Magellan Linux

  • Back to homepage
    • /[pkg-src]/trunk/kernel-alx/patches-4.9/0227-4.9.128-all-fixes.patch

    Contents of /trunk/kernel-alx/patches-4.9/0227-4.9.128-all-fixes.patch

    Parent Directory Parent Directory | Revision Log Revision Log

    Revision 3228 - (show annotations) (download)
    Mon Oct 1 09:59:39 2018 UTC (5 years, 7 months ago) by niro
    File size: 64909 byte(s) 
    -linux-4.9.128
    1 diff --git a/Makefile b/Makefile
    2 index 4e37716ae395..1892bdb6a760 100644
    3 --- a/Makefile
    4 +++ b/Makefile
    5 @@ -1,6 +1,6 @@
    6 VERSION = 4
    7 PATCHLEVEL = 9
    8 -SUBLEVEL = 127
    9 +SUBLEVEL = 128
    10 EXTRAVERSION =
    11 NAME = Roaring Lionus
    12
    13 diff --git a/arch/arc/configs/axs101_defconfig b/arch/arc/configs/axs101_defconfig
    14 index 5367fe36b69d..dd623199bb48 100644
    15 --- a/arch/arc/configs/axs101_defconfig
    16 +++ b/arch/arc/configs/axs101_defconfig
    17 @@ -1,5 +1,4 @@
    18 CONFIG_DEFAULT_HOSTNAME="ARCLinux"
    19 -# CONFIG_SWAP is not set
    20 CONFIG_SYSVIPC=y
    21 CONFIG_POSIX_MQUEUE=y
    22 # CONFIG_CROSS_MEMORY_ATTACH is not set
    23 diff --git a/arch/arc/configs/axs103_defconfig b/arch/arc/configs/axs103_defconfig
    24 index d40fad485982..2e0d7d74b8ee 100644
    25 --- a/arch/arc/configs/axs103_defconfig
    26 +++ b/arch/arc/configs/axs103_defconfig
    27 @@ -1,5 +1,4 @@
    28 CONFIG_DEFAULT_HOSTNAME="ARCLinux"
    29 -# CONFIG_SWAP is not set
    30 CONFIG_SYSVIPC=y
    31 CONFIG_POSIX_MQUEUE=y
    32 # CONFIG_CROSS_MEMORY_ATTACH is not set
    33 diff --git a/arch/arc/configs/axs103_smp_defconfig b/arch/arc/configs/axs103_smp_defconfig
    34 index 06cbd27ef860..ec188fca2cc9 100644
    35 --- a/arch/arc/configs/axs103_smp_defconfig
    36 +++ b/arch/arc/configs/axs103_smp_defconfig
    37 @@ -1,5 +1,4 @@
    38 CONFIG_DEFAULT_HOSTNAME="ARCLinux"
    39 -# CONFIG_SWAP is not set
    40 CONFIG_SYSVIPC=y
    41 CONFIG_POSIX_MQUEUE=y
    42 # CONFIG_CROSS_MEMORY_ATTACH is not set
    43 diff --git a/arch/mips/cavium-octeon/octeon-platform.c b/arch/mips/cavium-octeon/octeon-platform.c
    44 index 37a932d9148c..1ba6bcf98570 100644
    45 --- a/arch/mips/cavium-octeon/octeon-platform.c
    46 +++ b/arch/mips/cavium-octeon/octeon-platform.c
    47 @@ -366,6 +366,7 @@ static int __init octeon_ehci_device_init(void)
    48 return 0;
    49
    50 pd = of_find_device_by_node(ehci_node);
    51 + of_node_put(ehci_node);
    52 if (!pd)
    53 return 0;
    54
    55 @@ -428,6 +429,7 @@ static int __init octeon_ohci_device_init(void)
    56 return 0;
    57
    58 pd = of_find_device_by_node(ohci_node);
    59 + of_node_put(ohci_node);
    60 if (!pd)
    61 return 0;
    62
    63 diff --git a/arch/mips/generic/init.c b/arch/mips/generic/init.c
    64 index d493ccbf274a..cf5b56492d8e 100644
    65 --- a/arch/mips/generic/init.c
    66 +++ b/arch/mips/generic/init.c
    67 @@ -159,6 +159,7 @@ void __init arch_init_irq(void)
    68 "mti,cpu-interrupt-controller");
    69 if (!cpu_has_veic && !intc_node)
    70 mips_cpu_irq_init();
    71 + of_node_put(intc_node);
    72
    73 irqchip_init();
    74 }
    75 diff --git a/arch/mips/include/asm/io.h b/arch/mips/include/asm/io.h
    76 index 853b2f4954fa..06049b6b3ddd 100644
    77 --- a/arch/mips/include/asm/io.h
    78 +++ b/arch/mips/include/asm/io.h
    79 @@ -141,14 +141,14 @@ static inline void * phys_to_virt(unsigned long address)
    80 /*
    81 * ISA I/O bus memory addresses are 1:1 with the physical address.
    82 */
    83 -static inline unsigned long isa_virt_to_bus(volatile void * address)
    84 +static inline unsigned long isa_virt_to_bus(volatile void *address)
    85 {
    86 - return (unsigned long)address - PAGE_OFFSET;
    87 + return virt_to_phys(address);
    88 }
    89
    90 -static inline void * isa_bus_to_virt(unsigned long address)
    91 +static inline void *isa_bus_to_virt(unsigned long address)
    92 {
    93 - return (void *)(address + PAGE_OFFSET);
    94 + return phys_to_virt(address);
    95 }
    96
    97 #define isa_page_to_bus page_to_phys
    98 diff --git a/arch/mips/kernel/process.c b/arch/mips/kernel/process.c
    99 index 513a63b9b991..ba315e523b33 100644
    100 --- a/arch/mips/kernel/process.c
    101 +++ b/arch/mips/kernel/process.c
    102 @@ -118,7 +118,6 @@ int copy_thread(unsigned long clone_flags, unsigned long usp,
    103 struct thread_info *ti = task_thread_info(p);
    104 struct pt_regs *childregs, *regs = current_pt_regs();
    105 unsigned long childksp;
    106 - p->set_child_tid = p->clear_child_tid = NULL;
    107
    108 childksp = (unsigned long)task_stack_page(p) + THREAD_SIZE - 32;
    109
    110 diff --git a/arch/mips/mm/c-r4k.c b/arch/mips/mm/c-r4k.c
    111 index 43fa682e55da..0ff379f0cc4a 100644
    112 --- a/arch/mips/mm/c-r4k.c
    113 +++ b/arch/mips/mm/c-r4k.c
    114 @@ -835,7 +835,8 @@ static void r4k_flush_icache_user_range(unsigned long start, unsigned long end)
    115 static void r4k_dma_cache_wback_inv(unsigned long addr, unsigned long size)
    116 {
    117 /* Catch bad driver code */
    118 - BUG_ON(size == 0);
    119 + if (WARN_ON(size == 0))
    120 + return;
    121
    122 preempt_disable();
    123 if (cpu_has_inclusive_pcaches) {
    124 @@ -871,7 +872,8 @@ static void r4k_dma_cache_wback_inv(unsigned long addr, unsigned long size)
    125 static void r4k_dma_cache_inv(unsigned long addr, unsigned long size)
    126 {
    127 /* Catch bad driver code */
    128 - BUG_ON(size == 0);
    129 + if (WARN_ON(size == 0))
    130 + return;
    131
    132 preempt_disable();
    133 if (cpu_has_inclusive_pcaches) {
    134 diff --git a/arch/openrisc/kernel/process.c b/arch/openrisc/kernel/process.c
    135 index 7095dfe7666b..962372143fda 100644
    136 --- a/arch/openrisc/kernel/process.c
    137 +++ b/arch/openrisc/kernel/process.c
    138 @@ -152,8 +152,6 @@ copy_thread(unsigned long clone_flags, unsigned long usp,
    139
    140 top_of_kernel_stack = sp;
    141
    142 - p->set_child_tid = p->clear_child_tid = NULL;
    143 -
    144 /* Locate userspace context on stack... */
    145 sp -= STACK_FRAME_OVERHEAD; /* redzone */
    146 sp -= sizeof(struct pt_regs);
    147 diff --git a/arch/s390/kvm/vsie.c b/arch/s390/kvm/vsie.c
    148 index 51f842c0a175..da246d95b87c 100644
    149 --- a/arch/s390/kvm/vsie.c
    150 +++ b/arch/s390/kvm/vsie.c
    151 @@ -156,7 +156,8 @@ static int shadow_crycb(struct kvm_vcpu *vcpu, struct vsie_page *vsie_page)
    152 return set_validity_icpt(scb_s, 0x0039U);
    153
    154 /* copy only the wrapping keys */
    155 - if (read_guest_real(vcpu, crycb_addr + 72, &vsie_page->crycb, 56))
    156 + if (read_guest_real(vcpu, crycb_addr + 72,
    157 + vsie_page->crycb.dea_wrapping_key_mask, 56))
    158 return set_validity_icpt(scb_s, 0x0035U);
    159
    160 scb_s->ecb3 |= ecb3_flags;
    161 diff --git a/arch/x86/mm/fault.c b/arch/x86/mm/fault.c
    162 index acef3c6a32a2..5c419b8f99a0 100644
    163 --- a/arch/x86/mm/fault.c
    164 +++ b/arch/x86/mm/fault.c
    165 @@ -330,8 +330,6 @@ static noinline int vmalloc_fault(unsigned long address)
    166 if (!(address >= VMALLOC_START && address < VMALLOC_END))
    167 return -1;
    168
    169 - WARN_ON_ONCE(in_nmi());
    170 -
    171 /*
    172 * Synchronize this task's top level page-table
    173 * with the 'reference' page table.
    174 diff --git a/block/blk-cgroup.c b/block/blk-cgroup.c
    175 index 6cd839c1f507..f570f387034d 100644
    176 --- a/block/blk-cgroup.c
    177 +++ b/block/blk-cgroup.c
    178 @@ -185,7 +185,8 @@ static struct blkcg_gq *blkg_create(struct blkcg *blkcg,
    179 }
    180
    181 wb_congested = wb_congested_get_create(&q->backing_dev_info,
    182 - blkcg->css.id, GFP_NOWAIT);
    183 + blkcg->css.id,
    184 + GFP_NOWAIT | __GFP_NOWARN);
    185 if (!wb_congested) {
    186 ret = -ENOMEM;
    187 goto err_put_css;
    188 @@ -193,7 +194,7 @@ static struct blkcg_gq *blkg_create(struct blkcg *blkcg,
    189
    190 /* allocate */
    191 if (!new_blkg) {
    192 - new_blkg = blkg_alloc(blkcg, q, GFP_NOWAIT);
    193 + new_blkg = blkg_alloc(blkcg, q, GFP_NOWAIT | __GFP_NOWARN);
    194 if (unlikely(!new_blkg)) {
    195 ret = -ENOMEM;
    196 goto err_put_congested;
    197 @@ -1022,7 +1023,7 @@ blkcg_css_alloc(struct cgroup_subsys_state *parent_css)
    198 }
    199
    200 spin_lock_init(&blkcg->lock);
    201 - INIT_RADIX_TREE(&blkcg->blkg_tree, GFP_NOWAIT);
    202 + INIT_RADIX_TREE(&blkcg->blkg_tree, GFP_NOWAIT | __GFP_NOWARN);
    203 INIT_HLIST_HEAD(&blkcg->blkg_list);
    204 #ifdef CONFIG_CGROUP_WRITEBACK
    205 INIT_LIST_HEAD(&blkcg->cgwb_list);
    206 @@ -1238,7 +1239,7 @@ pd_prealloc:
    207 if (blkg->pd[pol->plid])
    208 continue;
    209
    210 - pd = pol->pd_alloc_fn(GFP_NOWAIT, q->node);
    211 + pd = pol->pd_alloc_fn(GFP_NOWAIT | __GFP_NOWARN, q->node);
    212 if (!pd)
    213 swap(pd, pd_prealloc);
    214 if (!pd) {
    215 diff --git a/block/cfq-iosched.c b/block/cfq-iosched.c
    216 index c7c3d4e6bc27..a4e2d0104af4 100644
    217 --- a/block/cfq-iosched.c
    218 +++ b/block/cfq-iosched.c
    219 @@ -2951,7 +2951,8 @@ static void cfq_arm_slice_timer(struct cfq_data *cfqd)
    220 * for devices that support queuing, otherwise we still have a problem
    221 * with sync vs async workloads.
