - /* Timer may get migrated to a different cpu on cpu hot unplug */
    665     - smp_call_function_any(policy->cpus, set_pstate, &freq_data, 1);
    666     }
    667    
    668     /*
    669     diff --git a/drivers/gpu/drm/amd/amdgpu/gfx_v8_0.c b/drivers/gpu/drm/amd/amdgpu/gfx_v8_0.c
    670     index a88d365be4c5..564362e8b486 100644
    671     --- a/drivers/gpu/drm/amd/amdgpu/gfx_v8_0.c
    672     +++ b/drivers/gpu/drm/amd/amdgpu/gfx_v8_0.c
    673     @@ -1484,10 +1484,11 @@ static const u32 sgpr_init_compute_shader[] =
    674     static const u32 vgpr_init_regs[] =
    675     {
    676     mmCOMPUTE_STATIC_THREAD_MGMT_SE0, 0xffffffff,
    677     - mmCOMPUTE_RESOURCE_LIMITS, 0,
    678     + mmCOMPUTE_RESOURCE_LIMITS, 0x1000000, /* CU_GROUP_COUNT=1 */
    679     mmCOMPUTE_NUM_THREAD_X, 256*4,
    680     mmCOMPUTE_NUM_THREAD_Y, 1,
    681     mmCOMPUTE_NUM_THREAD_Z, 1,
    682     + mmCOMPUTE_PGM_RSRC1, 0x100004f, /* VGPRS=15 (64 logical VGPRs), SGPRS=1 (16 SGPRs), BULKY=1 */
    683     mmCOMPUTE_PGM_RSRC2, 20,
    684     mmCOMPUTE_USER_DATA_0, 0xedcedc00,
    685     mmCOMPUTE_USER_DATA_1, 0xedcedc01,
    686     @@ -1504,10 +1505,11 @@ static const u32 vgpr_init_regs[] =
    687     static const u32 sgpr1_init_regs[] =
    688     {
    689     mmCOMPUTE_STATIC_THREAD_MGMT_SE0, 0x0f,
    690     - mmCOMPUTE_RESOURCE_LIMITS, 0x1000000,
    691     + mmCOMPUTE_RESOURCE_LIMITS, 0x1000000, /* CU_GROUP_COUNT=1 */
    692     mmCOMPUTE_NUM_THREAD_X, 256*5,
    693     mmCOMPUTE_NUM_THREAD_Y, 1,
    694     mmCOMPUTE_NUM_THREAD_Z, 1,
    695     + mmCOMPUTE_PGM_RSRC1, 0x240, /* SGPRS=9 (80 GPRS) */
    696     mmCOMPUTE_PGM_RSRC2, 20,
    697     mmCOMPUTE_USER_DATA_0, 0xedcedc00,
    698     mmCOMPUTE_USER_DATA_1, 0xedcedc01,
    699     @@ -1528,6 +1530,7 @@ static const u32 sgpr2_init_regs[] =
    700     mmCOMPUTE_NUM_THREAD_X, 256*5,
    701     mmCOMPUTE_NUM_THREAD_Y, 1,
    702     mmCOMPUTE_NUM_THREAD_Z, 1,
    703     + mmCOMPUTE_PGM_RSRC1, 0x240, /* SGPRS=9 (80 GPRS) */
    704     mmCOMPUTE_PGM_RSRC2, 20,
    705     mmCOMPUTE_USER_DATA_0, 0xedcedc00,
    706     mmCOMPUTE_USER_DATA_1, 0xedcedc01,
    707     diff --git a/drivers/gpu/drm/virtio/virtgpu_vq.c b/drivers/gpu/drm/virtio/virtgpu_vq.c
    708     index 5a0f8a745b9d..52436b3c01bb 100644
    709     --- a/drivers/gpu/drm/virtio/virtgpu_vq.c
    710     +++ b/drivers/gpu/drm/virtio/virtgpu_vq.c
    711     @@ -324,7 +324,7 @@ static int virtio_gpu_queue_ctrl_buffer_locked(struct virtio_gpu_device *vgdev,
    712     ret = virtqueue_add_sgs(vq, sgs, outcnt, incnt, vbuf, GFP_ATOMIC);
    713     if (ret == -ENOSPC) {
    714     spin_unlock(&vgdev->ctrlq.qlock);
    715     - wait_event(vgdev->ctrlq.ack_queue, vq->num_free);
    716     + wait_event(vgdev->ctrlq.ack_queue, vq->num_free >= outcnt + incnt);
    717     spin_lock(&vgdev->ctrlq.qlock);
    718     goto retry;
    719     } else {
    720     @@ -399,7 +399,7 @@ static int virtio_gpu_queue_cursor(struct virtio_gpu_device *vgdev,
    721     ret = virtqueue_add_sgs(vq, sgs, outcnt, 0, vbuf, GFP_ATOMIC);
    722     if (ret == -ENOSPC) {
    723     spin_unlock(&vgdev->cursorq.qlock);
    724     - wait_event(vgdev->cursorq.ack_queue, vq->num_free);
    725     + wait_event(vgdev->cursorq.ack_queue, vq->num_free >= outcnt);
    726     spin_lock(&vgdev->cursorq.qlock);
    727     goto retry;
    728     } else {
    729     diff --git a/drivers/mtd/chips/cfi_cmdset_0001.c b/drivers/mtd/chips/cfi_cmdset_0001.c
    730     index 5e1b68cbcd0a..e1b603ca0170 100644
    731     --- a/drivers/mtd/chips/cfi_cmdset_0001.c
    732     +++ b/drivers/mtd/chips/cfi_cmdset_0001.c
    733     @@ -45,6 +45,7 @@
    734     #define I82802AB 0x00ad
    735     #define I82802AC 0x00ac
    736     #define PF38F4476 0x881c
    737     +#define M28F00AP30 0x8963
    738     /* STMicroelectronics chips */
    739     #define M50LPW080 0x002F
    740     #define M50FLW080A 0x0080
    741     @@ -375,6 +376,17 @@ static void cfi_fixup_major_minor(struct cfi_private *cfi,
    742     extp->MinorVersion = '1';
    743     }
    744    
    745     +static int cfi_is_micron_28F00AP30(struct cfi_private *cfi, struct flchip *chip)
    746     +{
    747     + /*
    748     + * Micron(was Numonyx) 1Gbit bottom boot are buggy w.r.t
    749     + * Erase Supend for their small Erase Blocks(0x8000)
    750     + */
    751     + if (cfi->mfr == CFI_MFR_INTEL && cfi->id == M28F00AP30)
    752     + return 1;
    753     + return 0;
    754     +}
    755     +
    756     static inline struct cfi_pri_intelext *
    757     read_pri_intelext(struct map_info *map, __u16 adr)
    758     {
    759     @@ -831,21 +843,30 @@ static int chip_ready (struct map_info *map, struct flchip *chip, unsigned long
    760     (mode == FL_WRITING && (cfip->SuspendCmdSupport & 1))))
    761     goto sleep;
    762    
    763     + /* Do not allow suspend iff read/write to EB address */
    764     + if ((adr & chip->in_progress_block_mask) ==
    765     + chip->in_progress_block_addr)
    766     + goto sleep;
    767     +
    768     + /* do not suspend small EBs, buggy Micron Chips */
    769     + if (cfi_is_micron_28F00AP30(cfi, chip) &&
    770     + (chip->in_progress_block_mask == ~(0x8000-1)))
    771     + goto sleep;
    772    
    773     /* Erase suspend */
    774     - map_write(map, CMD(0xB0), adr);
    775     + map_write(map, CMD(0xB0), chip->in_progress_block_addr);
    776    
    777     /* If the flash has finished erasing, then 'erase suspend'
    778     * appears to make some (28F320) flash devices switch to
    779     * 'read' mode. Make sure that we switch to 'read status'
    780     * mode so we get the right data. --rmk
    781     */
    782     - map_write(map, CMD(0x70), adr);
    783     + map_write(map, CMD(0x70), chip->in_progress_block_addr);
    784     chip->oldstate = FL_ERASING;
    785     chip->state = FL_ERASE_SUSPENDING;
    786     chip->erase_suspended = 1;
    787     for (;;) {
    788     - status = map_read(map, adr);
    789     + status = map_read(map, chip->in_progress_block_addr);
    790     if (map_word_andequal(map, status, status_OK, status_OK))
    791     break;
    792    
    793     @@ -1041,8 +1062,8 @@ static void put_chip(struct map_info *map, struct flchip *chip, unsigned long ad
    794     sending the 0x70 (Read Status) command to an erasing
    795     chip and expecting it to be ignored, that's what we
    796     do. */
    797     - map_write(map, CMD(0xd0), adr);
    798     - map_write(map, CMD(0x70), adr);
    799     + map_write(map, CMD(0xd0), chip->in_progress_block_addr);
    800     + map_write(map, CMD(0x70), chip->in_progress_block_addr);
    801     chip->oldstate = FL_READY;
    802     chip->state = FL_ERASING;
    803     break;
    804     @@ -1933,6 +1954,8 @@ static int __xipram do_erase_oneblock(struct map_info *map, struct flchip *chip,
    805     map_write(map, CMD(0xD0), adr);
    806     chip->state = FL_ERASING;
    807     chip->erase_suspended = 0;
    808     + chip->in_progress_block_addr = adr;
    809     + chip->in_progress_block_mask = ~(len - 1);
    810    
    811     ret = INVAL_CACHE_AND_WAIT(map, chip, adr,
    812     adr, len,
    813     diff --git a/drivers/mtd/chips/cfi_cmdset_0002.c b/drivers/mtd/chips/cfi_cmdset_0002.c
    814     index 9dca881bb378..107c05b3ddbb 100644
    815     --- a/drivers/mtd/chips/cfi_cmdset_0002.c
    816     +++ b/drivers/mtd/chips/cfi_cmdset_0002.c
    817     @@ -812,9 +812,10 @@ static int get_chip(struct map_info *map, struct flchip *chip, unsigned long adr
    818     (mode == FL_WRITING && (cfip->EraseSuspend & 0x2))))
    819     goto sleep;
    820    
    821     - /* We could check to see if we're trying to access the sector
    822     - * that is currently being erased. However, no user will try
    823     - * anything like that so we just wait for the timeout. */
    824     + /* Do not allow suspend iff read/write to EB address */
    825     + if ((adr & chip->in_progress_block_mask) ==
    826     + chip->in_progress_block_addr)
    827     + goto sleep;
    828    
    829     /* Erase suspend */
    830     /* It's harmless to issue the Erase-Suspend and Erase-Resume
    831     @@ -2263,6 +2264,7 @@ static int __xipram do_erase_chip(struct map_info *map, struct flchip *chip)
    832     chip->state = FL_ERASING;
    833     chip->erase_suspended = 0;
    834     chip->in_progress_block_addr = adr;
    835     + chip->in_progress_block_mask = ~(map->size - 1);
    836    
    837     INVALIDATE_CACHE_UDELAY(map, chip,
    838     adr, map->size,
    839     @@ -2352,6 +2354,7 @@ static int __xipram do_erase_oneblock(struct map_info *map, struct flchip *chip,
    840     chip->state = FL_ERASING;
    841     chip->erase_suspended = 0;
    842     chip->in_progress_block_addr = adr;
    843     + chip->in_progress_block_mask = ~(len - 1);
    844    
    845     INVALIDATE_CACHE_UDELAY(map, chip,
    846     adr, len,
    847     diff --git a/drivers/of/fdt.c b/drivers/of/fdt.c
    848     index 502f5547a1f2..e9360d5cbcba 100644
    849     --- a/drivers/of/fdt.c
    850     +++ b/drivers/of/fdt.c
    851     @@ -935,7 +935,7 @@ int __init early_init_dt_scan_chosen_stdout(void)
    852     int offset;
    853     const char *p, *q, *options = NULL;
    854     int l;
