Magellan Linux

  • Back to homepage
    • /[pkg-src]/trunk/kernel-alx/patches-4.9/0230-4.9.131-all-fixes.patch

    Annotation of /trunk/kernel-alx/patches-4.9/0230-4.9.131-all-fixes.patch

    Parent Directory Parent Directory | Revision Log Revision Log

    Revision 3232 - (hide annotations) (download)
    Thu Oct 18 08:37:15 2018 UTC (5 years, 11 months ago) by niro
    File size: 91650 byte(s) 
    -linux-4.9.131
    1 niro 3232 diff --git a/Documentation/hwmon/ina2xx b/Documentation/hwmon/ina2xx
    2     index cfd31d94c872..f8bf14055c2f 100644
    3     --- a/Documentation/hwmon/ina2xx
    4     +++ b/Documentation/hwmon/ina2xx
    5     @@ -32,7 +32,7 @@ Supported chips:
    6     Datasheet: Publicly available at the Texas Instruments website
    7     http://www.ti.com/
    8    
    9     -Author: Lothar Felten <l-felten@ti.com>
    10     +Author: Lothar Felten <lothar.felten@gmail.com>
    11    
    12     Description
    13     -----------
    14     diff --git a/Makefile b/Makefile
    15     index b98e04a5e1e5..73c4e9a8c127 100644
    16     --- a/Makefile
    17     +++ b/Makefile
    18     @@ -1,6 +1,6 @@
    19     VERSION = 4
    20     PATCHLEVEL = 9
    21     -SUBLEVEL = 130
    22     +SUBLEVEL = 131
    23     EXTRAVERSION =
    24     NAME = Roaring Lionus
    25    
    26     diff --git a/arch/arm/boot/dts/dra7.dtsi b/arch/arm/boot/dts/dra7.dtsi
    27     index ce54a70b7695..a1a928064b53 100644
    28     --- a/arch/arm/boot/dts/dra7.dtsi
    29     +++ b/arch/arm/boot/dts/dra7.dtsi
    30     @@ -1770,7 +1770,7 @@
    31     };
    32     };
    33    
    34     - dcan1: can@481cc000 {
    35     + dcan1: can@4ae3c000 {
    36     compatible = "ti,dra7-d_can";
    37     ti,hwmods = "dcan1";
    38     reg = <0x4ae3c000 0x2000>;
    39     @@ -1780,7 +1780,7 @@
    40     status = "disabled";
    41     };
    42    
    43     - dcan2: can@481d0000 {
    44     + dcan2: can@48480000 {
    45     compatible = "ti,dra7-d_can";
    46     ti,hwmods = "dcan2";
    47     reg = <0x48480000 0x2000>;
    48     diff --git a/arch/arm/mach-mvebu/pmsu.c b/arch/arm/mach-mvebu/pmsu.c
    49     index f39bd51bce18..faaf7c3aaf9f 100644
    50     --- a/arch/arm/mach-mvebu/pmsu.c
    51     +++ b/arch/arm/mach-mvebu/pmsu.c
    52     @@ -116,8 +116,8 @@ void mvebu_pmsu_set_cpu_boot_addr(int hw_cpu, void *boot_addr)
    53     PMSU_BOOT_ADDR_REDIRECT_OFFSET(hw_cpu));
    54     }
    55    
    56     -extern unsigned char mvebu_boot_wa_start;
    57     -extern unsigned char mvebu_boot_wa_end;
    58     +extern unsigned char mvebu_boot_wa_start[];
    59     +extern unsigned char mvebu_boot_wa_end[];
    60    
    61     /*
    62     * This function sets up the boot address workaround needed for SMP
    63     @@ -130,7 +130,7 @@ int mvebu_setup_boot_addr_wa(unsigned int crypto_eng_target,
    64     phys_addr_t resume_addr_reg)
    65     {
    66     void __iomem *sram_virt_base;
    67     - u32 code_len = &mvebu_boot_wa_end - &mvebu_boot_wa_start;
    68     + u32 code_len = mvebu_boot_wa_end - mvebu_boot_wa_start;
    69    
    70     mvebu_mbus_del_window(BOOTROM_BASE, BOOTROM_SIZE);
    71     mvebu_mbus_add_window_by_id(crypto_eng_target, crypto_eng_attribute,
    72     diff --git a/arch/arm/mach-omap2/omap_hwmod_reset.c b/arch/arm/mach-omap2/omap_hwmod_reset.c
    73     index b68f9c0aff0b..d5ddba00bb73 100644
    74     --- a/arch/arm/mach-omap2/omap_hwmod_reset.c
    75     +++ b/arch/arm/mach-omap2/omap_hwmod_reset.c
    76     @@ -92,11 +92,13 @@ static void omap_rtc_wait_not_busy(struct omap_hwmod *oh)
    77     */
    78     void omap_hwmod_rtc_unlock(struct omap_hwmod *oh)
    79     {
    80     - local_irq_disable();
    81     + unsigned long flags;
    82     +
    83     + local_irq_save(flags);
    84     omap_rtc_wait_not_busy(oh);
    85     omap_hwmod_write(OMAP_RTC_KICK0_VALUE, oh, OMAP_RTC_KICK0_REG);