    222 */
    223 - if (blk_queue_nonrot(cfqd->queue) && cfqd->hw_tag)
    224 + if (blk_queue_nonrot(cfqd->queue) && cfqd->hw_tag &&
    225 + !cfqd->cfq_group_idle)
    226 return;
    227
    228 WARN_ON(!RB_EMPTY_ROOT(&cfqq->sort_list));
    229 @@ -3867,7 +3868,8 @@ cfq_get_queue(struct cfq_data *cfqd, bool is_sync, struct cfq_io_cq *cic,
    230 goto out;
    231 }
    232
    233 - cfqq = kmem_cache_alloc_node(cfq_pool, GFP_NOWAIT | __GFP_ZERO,
    234 + cfqq = kmem_cache_alloc_node(cfq_pool,
    235 + GFP_NOWAIT | __GFP_ZERO | __GFP_NOWARN,
    236 cfqd->queue->node);
    237 if (!cfqq) {
    238 cfqq = &cfqd->oom_cfqq;
    239 diff --git a/block/partitions/aix.c b/block/partitions/aix.c
    240 index f3ed7b2d89bf..8e7d358e0226 100644
    241 --- a/block/partitions/aix.c
    242 +++ b/block/partitions/aix.c
    243 @@ -177,7 +177,7 @@ int aix_partition(struct parsed_partitions *state)
    244 u32 vgda_sector = 0;
    245 u32 vgda_len = 0;
    246 int numlvs = 0;
    247 - struct pvd *pvd;
    248 + struct pvd *pvd = NULL;
    249 struct lv_info {
    250 unsigned short pps_per_lv;
    251 unsigned short pps_found;
    252 @@ -231,10 +231,11 @@ int aix_partition(struct parsed_partitions *state)
    253 if (lvip[i].pps_per_lv)
    254 foundlvs += 1;
    255 }
    256 + /* pvd loops depend on n[].name and lvip[].pps_per_lv */
    257 + pvd = alloc_pvd(state, vgda_sector + 17);
    258 }
    259 put_dev_sector(sect);
    260 }
    261 - pvd = alloc_pvd(state, vgda_sector + 17);
    262 if (pvd) {
    263 int numpps = be16_to_cpu(pvd->pp_count);
    264 int psn_part1 = be32_to_cpu(pvd->psn_part1);
    265 @@ -281,10 +282,14 @@ int aix_partition(struct parsed_partitions *state)
    266 next_lp_ix += 1;
    267 }
    268 for (i = 0; i < state->limit; i += 1)
    269 - if (lvip[i].pps_found && !lvip[i].lv_is_contiguous)
    270 + if (lvip[i].pps_found && !lvip[i].lv_is_contiguous) {
    271 + char tmp[sizeof(n[i].name) + 1]; // null char
    272 +
    273 + snprintf(tmp, sizeof(tmp), "%s", n[i].name);
    274 pr_warn("partition %s (%u pp's found) is "
    275 "not contiguous\n",
    276 - n[i].name, lvip[i].pps_found);
    277 + tmp, lvip[i].pps_found);
    278 + }
    279 kfree(pvd);
    280 }
    281 kfree(n);
    282 diff --git a/drivers/ata/libahci.c b/drivers/ata/libahci.c
    283 index d81b984b72e4..f233ce60a678 100644
    284 --- a/drivers/ata/libahci.c
    285 +++ b/drivers/ata/libahci.c
    286 @@ -2132,6 +2132,8 @@ static void ahci_set_aggressive_devslp(struct ata_port *ap, bool sleep)
    287 deto = 20;
    288 }
    289
    290 + /* Make dito, mdat, deto bits to 0s */
    291 + devslp &= ~GENMASK_ULL(24, 2);
    292 devslp |= ((dito << PORT_DEVSLP_DITO_OFFSET) |
    293 (mdat << PORT_DEVSLP_MDAT_OFFSET) |
    294 (deto << PORT_DEVSLP_DETO_OFFSET) |
    295 diff --git a/drivers/bluetooth/Kconfig b/drivers/bluetooth/Kconfig
    296 index 3cc9bff9d99d..4a9493a4159f 100644
    297 --- a/drivers/bluetooth/Kconfig
    298 +++ b/drivers/bluetooth/Kconfig
    299 @@ -125,6 +125,7 @@ config BT_HCIUART_LL
    300 config BT_HCIUART_3WIRE
    301 bool "Three-wire UART (H5) protocol support"
    302 depends on BT_HCIUART
    303 + depends on BT_HCIUART_SERDEV
    304 help
    305 The HCI Three-wire UART Transport Layer makes it possible to
    306 user the Bluetooth HCI over a serial port interface. The HCI
    307 diff --git a/drivers/char/tpm/tpm_i2c_infineon.c b/drivers/char/tpm/tpm_i2c_infineon.c
    308 index da69ddea56cf..b15479ac0f90 100644
    309 --- a/drivers/char/tpm/tpm_i2c_infineon.c
    310 +++ b/drivers/char/tpm/tpm_i2c_infineon.c
    311 @@ -115,7 +115,7 @@ static int iic_tpm_read(u8 addr, u8 *buffer, size_t len)
    312 /* Lock the adapter for the duration of the whole sequence. */
    313 if (!tpm_dev.client->adapter->algo->master_xfer)
    314 return -EOPNOTSUPP;
    315 - i2c_lock_adapter(tpm_dev.client->adapter);
    316 + i2c_lock_bus(tpm_dev.client->adapter, I2C_LOCK_SEGMENT);
    317
    318 if (tpm_dev.chip_type == SLB9645) {
    319 /* use a combined read for newer chips
    320 @@ -156,7 +156,7 @@ static int iic_tpm_read(u8 addr, u8 *buffer, size_t len)
    321 }
    322
    323 out:
    324 - i2c_unlock_adapter(tpm_dev.client->adapter);
    325 + i2c_unlock_bus(tpm_dev.client->adapter, I2C_LOCK_SEGMENT);
    326 /* take care of 'guard time' */
    327 usleep_range(SLEEP_DURATION_LOW, SLEEP_DURATION_HI);
    328
    329 @@ -188,7 +188,7 @@ static int iic_tpm_write_generic(u8 addr, u8 *buffer, size_t len,
    330
    331 if (!tpm_dev.client->adapter->algo->master_xfer)
    332 return -EOPNOTSUPP;
    333 - i2c_lock_adapter(tpm_dev.client->adapter);
    334 + i2c_lock_bus(tpm_dev.client->adapter, I2C_LOCK_SEGMENT);
    335
    336 /* prepend the 'register address' to the buffer */
    337 tpm_dev.buf[0] = addr;
    338 @@ -207,7 +207,7 @@ static int iic_tpm_write_generic(u8 addr, u8 *buffer, size_t len,
    339 usleep_range(sleep_low, sleep_hi);
    340 }
    341
    342 - i2c_unlock_adapter(tpm_dev.client->adapter);
    343 + i2c_unlock_bus(tpm_dev.client->adapter, I2C_LOCK_SEGMENT);
    344 /* take care of 'guard time' */
    345 usleep_range(SLEEP_DURATION_LOW, SLEEP_DURATION_HI);
    346
    347 diff --git a/drivers/char/tpm/tpm_tis_spi.c b/drivers/char/tpm/tpm_tis_spi.c
    348 index 01eccb193b5a..950c2d28d81d 100644
    349 --- a/drivers/char/tpm/tpm_tis_spi.c
    350 +++ b/drivers/char/tpm/tpm_tis_spi.c
    351 @@ -189,6 +189,7 @@ static const struct tpm_tis_phy_ops tpm_spi_phy_ops = {
    352 static int tpm_tis_spi_probe(struct spi_device *dev)
    353 {
    354 struct tpm_tis_spi_phy *phy;
    355 + int irq;
    356
    357 phy = devm_kzalloc(&dev->dev, sizeof(struct tpm_tis_spi_phy),
    358 GFP_KERNEL);
    359 @@ -201,7 +202,13 @@ static int tpm_tis_spi_probe(struct spi_device *dev)
    360 if (!phy->iobuf)
    361 return -ENOMEM;
    362
    363 - return tpm_tis_core_init(&dev->dev, &phy->priv, -1, &tpm_spi_phy_ops,
    364 + /* If the SPI device has an IRQ then use that */
    365 + if (dev->irq > 0)
    366 + irq = dev->irq;
    367 + else
    368 + irq = -1;
    369 +
    370 + return tpm_tis_core_init(&dev->dev, &phy->priv, irq, &tpm_spi_phy_ops,
    371 NULL);
    372 }
    373
    374 diff --git a/drivers/gpio/gpio-ml-ioh.c b/drivers/gpio/gpio-ml-ioh.c
    375 index 796a5a4bc4f5..e9b607417df9 100644
    376 --- a/drivers/gpio/gpio-ml-ioh.c
    377 +++ b/drivers/gpio/gpio-ml-ioh.c
    378 @@ -495,9 +495,10 @@ err_irq_alloc_descs:
    379
    380 chip = chip_save;
    381 err_gpiochip_add:
    382 + chip = chip_save;
    383 while (--i >= 0) {
    384 - chip--;
    385 gpiochip_remove(&chip->gpio);
    386 + chip++;
    387 }
    388 kfree(chip_save);
    389
    390 diff --git a/drivers/gpio/gpio-tegra.c b/drivers/gpio/gpio-tegra.c
    391 index 661b0e34e067..05d3241ad20b 100644
    392 --- a/drivers/gpio/gpio-tegra.c
    393 +++ b/drivers/gpio/gpio-tegra.c
    394 @@ -723,4 +723,4 @@ static int __init tegra_gpio_init(void)
    395 {
    396 return platform_driver_register(&tegra_gpio_driver);
    397 }
    398 -postcore_initcall(tegra_gpio_init);
    399 +subsys_initcall(tegra_gpio_init);
    400 diff --git a/drivers/i2c/busses/i2c-i801.c b/drivers/i2c/busses/i2c-i801.c
    401 index b32bf7eac3c8..663017f1d078 100644
    402 --- a/drivers/i2c/busses/i2c-i801.c
    403 +++ b/drivers/i2c/busses/i2c-i801.c
    404 @@ -135,6 +135,7 @@
    405
    406 #define SBREG_BAR 0x10
    407 #define SBREG_SMBCTRL 0xc6000c
    408 +#define SBREG_SMBCTRL_DNV 0xcf000c
    409
    410 /* Host status bits for SMBPCISTS */
    411 #define SMBPCISTS_INTS 0x08
    412 @@ -1387,7 +1388,11 @@ static void i801_add_tco(struct i801_priv *priv)
    413 spin_unlock(&p2sb_spinlock);
    414
    415 res = &tco_res[ICH_RES_MEM_OFF];
    416 - res->start = (resource_size_t)base64_addr + SBREG_SMBCTRL;
    417 + if (pci_dev->device == PCI_DEVICE_ID_INTEL_DNV_SMBUS)
    418 + res->start = (resource_size_t)base64_addr + SBREG_SMBCTRL_DNV;
    419 + else
    420 + res->start = (resource_size_t)base64_addr + SBREG_SMBCTRL;
    421 +
    422 res->end = res->start + 3;
    423 res->flags = IORESOURCE_MEM;
    424
    425 diff --git a/drivers/i2c/busses/i2c-xiic.c b/drivers/i2c/busses/i2c-xiic.c
    426 index 66bce3b311a1..b72cf2f8da5c 100644
    427 --- a/drivers/i2c/busses/i2c-xiic.c
    428 +++ b/drivers/i2c/busses/i2c-xiic.c
    429 @@ -538,6 +538,7 @@ static void xiic_start_recv(struct xiic_i2c *i2c)
    430 {
    431 u8 rx_watermark;
    432 struct i2c_msg *msg = i2c->rx_msg = i2c->tx_msg;
    433 + unsigned long flags;
    434
    435 /* Clear and enable Rx full interrupt. */
    436 xiic_irq_clr_en(i2c, XIIC_INTR_RX_FULL_MASK | XIIC_INTR_TX_ERROR_MASK);
    437 @@ -553,6 +554,7 @@ static void xiic_start_recv(struct xiic_i2c *i2c)
    438 rx_watermark = IIC_RX_FIFO_DEPTH;
    439 xiic_setreg8(i2c, XIIC_RFD_REG_OFFSET, rx_watermark - 1);
    440
    441 + local_irq_save(flags);
    442 if (!(msg->flags & I2C_M_NOSTART))
    443 /* write the address */
    444 xiic_setreg16(i2c, XIIC_DTR_REG_OFFSET,
    445 @@ -563,6 +565,8 @@ static void xiic_start_recv(struct xiic_i2c *i2c)
    446
    447 xiic_setreg16(i2c, XIIC_DTR_REG_OFFSET,
    448 msg->len | ((i2c->nmsgs == 1) ? XIIC_TX_DYN_STOP_MASK : 0));
    449 + local_irq_restore(flags);
    450 +
    451 if (i2c->nmsgs == 1)
    452 /* very last, enable bus not busy as well */
    453 xiic_irq_clr_en(i2c, XIIC_INTR_BNB_MASK);
    454 diff --git a/drivers/infiniband/core/cma.c b/drivers/infiniband/core/cma.c
    455 index cbe5324c4331..575afba1056a 100644
    456 --- a/drivers/infiniband/core/cma.c
    457 +++ b/drivers/infiniband/core/cma.c
    458 @@ -1409,9 +1409,16 @@ static bool cma_match_net_dev(const struct rdma_cm_id *id,
    459 (addr->src_addr.ss_family == AF_IB ||
    460 cma_protocol_roce_dev_port(id->device, port_num));
    461
    462 - return !addr->dev_addr.bound_dev_if ||
    463 - (net_eq(dev_net(net_dev), addr->dev_addr.net) &&
    464 - addr->dev_addr.bound_dev_if == net_dev->ifindex);
    465 + /*
    466 + * Net namespaces must match, and if the listner is listening
    467 + * on a specific netdevice than netdevice must match as well.