    855     - const struct earlycon_id *match;
    856     + const struct earlycon_id **p_match;
    857     const void *fdt = initial_boot_params;
    858    
    859     offset = fdt_path_offset(fdt, "/chosen");
    860     @@ -962,7 +962,10 @@ int __init early_init_dt_scan_chosen_stdout(void)
    861     return 0;
    862     }
    863    
    864     - for (match = __earlycon_table; match < __earlycon_table_end; match++) {
    865     + for (p_match = __earlycon_table; p_match < __earlycon_table_end;
    866     + p_match++) {
    867     + const struct earlycon_id *match = *p_match;
    868     +
    869     if (!match->compatible[0])
    870     continue;
    871    
    872     diff --git a/drivers/pci/host/pci-aardvark.c b/drivers/pci/host/pci-aardvark.c
    873     index 4fce494271cc..11bad826683e 100644
    874     --- a/drivers/pci/host/pci-aardvark.c
    875     +++ b/drivers/pci/host/pci-aardvark.c
    876     @@ -32,6 +32,7 @@
    877     #define PCIE_CORE_DEV_CTRL_STATS_MAX_PAYLOAD_SZ_SHIFT 5
    878     #define PCIE_CORE_DEV_CTRL_STATS_SNOOP_DISABLE (0 << 11)
    879     #define PCIE_CORE_DEV_CTRL_STATS_MAX_RD_REQ_SIZE_SHIFT 12
    880     +#define PCIE_CORE_DEV_CTRL_STATS_MAX_RD_REQ_SZ 0x2
    881     #define PCIE_CORE_LINK_CTRL_STAT_REG 0xd0
    882     #define PCIE_CORE_LINK_L0S_ENTRY BIT(0)
    883     #define PCIE_CORE_LINK_TRAINING BIT(5)
    884     @@ -175,8 +176,6 @@
    885     #define PCIE_CONFIG_WR_TYPE0 0xa
    886     #define PCIE_CONFIG_WR_TYPE1 0xb
    887    
    888     -/* PCI_BDF shifts 8bit, so we need extra 4bit shift */
    889     -#define PCIE_BDF(dev) (dev << 4)
    890     #define PCIE_CONF_BUS(bus) (((bus) & 0xff) << 20)
    891     #define PCIE_CONF_DEV(dev) (((dev) & 0x1f) << 15)
    892     #define PCIE_CONF_FUNC(fun) (((fun) & 0x7) << 12)
    893     @@ -298,7 +297,8 @@ static void advk_pcie_setup_hw(struct advk_pcie *pcie)
    894     reg = PCIE_CORE_DEV_CTRL_STATS_RELAX_ORDER_DISABLE |
    895     (7 << PCIE_CORE_DEV_CTRL_STATS_MAX_PAYLOAD_SZ_SHIFT) |
    896     PCIE_CORE_DEV_CTRL_STATS_SNOOP_DISABLE |
    897     - PCIE_CORE_DEV_CTRL_STATS_MAX_RD_REQ_SIZE_SHIFT;
    898     + (PCIE_CORE_DEV_CTRL_STATS_MAX_RD_REQ_SZ <<
    899     + PCIE_CORE_DEV_CTRL_STATS_MAX_RD_REQ_SIZE_SHIFT);
    900     advk_writel(pcie, reg, PCIE_CORE_DEV_CTRL_STATS_REG);
    901    
    902     /* Program PCIe Control 2 to disable strict ordering */
    903     @@ -439,7 +439,7 @@ static int advk_pcie_rd_conf(struct pci_bus *bus, u32 devfn,
    904     u32 reg;
    905     int ret;
    906    
    907     - if (PCI_SLOT(devfn) != 0) {
    908     + if ((bus->number == pcie->root_bus_nr) && PCI_SLOT(devfn) != 0) {
    909     *val = 0xffffffff;
    910     return PCIBIOS_DEVICE_NOT_FOUND;
    911     }
    912     @@ -458,7 +458,7 @@ static int advk_pcie_rd_conf(struct pci_bus *bus, u32 devfn,
    913     advk_writel(pcie, reg, PIO_CTRL);
    914    
    915     /* Program the address registers */
    916     - reg = PCIE_BDF(devfn) | PCIE_CONF_REG(where);
    917     + reg = PCIE_CONF_ADDR(bus->number, devfn, where);
    918     advk_writel(pcie, reg, PIO_ADDR_LS);
    919     advk_writel(pcie, 0, PIO_ADDR_MS);
    920    
    921     @@ -493,7 +493,7 @@ static int advk_pcie_wr_conf(struct pci_bus *bus, u32 devfn,
    922     int offset;
    923     int ret;
    924    
    925     - if (PCI_SLOT(devfn) != 0)
    926     + if ((bus->number == pcie->root_bus_nr) && PCI_SLOT(devfn) != 0)
    927     return PCIBIOS_DEVICE_NOT_FOUND;
    928    
    929     if (where % size)
    930     diff --git a/drivers/rtc/rtc-opal.c b/drivers/rtc/rtc-opal.c
    931     index aa53fceaa5e0..180ec1f8c917 100644
    932     --- a/drivers/rtc/rtc-opal.c
    933     +++ b/drivers/rtc/rtc-opal.c
    934     @@ -57,7 +57,7 @@ static void tm_to_opal(struct rtc_time *tm, u32 *y_m_d, u64 *h_m_s_ms)
    935    
    936     static int opal_get_rtc_time(struct device *dev, struct rtc_time *tm)
    937     {
    938     - long rc = OPAL_BUSY;
    939     + s64 rc = OPAL_BUSY;
    940     int retries = 10;
    941     u32 y_m_d;
    942     u64 h_m_s_ms;
    943     @@ -66,13 +66,17 @@ static int opal_get_rtc_time(struct device *dev, struct rtc_time *tm)
    944    
    945     while (rc == OPAL_BUSY || rc == OPAL_BUSY_EVENT) {
    946     rc = opal_rtc_read(&__y_m_d, &__h_m_s_ms);
    947     - if (rc == OPAL_BUSY_EVENT)
    948     + if (rc == OPAL_BUSY_EVENT) {
    949     + msleep(OPAL_BUSY_DELAY_MS);
    950     opal_poll_events(NULL);
    951     - else if (retries-- && (rc == OPAL_HARDWARE
    952     - || rc == OPAL_INTERNAL_ERROR))
    953     - msleep(10);
    954     - else if (rc != OPAL_BUSY && rc != OPAL_BUSY_EVENT)
    955     - break;
    956     + } else if (rc == OPAL_BUSY) {
    957     + msleep(OPAL_BUSY_DELAY_MS);
    958     + } else if (rc == OPAL_HARDWARE || rc == OPAL_INTERNAL_ERROR) {
    959     + if (retries--) {
    960     + msleep(10); /* Wait 10ms before retry */
    961     + rc = OPAL_BUSY; /* go around again */
    962     + }
    963     + }
    964     }
    965    
    966     if (rc != OPAL_SUCCESS)
    967     @@ -87,21 +91,26 @@ static int opal_get_rtc_time(struct device *dev, struct rtc_time *tm)
    968    
    969     static int opal_set_rtc_time(struct device *dev, struct rtc_time *tm)
    970     {
    971     - long rc = OPAL_BUSY;
    972     + s64 rc = OPAL_BUSY;
    973     int retries = 10;
    974     u32 y_m_d = 0;
    975     u64 h_m_s_ms = 0;
    976    
    977     tm_to_opal(tm, &y_m_d, &h_m_s_ms);
    978     +
    979     while (rc == OPAL_BUSY || rc == OPAL_BUSY_EVENT) {
    980     rc = opal_rtc_write(y_m_d, h_m_s_ms);
    981     - if (rc == OPAL_BUSY_EVENT)
    982     + if (rc == OPAL_BUSY_EVENT) {
    983     + msleep(OPAL_BUSY_DELAY_MS);
    984     opal_poll_events(NULL);
    985     - else if (retries-- && (rc == OPAL_HARDWARE
    986     - || rc == OPAL_INTERNAL_ERROR))
    987     - msleep(10);
    988     - else if (rc != OPAL_BUSY && rc != OPAL_BUSY_EVENT)
    989     - break;
    990     + } else if (rc == OPAL_BUSY) {
    991     + msleep(OPAL_BUSY_DELAY_MS);
    992     + } else if (rc == OPAL_HARDWARE || rc == OPAL_INTERNAL_ERROR) {
    993     + if (retries--) {
    994     + msleep(10); /* Wait 10ms before retry */
    995     + rc = OPAL_BUSY; /* go around again */
    996     + }
    997     + }
    998     }
    999    
    1000     return rc == OPAL_SUCCESS ? 0 : -EIO;
    1001     diff --git a/drivers/scsi/sd.c b/drivers/scsi/sd.c
    1002     index ace56c5e61e1..14ba1a2c0b7c 100644
    1003     --- a/drivers/scsi/sd.c
    1004     +++ b/drivers/scsi/sd.c
    1005     @@ -1935,6 +1935,8 @@ sd_spinup_disk(struct scsi_disk *sdkp)
    1006     break; /* standby */
    1007     if (sshdr.asc == 4 && sshdr.ascq == 0xc)
    1008     break; /* unavailable */
    1009     + if (sshdr.asc == 4 && sshdr.ascq == 0x1b)
    1010     + break; /* sanitize in progress */
    1011     /*
    1012     * Issue command to spin up drive when not ready
    1013     */
    1014     diff --git a/drivers/tty/n_gsm.c b/drivers/tty/n_gsm.c
    1015     index fe2291795d2f..9e9016e67843 100644
    1016     --- a/drivers/tty/n_gsm.c
    1017     +++ b/drivers/tty/n_gsm.c
    1018     @@ -137,6 +137,9 @@ struct gsm_dlci {
    1019     struct mutex mutex;
    1020    
    1021     /* Link layer */
    1022     + int mode;
    1023     +#define DLCI_MODE_ABM 0 /* Normal Asynchronous Balanced Mode */
    1024     +#define DLCI_MODE_ADM 1 /* Asynchronous Disconnected Mode */
    1025     spinlock_t lock; /* Protects the internal state */
    1026     struct timer_list t1; /* Retransmit timer for SABM and UA */
    1027     int retries;
    1028     @@ -1380,7 +1383,13 @@ static struct gsm_control *gsm_control_send(struct gsm_mux *gsm,
    1029     ctrl->data = data;
    1030     ctrl->len = clen;
    1031     gsm->pending_cmd = ctrl;
    1032     - gsm->cretries = gsm->n2;
    1033     +
    1034     + /* If DLCI0 is in ADM mode skip retries, it won't respond */
    1035     + if (gsm->dlci[0]->mode == DLCI_MODE_ADM)
    1036     + gsm->cretries = 1;
    1037     + else
    1038     + gsm->cretries = gsm->n2;
    1039     +
    1040     mod_timer(&gsm->t2_timer, jiffies + gsm->t2 * HZ / 100);
    1041     gsm_control_transmit(gsm, ctrl);
    1042     spin_unlock_irqrestore(&gsm->control_lock, flags);
    1043     @@ -1488,6 +1497,7 @@ static void gsm_dlci_t1(unsigned long data)
    1044     if (debug & 8)
    1045     pr_info("DLCI %d opening in ADM mode.\n",
    1046     dlci->addr);
    1047     + dlci->mode = DLCI_MODE_ADM;
    1048     gsm_dlci_open(dlci);
    1049     } else {
    1050     gsm_dlci_close(dlci);
    1051     @@ -2865,11 +2875,22 @@ static int gsmtty_modem_update(struct gsm_dlci *dlci, u8 brk)
    1052     static int gsm_carrier_raised(struct tty_port *port)
    1053     {
    1054     struct gsm_dlci *dlci = container_of(port, struct gsm_dlci, port);
    1055     + struct gsm_mux *gsm = dlci->gsm;
    1056     +
    1057     /* Not yet open so no carrier info */
    1058     if (dlci->state != DLCI_OPEN)
    1059     return 0;
    1060     if (debug & 2)
    1061     return 1;
    1062     +
    1063     + /*
    1064     + * Basic mode with control channel in ADM mode may not respond
    1065     + * to CMD_MSC at all and modem_rx is empty.