    468 + */
    469 + if (net_eq(dev_net(net_dev), addr->dev_addr.net) &&
    470 + (!!addr->dev_addr.bound_dev_if ==
    471 + (addr->dev_addr.bound_dev_if == net_dev->ifindex)))
    472 + return true;
    473 + else
    474 + return false;
    475 }
    476
    477 static struct rdma_id_private *cma_find_listener(
    478 diff --git a/drivers/infiniband/sw/rxe/rxe_resp.c b/drivers/infiniband/sw/rxe/rxe_resp.c
    479 index 0d25dc84d294..2152c71a99d3 100644
    480 --- a/drivers/infiniband/sw/rxe/rxe_resp.c
    481 +++ b/drivers/infiniband/sw/rxe/rxe_resp.c
    482 @@ -978,7 +978,9 @@ static int send_atomic_ack(struct rxe_qp *qp, struct rxe_pkt_info *pkt,
    483 free_rd_atomic_resource(qp, res);
    484 rxe_advance_resp_resource(qp);
    485
    486 - memcpy(SKB_TO_PKT(skb), &ack_pkt, sizeof(skb->cb));
    487 + memcpy(SKB_TO_PKT(skb), &ack_pkt, sizeof(ack_pkt));
    488 + memset((unsigned char *)SKB_TO_PKT(skb) + sizeof(ack_pkt), 0,
    489 + sizeof(skb->cb) - sizeof(ack_pkt));
    490
    491 res->type = RXE_ATOMIC_MASK;
    492 res->atomic.skb = skb;
    493 diff --git a/drivers/input/touchscreen/atmel_mxt_ts.c b/drivers/input/touchscreen/atmel_mxt_ts.c
    494 index 26132402fdf9..c2fb0236a47c 100644
    495 --- a/drivers/input/touchscreen/atmel_mxt_ts.c
    496 +++ b/drivers/input/touchscreen/atmel_mxt_ts.c
    497 @@ -1671,10 +1671,11 @@ static int mxt_get_object_table(struct mxt_data *data)
    498 break;
    499 case MXT_TOUCH_MULTI_T9:
    500 data->multitouch = MXT_TOUCH_MULTI_T9;
    501 + /* Only handle messages from first T9 instance */
    502 data->T9_reportid_min = min_id;
    503 - data->T9_reportid_max = max_id;
    504 - data->num_touchids = object->num_report_ids
    505 - * mxt_obj_instances(object);
    506 + data->T9_reportid_max = min_id +
    507 + object->num_report_ids - 1;
    508 + data->num_touchids = object->num_report_ids;
    509 break;
    510 case MXT_SPT_MESSAGECOUNT_T44:
    511 data->T44_address = object->start_address;
    512 diff --git a/drivers/iommu/ipmmu-vmsa.c b/drivers/iommu/ipmmu-vmsa.c
    513 index ace331da6459..85b5e75c7faa 100644
    514 --- a/drivers/iommu/ipmmu-vmsa.c
    515 +++ b/drivers/iommu/ipmmu-vmsa.c
    516 @@ -44,7 +44,7 @@ struct ipmmu_vmsa_domain {
    517 struct io_pgtable_ops *iop;
    518
    519 unsigned int context_id;
    520 - spinlock_t lock; /* Protects mappings */
    521 + struct mutex mutex; /* Protects mappings */
    522 };
    523
    524 struct ipmmu_vmsa_archdata {
    525 @@ -464,7 +464,7 @@ static struct iommu_domain *ipmmu_domain_alloc(unsigned type)
    526 if (!domain)
    527 return NULL;
    528
    529 - spin_lock_init(&domain->lock);
    530 + mutex_init(&domain->mutex);
    531
    532 return &domain->io_domain;
    533 }
    534 @@ -488,7 +488,6 @@ static int ipmmu_attach_device(struct iommu_domain *io_domain,
    535 struct ipmmu_vmsa_archdata *archdata = dev->archdata.iommu;
    536 struct ipmmu_vmsa_device *mmu = archdata->mmu;
    537 struct ipmmu_vmsa_domain *domain = to_vmsa_domain(io_domain);
    538 - unsigned long flags;
    539 unsigned int i;
    540 int ret = 0;
    541
    542 @@ -497,7 +496,7 @@ static int ipmmu_attach_device(struct iommu_domain *io_domain,
    543 return -ENXIO;
    544 }
    545
    546 - spin_lock_irqsave(&domain->lock, flags);
    547 + mutex_lock(&domain->mutex);
    548
    549 if (!domain->mmu) {
    550 /* The domain hasn't been used yet, initialize it. */
    551 @@ -513,7 +512,7 @@ static int ipmmu_attach_device(struct iommu_domain *io_domain,
    552 ret = -EINVAL;
    553 }
    554
    555 - spin_unlock_irqrestore(&domain->lock, flags);
    556 + mutex_unlock(&domain->mutex);
    557
    558 if (ret < 0)
    559 return ret;
    560 diff --git a/drivers/macintosh/via-pmu.c b/drivers/macintosh/via-pmu.c
    561 index 91081dcdc272..32c696799300 100644
    562 --- a/drivers/macintosh/via-pmu.c
    563 +++ b/drivers/macintosh/via-pmu.c
    564 @@ -531,8 +531,9 @@ init_pmu(void)
    565 int timeout;
    566 struct adb_request req;
    567
    568 - out_8(&via[B], via[B] | TREQ); /* negate TREQ */
    569 - out_8(&via[DIRB], (via[DIRB] | TREQ) & ~TACK); /* TACK in, TREQ out */
    570 + /* Negate TREQ. Set TACK to input and TREQ to output. */
    571 + out_8(&via[B], in_8(&via[B]) | TREQ);
    572 + out_8(&via[DIRB], (in_8(&via[DIRB]) | TREQ) & ~TACK);
    573
    574 pmu_request(&req, NULL, 2, PMU_SET_INTR_MASK, pmu_intr_mask);
    575 timeout = 100000;
    576 @@ -1454,8 +1455,8 @@ pmu_sr_intr(void)
    577 struct adb_request *req;
    578 int bite = 0;
    579
    580 - if (via[B] & TREQ) {
    581 - printk(KERN_ERR "PMU: spurious SR intr (%x)\n", via[B]);
    582 + if (in_8(&via[B]) & TREQ) {
    583 + printk(KERN_ERR "PMU: spurious SR intr (%x)\n", in_8(&via[B]));
    584 out_8(&via[IFR], SR_INT);
    585 return NULL;
    586 }
    587 diff --git a/drivers/md/raid5.c b/drivers/md/raid5.c
    588 index e43b9f80bb1d..4afc419da60f 100644
    589 --- a/drivers/md/raid5.c
    590 +++ b/drivers/md/raid5.c
    591 @@ -4207,6 +4207,12 @@ static void analyse_stripe(struct stripe_head *sh, struct stripe_head_state *s)
    592 s->failed++;
    593 if (rdev && !test_bit(Faulty, &rdev->flags))
    594 do_recovery = 1;
    595 + else if (!rdev) {
    596 + rdev = rcu_dereference(
    597 + conf->disks[i].replacement);
    598 + if (rdev && !test_bit(Faulty, &rdev->flags))
    599 + do_recovery = 1;
    600 + }
    601 }
    602 }
    603 if (test_bit(STRIPE_SYNCING, &sh->state)) {
    604 diff --git a/drivers/media/dvb-frontends/helene.c b/drivers/media/dvb-frontends/helene.c
    605 index e06bcd4b3ddc..800f386f1f3f 100644
    606 --- a/drivers/media/dvb-frontends/helene.c
    607 +++ b/drivers/media/dvb-frontends/helene.c
    608 @@ -898,7 +898,10 @@ static int helene_x_pon(struct helene_priv *priv)
    609 helene_write_regs(priv, 0x99, cdata, sizeof(cdata));
    610
    611 /* 0x81 - 0x94 */
    612 - data[0] = 0x18; /* xtal 24 MHz */
    613 + if (priv->xtal == SONY_HELENE_XTAL_16000)
    614 + data[0] = 0x10; /* xtal 16 MHz */
    615 + else
    616 + data[0] = 0x18; /* xtal 24 MHz */
    617 data[1] = (uint8_t)(0x80 | (0x04 & 0x1F)); /* 4 x 25 = 100uA */
    618 data[2] = (uint8_t)(0x80 | (0x26 & 0x7F)); /* 38 x 0.25 = 9.5pF */
    619 data[3] = 0x80; /* REFOUT signal output 500mVpp */
    620 diff --git a/drivers/media/platform/s5p-mfc/s5p_mfc.c b/drivers/media/platform/s5p-mfc/s5p_mfc.c
    621 index 7c24da51626c..8051c1345692 100644
    622 --- a/drivers/media/platform/s5p-mfc/s5p_mfc.c
    623 +++ b/drivers/media/platform/s5p-mfc/s5p_mfc.c
    624 @@ -249,24 +249,24 @@ static void s5p_mfc_handle_frame_all_extracted(struct s5p_mfc_ctx *ctx)
    625 static void s5p_mfc_handle_frame_copy_time(struct s5p_mfc_ctx *ctx)
    626 {
    627 struct s5p_mfc_dev *dev = ctx->dev;
    628 - struct s5p_mfc_buf *dst_buf, *src_buf;
    629 - size_t dec_y_addr;
    630 + struct s5p_mfc_buf *dst_buf, *src_buf;
    631 + u32 dec_y_addr;
    632 unsigned int frame_type;
    633
    634 /* Make sure we actually have a new frame before continuing. */
    635 frame_type = s5p_mfc_hw_call(dev->mfc_ops, get_dec_frame_type, dev);
    636 if (frame_type == S5P_FIMV_DECODE_FRAME_SKIPPED)
    637 return;
    638 - dec_y_addr = s5p_mfc_hw_call(dev->mfc_ops, get_dec_y_adr, dev);
    639 + dec_y_addr = (u32)s5p_mfc_hw_call(dev->mfc_ops, get_dec_y_adr, dev);
    640
    641 /* Copy timestamp / timecode from decoded src to dst and set
    642 appropriate flags. */
    643 src_buf = list_entry(ctx->src_queue.next, struct s5p_mfc_buf, list);
    644 list_for_each_entry(dst_buf, &ctx->dst_queue, list) {
    645 - if (vb2_dma_contig_plane_dma_addr(&dst_buf->b->vb2_buf, 0)
    646 - == dec_y_addr) {
    647 - dst_buf->b->timecode =
    648 - src_buf->b->timecode;
    649 + u32 addr = (u32)vb2_dma_contig_plane_dma_addr(&dst_buf->b->vb2_buf, 0);
    650 +
    651 + if (addr == dec_y_addr) {
    652 + dst_buf->b->timecode = src_buf->b->timecode;
    653 dst_buf->b->vb2_buf.timestamp =
    654 src_buf->b->vb2_buf.timestamp;
    655 dst_buf->b->flags &=
    656 @@ -302,10 +302,10 @@ static void s5p_mfc_handle_frame_new(struct s5p_mfc_ctx *ctx, unsigned int err)
    657 {
    658 struct s5p_mfc_dev *dev = ctx->dev;
    659 struct s5p_mfc_buf *dst_buf;
    660 - size_t dspl_y_addr;
    661 + u32 dspl_y_addr;
    662 unsigned int frame_type;
    663
    664 - dspl_y_addr = s5p_mfc_hw_call(dev->mfc_ops, get_dspl_y_adr, dev);
    665 + dspl_y_addr = (u32)s5p_mfc_hw_call(dev->mfc_ops, get_dspl_y_adr, dev);
    666 if (IS_MFCV6_PLUS(dev))
    667 frame_type = s5p_mfc_hw_call(dev->mfc_ops,
    668 get_disp_frame_type, ctx);
    669 @@ -324,9 +324,10 @@ static void s5p_mfc_handle_frame_new(struct s5p_mfc_ctx *ctx, unsigned int err)
    670 /* The MFC returns address of the buffer, now we have to
    671 * check which videobuf does it correspond to */
    672 list_for_each_entry(dst_buf, &ctx->dst_queue, list) {
    673 + u32 addr = (u32)vb2_dma_contig_plane_dma_addr(&dst_buf->b->vb2_buf, 0);
    674 +
    675 /* Check if this is the buffer we're looking for */
    676 - if (vb2_dma_contig_plane_dma_addr(&dst_buf->b->vb2_buf, 0)
    677 - == dspl_y_addr) {
    678 + if (addr == dspl_y_addr) {
    679 list_del(&dst_buf->list);
    680 ctx->dst_queue_cnt--;
    681 dst_buf->b->sequence = ctx->sequence;
    682 diff --git a/drivers/mfd/ti_am335x_tscadc.c b/drivers/mfd/ti_am335x_tscadc.c
    683 index c8f027b4ea4c..798f0a829637 100644
    684 --- a/drivers/mfd/ti_am335x_tscadc.c
    685 +++ b/drivers/mfd/ti_am335x_tscadc.c
    686 @@ -209,14 +209,13 @@ static int ti_tscadc_probe(struct platform_device *pdev)
    687 * The TSC_ADC_SS controller design assumes the OCP clock is
    688 * at least 6x faster than the ADC clock.