    1066     + */
    1067     + if (gsm->encoding == 0 && gsm->dlci[0]->mode == DLCI_MODE_ADM &&
    1068     + !dlci->modem_rx)
    1069     + return 1;
    1070     +
    1071     return dlci->modem_rx & TIOCM_CD;
    1072     }
    1073    
    1074     diff --git a/drivers/tty/serial/earlycon.c b/drivers/tty/serial/earlycon.c
    1075     index 3b31fd8863eb..b9a4625b8690 100644
    1076     --- a/drivers/tty/serial/earlycon.c
    1077     +++ b/drivers/tty/serial/earlycon.c
    1078     @@ -172,7 +172,7 @@ static int __init register_earlycon(char *buf, const struct earlycon_id *match)
    1079     */
    1080     int __init setup_earlycon(char *buf)
    1081     {
    1082     - const struct earlycon_id *match;
    1083     + const struct earlycon_id **p_match;
    1084    
    1085     if (!buf || !buf[0])
    1086     return -EINVAL;
    1087     @@ -180,7 +180,9 @@ int __init setup_earlycon(char *buf)
    1088     if (early_con.flags & CON_ENABLED)
    1089     return -EALREADY;
    1090    
    1091     - for (match = __earlycon_table; match < __earlycon_table_end; match++) {
    1092     + for (p_match = __earlycon_table; p_match < __earlycon_table_end;
    1093     + p_match++) {
    1094     + const struct earlycon_id *match = *p_match;
    1095     size_t len = strlen(match->name);
    1096    
    1097     if (strncmp(buf, match->name, len))
    1098     diff --git a/drivers/tty/tty_io.c b/drivers/tty/tty_io.c
    1099     index 4ee0a9de7556..789c81482542 100644
    1100     --- a/drivers/tty/tty_io.c
    1101     +++ b/drivers/tty/tty_io.c
    1102     @@ -3170,7 +3170,10 @@ struct tty_struct *alloc_tty_struct(struct tty_driver *driver, int idx)
    1103    
    1104     kref_init(&tty->kref);
    1105     tty->magic = TTY_MAGIC;
    1106     - tty_ldisc_init(tty);
    1107     + if (tty_ldisc_init(tty)) {
    1108     + kfree(tty);
    1109     + return NULL;
    1110     + }
    1111     tty->session = NULL;
    1112     tty->pgrp = NULL;
    1113     mutex_init(&tty->legacy_mutex);
    1114     diff --git a/drivers/tty/tty_ldisc.c b/drivers/tty/tty_ldisc.c
    1115     index 3a9e2a2fd4c6..4ab518d43758 100644
    1116     --- a/drivers/tty/tty_ldisc.c
    1117     +++ b/drivers/tty/tty_ldisc.c
    1118     @@ -175,12 +175,11 @@ static struct tty_ldisc *tty_ldisc_get(struct tty_struct *tty, int disc)
    1119     return ERR_CAST(ldops);
    1120     }
    1121    
    1122     - ld = kmalloc(sizeof(struct tty_ldisc), GFP_KERNEL);
    1123     - if (ld == NULL) {
    1124     - put_ldops(ldops);
    1125     - return ERR_PTR(-ENOMEM);
    1126     - }
    1127     -
    1128     + /*
    1129     + * There is no way to handle allocation failure of only 16 bytes.
    1130     + * Let's simplify error handling and save more memory.
    1131     + */
    1132     + ld = kmalloc(sizeof(struct tty_ldisc), GFP_KERNEL | __GFP_NOFAIL);
    1133     ld->ops = ldops;
    1134     ld->tty = tty;
    1135    
    1136     @@ -753,12 +752,13 @@ void tty_ldisc_release(struct tty_struct *tty)
    1137     * the tty structure is not completely set up when this call is made.
    1138     */
    1139    
    1140     -void tty_ldisc_init(struct tty_struct *tty)
    1141     +int tty_ldisc_init(struct tty_struct *tty)
    1142     {
    1143     struct tty_ldisc *ld = tty_ldisc_get(tty, N_TTY);
    1144     if (IS_ERR(ld))
    1145     - panic("n_tty: init_tty");
    1146     + return PTR_ERR(ld);
    1147     tty->ldisc = ld;
    1148     + return 0;
    1149     }
    1150    
    1151     /**
    1152     diff --git a/drivers/usb/core/hcd.c b/drivers/usb/core/hcd.c
    1153     index fcc7aa248ce7..bdb0d7a08ff9 100644
    1154     --- a/drivers/usb/core/hcd.c
    1155     +++ b/drivers/usb/core/hcd.c
    1156     @@ -2365,6 +2365,7 @@ void usb_hcd_resume_root_hub (struct usb_hcd *hcd)
    1157    
    1158     spin_lock_irqsave (&hcd_root_hub_lock, flags);
    1159     if (hcd->rh_registered) {
    1160     + pm_wakeup_event(&hcd->self.root_hub->dev, 0);
    1161     set_bit(HCD_FLAG_WAKEUP_PENDING, &hcd->flags);
    1162     queue_work(pm_wq, &hcd->wakeup_work);
    1163     }
    1164     diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c
    1165     index d0d3f9ef9f10..d8d992b73e88 100644
    1166     --- a/drivers/usb/core/hub.c
    1167     +++ b/drivers/usb/core/hub.c
    1168     @@ -648,12 +648,17 @@ void usb_wakeup_notification(struct usb_device *hdev,
    1169     unsigned int portnum)
    1170     {
    1171     struct usb_hub *hub;
    1172     + struct usb_port *port_dev;
    1173    
    1174     if (!hdev)
    1175     return;
    1176    
    1177     hub = usb_hub_to_struct_hub(hdev);
    1178     if (hub) {
    1179     + port_dev = hub->ports[portnum - 1];
    1180     + if (port_dev && port_dev->child)
    1181     + pm_wakeup_event(&port_dev->child->dev, 0);
    1182     +
    1183     set_bit(portnum, hub->wakeup_bits);
    1184     kick_hub_wq(hub);
    1185     }
    1186     @@ -3417,8 +3422,11 @@ int usb_port_resume(struct usb_device *udev, pm_message_t msg)
    1187    
    1188     /* Skip the initial Clear-Suspend step for a remote wakeup */
    1189     status = hub_port_status(hub, port1, &portstatus, &portchange);
    1190     - if (status == 0 && !port_is_suspended(hub, portstatus))
    1191     + if (status == 0 && !port_is_suspended(hub, portstatus)) {
    1192     + if (portchange & USB_PORT_STAT_C_SUSPEND)
    1193     + pm_wakeup_event(&udev->dev, 0);
    1194     goto SuspendCleared;
    1195     + }
    1196    
    1197     /* see 7.1.7.7; affects power usage, but not budgeting */
    1198     if (hub_is_superspeed(hub->hdev))
    1199     diff --git a/drivers/usb/core/quirks.c b/drivers/usb/core/quirks.c
    1200     index 4f1c6f8d4352..40ce175655e6 100644
    1201     --- a/drivers/usb/core/quirks.c
    1202     +++ b/drivers/usb/core/quirks.c
    1203     @@ -45,6 +45,9 @@ static const struct usb_device_id usb_quirk_list[] = {
    1204     { USB_DEVICE(0x03f0, 0x0701), .driver_info =
    1205     USB_QUIRK_STRING_FETCH_255 },
    1206    
    1207     + /* HP v222w 16GB Mini USB Drive */
    1208     + { USB_DEVICE(0x03f0, 0x3f40), .driver_info = USB_QUIRK_DELAY_INIT },
    1209     +
    1210     /* Creative SB Audigy 2 NX */
    1211     { USB_DEVICE(0x041e, 0x3020), .driver_info = USB_QUIRK_RESET_RESUME },
    1212    
    1213     diff --git a/drivers/usb/serial/Kconfig b/drivers/usb/serial/Kconfig
    1214     index 584ae8cbaf1c..77c3ebe860c5 100644
    1215     --- a/drivers/usb/serial/Kconfig
    1216     +++ b/drivers/usb/serial/Kconfig
    1217     @@ -62,6 +62,7 @@ config USB_SERIAL_SIMPLE
    1218     - Fundamental Software dongle.
    1219     - Google USB serial devices
    1220     - HP4x calculators
    1221     + - Libtransistor USB console
    1222     - a number of Motorola phones
    1223     - Motorola Tetra devices
    1224     - Novatel Wireless GPS receivers
    1225     diff --git a/drivers/usb/serial/cp210x.c b/drivers/usb/serial/cp210x.c
    1226     index cab80acace4e..d98531823998 100644
    1227     --- a/drivers/usb/serial/cp210x.c
    1228     +++ b/drivers/usb/serial/cp210x.c
    1229     @@ -211,6 +211,7 @@ static const struct usb_device_id id_table[] = {
    1230     { USB_DEVICE(0x3195, 0xF190) }, /* Link Instruments MSO-19 */
    1231     { USB_DEVICE(0x3195, 0xF280) }, /* Link Instruments MSO-28 */
    1232     { USB_DEVICE(0x3195, 0xF281) }, /* Link Instruments MSO-28 */
    1233     + { USB_DEVICE(0x3923, 0x7A0B) }, /* National Instruments USB Serial Console */
    1234     { USB_DEVICE(0x413C, 0x9500) }, /* DW700 GPS USB interface */
    1235     { } /* Terminating Entry */
    1236     };
    1237     diff --git a/drivers/usb/serial/ftdi_sio.c b/drivers/usb/serial/ftdi_sio.c
    1238     index 71cbc6890ac4..2e2f736384ab 100644
    1239     --- a/drivers/usb/serial/ftdi_sio.c
    1240     +++ b/drivers/usb/serial/ftdi_sio.c
    1241     @@ -1911,7 +1911,8 @@ static int ftdi_8u2232c_probe(struct usb_serial *serial)
    1242     return ftdi_jtag_probe(serial);
    1243    
    1244     if (udev->product &&
    1245     - (!strcmp(udev->product, "BeagleBone/XDS100V2") ||
    1246     + (!strcmp(udev->product, "Arrow USB Blaster") ||
    1247     + !strcmp(udev->product, "BeagleBone/XDS100V2") ||
    1248     !strcmp(udev->product, "SNAP Connect E10")))
    1249     return ftdi_jtag_probe(serial);
    1250    
    1251     diff --git a/drivers/usb/serial/usb-serial-simple.c b/drivers/usb/serial/usb-serial-simple.c
    1252     index 6aa7ff2c1cf7..2674da40d9cd 100644
    1253     --- a/drivers/usb/serial/usb-serial-simple.c
    1254     +++ b/drivers/usb/serial/usb-serial-simple.c
    1255     @@ -66,6 +66,11 @@ DEVICE(flashloader, FLASHLOADER_IDS);
    1256     0x01) }
    1257     DEVICE(google, GOOGLE_IDS);
    1258    
    1259     +/* Libtransistor USB console */
    1260     +#define LIBTRANSISTOR_IDS() \
    1261     + { USB_DEVICE(0x1209, 0x8b00) }
    1262     +DEVICE(libtransistor, LIBTRANSISTOR_IDS);
    1263     +
    1264     /* ViVOpay USB Serial Driver */
    1265     #define VIVOPAY_IDS() \
    1266     { USB_DEVICE(0x1d5f, 0x1004) } /* ViVOpay 8800 */
    1267     @@ -113,6 +118,7 @@ static struct usb_serial_driver * const serial_drivers[] = {
    1268     &funsoft_device,
    1269     &flashloader_device,
    1270     &google_device,
    1271     + &libtransistor_device,
    1272     &vivopay_device,
    1273     &moto_modem_device,
    1274     &motorola_tetra_device,
    1275     @@ -129,6 +135,7 @@ static const struct usb_device_id id_table[] = {
    1276     FUNSOFT_IDS(),
    1277     FLASHLOADER_IDS(),
    1278     GOOGLE_IDS(),
    1279     + LIBTRANSISTOR_IDS(),
    1280     VIVOPAY_IDS(),
    1281     MOTO_IDS(),
    1282     MOTOROLA_TETRA_IDS(),
    1283     diff --git a/drivers/usb/usbip/stub_main.c b/drivers/usb/usbip/stub_main.c
    1284     index 325b4c05acdd..f761e02e75c9 100644
    1285     --- a/drivers/usb/usbip/stub_main.c
    1286     +++ b/drivers/usb/usbip/stub_main.c
    1287     @@ -201,7 +201,12 @@ static ssize_t rebind_store(struct device_driver *dev, const char *buf,
    1288     if (!bid)
    1289     return -ENODEV;
    1290    
    1291     + /* device_attach() callers should hold parent lock for USB */
    1292     + if (bid->udev->dev.parent)
    1293     + device_lock(bid->udev->dev.parent);
    1294     ret = device_attach(&bid->udev->dev);
    1295     + if (bid->udev->dev.parent)
    1296     + device_unlock(bid->udev->dev.parent);
    1297     if (ret < 0) {
    1298     dev_err(&bid->udev->dev, "rebind failed\n");
    1299     return ret;
    1300     diff --git a/drivers/usb/usbip/usbip_common.h b/drivers/usb/usbip/usbip_common.h
    1301     index f0b955f8504e..109e65ba01a0 100644
    1302     --- a/drivers/usb/usbip/usbip_common.h
    1303     +++ b/drivers/usb/usbip/usbip_common.h
    1304     @@ -258,7 +258,7 @@ enum usbip_side {
    1305     #define VUDC_EVENT_ERROR_USB (USBIP_EH_SHUTDOWN | USBIP_EH_UNUSABLE)
    1306     #define VUDC_EVENT_ERROR_MALLOC (USBIP_EH_SHUTDOWN | USBIP_EH_UNUSABLE)
    1307    
    1308     -#define VDEV_EVENT_REMOVED (USBIP_EH_SHUTDOWN | USBIP_EH_BYE)
    1309     +#define VDEV_EVENT_REMOVED (USBIP_EH_SHUTDOWN | USBIP_EH_RESET | USBIP_EH_BYE)
    1310     #define VDEV_EVENT_DOWN (USBIP_EH_SHUTDOWN | USBIP_EH_RESET)
    1311     #define VDEV_EVENT_ERROR_TCP (USBIP_EH_SHUTDOWN | USBIP_EH_RESET)
    1312     #define VDEV_EVENT_ERROR_MALLOC (USBIP_EH_SHUTDOWN | USBIP_EH_UNUSABLE)
    1313     diff --git a/drivers/usb/usbip/usbip_event.c b/drivers/usb/usbip/usbip_event.c
    1314     index f1635662c299..f8f7f3803a99 100644
    1315     --- a/drivers/usb/usbip/usbip_event.c
    1316     +++ b/drivers/usb/usbip/usbip_event.c
    1317     @@ -105,10 +105,6 @@ static void event_handler(struct work_struct *work)
    1318     unset_event(ud, USBIP_EH_UNUSABLE);
    1319     }
    1320    
    1321     - /* Stop the error handler. */
    1322     - if (ud->event & USBIP_EH_BYE)
    1323     - usbip_dbg_eh("removed %p\n", ud);
    1324     -
    1325     wake_up(&ud->eh_waitq);
    1326     }
    1327     }
    1328     diff --git a/fs/ext4/balloc.c b/fs/ext4/balloc.c
    1329     index 176b4b27a27a..6776f4aa3d12 100644
    1330     --- a/fs/ext4/balloc.c
    1331     +++ b/fs/ext4/balloc.c
    1332     @@ -320,6 +320,7 @@ static ext4_fsblk_t ext4_valid_block_bitmap(struct super_block *sb,
    1333     struct ext4_sb_info *sbi = EXT4_SB(sb);
    1334     ext4_grpblk_t offset;
    1335     ext4_grpblk_t next_zero_bit;
    1336     + ext4_grpblk_t max_bit = EXT4_CLUSTERS_PER_GROUP(sb);
    1337     ext4_fsblk_t blk;
    1338     ext4_fsblk_t group_first_block;
    1339    
    1340     @@ -337,20 +338,25 @@ static ext4_fsblk_t ext4_valid_block_bitmap(struct super_block *sb,
    1341     /* check whether block bitmap block number is set */
    1342     blk = ext4_block_bitmap(sb, desc);
    1343     offset = blk - group_first_block;
    1344     - if (!ext4_test_bit(EXT4_B2C(sbi, offset), bh->b_data))
    1345     + if (offset < 0 || EXT4_B2C(sbi, offset) >= max_bit ||
    1346     + !ext4_test_bit(EXT4_B2C(sbi, offset), bh->b_data))
    1347     /* bad block bitmap */
    1348     return blk;
    1349    
    1350     /* check whether the inode bitmap block number is set */
    1351     blk = ext4_inode_bitmap(sb, desc);
    1352     offset = blk - group_first_block;
    1353     - if (!ext4_test_bit(EXT4_B2C(sbi, offset), bh->b_data))
    1354     + if (offset < 0 || EXT4_B2C(sbi, offset) >= max_bit ||
    1355     + !ext4_test_bit(EXT4_B2C(sbi, offset), bh->b_data))
    1356     /* bad block bitmap */
    1357     return blk;
    1358    
    1359     /* check whether the inode table block number is set */
    1360     blk = ext4_inode_table(sb, desc);
    1361     offset = blk - group_first_block;
    1362     + if (offset < 0 || EXT4_B2C(sbi, offset) >= max_bit ||
    1363     + EXT4_B2C(sbi, offset + sbi->s_itb_per_group) >= max_bit)
    1364     + return blk;
    1365     next_zero_bit = ext4_find_next_zero_bit(bh->b_data,
    1366     EXT4_B2C(sbi, offset + EXT4_SB(sb)->s_itb_per_group),
    1367     EXT4_B2C(sbi, offset));
    1368     @@ -416,6 +422,7 @@ struct buffer_head *
    1369     ext4_read_block_bitmap_nowait(struct super_block *sb, ext4_group_t block_group)
    1370     {
    1371     struct ext4_group_desc *desc;
    1372     + struct ext4_sb_info *sbi = EXT4_SB(sb);
    1373     struct buffer_head *bh;
    1374     ext4_fsblk_t bitmap_blk;
    1375     int err;
    1376     @@ -424,6 +431,12 @@ ext4_read_block_bitmap_nowait(struct super_block *sb, ext4_group_t block_group)
    1377     if (!desc)
    1378     return ERR_PTR(-EFSCORRUPTED);
    1379     bitmap_blk = ext4_block_bitmap(sb, desc);
    1380     + if ((bitmap_blk <= le32_to_cpu(sbi->s_es->s_first_data_block)) ||
    1381     + (bitmap_blk >= ext4_blocks_count(sbi->s_es))) {
    1382     + ext4_error(sb, "Invalid block bitmap block %llu in "
    1383     + "block_group %u", bitmap_blk, block_group);
    1384     + return ERR_PTR(-EFSCORRUPTED);
    1385     + }
    1386     bh = sb_getblk(sb, bitmap_blk);
    1387     if (unlikely(!bh)) {
    1388     ext4_error(sb, "Cannot get buffer for block bitmap - "
    1389     diff --git a/fs/ext4/extents.c b/fs/ext4/extents.c
    1390     index 1a0c57100f28..63c702b4b24c 100644
    1391     --- a/fs/ext4/extents.c
    1392     +++ b/fs/ext4/extents.c
    1393     @@ -5356,8 +5356,9 @@ ext4_ext_shift_extents(struct inode *inode, handle_t *handle,
    1394     stop = le32_to_cpu(extent->ee_block);
    1395    
    1396     /*
    1397     - * In case of left shift, Don't start shifting extents until we make
    1398     - * sure the hole is big enough to accommodate the shift.
    1399     + * For left shifts, make sure the hole on the left is big enough to
    1400     + * accommodate the shift. For right shifts, make sure the last extent
    1401     + * won't be shifted beyond EXT_MAX_BLOCKS.