    689 */
    690 - clk = clk_get(&pdev->dev, "adc_tsc_fck");
    691 + clk = devm_clk_get(&pdev->dev, "adc_tsc_fck");
    692 if (IS_ERR(clk)) {
    693 dev_err(&pdev->dev, "failed to get TSC fck\n");
    694 err = PTR_ERR(clk);
    695 goto err_disable_clk;
    696 }
    697 clock_rate = clk_get_rate(clk);
    698 - clk_put(clk);
    699 tscadc->clk_div = clock_rate / ADC_CLK;
    700
    701 /* TSCADC_CLKDIV needs to be configured to the value minus 1 */
    702 diff --git a/drivers/misc/mic/scif/scif_api.c b/drivers/misc/mic/scif/scif_api.c
    703 index ddc9e4b08b5c..56efa9d18a9a 100644
    704 --- a/drivers/misc/mic/scif/scif_api.c
    705 +++ b/drivers/misc/mic/scif/scif_api.c
    706 @@ -370,11 +370,10 @@ int scif_bind(scif_epd_t epd, u16 pn)
    707 goto scif_bind_exit;
    708 }
    709 } else {
    710 - pn = scif_get_new_port();
    711 - if (!pn) {
    712 - ret = -ENOSPC;
    713 + ret = scif_get_new_port();
    714 + if (ret < 0)
    715 goto scif_bind_exit;
    716 - }
    717 + pn = ret;
    718 }
    719
    720 ep->state = SCIFEP_BOUND;
    721 @@ -648,13 +647,12 @@ int __scif_connect(scif_epd_t epd, struct scif_port_id *dst, bool non_block)
    722 err = -EISCONN;
    723 break;
    724 case SCIFEP_UNBOUND:
    725 - ep->port.port = scif_get_new_port();
    726 - if (!ep->port.port) {
    727 - err = -ENOSPC;
    728 - } else {
    729 - ep->port.node = scif_info.nodeid;
    730 - ep->conn_async_state = ASYNC_CONN_IDLE;
    731 - }
    732 + err = scif_get_new_port();
    733 + if (err < 0)
    734 + break;
    735 + ep->port.port = err;
    736 + ep->port.node = scif_info.nodeid;
    737 + ep->conn_async_state = ASYNC_CONN_IDLE;
    738 /* Fall through */
    739 case SCIFEP_BOUND:
    740 /*
    741 diff --git a/drivers/misc/ti-st/st_kim.c b/drivers/misc/ti-st/st_kim.c
    742 index bf0d7708beac..9be64336461e 100644
    743 --- a/drivers/misc/ti-st/st_kim.c
    744 +++ b/drivers/misc/ti-st/st_kim.c
    745 @@ -756,14 +756,14 @@ static int kim_probe(struct platform_device *pdev)
    746 err = gpio_request(kim_gdata->nshutdown, "kim");
    747 if (unlikely(err)) {
    748 pr_err(" gpio %d request failed ", kim_gdata->nshutdown);
    749 - return err;
    750 + goto err_sysfs_group;
    751 }
    752
    753 /* Configure nShutdown GPIO as output=0 */
    754 err = gpio_direction_output(kim_gdata->nshutdown, 0);
    755 if (unlikely(err)) {
    756 pr_err(" unable to configure gpio %d", kim_gdata->nshutdown);
    757 - return err;
    758 + goto err_sysfs_group;
    759 }
    760 /* get reference of pdev for request_firmware
    761 */
    762 diff --git a/drivers/mtd/ubi/wl.c b/drivers/mtd/ubi/wl.c
    763 index 23a6986d512b..a8f74d9bba4f 100644
    764 --- a/drivers/mtd/ubi/wl.c
    765 +++ b/drivers/mtd/ubi/wl.c
    766 @@ -1615,8 +1615,10 @@ int ubi_wl_init(struct ubi_device *ubi, struct ubi_attach_info *ai)
    767 cond_resched();
    768
    769 e = kmem_cache_alloc(ubi_wl_entry_slab, GFP_KERNEL);
    770 - if (!e)
    771 + if (!e) {
    772 + err = -ENOMEM;
    773 goto out_free;
    774 + }
    775
    776 e->pnum = aeb->pnum;
    777 e->ec = aeb->ec;
    778 @@ -1635,8 +1637,10 @@ int ubi_wl_init(struct ubi_device *ubi, struct ubi_attach_info *ai)
    779 cond_resched();
    780
    781 e = kmem_cache_alloc(ubi_wl_entry_slab, GFP_KERNEL);
    782 - if (!e)
    783 + if (!e) {
    784 + err = -ENOMEM;
    785 goto out_free;
    786 + }
    787
    788 e->pnum = aeb->pnum;
    789 e->ec = aeb->ec;
    790 diff --git a/drivers/net/ethernet/marvell/mvneta.c b/drivers/net/ethernet/marvell/mvneta.c
    791 index 17b81780d12f..c92ffdf91065 100644
    792 --- a/drivers/net/ethernet/marvell/mvneta.c
    793 +++ b/drivers/net/ethernet/marvell/mvneta.c
    794 @@ -3117,7 +3117,6 @@ static int mvneta_change_mtu(struct net_device *dev, int mtu)
    795
    796 on_each_cpu(mvneta_percpu_enable, pp, true);
    797 mvneta_start_dev(pp);
    798 - mvneta_port_up(pp);
    799
    800 netdev_update_features(dev);
    801
    802 diff --git a/drivers/net/phy/mdio-mux-bcm-iproc.c b/drivers/net/phy/mdio-mux-bcm-iproc.c
    803 index 487bf5b8f545..bd9f9b9853c1 100644
    804 --- a/drivers/net/phy/mdio-mux-bcm-iproc.c
    805 +++ b/drivers/net/phy/mdio-mux-bcm-iproc.c
    806 @@ -22,7 +22,7 @@
    807 #include <linux/mdio-mux.h>
    808 #include <linux/delay.h>
    809
    810 -#define MDIO_PARAM_OFFSET 0x00
    811 +#define MDIO_PARAM_OFFSET 0x23c
    812 #define MDIO_PARAM_MIIM_CYCLE 29
    813 #define MDIO_PARAM_INTERNAL_SEL 25
    814 #define MDIO_PARAM_BUS_ID 22
    815 @@ -30,20 +30,22 @@
    816 #define MDIO_PARAM_PHY_ID 16
    817 #define MDIO_PARAM_PHY_DATA 0
    818
    819 -#define MDIO_READ_OFFSET 0x04
    820 +#define MDIO_READ_OFFSET 0x240
    821 #define MDIO_READ_DATA_MASK 0xffff
    822 -#define MDIO_ADDR_OFFSET 0x08
    823 +#define MDIO_ADDR_OFFSET 0x244
    824
    825 -#define MDIO_CTRL_OFFSET 0x0C
    826 +#define MDIO_CTRL_OFFSET 0x248
    827 #define MDIO_CTRL_WRITE_OP 0x1
    828 #define MDIO_CTRL_READ_OP 0x2
    829
    830 -#define MDIO_STAT_OFFSET 0x10
    831 +#define MDIO_STAT_OFFSET 0x24c
    832 #define MDIO_STAT_DONE 1
    833
    834 #define BUS_MAX_ADDR 32
    835 #define EXT_BUS_START_ADDR 16
    836
    837 +#define MDIO_REG_ADDR_SPACE_SIZE 0x250
    838 +
    839 struct iproc_mdiomux_desc {
    840 void *mux_handle;
    841 void __iomem *base;
    842 @@ -169,6 +171,14 @@ static int mdio_mux_iproc_probe(struct platform_device *pdev)
    843 md->dev = &pdev->dev;
    844
    845 res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
    846 + if (res->start & 0xfff) {
    847 + /* For backward compatibility in case the
    848 + * base address is specified with an offset.
    849 + */
    850 + dev_info(&pdev->dev, "fix base address in dt-blob\n");
    851 + res->start &= ~0xfff;
    852 + res->end = res->start + MDIO_REG_ADDR_SPACE_SIZE - 1;
    853 + }
    854 md->base = devm_ioremap_resource(&pdev->dev, res);
    855 if (IS_ERR(md->base)) {
    856 dev_err(&pdev->dev, "failed to ioremap register\n");
    857 diff --git a/drivers/net/wireless/ath/ath10k/mac.c b/drivers/net/wireless/ath/ath10k/mac.c
    858 index d68f4f2965e0..5fe6841b8889 100644
    859 --- a/drivers/net/wireless/ath/ath10k/mac.c
    860 +++ b/drivers/net/wireless/ath/ath10k/mac.c
    861 @@ -3003,6 +3003,13 @@ static int ath10k_update_channel_list(struct ath10k *ar)
    862 passive = channel->flags & IEEE80211_CHAN_NO_IR;
    863 ch->passive = passive;
    864
    865 + /* the firmware is ignoring the "radar" flag of the
    866 + * channel and is scanning actively using Probe Requests
    867 + * on "Radar detection"/DFS channels which are not
    868 + * marked as "available"
    869 + */
    870 + ch->passive |= ch->chan_radar;
    871 +
    872 ch->freq = channel->center_freq;
    873 ch->band_center_freq1 = channel->center_freq;
    874 ch->min_power = 0;
    875 diff --git a/drivers/net/wireless/ath/ath10k/wmi-tlv.c b/drivers/net/wireless/ath/ath10k/wmi-tlv.c
    876 index 0e4d49adddd0..f69b98f4276b 100644
    877 --- a/drivers/net/wireless/ath/ath10k/wmi-tlv.c
    878 +++ b/drivers/net/wireless/ath/ath10k/wmi-tlv.c
    879 @@ -1451,6 +1451,11 @@ static struct sk_buff *ath10k_wmi_tlv_op_gen_init(struct ath10k *ar)
    880 cfg->keep_alive_pattern_size = __cpu_to_le32(0);
    881 cfg->max_tdls_concurrent_sleep_sta = __cpu_to_le32(1);
    882 cfg->max_tdls_concurrent_buffer_sta = __cpu_to_le32(1);
    883 + cfg->wmi_send_separate = __cpu_to_le32(0);
    884 + cfg->num_ocb_vdevs = __cpu_to_le32(0);
    885 + cfg->num_ocb_channels = __cpu_to_le32(0);
    886 + cfg->num_ocb_schedules = __cpu_to_le32(0);
    887 + cfg->host_capab = __cpu_to_le32(0);
    888
    889 ath10k_wmi_put_host_mem_chunks(ar, chunks);
    890
    891 diff --git a/drivers/net/wireless/ath/ath10k/wmi-tlv.h b/drivers/net/wireless/ath/ath10k/wmi-tlv.h
    892 index b8aa6000573c..2c94fe370bb8 100644
    893 --- a/drivers/net/wireless/ath/ath10k/wmi-tlv.h
    894 +++ b/drivers/net/wireless/ath/ath10k/wmi-tlv.h
    895 @@ -1227,6 +1227,11 @@ struct wmi_tlv_resource_config {
    896 __le32 keep_alive_pattern_size;
    897 __le32 max_tdls_concurrent_sleep_sta;
    898 __le32 max_tdls_concurrent_buffer_sta;
    899 + __le32 wmi_send_separate;
    900 + __le32 num_ocb_vdevs;
    901 + __le32 num_ocb_channels;
    902 + __le32 num_ocb_schedules;
    903 + __le32 host_capab;
    904 } __packed;
    905
    906 struct wmi_tlv_init_cmd {
    907 diff --git a/drivers/net/wireless/ath/ath9k/hw.c b/drivers/net/wireless/ath/ath9k/hw.c
    908 index acef4ec928c1..951bac2caf12 100644
    909 --- a/drivers/net/wireless/ath/ath9k/hw.c
    910 +++ b/drivers/net/wireless/ath/ath9k/hw.c
    911 @@ -2915,16 +2915,19 @@ void ath9k_hw_apply_txpower(struct ath_hw *ah, struct ath9k_channel *chan,
    912 struct ath_regulatory *reg = ath9k_hw_regulatory(ah);
    913 struct ieee80211_channel *channel;
    914 int chan_pwr, new_pwr;
    915 + u16 ctl = NO_CTL;
    916
    917 if (!chan)
    918 return;
    919
    920 + if (!test)
    921 + ctl = ath9k_regd_get_ctl(reg, chan);
    922 +
    923 channel = chan->chan;
    924 chan_pwr = min_t(int, channel->max_power * 2, MAX_RATE_POWER);
    925 new_pwr = min_t(int, chan_pwr, reg->power_limit);
    926
    927 - ah->eep_ops->set_txpower(ah, chan,
    928 - ath9k_regd_get_ctl(reg, chan),
    929 + ah->eep_ops->set_txpower(ah, chan, ctl,
    930 get_antenna_gain(ah, chan), new_pwr, test);
    931 }
    932
    933 diff --git a/drivers/net/wireless/ath/ath9k/xmit.c b/drivers/net/wireless/ath/ath9k/xmit.c
    934 index e47286bf378e..8a504afe667e 100644
    935 --- a/drivers/net/wireless/ath/ath9k/xmit.c
    936 +++ b/drivers/net/wireless/ath/ath9k/xmit.c
    937 @@ -84,7 +84,8 @@ static void ath_tx_status(struct ieee80211_hw *hw, struct sk_buff *skb)
    938 struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
    939 struct ieee80211_sta *sta = info->status.status_driver_data[0];
    940
    941 - if (info->flags & IEEE80211_TX_CTL_REQ_TX_STATUS) {
    942 + if (info->flags & (IEEE80211_TX_CTL_REQ_TX_STATUS |
    943 + IEEE80211_TX_STATUS_EOSP)) {
    944 ieee80211_tx_status(hw, skb);