    1402     */
    1403     if (SHIFT == SHIFT_LEFT) {
    1404     path = ext4_find_extent(inode, start - 1, &path,
    1405     @@ -5377,9 +5378,14 @@ ext4_ext_shift_extents(struct inode *inode, handle_t *handle,
    1406    
    1407     if ((start == ex_start && shift > ex_start) ||
    1408     (shift > start - ex_end)) {
    1409     - ext4_ext_drop_refs(path);
    1410     - kfree(path);
    1411     - return -EINVAL;
    1412     + ret = -EINVAL;
    1413     + goto out;
    1414     + }
    1415     + } else {
    1416     + if (shift > EXT_MAX_BLOCKS -
    1417     + (stop + ext4_ext_get_actual_len(extent))) {
    1418     + ret = -EINVAL;
    1419     + goto out;
    1420     }
    1421     }
    1422    
    1423     diff --git a/fs/ext4/ialloc.c b/fs/ext4/ialloc.c
    1424     index 79a9a1bddafc..dcf63daefee0 100644
    1425     --- a/fs/ext4/ialloc.c
    1426     +++ b/fs/ext4/ialloc.c
    1427     @@ -119,6 +119,7 @@ static struct buffer_head *
    1428     ext4_read_inode_bitmap(struct super_block *sb, ext4_group_t block_group)
    1429     {
    1430     struct ext4_group_desc *desc;
    1431     + struct ext4_sb_info *sbi = EXT4_SB(sb);
    1432     struct buffer_head *bh = NULL;
    1433     ext4_fsblk_t bitmap_blk;
    1434     int err;
    1435     @@ -128,6 +129,12 @@ ext4_read_inode_bitmap(struct super_block *sb, ext4_group_t block_group)
    1436     return ERR_PTR(-EFSCORRUPTED);
    1437    
    1438     bitmap_blk = ext4_inode_bitmap(sb, desc);
    1439     + if ((bitmap_blk <= le32_to_cpu(sbi->s_es->s_first_data_block)) ||
    1440     + (bitmap_blk >= ext4_blocks_count(sbi->s_es))) {
    1441     + ext4_error(sb, "Invalid inode bitmap blk %llu in "
    1442     + "block_group %u", bitmap_blk, block_group);
    1443     + return ERR_PTR(-EFSCORRUPTED);
    1444     + }
    1445     bh = sb_getblk(sb, bitmap_blk);
    1446     if (unlikely(!bh)) {
    1447     ext4_error(sb, "Cannot read inode bitmap - "
    1448     diff --git a/fs/jbd2/transaction.c b/fs/jbd2/transaction.c
    1449     index 4e5c6103b76c..9e9e0936138b 100644
    1450     --- a/fs/jbd2/transaction.c
    1451     +++ b/fs/jbd2/transaction.c
    1452     @@ -528,6 +528,7 @@ int jbd2_journal_start_reserved(handle_t *handle, unsigned int type,
    1453     */
    1454     ret = start_this_handle(journal, handle, GFP_NOFS);
    1455     if (ret < 0) {
    1456     + handle->h_journal = journal;
    1457     jbd2_journal_free_reserved(handle);
    1458     return ret;
    1459     }
    1460     diff --git a/include/asm-generic/vmlinux.lds.h b/include/asm-generic/vmlinux.lds.h
    1461     index 2e6000a4eb2c..1462071a19bf 100644
    1462     --- a/include/asm-generic/vmlinux.lds.h
    1463     +++ b/include/asm-generic/vmlinux.lds.h
    1464     @@ -170,7 +170,7 @@
    1465     #endif
    1466    
    1467     #ifdef CONFIG_SERIAL_EARLYCON
    1468     -#define EARLYCON_TABLE() STRUCT_ALIGN(); \
    1469     +#define EARLYCON_TABLE() . = ALIGN(8); \
    1470     VMLINUX_SYMBOL(__earlycon_table) = .; \
    1471     *(__earlycon_table) \
    1472     VMLINUX_SYMBOL(__earlycon_table_end) = .;
    1473     diff --git a/include/linux/mtd/flashchip.h b/include/linux/mtd/flashchip.h
    1474     index b63fa457febd..3529683f691e 100644
    1475     --- a/include/linux/mtd/flashchip.h
    1476     +++ b/include/linux/mtd/flashchip.h
    1477     @@ -85,6 +85,7 @@ struct flchip {
    1478     unsigned int write_suspended:1;
    1479     unsigned int erase_suspended:1;
    1480     unsigned long in_progress_block_addr;
    1481     + unsigned long in_progress_block_mask;
    1482    
    1483     struct mutex mutex;
    1484     wait_queue_head_t wq; /* Wait on here when we're waiting for the chip
    1485     diff --git a/include/linux/serial_core.h b/include/linux/serial_core.h
    1486     index 344201437017..7b16c5322673 100644
    1487     --- a/include/linux/serial_core.h
    1488     +++ b/include/linux/serial_core.h
    1489     @@ -347,10 +347,10 @@ struct earlycon_id {
    1490     char name[16];
    1491     char compatible[128];
    1492     int (*setup)(struct earlycon_device *, const char *options);
    1493     -} __aligned(32);
    1494     +};
    1495    
    1496     -extern const struct earlycon_id __earlycon_table[];
    1497     -extern const struct earlycon_id __earlycon_table_end[];
    1498     +extern const struct earlycon_id *__earlycon_table[];
    1499     +extern const struct earlycon_id *__earlycon_table_end[];
    1500    
    1501     #if defined(CONFIG_SERIAL_EARLYCON) && !defined(MODULE)
    1502     #define EARLYCON_USED_OR_UNUSED __used
    1503     @@ -358,12 +358,19 @@ extern const struct earlycon_id __earlycon_table_end[];
    1504     #define EARLYCON_USED_OR_UNUSED __maybe_unused
    1505     #endif
    1506    
    1507     -#define OF_EARLYCON_DECLARE(_name, compat, fn) \
    1508     - static const struct earlycon_id __UNIQUE_ID(__earlycon_##_name) \
    1509     - EARLYCON_USED_OR_UNUSED __section(__earlycon_table) \
    1510     +#define _OF_EARLYCON_DECLARE(_name, compat, fn, unique_id) \
    1511     + static const struct earlycon_id unique_id \
    1512     + EARLYCON_USED_OR_UNUSED __initconst \
    1513     = { .name = __stringify(_name), \
    1514     .compatible = compat, \
    1515     - .setup = fn }
    1516     + .setup = fn }; \
    1517     + static const struct earlycon_id EARLYCON_USED_OR_UNUSED \
    1518     + __section(__earlycon_table) \
    1519     + * const __PASTE(__p, unique_id) = &unique_id
    1520     +
    1521     +#define OF_EARLYCON_DECLARE(_name, compat, fn) \
    1522     + _OF_EARLYCON_DECLARE(_name, compat, fn, \
    1523     + __UNIQUE_ID(__earlycon_##_name))
    1524    
    1525     #define EARLYCON_DECLARE(_name, fn) OF_EARLYCON_DECLARE(_name, "", fn)
    1526    
    1527     diff --git a/include/linux/tty.h b/include/linux/tty.h
    1528     index 6f1ee8528210..fe1b8623a3a1 100644
    1529     --- a/include/linux/tty.h
    1530     +++ b/include/linux/tty.h
    1531     @@ -657,7 +657,7 @@ extern int tty_unregister_ldisc(int disc);
    1532     extern int tty_set_ldisc(struct tty_struct *tty, int disc);
    1533     extern int tty_ldisc_setup(struct tty_struct *tty, struct tty_struct *o_tty);
    1534     extern void tty_ldisc_release(struct tty_struct *tty);
    1535     -extern void tty_ldisc_init(struct tty_struct *tty);
    1536     +extern int __must_check tty_ldisc_init(struct tty_struct *tty);
    1537     extern void tty_ldisc_deinit(struct tty_struct *tty);
    1538     extern int tty_ldisc_receive_buf(struct tty_ldisc *ld, unsigned char *p,
    1539     char *f, int count);
    1540     diff --git a/include/linux/virtio.h b/include/linux/virtio.h
    1541     index d5eb5479a425..3f8f35053260 100644
    1542     --- a/include/linux/virtio.h
    1543     +++ b/include/linux/virtio.h
    1544     @@ -143,6 +143,9 @@ int virtio_device_freeze(struct virtio_device *dev);
    1545     int virtio_device_restore(struct virtio_device *dev);
    1546     #endif
    1547    
    1548     +#define virtio_device_for_each_vq(vdev, vq) \
    1549     + list_for_each_entry(vq, &vdev->vqs, list)
    1550     +
    1551     /**
    1552     * virtio_driver - operations for a virtio I/O driver
    1553     * @driver: underlying device driver (populate name and owner).
    1554     diff --git a/include/sound/control.h b/include/sound/control.h
    1555     index 21d047f229a1..4142757080f8 100644
    1556     --- a/include/sound/control.h
    1557     +++ b/include/sound/control.h
    1558     @@ -22,6 +22,7 @@
    1559     *
    1560     */
    1561    
    1562     +#include <linux/nospec.h>
    1563     #include <sound/asound.h>
    1564    
    1565     #define snd_kcontrol_chip(kcontrol) ((kcontrol)->private_data)
    1566     @@ -147,12 +148,14 @@ int snd_ctl_get_preferred_subdevice(struct snd_card *card, int type);
    1567    
    1568     static inline unsigned int snd_ctl_get_ioffnum(struct snd_kcontrol *kctl, struct snd_ctl_elem_id *id)
    1569     {
    1570     - return id->numid - kctl->id.numid;
    1571     + unsigned int ioff = id->numid - kctl->id.numid;
    1572     + return array_index_nospec(ioff, kctl->count);
    1573     }
    1574    
    1575     static inline unsigned int snd_ctl_get_ioffidx(struct snd_kcontrol *kctl, struct snd_ctl_elem_id *id)
    1576     {
    1577     - return id->index - kctl->id.index;
    1578     + unsigned int ioff = id->index - kctl->id.index;
    1579     + return array_index_nospec(ioff, kctl->count);
    1580     }
    1581    
    1582     static inline unsigned int snd_ctl_get_ioff(struct snd_kcontrol *kctl, struct snd_ctl_elem_id *id)
    1583     diff --git a/lib/kobject.c b/lib/kobject.c
    1584     index 445dcaeb0f56..b733a83e5294 100644
    1585     --- a/lib/kobject.c
    1586     +++ b/lib/kobject.c
    1587     @@ -234,14 +234,12 @@ static int kobject_add_internal(struct kobject *kobj)
    1588    
    1589     /* be noisy on error issues */
    1590     if (error == -EEXIST)
    1591     - WARN(1, "%s failed for %s with "
    1592     - "-EEXIST, don't try to register things with "
    1593     - "the same name in the same directory.\n",
    1594     - __func__, kobject_name(kobj));
    1595     + pr_err("%s failed for %s with -EEXIST, don't try to register things with the same name in the same directory.\n",
    1596     + __func__, kobject_name(kobj));
    1597     else
    1598     - WARN(1, "%s failed for %s (error: %d parent: %s)\n",
    1599     - __func__, kobject_name(kobj), error,
    1600     - parent ? kobject_name(parent) : "'none'");
    1601     + pr_err("%s failed for %s (error: %d parent: %s)\n",
    1602     + __func__, kobject_name(kobj), error,
    1603     + parent ? kobject_name(parent) : "'none'");
    1604     } else
    1605     kobj->state_in_sysfs = 1;
    1606    
    1607     diff --git a/net/ceph/messenger.c b/net/ceph/messenger.c
    1608     index 25a30be862e9..98ea28dc03f9 100644
    1609     --- a/net/ceph/messenger.c
    1610     +++ b/net/ceph/messenger.c
    1611     @@ -2512,6 +2512,11 @@ static int try_write(struct ceph_connection *con)
    1612     int ret = 1;
    1613    
    1614     dout("try_write start %p state %lu\n", con, con->state);
    1615     + if (con->state != CON_STATE_PREOPEN &&
    1616     + con->state != CON_STATE_CONNECTING &&
    1617     + con->state != CON_STATE_NEGOTIATING &&
    1618     + con->state != CON_STATE_OPEN)
    1619     + return 0;
    1620    
    1621     more:
    1622     dout("try_write out_kvec_bytes %d\n", con->out_kvec_bytes);
    1623     @@ -2537,6 +2542,8 @@ static int try_write(struct ceph_connection *con)
    1624     }
    1625    
    1626     more_kvec:
    1627     + BUG_ON(!con->sock);
    1628     +
    1629     /* kvec data queued? */
    1630     if (con->out_kvec_left) {
    1631     ret = write_partial_kvec(con);
    1632     diff --git a/net/ceph/mon_client.c b/net/ceph/mon_client.c
    1633     index a8effc8b7280..500481003de4 100644
    1634     --- a/net/ceph/mon_client.c
    1635     +++ b/net/ceph/mon_client.c
    1636     @@ -209,6 +209,14 @@ static void reopen_session(struct ceph_mon_client *monc)
    1637     __open_session(monc);
    1638     }
    1639    
    1640     +static void un_backoff(struct ceph_mon_client *monc)
    1641     +{
    1642     + monc->hunt_mult /= 2; /* reduce by 50% */
    1643     + if (monc->hunt_mult < 1)
    1644     + monc->hunt_mult = 1;
    1645     + dout("%s hunt_mult now %d\n", __func__, monc->hunt_mult);
    1646     +}
    1647     +
    1648     /*
    1649     * Reschedule delayed work timer.