    945 return;
    946 }
    947 diff --git a/drivers/net/wireless/ti/wlcore/rx.c b/drivers/net/wireless/ti/wlcore/rx.c
    948 index b9e14045195f..7367f0947825 100644
    949 --- a/drivers/net/wireless/ti/wlcore/rx.c
    950 +++ b/drivers/net/wireless/ti/wlcore/rx.c
    951 @@ -59,7 +59,7 @@ static u32 wlcore_rx_get_align_buf_size(struct wl1271 *wl, u32 pkt_len)
    952 static void wl1271_rx_status(struct wl1271 *wl,
    953 struct wl1271_rx_descriptor *desc,
    954 struct ieee80211_rx_status *status,
    955 - u8 beacon)
    956 + u8 beacon, u8 probe_rsp)
    957 {
    958 memset(status, 0, sizeof(struct ieee80211_rx_status));
    959
    960 @@ -106,6 +106,9 @@ static void wl1271_rx_status(struct wl1271 *wl,
    961 }
    962 }
    963
    964 + if (beacon || probe_rsp)
    965 + status->boottime_ns = ktime_get_boot_ns();
    966 +
    967 if (beacon)
    968 wlcore_set_pending_regdomain_ch(wl, (u16)desc->channel,
    969 status->band);
    970 @@ -194,7 +197,8 @@ static int wl1271_rx_handle_data(struct wl1271 *wl, u8 *data, u32 length,
    971 if (ieee80211_is_data_present(hdr->frame_control))
    972 is_data = 1;
    973
    974 - wl1271_rx_status(wl, desc, IEEE80211_SKB_RXCB(skb), beacon);
    975 + wl1271_rx_status(wl, desc, IEEE80211_SKB_RXCB(skb), beacon,
    976 + ieee80211_is_probe_resp(hdr->frame_control));
    977 wlcore_hw_set_rx_csum(wl, desc, skb);
    978
    979 seq_num = (le16_to_cpu(hdr->seq_ctrl) & IEEE80211_SCTL_SEQ) >> 4;
    980 diff --git a/drivers/scsi/3w-9xxx.c b/drivers/scsi/3w-9xxx.c
    981 index 5466246c69b4..b78a2f3745f2 100644
    982 --- a/drivers/scsi/3w-9xxx.c
    983 +++ b/drivers/scsi/3w-9xxx.c
    984 @@ -2045,6 +2045,7 @@ static int twa_probe(struct pci_dev *pdev, const struct pci_device_id *dev_id)
    985
    986 if (twa_initialize_device_extension(tw_dev)) {
    987 TW_PRINTK(tw_dev->host, TW_DRIVER, 0x25, "Failed to initialize device extension");
    988 + retval = -ENOMEM;
    989 goto out_free_device_extension;
    990 }
    991
    992 @@ -2067,6 +2068,7 @@ static int twa_probe(struct pci_dev *pdev, const struct pci_device_id *dev_id)
    993 tw_dev->base_addr = ioremap(mem_addr, mem_len);
    994 if (!tw_dev->base_addr) {
    995 TW_PRINTK(tw_dev->host, TW_DRIVER, 0x35, "Failed to ioremap");
    996 + retval = -ENOMEM;
    997 goto out_release_mem_region;
    998 }
    999
    1000 @@ -2074,8 +2076,10 @@ static int twa_probe(struct pci_dev *pdev, const struct pci_device_id *dev_id)
    1001 TW_DISABLE_INTERRUPTS(tw_dev);
    1002
    1003 /* Initialize the card */
    1004 - if (twa_reset_sequence(tw_dev, 0))
    1005 + if (twa_reset_sequence(tw_dev, 0)) {
    1006 + retval = -ENOMEM;
    1007 goto out_iounmap;
    1008 + }
    1009
    1010 /* Set host specific parameters */
    1011 if ((pdev->device == PCI_DEVICE_ID_3WARE_9650SE) ||
    1012 diff --git a/drivers/scsi/3w-sas.c b/drivers/scsi/3w-sas.c
    1013 index f8374850f714..f0a5536a9ff5 100644
    1014 --- a/drivers/scsi/3w-sas.c
    1015 +++ b/drivers/scsi/3w-sas.c
    1016 @@ -1600,6 +1600,7 @@ static int twl_probe(struct pci_dev *pdev, const struct pci_device_id *dev_id)
    1017
    1018 if (twl_initialize_device_extension(tw_dev)) {
    1019 TW_PRINTK(tw_dev->host, TW_DRIVER, 0x1a, "Failed to initialize device extension");
    1020 + retval = -ENOMEM;
    1021 goto out_free_device_extension;
    1022 }
    1023
    1024 @@ -1614,6 +1615,7 @@ static int twl_probe(struct pci_dev *pdev, const struct pci_device_id *dev_id)
    1025 tw_dev->base_addr = pci_iomap(pdev, 1, 0);
    1026 if (!tw_dev->base_addr) {
    1027 TW_PRINTK(tw_dev->host, TW_DRIVER, 0x1c, "Failed to ioremap");
    1028 + retval = -ENOMEM;
    1029 goto out_release_mem_region;
    1030 }
    1031
    1032 @@ -1623,6 +1625,7 @@ static int twl_probe(struct pci_dev *pdev, const struct pci_device_id *dev_id)
    1033 /* Initialize the card */
    1034 if (twl_reset_sequence(tw_dev, 0)) {
    1035 TW_PRINTK(tw_dev->host, TW_DRIVER, 0x1d, "Controller reset failed during probe");
    1036 + retval = -ENOMEM;
    1037 goto out_iounmap;
    1038 }
    1039
    1040 diff --git a/drivers/scsi/3w-xxxx.c b/drivers/scsi/3w-xxxx.c
    1041 index 24ac19e31003..0ee0835d2647 100644
    1042 --- a/drivers/scsi/3w-xxxx.c
    1043 +++ b/drivers/scsi/3w-xxxx.c
    1044 @@ -2281,6 +2281,7 @@ static int tw_probe(struct pci_dev *pdev, const struct pci_device_id *dev_id)
    1045
    1046 if (tw_initialize_device_extension(tw_dev)) {
    1047 printk(KERN_WARNING "3w-xxxx: Failed to initialize device extension.");
    1048 + retval = -ENOMEM;
    1049 goto out_free_device_extension;
    1050 }
    1051
    1052 @@ -2295,6 +2296,7 @@ static int tw_probe(struct pci_dev *pdev, const struct pci_device_id *dev_id)
    1053 tw_dev->base_addr = pci_resource_start(pdev, 0);
    1054 if (!tw_dev->base_addr) {
    1055 printk(KERN_WARNING "3w-xxxx: Failed to get io address.");
    1056 + retval = -ENOMEM;
    1057 goto out_release_mem_region;
    1058 }
    1059
    1060 diff --git a/drivers/staging/rts5208/rtsx_scsi.c b/drivers/staging/rts5208/rtsx_scsi.c
    1061 index b3790334fd3f..f50076d0fb6c 100644
    1062 --- a/drivers/staging/rts5208/rtsx_scsi.c
    1063 +++ b/drivers/staging/rts5208/rtsx_scsi.c
    1064 @@ -536,7 +536,7 @@ static int inquiry(struct scsi_cmnd *srb, struct rtsx_chip *chip)
    1065
    1066 if (sendbytes > 8) {
    1067 memcpy(buf, inquiry_buf, 8);
    1068 - memcpy(buf + 8, inquiry_string, sendbytes - 8);
    1069 + strncpy(buf + 8, inquiry_string, sendbytes - 8);
    1070 if (pro_formatter_flag) {
    1071 /* Additional Length */
    1072 buf[4] = 0x33;
    1073 diff --git a/drivers/staging/rts5208/xd.c b/drivers/staging/rts5208/xd.c
    1074 index 1de02bb98839..647f6beb4c65 100644
    1075 --- a/drivers/staging/rts5208/xd.c
    1076 +++ b/drivers/staging/rts5208/xd.c
    1077 @@ -1247,7 +1247,7 @@ static int xd_copy_page(struct rtsx_chip *chip, u32 old_blk, u32 new_blk,
    1078 reg = 0;
    1079 rtsx_read_register(chip, XD_CTL, &reg);
    1080 if (reg & (XD_ECC1_ERROR | XD_ECC2_ERROR)) {
    1081 - wait_timeout(100);
    1082 + mdelay(100);
    1083
    1084 if (detect_card_cd(chip,
    1085 XD_CARD) != STATUS_SUCCESS) {
    1086 diff --git a/drivers/target/target_core_transport.c b/drivers/target/target_core_transport.c
    1087 index 6f3eccf986c7..e738b4621cbb 100644
    1088 --- a/drivers/target/target_core_transport.c
    1089 +++ b/drivers/target/target_core_transport.c
    1090 @@ -316,6 +316,7 @@ void __transport_register_session(
    1091 {
    1092 const struct target_core_fabric_ops *tfo = se_tpg->se_tpg_tfo;
    1093 unsigned char buf[PR_REG_ISID_LEN];
    1094 + unsigned long flags;
    1095
    1096 se_sess->se_tpg = se_tpg;
    1097 se_sess->fabric_sess_ptr = fabric_sess_ptr;
    1098 @@ -352,7 +353,7 @@ void __transport_register_session(
    1099 se_sess->sess_bin_isid = get_unaligned_be64(&buf[0]);
    1100 }
    1101
    1102 - spin_lock_irq(&se_nacl->nacl_sess_lock);
    1103 + spin_lock_irqsave(&se_nacl->nacl_sess_lock, flags);
    1104 /*
    1105 * The se_nacl->nacl_sess pointer will be set to the
    1106 * last active I_T Nexus for each struct se_node_acl.
    1107 @@ -361,7 +362,7 @@ void __transport_register_session(
    1108
    1109 list_add_tail(&se_sess->sess_acl_list,
    1110 &se_nacl->acl_sess_list);
    1111 - spin_unlock_irq(&se_nacl->nacl_sess_lock);
    1112 + spin_unlock_irqrestore(&se_nacl->nacl_sess_lock, flags);
    1113 }
    1114 list_add_tail(&se_sess->sess_list, &se_tpg->tpg_sess_list);
    1115
    1116 diff --git a/drivers/tty/rocket.c b/drivers/tty/rocket.c
    1117 index b0cc47c77b40..e8e8973939d3 100644
    1118 --- a/drivers/tty/rocket.c
    1119 +++ b/drivers/tty/rocket.c
    1120 @@ -1913,7 +1913,7 @@ static __init int register_PCI(int i, struct pci_dev *dev)
    1121 ByteIO_t UPCIRingInd = 0;
    1122
    1123 if (!dev || !pci_match_id(rocket_pci_ids, dev) ||
    1124 - pci_enable_device(dev))
    1125 + pci_enable_device(dev) || i >= NUM_BOARDS)
    1126 return 0;
    1127
    1128 rcktpt_io_addr[i] = pci_resource_start(dev, 0);
    1129 diff --git a/drivers/uio/uio.c b/drivers/uio/uio.c
    1130 index 208bc52fc84d..f0a9ea2740df 100644
    1131 --- a/drivers/uio/uio.c
    1132 +++ b/drivers/uio/uio.c
    1133 @@ -841,8 +841,6 @@ int __uio_register_device(struct module *owner,
    1134 if (ret)
    1135 goto err_uio_dev_add_attributes;
    1136
    1137 - info->uio_dev = idev;
    1138 -
    1139 if (info->irq && (info->irq != UIO_IRQ_CUSTOM)) {
    1140 /*
    1141 * Note that we deliberately don't use devm_request_irq
    1142 @@ -858,6 +856,7 @@ int __uio_register_device(struct module *owner,
    1143 goto err_request_irq;
    1144 }
    1145
    1146 + info->uio_dev = idev;
    1147 return 0;
    1148
    1149 err_request_irq:
    1150 diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c
    1151 index c190fabd1875..e9f5f9c32b49 100644
    1152 --- a/drivers/usb/host/xhci.c
    1153 +++ b/drivers/usb/host/xhci.c
    1154 @@ -3656,6 +3656,9 @@ void xhci_free_dev(struct usb_hcd *hcd, struct usb_device *udev)
    1155 }
    1156
    1157 spin_lock_irqsave(&xhci->lock, flags);
    1158 +
    1159 + virt_dev->udev = NULL;
    1160 +
    1161 /* Don't disable the slot if the host controller is dead. */
    1162 state = readl(&xhci->op_regs->status);
    1163 if (state == 0xffffffff || (xhci->xhc_state & XHCI_STATE_DYING) ||
    1164 diff --git a/fs/autofs4/autofs_i.h b/fs/autofs4/autofs_i.h
    1165 index a1fba4285277..42f863346409 100644
    1166 --- a/fs/autofs4/autofs_i.h
    1167 +++ b/fs/autofs4/autofs_i.h
    1168 @@ -14,6 +14,7 @@
    1169 #include <linux/mutex.h>
    1170 #include <linux/spinlock.h>
    1171 #include <linux/list.h>
    1172 +#include <linux/magic.h>
    1173
    1174 /* This is the range of ioctl() numbers we claim as ours */
    1175 #define AUTOFS_IOC_FIRST AUTOFS_IOC_READY
    1176 @@ -123,7 +124,8 @@ struct autofs_sb_info {
    1177
    1178 static inline struct autofs_sb_info *autofs4_sbi(struct super_block *sb)
    1179 {
    1180 - return (struct autofs_sb_info *)(sb->s_fs_info);
    1181 + return sb->s_magic != AUTOFS_SUPER_MAGIC ?