    1650     */
    1651     @@ -955,6 +963,7 @@ static void delayed_work(struct work_struct *work)
    1652     if (!monc->hunting) {
    1653     ceph_con_keepalive(&monc->con);
    1654     __validate_auth(monc);
    1655     + un_backoff(monc);
    1656     }
    1657    
    1658     if (is_auth) {
    1659     @@ -1114,9 +1123,8 @@ static void finish_hunting(struct ceph_mon_client *monc)
    1660     dout("%s found mon%d\n", __func__, monc->cur_mon);
    1661     monc->hunting = false;
    1662     monc->had_a_connection = true;
    1663     - monc->hunt_mult /= 2; /* reduce by 50% */
    1664     - if (monc->hunt_mult < 1)
    1665     - monc->hunt_mult = 1;
    1666     + un_backoff(monc);
    1667     + __schedule_delayed(monc);
    1668     }
    1669     }
    1670    
    1671     diff --git a/sound/core/pcm_native.c b/sound/core/pcm_native.c
    1672     index d503285867e7..79018697b477 100644
    1673     --- a/sound/core/pcm_native.c
    1674     +++ b/sound/core/pcm_native.c
    1675     @@ -2729,6 +2729,7 @@ static int snd_pcm_sync_ptr(struct snd_pcm_substream *substream,
    1676     sync_ptr.s.status.hw_ptr = status->hw_ptr;
    1677     sync_ptr.s.status.tstamp = status->tstamp;
    1678     sync_ptr.s.status.suspended_state = status->suspended_state;
    1679     + sync_ptr.s.status.audio_tstamp = status->audio_tstamp;
    1680     snd_pcm_stream_unlock_irq(substream);
    1681     if (copy_to_user(_sync_ptr, &sync_ptr, sizeof(sync_ptr)))
    1682     return -EFAULT;
    1683     diff --git a/sound/core/seq/oss/seq_oss_event.c b/sound/core/seq/oss/seq_oss_event.c
    1684     index c3908862bc8b..86ca584c27b2 100644
    1685     --- a/sound/core/seq/oss/seq_oss_event.c
    1686     +++ b/sound/core/seq/oss/seq_oss_event.c
    1687     @@ -26,6 +26,7 @@
    1688     #include <sound/seq_oss_legacy.h>
    1689     #include "seq_oss_readq.h"
    1690     #include "seq_oss_writeq.h"
    1691     +#include <linux/nospec.h>
    1692    
    1693    
    1694     /*
    1695     @@ -287,10 +288,10 @@ note_on_event(struct seq_oss_devinfo *dp, int dev, int ch, int note, int vel, st
    1696     {
    1697     struct seq_oss_synthinfo *info;
    1698    
    1699     - if (!snd_seq_oss_synth_is_valid(dp, dev))
    1700     + info = snd_seq_oss_synth_info(dp, dev);
    1701     + if (!info)
    1702     return -ENXIO;
    1703    
    1704     - info = &dp->synths[dev];
    1705     switch (info->arg.event_passing) {
    1706     case SNDRV_SEQ_OSS_PROCESS_EVENTS:
    1707     if (! info->ch || ch < 0 || ch >= info->nr_voices) {
    1708     @@ -298,6 +299,7 @@ note_on_event(struct seq_oss_devinfo *dp, int dev, int ch, int note, int vel, st
    1709     return set_note_event(dp, dev, SNDRV_SEQ_EVENT_NOTEON, ch, note, vel, ev);
    1710     }
    1711    
    1712     + ch = array_index_nospec(ch, info->nr_voices);
    1713     if (note == 255 && info->ch[ch].note >= 0) {
    1714     /* volume control */
    1715     int type;
    1716     @@ -347,10 +349,10 @@ note_off_event(struct seq_oss_devinfo *dp, int dev, int ch, int note, int vel, s
    1717     {
    1718     struct seq_oss_synthinfo *info;
    1719    
    1720     - if (!snd_seq_oss_synth_is_valid(dp, dev))
    1721     + info = snd_seq_oss_synth_info(dp, dev);
    1722     + if (!info)
    1723     return -ENXIO;
    1724    
    1725     - info = &dp->synths[dev];
    1726     switch (info->arg.event_passing) {
    1727     case SNDRV_SEQ_OSS_PROCESS_EVENTS:
    1728     if (! info->ch || ch < 0 || ch >= info->nr_voices) {
    1729     @@ -358,6 +360,7 @@ note_off_event(struct seq_oss_devinfo *dp, int dev, int ch, int note, int vel, s
    1730     return set_note_event(dp, dev, SNDRV_SEQ_EVENT_NOTEON, ch, note, vel, ev);
    1731     }
    1732    
    1733     + ch = array_index_nospec(ch, info->nr_voices);
    1734     if (info->ch[ch].note >= 0) {
    1735     note = info->ch[ch].note;
    1736     info->ch[ch].vel = 0;
    1737     @@ -381,7 +384,7 @@ note_off_event(struct seq_oss_devinfo *dp, int dev, int ch, int note, int vel, s
    1738     static int
    1739     set_note_event(struct seq_oss_devinfo *dp, int dev, int type, int ch, int note, int vel, struct snd_seq_event *ev)
    1740     {
    1741     - if (! snd_seq_oss_synth_is_valid(dp, dev))
    1742     + if (!snd_seq_oss_synth_info(dp, dev))
    1743     return -ENXIO;
    1744    
    1745     ev->type = type;
    1746     @@ -399,7 +402,7 @@ set_note_event(struct seq_oss_devinfo *dp, int dev, int type, int ch, int note,
    1747     static int
    1748     set_control_event(struct seq_oss_devinfo *dp, int dev, int type, int ch, int param, int val, struct snd_seq_event *ev)
    1749     {
    1750     - if (! snd_seq_oss_synth_is_valid(dp, dev))
    1751     + if (!snd_seq_oss_synth_info(dp, dev))
    1752     return -ENXIO;
    1753    
    1754     ev->type = type;
    1755     diff --git a/sound/core/seq/oss/seq_oss_midi.c b/sound/core/seq/oss/seq_oss_midi.c
    1756     index b30b2139e3f0..9debd1b8fd28 100644
    1757     --- a/sound/core/seq/oss/seq_oss_midi.c
    1758     +++ b/sound/core/seq/oss/seq_oss_midi.c
    1759     @@ -29,6 +29,7 @@
    1760     #include "../seq_lock.h"
    1761     #include <linux/init.h>
    1762     #include <linux/slab.h>
    1763     +#include <linux/nospec.h>
    1764    
    1765    
    1766     /*
    1767     @@ -315,6 +316,7 @@ get_mididev(struct seq_oss_devinfo *dp, int dev)
    1768     {
    1769     if (dev < 0 || dev >= dp->max_mididev)
    1770     return NULL;
    1771     + dev = array_index_nospec(dev, dp->max_mididev);
    1772     return get_mdev(dev);
    1773     }
    1774    
    1775     diff --git a/sound/core/seq/oss/seq_oss_synth.c b/sound/core/seq/oss/seq_oss_synth.c
    1776     index cd0e0ebbfdb1..278ebb993122 100644
    1777     --- a/sound/core/seq/oss/seq_oss_synth.c
    1778     +++ b/sound/core/seq/oss/seq_oss_synth.c
    1779     @@ -26,6 +26,7 @@
    1780     #include <linux/init.h>
    1781     #include <linux/module.h>
    1782     #include <linux/slab.h>
    1783     +#include <linux/nospec.h>
    1784    
    1785     /*
    1786     * constants
    1787     @@ -339,17 +340,13 @@ snd_seq_oss_synth_cleanup(struct seq_oss_devinfo *dp)
    1788     dp->max_synthdev = 0;
    1789     }
    1790    
    1791     -/*
    1792     - * check if the specified device is MIDI mapped device
    1793     - */
    1794     -static int
    1795     -is_midi_dev(struct seq_oss_devinfo *dp, int dev)
    1796     +static struct seq_oss_synthinfo *
    1797     +get_synthinfo_nospec(struct seq_oss_devinfo *dp, int dev)
    1798     {
    1799     if (dev < 0 || dev >= dp->max_synthdev)
    1800     - return 0;
    1801     - if (dp->synths[dev].is_midi)
    1802     - return 1;
    1803     - return 0;
    1804     + return NULL;
    1805     + dev = array_index_nospec(dev, SNDRV_SEQ_OSS_MAX_SYNTH_DEVS);
    1806     + return &dp->synths[dev];
    1807     }
    1808    
    1809     /*
    1810     @@ -359,14 +356,20 @@ static struct seq_oss_synth *
    1811     get_synthdev(struct seq_oss_devinfo *dp, int dev)
    1812     {
    1813     struct seq_oss_synth *rec;
    1814     - if (dev < 0 || dev >= dp->max_synthdev)
    1815     - return NULL;
    1816     - if (! dp->synths[dev].opened)
    1817     + struct seq_oss_synthinfo *info = get_synthinfo_nospec(dp, dev);
    1818     +
    1819     + if (!info)
    1820     return NULL;
    1821     - if (dp->synths[dev].is_midi)
    1822     - return &midi_synth_dev;
    1823     - if ((rec = get_sdev(dev)) == NULL)
    1824     + if (!info->opened)
    1825     return NULL;
    1826     + if (info->is_midi) {
    1827     + rec = &midi_synth_dev;
    1828     + snd_use_lock_use(&rec->use_lock);
    1829     + } else {
    1830     + rec = get_sdev(dev);
    1831     + if (!rec)
    1832     + return NULL;
    1833     + }
    1834     if (! rec->opened) {
    1835     snd_use_lock_free(&rec->use_lock);
    1836     return NULL;
    1837     @@ -402,10 +405,8 @@ snd_seq_oss_synth_reset(struct seq_oss_devinfo *dp, int dev)
    1838     struct seq_oss_synth *rec;
    1839     struct seq_oss_synthinfo *info;
    1840    
    1841     - if (snd_BUG_ON(dev < 0 || dev >= dp->max_synthdev))
    1842     - return;
    1843     - info = &dp->synths[dev];
    1844     - if (! info->opened)
    1845     + info = get_synthinfo_nospec(dp, dev);
    1846     + if (!info || !info->opened)
    1847     return;
    1848     if (info->sysex)
    1849     info->sysex->len = 0; /* reset sysex */
    1850     @@ -454,12 +455,14 @@ snd_seq_oss_synth_load_patch(struct seq_oss_devinfo *dp, int dev, int fmt,
    1851     const char __user *buf, int p, int c)
    1852     {
    1853     struct seq_oss_synth *rec;
    1854     + struct seq_oss_synthinfo *info;
    1855     int rc;
    1856    
    1857     - if (dev < 0 || dev >= dp->max_synthdev)
    1858     + info = get_synthinfo_nospec(dp, dev);
    1859     + if (!info)
    1860     return -ENXIO;
    1861    
    1862     - if (is_midi_dev(dp, dev))
    1863     + if (info->is_midi)
    1864     return 0;
    1865     if ((rec = get_synthdev(dp, dev)) == NULL)
    1866     return -ENXIO;
    1867     @@ -467,24 +470,25 @@ snd_seq_oss_synth_load_patch(struct seq_oss_devinfo *dp, int dev, int fmt,
    1868     if (rec->oper.load_patch == NULL)
    1869     rc = -ENXIO;
    1870     else
    1871     - rc = rec->oper.load_patch(&dp->synths[dev].arg, fmt, buf, p, c);
    1872     + rc = rec->oper.load_patch(&info->arg, fmt, buf, p, c);
    1873     snd_use_lock_free(&rec->use_lock);
    1874     return rc;