    1182 + NULL : (struct autofs_sb_info *)(sb->s_fs_info);
    1183 }
    1184
    1185 static inline struct autofs_info *autofs4_dentry_ino(struct dentry *dentry)
    1186 diff --git a/fs/autofs4/inode.c b/fs/autofs4/inode.c
    1187 index 438b5bf675b6..ce0c6ea96a87 100644
    1188 --- a/fs/autofs4/inode.c
    1189 +++ b/fs/autofs4/inode.c
    1190 @@ -14,7 +14,6 @@
    1191 #include <linux/pagemap.h>
    1192 #include <linux/parser.h>
    1193 #include <linux/bitops.h>
    1194 -#include <linux/magic.h>
    1195 #include "autofs_i.h"
    1196 #include <linux/module.h>
    1197
    1198 diff --git a/fs/f2fs/file.c b/fs/f2fs/file.c
    1199 index 7d0e8d6bf009..594e6e20d6dd 100644
    1200 --- a/fs/f2fs/file.c
    1201 +++ b/fs/f2fs/file.c
    1202 @@ -1665,7 +1665,7 @@ static int f2fs_ioc_shutdown(struct file *filp, unsigned long arg)
    1203 struct f2fs_sb_info *sbi = F2FS_I_SB(inode);
    1204 struct super_block *sb = sbi->sb;
    1205 __u32 in;
    1206 - int ret;
    1207 + int ret = 0;
    1208
    1209 if (!capable(CAP_SYS_ADMIN))
    1210 return -EPERM;
    1211 diff --git a/fs/f2fs/gc.c b/fs/f2fs/gc.c
    1212 index ad4dfd29d923..759056e776e5 100644
    1213 --- a/fs/f2fs/gc.c
    1214 +++ b/fs/f2fs/gc.c
    1215 @@ -877,7 +877,13 @@ static int do_garbage_collect(struct f2fs_sb_info *sbi,
    1216 goto next;
    1217
    1218 sum = page_address(sum_page);
    1219 - f2fs_bug_on(sbi, type != GET_SUM_TYPE((&sum->footer)));
    1220 + if (type != GET_SUM_TYPE((&sum->footer))) {
    1221 + f2fs_msg(sbi->sb, KERN_ERR, "Inconsistent segment (%u) "
    1222 + "type [%d, %d] in SSA and SIT",
    1223 + segno, type, GET_SUM_TYPE((&sum->footer)));
    1224 + set_sbi_flag(sbi, SBI_NEED_FSCK);
    1225 + goto next;
    1226 + }
    1227
    1228 /*
    1229 * this is to avoid deadlock:
    1230 diff --git a/fs/f2fs/inline.c b/fs/f2fs/inline.c
    1231 index a21faa1c6817..482888ee8942 100644
    1232 --- a/fs/f2fs/inline.c
    1233 +++ b/fs/f2fs/inline.c
    1234 @@ -124,6 +124,16 @@ int f2fs_convert_inline_page(struct dnode_of_data *dn, struct page *page)
    1235 if (err)
    1236 return err;
    1237
    1238 + if (unlikely(dn->data_blkaddr != NEW_ADDR)) {
    1239 + f2fs_put_dnode(dn);
    1240 + set_sbi_flag(fio.sbi, SBI_NEED_FSCK);
    1241 + f2fs_msg(fio.sbi->sb, KERN_WARNING,
    1242 + "%s: corrupted inline inode ino=%lx, i_addr[0]:0x%x, "
    1243 + "run fsck to fix.",
    1244 + __func__, dn->inode->i_ino, dn->data_blkaddr);
    1245 + return -EINVAL;
    1246 + }
    1247 +
    1248 f2fs_bug_on(F2FS_P_SB(page), PageWriteback(page));
    1249
    1250 read_inline_data(page, dn->inode_page);
    1251 @@ -351,6 +361,17 @@ static int f2fs_move_inline_dirents(struct inode *dir, struct page *ipage,
    1252 if (err)
    1253 goto out;
    1254
    1255 + if (unlikely(dn.data_blkaddr != NEW_ADDR)) {
    1256 + f2fs_put_dnode(&dn);
    1257 + set_sbi_flag(F2FS_P_SB(page), SBI_NEED_FSCK);
    1258 + f2fs_msg(F2FS_P_SB(page)->sb, KERN_WARNING,
    1259 + "%s: corrupted inline inode ino=%lx, i_addr[0]:0x%x, "
    1260 + "run fsck to fix.",
    1261 + __func__, dir->i_ino, dn.data_blkaddr);
    1262 + err = -EINVAL;
    1263 + goto out;
    1264 + }
    1265 +
    1266 f2fs_wait_on_page_writeback(page, DATA, true);
    1267 zero_user_segment(page, MAX_INLINE_DATA, PAGE_SIZE);
    1268
    1269 diff --git a/fs/f2fs/node.c b/fs/f2fs/node.c
    1270 index 01177ecdeab8..addff6a3b176 100644
    1271 --- a/fs/f2fs/node.c
    1272 +++ b/fs/f2fs/node.c
    1273 @@ -1463,7 +1463,9 @@ next_step:
    1274 !is_cold_node(page)))
    1275 continue;
    1276 lock_node:
    1277 - if (!trylock_page(page))
    1278 + if (wbc->sync_mode == WB_SYNC_ALL)
    1279 + lock_page(page);
    1280 + else if (!trylock_page(page))
    1281 continue;
    1282
    1283 if (unlikely(page->mapping != NODE_MAPPING(sbi))) {
    1284 diff --git a/fs/f2fs/segment.h b/fs/f2fs/segment.h
    1285 index b164f8339281..3d9b9e98c4c2 100644
    1286 --- a/fs/f2fs/segment.h
    1287 +++ b/fs/f2fs/segment.h
    1288 @@ -386,6 +386,8 @@ static inline void __set_test_and_free(struct f2fs_sb_info *sbi,
    1289 if (test_and_clear_bit(segno, free_i->free_segmap)) {
    1290 free_i->free_segments++;
    1291
    1292 + if (IS_CURSEC(sbi, secno))
    1293 + goto skip_free;
    1294 next = find_next_bit(free_i->free_segmap,
    1295 start_segno + sbi->segs_per_sec, start_segno);
    1296 if (next >= start_segno + sbi->segs_per_sec) {
    1297 @@ -393,6 +395,7 @@ static inline void __set_test_and_free(struct f2fs_sb_info *sbi,
    1298 free_i->free_sections++;
    1299 }
    1300 }
    1301 +skip_free:
    1302 spin_unlock(&free_i->segmap_lock);
    1303 }
    1304
    1305 diff --git a/fs/f2fs/super.c b/fs/f2fs/super.c
    1306 index e627671f0183..91bf72334722 100644
    1307 --- a/fs/f2fs/super.c
    1308 +++ b/fs/f2fs/super.c
    1309 @@ -1425,12 +1425,17 @@ int sanity_check_ckpt(struct f2fs_sb_info *sbi)
    1310 struct f2fs_super_block *raw_super = F2FS_RAW_SUPER(sbi);
    1311 struct f2fs_checkpoint *ckpt = F2FS_CKPT(sbi);
    1312 unsigned int main_segs, blocks_per_seg;
    1313 + unsigned int sit_segs, nat_segs;
    1314 + unsigned int sit_bitmap_size, nat_bitmap_size;
    1315 + unsigned int log_blocks_per_seg;
    1316 int i;
    1317
    1318 total = le32_to_cpu(raw_super->segment_count);
    1319 fsmeta = le32_to_cpu(raw_super->segment_count_ckpt);
    1320 - fsmeta += le32_to_cpu(raw_super->segment_count_sit);
    1321 - fsmeta += le32_to_cpu(raw_super->segment_count_nat);
    1322 + sit_segs = le32_to_cpu(raw_super->segment_count_sit);
    1323 + fsmeta += sit_segs;
    1324 + nat_segs = le32_to_cpu(raw_super->segment_count_nat);
    1325 + fsmeta += nat_segs;
    1326 fsmeta += le32_to_cpu(ckpt->rsvd_segment_count);
    1327 fsmeta += le32_to_cpu(raw_super->segment_count_ssa);
    1328
    1329 @@ -1451,6 +1456,18 @@ int sanity_check_ckpt(struct f2fs_sb_info *sbi)
    1330 return 1;
    1331 }
    1332
    1333 + sit_bitmap_size = le32_to_cpu(ckpt->sit_ver_bitmap_bytesize);
    1334 + nat_bitmap_size = le32_to_cpu(ckpt->nat_ver_bitmap_bytesize);
    1335 + log_blocks_per_seg = le32_to_cpu(raw_super->log_blocks_per_seg);
    1336 +
    1337 + if (sit_bitmap_size != ((sit_segs / 2) << log_blocks_per_seg) / 8 ||
    1338 + nat_bitmap_size != ((nat_segs / 2) << log_blocks_per_seg) / 8) {
    1339 + f2fs_msg(sbi->sb, KERN_ERR,
    1340 + "Wrong bitmap size: sit: %u, nat:%u",
    1341 + sit_bitmap_size, nat_bitmap_size);
    1342 + return 1;
    1343 + }
    1344 +
    1345 if (unlikely(f2fs_cp_error(sbi))) {
    1346 f2fs_msg(sbi->sb, KERN_ERR, "A bug case: need to run fsck");
    1347 return 1;
    1348 diff --git a/fs/nfs/callback_proc.c b/fs/nfs/callback_proc.c
    1349 index 2e7ebd9d7168..9d7537446260 100644
    1350 --- a/fs/nfs/callback_proc.c
    1351 +++ b/fs/nfs/callback_proc.c
    1352 @@ -175,9 +175,9 @@ static u32 pnfs_check_callback_stateid(struct pnfs_layout_hdr *lo,
    1353 {
    1354 u32 oldseq, newseq;
    1355
    1356 - /* Is the stateid still not initialised? */
    1357 + /* Is the stateid not initialised? */
    1358 if (!pnfs_layout_is_valid(lo))
    1359 - return NFS4ERR_DELAY;
    1360 + return NFS4ERR_NOMATCHING_LAYOUT;
    1361
    1362 /* Mismatched stateid? */
    1363 if (!nfs4_stateid_match_other(&lo->plh_stateid, new))
    1364 diff --git a/fs/nfs/callback_xdr.c b/fs/nfs/callback_xdr.c
    1365 index eb094c6011d8..67903eeb2ca4 100644
    1366 --- a/fs/nfs/callback_xdr.c
    1367 +++ b/fs/nfs/callback_xdr.c
    1368 @@ -968,16 +968,21 @@ static __be32 nfs4_callback_compound(struct svc_rqst *rqstp, void *argp, void *r
    1369
    1370 if (hdr_arg.minorversion == 0) {
    1371 cps.clp = nfs4_find_client_ident(SVC_NET(rqstp), hdr_arg.cb_ident);
    1372 - if (!cps.clp || !check_gss_callback_principal(cps.clp, rqstp))
    1373 + if (!cps.clp || !check_gss_callback_principal(cps.clp, rqstp)) {
    1374 + if (cps.clp)
    1375 + nfs_put_client(cps.clp);
    1376 goto out_invalidcred;
    1377 + }
    1378 }
    1379
    1380 cps.minorversion = hdr_arg.minorversion;
    1381 hdr_res.taglen = hdr_arg.taglen;
    1382 hdr_res.tag = hdr_arg.tag;
    1383 - if (encode_compound_hdr_res(&xdr_out, &hdr_res) != 0)
    1384 + if (encode_compound_hdr_res(&xdr_out, &hdr_res) != 0) {
    1385 + if (cps.clp)
    1386 + nfs_put_client(cps.clp);
    1387 return rpc_system_err;
    1388 -
    1389 + }
    1390 while (status == 0 && nops != hdr_arg.nops) {
    1391 status = process_op(nops, rqstp, &xdr_in,
    1392 argp, &xdr_out, resp, &cps);
    1393 diff --git a/include/linux/mm_types.h b/include/linux/mm_types.h
    1394 index e8471c2ca83a..8d6decd50220 100644
    1395 --- a/include/linux/mm_types.h
    1396 +++ b/include/linux/mm_types.h
    1397 @@ -396,7 +396,7 @@ struct kioctx_table;
    1398 struct mm_struct {
    1399 struct vm_area_struct *mmap; /* list of VMAs */
    1400 struct rb_root mm_rb;
    1401 - u32 vmacache_seqnum; /* per-thread vmacache */
    1402 + u64 vmacache_seqnum; /* per-thread vmacache */
    1403 #ifdef CONFIG_MMU
    1404 unsigned long (*get_unmapped_area) (struct file *filp,
    1405 unsigned long addr, unsigned long len,
    1406 diff --git a/include/linux/sched.h b/include/linux/sched.h
    1407 index 1cc5723a7821..f4a551a5482c 100644
    1408 --- a/include/linux/sched.h
    1409 +++ b/include/linux/sched.h
    1410 @@ -1559,7 +1559,7 @@ struct task_struct {
    1411
    1412 struct mm_struct *mm, *active_mm;
    1413 /* per-thread vma caching */
    1414 - u32 vmacache_seqnum;
    1415 + u64 vmacache_seqnum;
    1416 struct vm_area_struct *vmacache[VMACACHE_SIZE];
    1417 #if defined(SPLIT_RSS_COUNTING)
    1418 struct task_rss_stat rss_stat;
    1419 diff --git a/include/linux/vm_event_item.h b/include/linux/vm_event_item.h
    1420 index 2edb150f1a4d..544cd50fbbd0 100644
    1421 --- a/include/linux/vm_event_item.h
    1422 +++ b/include/linux/vm_event_item.h
    1423 @@ -97,7 +97,6 @@ enum vm_event_item { PGPGIN, PGPGOUT, PSWPIN, PSWPOUT,
    1424 #ifdef CONFIG_DEBUG_VM_VMACACHE
    1425 VMACACHE_FIND_CALLS,
    1426 VMACACHE_FIND_HITS,
    1427 - VMACACHE_FULL_FLUSHES,
    1428 #endif
    1429 NR_VM_EVENT_ITEMS
    1430 };
    1431 diff --git a/include/linux/vmacache.h b/include/linux/vmacache.h
    1432 index c3fa0fd43949..4f58ff2dacd6 100644
    1433 --- a/include/linux/vmacache.h
    1434 +++ b/include/linux/vmacache.h
    1435 @@ -15,7 +15,6 @@ static inline void vmacache_flush(struct task_struct *tsk)
    1436 memset(tsk->vmacache, 0, sizeof(tsk->vmacache));
    1437 }
    1438
    1439 -extern void vmacache_flush_all(struct mm_struct *mm);
    1440 extern void vmacache_update(unsigned long addr, struct vm_area_struct *newvma);
    1441 extern struct vm_area_struct *vmacache_find(struct mm_struct *mm,
    1442 unsigned long addr);
    1443 @@ -29,10 +28,6 @@ extern struct vm_area_struct *vmacache_find_exact(struct mm_struct *mm,
    1444 static inline void vmacache_invalidate(struct mm_struct *mm)
    1445 {
    1446 mm->vmacache_seqnum++;
    1447 -
    1448 - /* deal with overflows */
    1449 - if (unlikely(mm->vmacache_seqnum == 0))
    1450 - vmacache_flush_all(mm);
    1451 }
    1452
    1453 #endif /* __LINUX_VMACACHE_H */
    1454 diff --git a/include/uapi/linux/ethtool.h b/include/uapi/linux/ethtool.h
    1455 index 5c22e8cab24b..8c5335bde212 100644
    1456 --- a/include/uapi/linux/ethtool.h
    1457 +++ b/include/uapi/linux/ethtool.h
    1458 @@ -882,13 +882,13 @@ struct ethtool_rx_flow_spec {
    1459 static inline __u64 ethtool_get_flow_spec_ring(__u64 ring_cookie)
    1460 {
    1461 return ETHTOOL_RX_FLOW_SPEC_RING & ring_cookie;
    1462 -};
    1463 +}
    1464
    1465 static inline __u64 ethtool_get_flow_spec_ring_vf(__u64 ring_cookie)
    1466 {
    1467 return (ETHTOOL_RX_FLOW_SPEC_RING_VF & ring_cookie) >>
    1468 ETHTOOL_RX_FLOW_SPEC_RING_VF_OFF;
    1469 -};
    1470 +}
    1471
    1472 /**
    1473 * struct ethtool_rxnfc - command to get or set RX flow classification rules
    1474 diff --git a/kernel/fork.c b/kernel/fork.c
    1475 index 5d0e2f366766..73beb8dfa9df 100644
    1476 --- a/kernel/fork.c
    1477 +++ b/kernel/fork.c
    1478 @@ -1532,6 +1532,18 @@ static __latent_entropy struct task_struct *copy_process(
    1479 if (!p)
    1480 goto fork_out;
    1481
    1482 + /*
    1483 + * This _must_ happen before we call free_task(), i.e. before we jump
    1484 + * to any of the bad_fork_* labels. This is to avoid freeing
    1485 + * p->set_child_tid which is (ab)used as a kthread's data pointer for
    1486 + * kernel threads (PF_KTHREAD).
    1487 + */
    1488 + p->set_child_tid = (clone_flags & CLONE_CHILD_SETTID) ? child_tidptr : NULL;
    1489 + /*
    1490 + * Clear TID on mm_release()?
    1491 + */
    1492 + p->clear_child_tid = (clone_flags & CLONE_CHILD_CLEARTID) ? child_tidptr : NULL;
    1493 +
    1494 ftrace_graph_init_task(p);
    1495
    1496 rt_mutex_init_task(p);
    1497 @@ -1693,11 +1705,6 @@ static __latent_entropy struct task_struct *copy_process(
    1498 }
    1499 }
    1500
    1501 - p->set_child_tid = (clone_flags & CLONE_CHILD_SETTID) ? child_tidptr : NULL;
    1502 - /*
    1503 - * Clear TID on mm_release()?
    1504 - */
    1505 - p->clear_child_tid = (clone_flags & CLONE_CHILD_CLEARTID) ? child_tidptr : NULL;
    1506 #ifdef CONFIG_BLOCK
    1507 p->plug = NULL;
    1508 #endif
    1509 diff --git a/kernel/locking/osq_lock.c b/kernel/locking/osq_lock.c
    1510 index 05a37857ab55..8d7047ecef4e 100644
    1511 --- a/kernel/locking/osq_lock.c
    1512 +++ b/kernel/locking/osq_lock.c
    1513 @@ -104,6 +104,19 @@ bool osq_lock(struct optimistic_spin_queue *lock)
    1514
    1515 prev = decode_cpu(old);
    1516 node->prev = prev;
    1517 +
    1518 + /*
    1519 + * osq_lock() unqueue
    1520 + *
    1521 + * node->prev = prev osq_wait_next()
    1522 + * WMB MB
    1523 + * prev->next = node next->prev = prev // unqueue-C
    1524 + *
    1525 + * Here 'node->prev' and 'next->prev' are the same variable and we need
    1526 + * to ensure these stores happen in-order to avoid corrupting the list.
    1527 + */
    1528 + smp_wmb();
    1529 +
    1530 WRITE_ONCE(prev->next, node);
    1531
    1532 /*
    1533 diff --git a/kernel/locking/rwsem-xadd.c b/kernel/locking/rwsem-xadd.c
    1534 index 2337b4bb2366..a4112dfcd0fb 100644
    1535 --- a/kernel/locking/rwsem-xadd.c
    1536 +++ b/kernel/locking/rwsem-xadd.c
    1537 @@ -573,6 +573,33 @@ struct rw_semaphore *rwsem_wake(struct rw_semaphore *sem)
    1538 unsigned long flags;
    1539 WAKE_Q(wake_q);
    1540
    1541 + /*
    1542 + * __rwsem_down_write_failed_common(sem)
    1543 + * rwsem_optimistic_spin(sem)
    1544 + * osq_unlock(sem->osq)
    1545 + * ...
    1546 + * atomic_long_add_return(&sem->count)
    1547 + *
    1548 + * - VS -
    1549 + *
    1550 + * __up_write()
    1551 + * if (atomic_long_sub_return_release(&sem->count) < 0)
    1552 + * rwsem_wake(sem)
    1553 + * osq_is_locked(&sem->osq)
    1554 + *
    1555 + * And __up_write() must observe !osq_is_locked() when it observes the
    1556 + * atomic_long_add_return() in order to not miss a wakeup.
    1557 + *
    1558 + * This boils down to:
    1559 + *
    1560 + * [S.rel] X = 1 [RmW] r0 = (Y += 0)
    1561 + * MB RMB
    1562 + * [RmW] Y += 1 [L] r1 = X
    1563 + *
    1564 + * exists (r0=1 /\ r1=0)
    1565 + */
    1566 + smp_rmb();
    1567 +
    1568 /*
    1569 * If a spinner is present, it is not necessary to do the wakeup.
    1570 * Try to do wakeup only if the trylock succeeds to minimize
    1571 diff --git a/kernel/time/timer.c b/kernel/time/timer.c
    1572 index 7c477912f36d..b625cc7fcc1c 100644
    1573 --- a/kernel/time/timer.c
    1574 +++ b/kernel/time/timer.c
    1575 @@ -1649,6 +1649,22 @@ static inline void __run_timers(struct timer_base *base)
    1576
    1577 spin_lock_irq(&base->lock);
    1578
    1579 + /*
    1580 + * timer_base::must_forward_clk must be cleared before running
    1581 + * timers so that any timer functions that call mod_timer() will
    1582 + * not try to forward the base. Idle tracking / clock forwarding
    1583 + * logic is only used with BASE_STD timers.
    1584 + *
    1585 + * The must_forward_clk flag is cleared unconditionally also for
    1586 + * the deferrable base. The deferrable base is not affected by idle
    1587 + * tracking and never forwarded, so clearing the flag is a NOOP.
    1588 + *
    1589 + * The fact that the deferrable base is never forwarded can cause
    1590 + * large variations in granularity for deferrable timers, but they
    1591 + * can be deferred for long periods due to idle anyway.
    1592 + */
    1593 + base->must_forward_clk = false;
    1594 +
    1595 while (time_after_eq(jiffies, base->clk)) {
    1596
    1597 levels = collect_expired_timers(base, heads);
    1598 @@ -1668,19 +1684,6 @@ static __latent_entropy void run_timer_softirq(struct softirq_action *h)
    1599 {
    1600 struct timer_base *base = this_cpu_ptr(&timer_bases[BASE_STD]);
    1601
    1602 - /*
    1603 - * must_forward_clk must be cleared before running timers so that any
    1604 - * timer functions that call mod_timer will not try to forward the
    1605 - * base. idle trcking / clock forwarding logic is only used with
    1606 - * BASE_STD timers.
    1607 - *
    1608 - * The deferrable base does not do idle tracking at all, so we do
    1609 - * not forward it. This can result in very large variations in
    1610 - * granularity for deferrable timers, but they can be deferred for
    1611 - * long periods due to idle.
    1612 - */
    1613 - base->must_forward_clk = false;
    1614 -
    1615 __run_timers(base);
    1616 if (IS_ENABLED(CONFIG_NO_HZ_COMMON))
    1617 __run_timers(this_cpu_ptr(&timer_bases[BASE_DEF]));
    1618 diff --git a/mm/debug.c b/mm/debug.c
    1619 index 9feb699c5d25..bebe48aece6d 100644
    1620 --- a/mm/debug.c
    1621 +++ b/mm/debug.c
    1622 @@ -95,7 +95,7 @@ EXPORT_SYMBOL(dump_vma);
    1623
    1624 void dump_mm(const struct mm_struct *mm)
    1625 {
    1626 - pr_emerg("mm %p mmap %p seqnum %d task_size %lu\n"
    1627 + pr_emerg("mm %p mmap %p seqnum %llu task_size %lu\n"
    1628 #ifdef CONFIG_MMU
    1629 "get_unmapped_area %p\n"
    1630 #endif
    1631 @@ -125,7 +125,7 @@ void dump_mm(const struct mm_struct *mm)
    1632 #endif
    1633 "def_flags: %#lx(%pGv)\n",
    1634
    1635 - mm, mm->mmap, mm->vmacache_seqnum, mm->task_size,
    1636 + mm, mm->mmap, (long long) mm->vmacache_seqnum, mm->task_size,
    1637 #ifdef CONFIG_MMU
    1638 mm->get_unmapped_area,
    1639 #endif
    1640 diff --git a/mm/vmacache.c b/mm/vmacache.c
    1641 index 035fdeb35b43..c9ca3dd46b97 100644
    1642 --- a/mm/vmacache.c
    1643 +++ b/mm/vmacache.c
    1644 @@ -5,44 +5,6 @@
    1645 #include <linux/mm.h>
    1646 #include <linux/vmacache.h>
    1647
    1648 -/*
    1649 - * Flush vma caches for threads that share a given mm.