    1875     }
    1876    
    1877     /*
    1878     - * check if the device is valid synth device
    1879     + * check if the device is valid synth device and return the synth info
    1880     */
    1881     -int
    1882     -snd_seq_oss_synth_is_valid(struct seq_oss_devinfo *dp, int dev)
    1883     +struct seq_oss_synthinfo *
    1884     +snd_seq_oss_synth_info(struct seq_oss_devinfo *dp, int dev)
    1885     {
    1886     struct seq_oss_synth *rec;
    1887     +
    1888     rec = get_synthdev(dp, dev);
    1889     if (rec) {
    1890     snd_use_lock_free(&rec->use_lock);
    1891     - return 1;
    1892     + return get_synthinfo_nospec(dp, dev);
    1893     }
    1894     - return 0;
    1895     + return NULL;
    1896     }
    1897    
    1898    
    1899     @@ -499,16 +503,18 @@ snd_seq_oss_synth_sysex(struct seq_oss_devinfo *dp, int dev, unsigned char *buf,
    1900     int i, send;
    1901     unsigned char *dest;
    1902     struct seq_oss_synth_sysex *sysex;
    1903     + struct seq_oss_synthinfo *info;
    1904    
    1905     - if (! snd_seq_oss_synth_is_valid(dp, dev))
    1906     + info = snd_seq_oss_synth_info(dp, dev);
    1907     + if (!info)
    1908     return -ENXIO;
    1909    
    1910     - sysex = dp->synths[dev].sysex;
    1911     + sysex = info->sysex;
    1912     if (sysex == NULL) {
    1913     sysex = kzalloc(sizeof(*sysex), GFP_KERNEL);
    1914     if (sysex == NULL)
    1915     return -ENOMEM;
    1916     - dp->synths[dev].sysex = sysex;
    1917     + info->sysex = sysex;
    1918     }
    1919    
    1920     send = 0;
    1921     @@ -553,10 +559,12 @@ snd_seq_oss_synth_sysex(struct seq_oss_devinfo *dp, int dev, unsigned char *buf,
    1922     int
    1923     snd_seq_oss_synth_addr(struct seq_oss_devinfo *dp, int dev, struct snd_seq_event *ev)
    1924     {
    1925     - if (! snd_seq_oss_synth_is_valid(dp, dev))
    1926     + struct seq_oss_synthinfo *info = snd_seq_oss_synth_info(dp, dev);
    1927     +
    1928     + if (!info)
    1929     return -EINVAL;
    1930     - snd_seq_oss_fill_addr(dp, ev, dp->synths[dev].arg.addr.client,
    1931     - dp->synths[dev].arg.addr.port);
    1932     + snd_seq_oss_fill_addr(dp, ev, info->arg.addr.client,
    1933     + info->arg.addr.port);
    1934     return 0;
    1935     }
    1936    
    1937     @@ -568,16 +576,18 @@ int
    1938     snd_seq_oss_synth_ioctl(struct seq_oss_devinfo *dp, int dev, unsigned int cmd, unsigned long addr)
    1939     {
    1940     struct seq_oss_synth *rec;
    1941     + struct seq_oss_synthinfo *info;
    1942     int rc;
    1943    
    1944     - if (is_midi_dev(dp, dev))
    1945     + info = get_synthinfo_nospec(dp, dev);
    1946     + if (!info || info->is_midi)
    1947     return -ENXIO;
    1948     if ((rec = get_synthdev(dp, dev)) == NULL)
    1949     return -ENXIO;
    1950     if (rec->oper.ioctl == NULL)
    1951     rc = -ENXIO;
    1952     else
    1953     - rc = rec->oper.ioctl(&dp->synths[dev].arg, cmd, addr);
    1954     + rc = rec->oper.ioctl(&info->arg, cmd, addr);
    1955     snd_use_lock_free(&rec->use_lock);
    1956     return rc;
    1957     }
    1958     @@ -589,7 +599,10 @@ snd_seq_oss_synth_ioctl(struct seq_oss_devinfo *dp, int dev, unsigned int cmd, u
    1959     int
    1960     snd_seq_oss_synth_raw_event(struct seq_oss_devinfo *dp, int dev, unsigned char *data, struct snd_seq_event *ev)
    1961     {
    1962     - if (! snd_seq_oss_synth_is_valid(dp, dev) || is_midi_dev(dp, dev))
    1963     + struct seq_oss_synthinfo *info;
    1964     +
    1965     + info = snd_seq_oss_synth_info(dp, dev);
    1966     + if (!info || info->is_midi)
    1967     return -ENXIO;
    1968     ev->type = SNDRV_SEQ_EVENT_OSS;
    1969     memcpy(ev->data.raw8.d, data, 8);
    1970     diff --git a/sound/core/seq/oss/seq_oss_synth.h b/sound/core/seq/oss/seq_oss_synth.h
    1971     index 74ac55f166b6..a63f9e22974d 100644
    1972     --- a/sound/core/seq/oss/seq_oss_synth.h
    1973     +++ b/sound/core/seq/oss/seq_oss_synth.h
    1974     @@ -37,7 +37,8 @@ void snd_seq_oss_synth_cleanup(struct seq_oss_devinfo *dp);
    1975     void snd_seq_oss_synth_reset(struct seq_oss_devinfo *dp, int dev);
    1976     int snd_seq_oss_synth_load_patch(struct seq_oss_devinfo *dp, int dev, int fmt,
    1977     const char __user *buf, int p, int c);
    1978     -int snd_seq_oss_synth_is_valid(struct seq_oss_devinfo *dp, int dev);
    1979     +struct seq_oss_synthinfo *snd_seq_oss_synth_info(struct seq_oss_devinfo *dp,
    1980     + int dev);
    1981     int snd_seq_oss_synth_sysex(struct seq_oss_devinfo *dp, int dev, unsigned char *buf,
    1982     struct snd_seq_event *ev);
    1983     int snd_seq_oss_synth_addr(struct seq_oss_devinfo *dp, int dev, struct snd_seq_event *ev);
    1984     diff --git a/sound/drivers/opl3/opl3_synth.c b/sound/drivers/opl3/opl3_synth.c
    1985     index ddcc1a325a61..42920a243328 100644
    1986     --- a/sound/drivers/opl3/opl3_synth.c
    1987     +++ b/sound/drivers/opl3/opl3_synth.c
    1988     @@ -21,6 +21,7 @@
    1989    
    1990     #include <linux/slab.h>
    1991     #include <linux/export.h>
    1992     +#include <linux/nospec.h>
    1993     #include <sound/opl3.h>
    1994     #include <sound/asound_fm.h>
    1995    
    1996     @@ -448,7 +449,7 @@ static int snd_opl3_set_voice(struct snd_opl3 * opl3, struct snd_dm_fm_voice * v
    1997     {
    1998     unsigned short reg_side;
    1999     unsigned char op_offset;
    2000     - unsigned char voice_offset;
    2001     + unsigned char voice_offset, voice_op;
    2002    
    2003     unsigned short opl3_reg;
    2004     unsigned char reg_val;
    2005     @@ -473,7 +474,9 @@ static int snd_opl3_set_voice(struct snd_opl3 * opl3, struct snd_dm_fm_voice * v
    2006     voice_offset = voice->voice - MAX_OPL2_VOICES;
    2007     }
    2008     /* Get register offset of operator */
    2009     - op_offset = snd_opl3_regmap[voice_offset][voice->op];
    2010     + voice_offset = array_index_nospec(voice_offset, MAX_OPL2_VOICES);
    2011     + voice_op = array_index_nospec(voice->op, 4);
    2012     + op_offset = snd_opl3_regmap[voice_offset][voice_op];
    2013    
    2014     reg_val = 0x00;
    2015     /* Set amplitude modulation (tremolo) effect */
    2016     diff --git a/sound/firewire/dice/dice-stream.c b/sound/firewire/dice/dice-stream.c
    2017     index ec4db3a514fc..257cfbfadb4a 100644
    2018     --- a/sound/firewire/dice/dice-stream.c
    2019     +++ b/sound/firewire/dice/dice-stream.c
    2020     @@ -425,7 +425,7 @@ int snd_dice_stream_init_duplex(struct snd_dice *dice)
    2021     err = init_stream(dice, AMDTP_IN_STREAM, i);
    2022     if (err < 0) {
    2023     for (; i >= 0; i--)
    2024     - destroy_stream(dice, AMDTP_OUT_STREAM, i);
    2025     + destroy_stream(dice, AMDTP_IN_STREAM, i);
    2026     goto end;
    2027     }
    2028     }
    2029     diff --git a/sound/firewire/dice/dice.c b/sound/firewire/dice/dice.c
    2030     index 25e9f77275c4..0d3d36fb1540 100644
    2031     --- a/sound/firewire/dice/dice.c
    2032     +++ b/sound/firewire/dice/dice.c
    2033     @@ -14,7 +14,7 @@ MODULE_LICENSE("GPL v2");
    2034     #define OUI_WEISS 0x001c6a
    2035     #define OUI_LOUD 0x000ff2
    2036     #define OUI_FOCUSRITE 0x00130e
    2037     -#define OUI_TCELECTRONIC 0x001486
    2038     +#define OUI_TCELECTRONIC 0x000166
    2039    
    2040     #define DICE_CATEGORY_ID 0x04
    2041     #define WEISS_CATEGORY_ID 0x00
    2042     diff --git a/sound/pci/asihpi/hpimsginit.c b/sound/pci/asihpi/hpimsginit.c
    2043     index 7eb617175fde..a31a70dccecf 100644
    2044     --- a/sound/pci/asihpi/hpimsginit.c
    2045     +++ b/sound/pci/asihpi/hpimsginit.c
    2046     @@ -23,6 +23,7 @@
    2047    
    2048     #include "hpi_internal.h"
    2049     #include "hpimsginit.h"
    2050     +#include <linux/nospec.h>
    2051    
    2052     /* The actual message size for each object type */
    2053     static u16 msg_size[HPI_OBJ_MAXINDEX + 1] = HPI_MESSAGE_SIZE_BY_OBJECT;
    2054     @@ -39,10 +40,12 @@ static void hpi_init_message(struct hpi_message *phm, u16 object,
    2055     {
    2056     u16 size;
    2057    
    2058     - if ((object > 0) && (object <= HPI_OBJ_MAXINDEX))
    2059     + if ((object > 0) && (object <= HPI_OBJ_MAXINDEX)) {
    2060     + object = array_index_nospec(object, HPI_OBJ_MAXINDEX + 1);
    2061     size = msg_size[object];
    2062     - else
    2063     + } else {
    2064     size = sizeof(*phm);
    2065     + }
    2066    
    2067     memset(phm, 0, size);
    2068     phm->size = size;
    2069     @@ -66,10 +69,12 @@ void hpi_init_response(struct hpi_response *phr, u16 object, u16 function,
    2070     {
    2071     u16 size;
    2072    
    2073     - if ((object > 0) && (object <= HPI_OBJ_MAXINDEX))
    2074     + if ((object > 0) && (object <= HPI_OBJ_MAXINDEX)) {
    2075     + object = array_index_nospec(object, HPI_OBJ_MAXINDEX + 1);
    2076     size = res_size[object];
    2077     - else
    2078     + } else {
    2079     size = sizeof(*phr);
    2080     + }
    2081    
    2082     memset(phr, 0, sizeof(*phr));
    2083     phr->size = size;
    2084     diff --git a/sound/pci/asihpi/hpioctl.c b/sound/pci/asihpi/hpioctl.c
    2085     index 7e3aa50b21f9..3ef9af53ef49 100644
    2086     --- a/sound/pci/asihpi/hpioctl.c
    2087     +++ b/sound/pci/asihpi/hpioctl.c
    2088     @@ -33,6 +33,7 @@
    2089     #include <linux/stringify.h>
    2090     #include <linux/module.h>
    2091     #include <linux/vmalloc.h>
    2092     +#include <linux/nospec.h>
    2093    
    2094     #ifdef MODULE_FIRMWARE
    2095     MODULE_FIRMWARE("asihpi/dsp5000.bin");
    2096     @@ -182,7 +183,8 @@ long asihpi_hpi_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
    2097     struct hpi_adapter *pa = NULL;
    2098    
    2099     if (hm->h.adapter_index < ARRAY_SIZE(adapters))
    2100     - pa = &adapters[hm->h.adapter_index];
    2101     + pa = &adapters[array_index_nospec(hm->h.adapter_index,
    2102     + ARRAY_SIZE(adapters))];
    2103    
    2104     if (!pa || !pa->adapter || !pa->adapter->type) {
    2105     hpi_init_response(&hr->r0, hm->h.object,
    2106     diff --git a/sound/pci/hda/hda_hwdep.c b/sound/pci/hda/hda_hwdep.c
    2107     index 57df06e76968..cc009a4a3d1d 100644
    2108     --- a/sound/pci/hda/hda_hwdep.c
    2109     +++ b/sound/pci/hda/hda_hwdep.c
    2110     @@ -21,6 +21,7 @@
    2111     #include <linux/init.h>
    2112     #include <linux/slab.h>
    2113     #include <linux/compat.h>
    2114     +#include <linux/nospec.h>
    2115     #include <sound/core.h>
    2116     #include "hda_codec.h"
    2117     #include "hda_local.h"
    2118     @@ -51,7 +52,16 @@ static int get_wcap_ioctl(struct hda_codec *codec,
    2119    
    2120     if (get_user(verb, &arg->verb))
    2121     return -EFAULT;
    2122     - res = get_wcaps(codec, verb >> 24);
    2123     + /* open-code get_wcaps(verb>>24) with nospec */
    2124     + verb >>= 24;
    2125     + if (verb < codec->core.start_nid ||
    2126     + verb >= codec->core.start_nid + codec->core.num_nodes) {
    2127     + res = 0;
    2128     + } else {
    2129     + verb -= codec->core.start_nid;
    2130     + verb = array_index_nospec(verb, codec->core.num_nodes);
    2131     + res = codec->wcaps[verb];
    2132     + }
    2133     if (put_user(res, &arg->res))
    2134     return -EFAULT;
    2135     return 0;
    2136     diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
    2137     index e2230bed7409..7ece1ab57eef 100644
    2138     --- a/sound/pci/hda/patch_realtek.c
    2139     +++ b/sound/pci/hda/patch_realtek.c
    2140     @@ -329,6 +329,7 @@ static void alc_fill_eapd_coef(struct hda_codec *codec)
    2141     break;
    2142     case 0x10ec0225:
    2143     case 0x10ec0233:
    2144     + case 0x10ec0235:
    2145     case 0x10ec0236:
    2146     case 0x10ec0255:
    2147     case 0x10ec0256:
    2148     @@ -6359,6 +6360,7 @@ static int patch_alc269(struct hda_codec *codec)
    2149     case 0x10ec0298:
    2150     spec->codec_variant = ALC269_TYPE_ALC298;
    2151     break;
    2152     + case 0x10ec0235:
    2153     case 0x10ec0255:
    2154     spec->codec_variant = ALC269_TYPE_ALC255;
    2155     break;
    2156     diff --git a/sound/pci/rme9652/hdspm.c b/sound/pci/rme9652/hdspm.c
    2157     index 14bbf55c1ef9..9899ef4c7efa 100644
    2158     --- a/sound/pci/rme9652/hdspm.c
    2159     +++ b/sound/pci/rme9652/hdspm.c
    2160     @@ -137,6 +137,7 @@
    2161     #include <linux/pci.h>
    2162     #include <linux/math64.h>
    2163     #include <linux/io.h>
    2164     +#include <linux/nospec.h>
    2165    
    2166     #include <sound/core.h>
    2167     #include <sound/control.h>
    2168     @@ -5692,40 +5693,43 @@ static int snd_hdspm_channel_info(struct snd_pcm_substream *substream,
    2169     struct snd_pcm_channel_info *info)
    2170     {
    2171     struct hdspm *hdspm = snd_pcm_substream_chip(substream);
    2172     + unsigned int channel = info->channel;
    2173    
    2174     if (substream->stream == SNDRV_PCM_STREAM_PLAYBACK) {
    2175     - if (snd_BUG_ON(info->channel >= hdspm->max_channels_out)) {
    2176     + if (snd_BUG_ON(channel >= hdspm->max_channels_out)) {
    2177     dev_info(hdspm->card->dev,
    2178     "snd_hdspm_channel_info: output channel out of range (%d)\n",
    2179     - info->channel);
    2180     + channel);
    2181     return -EINVAL;
    2182     }
    2183    
    2184     - if (hdspm->channel_map_out[info->channel] < 0) {
    2185     + channel = array_index_nospec(channel, hdspm->max_channels_out);
    2186     + if (hdspm->channel_map_out[channel] < 0) {
    2187     dev_info(hdspm->card->dev,
    2188     "snd_hdspm_channel_info: output channel %d mapped out\n",
    2189     - info->channel);
    2190     + channel);
    2191     return -EINVAL;
    2192     }
    2193    
    2194     - info->offset = hdspm->channel_map_out[info->channel] *
    2195     + info->offset = hdspm->channel_map_out[channel] *
    2196     HDSPM_CHANNEL_BUFFER_BYTES;
    2197     } else {
    2198     - if (snd_BUG_ON(info->channel >= hdspm->max_channels_in)) {
    2199     + if (snd_BUG_ON(channel >= hdspm->max_channels_in)) {
    2200     dev_info(hdspm->card->dev,
    2201     "snd_hdspm_channel_info: input channel out of range (%d)\n",
    2202     - info->channel);
    2203     + channel);
    2204     return -EINVAL;
    2205     }
    2206    
    2207     - if (hdspm->channel_map_in[info->channel] < 0) {
    2208     + channel = array_index_nospec(channel, hdspm->max_channels_in);
    2209     + if (hdspm->channel_map_in[channel] < 0) {
    2210     dev_info(hdspm->card->dev,
    2211     "snd_hdspm_channel_info: input channel %d mapped out\n",
    2212     - info->channel);
    2213     + channel);
    2214     return -EINVAL;
    2215     }
    2216    
    2217     - info->offset = hdspm->channel_map_in[info->channel] *
    2218     + info->offset = hdspm->channel_map_in[channel] *
    2219     HDSPM_CHANNEL_BUFFER_BYTES;
    2220     }
    2221    
    2222     diff --git a/sound/pci/rme9652/rme9652.c b/sound/pci/rme9652/rme9652.c
    2223     index 55172c689991..a76b1f147660 100644
    2224     --- a/sound/pci/rme9652/rme9652.c
    2225     +++ b/sound/pci/rme9652/rme9652.c
    2226     @@ -26,6 +26,7 @@
    2227     #include <linux/pci.h>
    2228     #include <linux/module.h>
    2229     #include <linux/io.h>
    2230     +#include <linux/nospec.h>
    2231    
    2232     #include <sound/core.h>
    2233     #include <sound/control.h>
    2234     @@ -2036,9 +2037,10 @@ static int snd_rme9652_channel_info(struct snd_pcm_substream *substream,
    2235     if (snd_BUG_ON(info->channel >= RME9652_NCHANNELS))
    2236     return -EINVAL;
    2237    
    2238     - if ((chn = rme9652->channel_map[info->channel]) < 0) {
    2239     + chn = rme9652->channel_map[array_index_nospec(info->channel,
    2240     + RME9652_NCHANNELS)];
    2241     + if (chn < 0)
    2242     return -EINVAL;
    2243     - }
    2244    
    2245     info->offset = chn * RME9652_CHANNEL_BUFFER_BYTES;
    2246     info->first = 0;
    2247     diff --git a/sound/soc/fsl/fsl_esai.c b/sound/soc/fsl/fsl_esai.c
    2248     index 38bfd46f4ad8..3ef174531344 100644
    2249     --- a/sound/soc/fsl/fsl_esai.c
    2250     +++ b/sound/soc/fsl/fsl_esai.c
    2251     @@ -145,6 +145,13 @@ static int fsl_esai_divisor_cal(struct snd_soc_dai *dai, bool tx, u32 ratio,
    2252    
    2253     psr = ratio <= 256 * maxfp ? ESAI_xCCR_xPSR_BYPASS : ESAI_xCCR_xPSR_DIV8;
    2254    
    2255     + /* Do not loop-search if PM (1 ~ 256) alone can serve the ratio */
    2256     + if (ratio <= 256) {
    2257     + pm = ratio;
    2258     + fp = 1;
    2259     + goto out;
    2260     + }
    2261     +
    2262     /* Set the max fluctuation -- 0.1% of the max devisor */
    2263     savesub = (psr ? 1 : 8) * 256 * maxfp / 1000;
    2264    
    2265     diff --git a/sound/usb/mixer_maps.c b/sound/usb/mixer_maps.c
    2266     index 9038b2e7df73..eaa03acd4686 100644
    2267     --- a/sound/usb/mixer_maps.c
    2268     +++ b/sound/usb/mixer_maps.c
    2269     @@ -353,8 +353,11 @@ static struct usbmix_name_map bose_companion5_map[] = {
    2270     /*
    2271     * Dell usb dock with ALC4020 codec had a firmware problem where it got
    2272     * screwed up when zero volume is passed; just skip it as a workaround
    2273     + *
    2274     + * Also the extension unit gives an access error, so skip it as well.
    2275     */
    2276     static const struct usbmix_name_map dell_alc4020_map[] = {
    2277     + { 4, NULL }, /* extension unit */
    2278     { 16, NULL },
    2279     { 19, NULL },
    2280     { 0 }
    2281     diff --git a/tools/lib/str_error_r.c b/tools/lib/str_error_r.c
    2282     index 503ae072244c..9ab2d0ad22d5 100644
    2283     --- a/tools/lib/str_error_r.c
    2284     +++ b/tools/lib/str_error_r.c
    2285     @@ -21,6 +21,6 @@ char *str_error_r(int errnum, char *buf, size_t buflen)
    2286     {
    2287     int err = strerror_r(errnum, buf, buflen);
    2288     if (err)
    2289     - snprintf(buf, buflen, "INTERNAL ERROR: strerror_r(%d, %p, %zd)=%d", errnum, buf, buflen, err);
    2290     + snprintf(buf, buflen, "INTERNAL ERROR: strerror_r(%d, [buf], %zd)=%d", errnum, buflen, err);
    2291     return buf;
    2292     }
    2293     diff --git a/tools/lib/subcmd/pager.c b/tools/lib/subcmd/pager.c
    2294     index 6518bea926d6..68af60fdf0b9 100644
    2295     --- a/tools/lib/subcmd/pager.c
    2296     +++ b/tools/lib/subcmd/pager.c
    2297     @@ -29,10 +29,13 @@ static void pager_preexec(void)
    2298     * have real input
    2299     */
    2300     fd_set in;
    2301     + fd_set exception;
    2302    
    2303     FD_ZERO(&in);
    2304     + FD_ZERO(&exception);
    2305     FD_SET(0, &in);
    2306     - select(1, &in, NULL, &in, NULL);
    2307     + FD_SET(0, &exception);
    2308     + select(1, &in, NULL, &exception, NULL);
    2309    
    2310     setenv("LESS", "FRSX", 0);
    2311     }