    1650 - *
    1651 - * The operation is safe because the caller holds the mmap_sem
    1652 - * exclusively and other threads accessing the vma cache will
    1653 - * have mmap_sem held at least for read, so no extra locking
    1654 - * is required to maintain the vma cache.
    1655 - */
    1656 -void vmacache_flush_all(struct mm_struct *mm)
    1657 -{
    1658 - struct task_struct *g, *p;
    1659 -
    1660 - count_vm_vmacache_event(VMACACHE_FULL_FLUSHES);
    1661 -
    1662 - /*
    1663 - * Single threaded tasks need not iterate the entire
    1664 - * list of process. We can avoid the flushing as well
    1665 - * since the mm's seqnum was increased and don't have
    1666 - * to worry about other threads' seqnum. Current's
    1667 - * flush will occur upon the next lookup.
    1668 - */
    1669 - if (atomic_read(&mm->mm_users) == 1)
    1670 - return;
    1671 -
    1672 - rcu_read_lock();
    1673 - for_each_process_thread(g, p) {
    1674 - /*
    1675 - * Only flush the vmacache pointers as the
    1676 - * mm seqnum is already set and curr's will
    1677 - * be set upon invalidation when the next
    1678 - * lookup is done.
    1679 - */
    1680 - if (mm == p->mm)
    1681 - vmacache_flush(p);
    1682 - }
    1683 - rcu_read_unlock();
    1684 -}
    1685 -
    1686 /*
    1687 * This task may be accessing a foreign mm via (for example)
    1688 * get_user_pages()->find_vma(). The vmacache is task-local and this
    1689 diff --git a/mm/vmscan.c b/mm/vmscan.c
    1690 index f03ca5ab86b1..4e5846b8b5eb 100644
    1691 --- a/mm/vmscan.c
    1692 +++ b/mm/vmscan.c
    1693 @@ -3123,6 +3123,7 @@ static bool zone_balanced(struct zone *zone, int order, int classzone_idx)
    1694 */
    1695 clear_bit(PGDAT_CONGESTED, &zone->zone_pgdat->flags);
    1696 clear_bit(PGDAT_DIRTY, &zone->zone_pgdat->flags);
    1697 + clear_bit(PGDAT_WRITEBACK, &zone->zone_pgdat->flags);
    1698
    1699 return true;
    1700 }
    1701 @@ -3300,7 +3301,7 @@ static int balance_pgdat(pg_data_t *pgdat, int order, int classzone_idx)
    1702 * If we're getting trouble reclaiming, start doing writepage
    1703 * even in laptop mode.
    1704 */
    1705 - if (sc.priority < DEF_PRIORITY - 2 || !pgdat_reclaimable(pgdat))
    1706 + if (sc.priority < DEF_PRIORITY - 2)
    1707 sc.may_writepage = 1;
    1708
    1709 /* Call soft limit reclaim before calling shrink_node. */
    1710 diff --git a/net/bluetooth/hidp/core.c b/net/bluetooth/hidp/core.c
    1711 index 1811f8e7ddf4..552e00b07196 100644
    1712 --- a/net/bluetooth/hidp/core.c
    1713 +++ b/net/bluetooth/hidp/core.c
    1714 @@ -774,7 +774,7 @@ static int hidp_setup_hid(struct hidp_session *session,
    1715 hid->version = req->version;
    1716 hid->country = req->country;
    1717
    1718 - strncpy(hid->name, req->name, sizeof(req->name) - 1);
    1719 + strncpy(hid->name, req->name, sizeof(hid->name));
    1720
    1721 snprintf(hid->phys, sizeof(hid->phys), "%pMR",
    1722 &l2cap_pi(session->ctrl_sock->sk)->chan->src);
    1723 diff --git a/net/dcb/dcbnl.c b/net/dcb/dcbnl.c
    1724 index 3202d75329b5..a1116701287f 100644
    1725 --- a/net/dcb/dcbnl.c
    1726 +++ b/net/dcb/dcbnl.c
    1727 @@ -1764,7 +1764,7 @@ static struct dcb_app_type *dcb_app_lookup(const struct dcb_app *app,
    1728 if (itr->app.selector == app->selector &&
    1729 itr->app.protocol == app->protocol &&
    1730 itr->ifindex == ifindex &&
    1731 - (!prio || itr->app.priority == prio))
    1732 + ((prio == -1) || itr->app.priority == prio))
    1733 return itr;
    1734 }
    1735
    1736 @@ -1799,7 +1799,8 @@ u8 dcb_getapp(struct net_device *dev, struct dcb_app *app)
    1737 u8 prio = 0;
    1738
    1739 spin_lock_bh(&dcb_lock);
    1740 - if ((itr = dcb_app_lookup(app, dev->ifindex, 0)))
    1741 + itr = dcb_app_lookup(app, dev->ifindex, -1);
    1742 + if (itr)
    1743 prio = itr->app.priority;
    1744 spin_unlock_bh(&dcb_lock);
    1745
    1746 @@ -1827,7 +1828,8 @@ int dcb_setapp(struct net_device *dev, struct dcb_app *new)
    1747
    1748 spin_lock_bh(&dcb_lock);
    1749 /* Search for existing match and replace */
    1750 - if ((itr = dcb_app_lookup(new, dev->ifindex, 0))) {
    1751 + itr = dcb_app_lookup(new, dev->ifindex, -1);
    1752 + if (itr) {
    1753 if (new->priority)
    1754 itr->app.priority = new->priority;
    1755 else {
    1756 @@ -1860,7 +1862,8 @@ u8 dcb_ieee_getapp_mask(struct net_device *dev, struct dcb_app *app)
    1757 u8 prio = 0;
    1758
    1759 spin_lock_bh(&dcb_lock);
    1760 - if ((itr = dcb_app_lookup(app, dev->ifindex, 0)))
    1761 + itr = dcb_app_lookup(app, dev->ifindex, -1);
    1762 + if (itr)
    1763 prio |= 1 << itr->app.priority;
    1764 spin_unlock_bh(&dcb_lock);
    1765
    1766 diff --git a/net/netfilter/x_tables.c b/net/netfilter/x_tables.c
    1767 index 59be89813a29..751fec729ffb 100644
    1768 --- a/net/netfilter/x_tables.c
    1769 +++ b/net/netfilter/x_tables.c
    1770 @@ -877,7 +877,7 @@ void *xt_copy_counters_from_user(const void __user *user, unsigned int len,
    1771 if (copy_from_user(&compat_tmp, user, sizeof(compat_tmp)) != 0)
    1772 return ERR_PTR(-EFAULT);
    1773
    1774 - strlcpy(info->name, compat_tmp.name, sizeof(info->name));
    1775 + memcpy(info->name, compat_tmp.name, sizeof(info->name) - 1);
    1776 info->num_counters = compat_tmp.num_counters;
    1777 user += sizeof(compat_tmp);
    1778 } else
    1779 @@ -890,9 +890,9 @@ void *xt_copy_counters_from_user(const void __user *user, unsigned int len,
    1780 if (copy_from_user(info, user, sizeof(*info)) != 0)
    1781 return ERR_PTR(-EFAULT);
    1782
    1783 - info->name[sizeof(info->name) - 1] = '\0';
    1784 user += sizeof(*info);
    1785 }
    1786 + info->name[sizeof(info->name) - 1] = '\0';
    1787
    1788 size = sizeof(struct xt_counters);
    1789 size *= info->num_counters;
    1790 diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
    1791 index 146d83785b37..6afac189d20f 100644
    1792 --- a/net/wireless/nl80211.c
    1793 +++ b/net/wireless/nl80211.c
    1794 @@ -9481,6 +9481,9 @@ static int nl80211_join_mesh(struct sk_buff *skb, struct genl_info *info)
    1795 if (err)
    1796 return err;
    1797
    1798 + if (!setup.chandef.chan)
    1799 + return -EINVAL;
    1800 +
    1801 err = validate_beacon_tx_rate(rdev, setup.chandef.chan->band,
    1802 &setup.beacon_rate);
    1803 if (err)
    1804 diff --git a/security/selinux/avc.c b/security/selinux/avc.c
    1805 index e60c79de13e1..52f3c550abcc 100644
    1806 --- a/security/selinux/avc.c
    1807 +++ b/security/selinux/avc.c
    1808 @@ -348,27 +348,26 @@ static struct avc_xperms_decision_node
    1809 struct avc_xperms_decision_node *xpd_node;
    1810 struct extended_perms_decision *xpd;
    1811
    1812 - xpd_node = kmem_cache_zalloc(avc_xperms_decision_cachep,
    1813 - GFP_ATOMIC | __GFP_NOMEMALLOC);
    1814 + xpd_node = kmem_cache_zalloc(avc_xperms_decision_cachep, GFP_NOWAIT);
    1815 if (!xpd_node)
    1816 return NULL;
    1817
    1818 xpd = &xpd_node->xpd;
    1819 if (which & XPERMS_ALLOWED) {
    1820 xpd->allowed = kmem_cache_zalloc(avc_xperms_data_cachep,
    1821 - GFP_ATOMIC | __GFP_NOMEMALLOC);
    1822 + GFP_NOWAIT);
    1823 if (!xpd->allowed)
    1824 goto error;
    1825 }
    1826 if (which & XPERMS_AUDITALLOW) {
    1827 xpd->auditallow = kmem_cache_zalloc(avc_xperms_data_cachep,
    1828 - GFP_ATOMIC | __GFP_NOMEMALLOC);
    1829 + GFP_NOWAIT);
    1830 if (!xpd->auditallow)
    1831 goto error;
    1832 }
    1833 if (which & XPERMS_DONTAUDIT) {
    1834 xpd->dontaudit = kmem_cache_zalloc(avc_xperms_data_cachep,
    1835 - GFP_ATOMIC | __GFP_NOMEMALLOC);
    1836 + GFP_NOWAIT);
    1837 if (!xpd->dontaudit)
    1838 goto error;
    1839 }
    1840 @@ -396,8 +395,7 @@ static struct avc_xperms_node *avc_xperms_alloc(void)
    1841 {
    1842 struct avc_xperms_node *xp_node;
    1843
    1844 - xp_node = kmem_cache_zalloc(avc_xperms_cachep,
    1845 - GFP_ATOMIC|__GFP_NOMEMALLOC);
    1846 + xp_node = kmem_cache_zalloc(avc_xperms_cachep, GFP_NOWAIT);
    1847 if (!xp_node)
    1848 return xp_node;
    1849 INIT_LIST_HEAD(&xp_node->xpd_head);
    1850 @@ -550,7 +548,7 @@ static struct avc_node *avc_alloc_node(void)
    1851 {
    1852 struct avc_node *node;
    1853
    1854 - node = kmem_cache_zalloc(avc_node_cachep, GFP_ATOMIC|__GFP_NOMEMALLOC);
    1855 + node = kmem_cache_zalloc(avc_node_cachep, GFP_NOWAIT);
    1856 if (!node)
    1857 goto out;
    1858
    1859 diff --git a/sound/pci/hda/hda_codec.c b/sound/pci/hda/hda_codec.c
    1860 index e46c561a8c90..c6b046ddefdd 100644
    1861 --- a/sound/pci/hda/hda_codec.c
    1862 +++ b/sound/pci/hda/hda_codec.c
    1863 @@ -4025,7 +4025,8 @@ void snd_hda_bus_reset_codecs(struct hda_bus *bus)
    1864
    1865 list_for_each_codec(codec, bus) {
    1866 /* FIXME: maybe a better way needed for forced reset */
    1867 - cancel_delayed_work_sync(&codec->jackpoll_work);
    1868 + if (current_work() != &codec->jackpoll_work.work)
    1869 + cancel_delayed_work_sync(&codec->jackpoll_work);
    1870 #ifdef CONFIG_PM
    1871 if (hda_codec_is_power_on(codec)) {
    1872 hda_call_codec_suspend(codec);
    1873 diff --git a/tools/perf/perf.h b/tools/perf/perf.h
    1874 index 9a0236a4cf95..8f8d895d5b74 100644
    1875 --- a/tools/perf/perf.h
    1876 +++ b/tools/perf/perf.h
    1877 @@ -22,7 +22,9 @@ static inline unsigned long long rdclock(void)
    1878 return ts.tv_sec * 1000000000ULL + ts.tv_nsec;
    1879 }
    1880
    1881 +#ifndef MAX_NR_CPUS
    1882 #define MAX_NR_CPUS 1024
    1883 +#endif
    1884
    1885 extern const char *input_name;
    1886 extern bool perf_host, perf_guest;