    86     omap_hwmod_write(OMAP_RTC_KICK1_VALUE, oh, OMAP_RTC_KICK1_REG);
    87     - local_irq_enable();
    88     + local_irq_restore(flags);
    89     }
    90    
    91     /**
    92     @@ -110,9 +112,11 @@ void omap_hwmod_rtc_unlock(struct omap_hwmod *oh)
    93     */
    94     void omap_hwmod_rtc_lock(struct omap_hwmod *oh)
    95     {
    96     - local_irq_disable();
    97     + unsigned long flags;
    98     +
    99     + local_irq_save(flags);
    100     omap_rtc_wait_not_busy(oh);
    101     omap_hwmod_write(0x0, oh, OMAP_RTC_KICK0_REG);
    102     omap_hwmod_write(0x0, oh, OMAP_RTC_KICK1_REG);
    103     - local_irq_enable();
    104     + local_irq_restore(flags);
    105     }
    106     diff --git a/arch/arm64/include/asm/kvm_emulate.h b/arch/arm64/include/asm/kvm_emulate.h
    107     index fe39e6841326..ba0d52c22b50 100644
    108     --- a/arch/arm64/include/asm/kvm_emulate.h
    109     +++ b/arch/arm64/include/asm/kvm_emulate.h
    110     @@ -42,6 +42,11 @@ void kvm_inject_vabt(struct kvm_vcpu *vcpu);
    111     void kvm_inject_dabt(struct kvm_vcpu *vcpu, unsigned long addr);
    112     void kvm_inject_pabt(struct kvm_vcpu *vcpu, unsigned long addr);
    113    
    114     +static inline bool vcpu_el1_is_32bit(struct kvm_vcpu *vcpu)
    115     +{
    116     + return !(vcpu->arch.hcr_el2 & HCR_RW);
    117     +}
    118     +
    119     static inline void vcpu_reset_hcr(struct kvm_vcpu *vcpu)
    120     {
    121     vcpu->arch.hcr_el2 = HCR_GUEST_FLAGS;
    122     diff --git a/arch/arm64/kvm/guest.c b/arch/arm64/kvm/guest.c
    123     index d3e0a2ffb383..e41a7b4f3a9b 100644
    124     --- a/arch/arm64/kvm/guest.c
    125     +++ b/arch/arm64/kvm/guest.c
    126     @@ -57,6 +57,45 @@ static u64 core_reg_offset_from_id(u64 id)
    127     return id & ~(KVM_REG_ARCH_MASK | KVM_REG_SIZE_MASK | KVM_REG_ARM_CORE);
    128     }
    129    
    130     +static int validate_core_offset(const struct kvm_one_reg *reg)
    131     +{
    132     + u64 off = core_reg_offset_from_id(reg->id);
    133     + int size;
    134     +
    135     + switch (off) {
    136     + case KVM_REG_ARM_CORE_REG(regs.regs[0]) ...
    137     + KVM_REG_ARM_CORE_REG(regs.regs[30]):
    138     + case KVM_REG_ARM_CORE_REG(regs.sp):
    139     + case KVM_REG_ARM_CORE_REG(regs.pc):
    140     + case KVM_REG_ARM_CORE_REG(regs.pstate):
    141     + case KVM_REG_ARM_CORE_REG(sp_el1):
    142     + case KVM_REG_ARM_CORE_REG(elr_el1):
    143     + case KVM_REG_ARM_CORE_REG(spsr[0]) ...
    144     + KVM_REG_ARM_CORE_REG(spsr[KVM_NR_SPSR - 1]):
    145     + size = sizeof(__u64);
    146     + break;
    147     +
    148     + case KVM_REG_ARM_CORE_REG(fp_regs.vregs[0]) ...
    149     + KVM_REG_ARM_CORE_REG(fp_regs.vregs[31]):
    150     + size = sizeof(__uint128_t);
    151     + break;
    152     +
    153     + case KVM_REG_ARM_CORE_REG(fp_regs.fpsr):
    154     + case KVM_REG_ARM_CORE_REG(fp_regs.fpcr):
    155     + size = sizeof(__u32);
    156     + break;
    157     +
    158     + default:
    159     + return -EINVAL;
    160     + }
    161     +
    162     + if (KVM_REG_SIZE(reg->id) == size &&
    163     + IS_ALIGNED(off, size / sizeof(__u32)))
    164     + return 0;
    165     +
    166     + return -EINVAL;
    167     +}
    168     +
    169     static int get_core_reg(struct kvm_vcpu *vcpu, const struct kvm_one_reg *reg)
    170     {
    171     /*
    172     @@ -76,6 +115,9 @@ static int get_core_reg(struct kvm_vcpu *vcpu, const struct kvm_one_reg *reg)
    173     (off + (KVM_REG_SIZE(reg->id) / sizeof(__u32))) >= nr_regs)
    174     return -ENOENT;
    175    
    176     + if (validate_core_offset(reg))
    177     + return -EINVAL;
    178     +
    179     if (copy_to_user(uaddr, ((u32 *)regs) + off, KVM_REG_SIZE(reg->id)))
    180     return -EFAULT;
    181    
    182     @@ -98,6 +140,9 @@ static int set_core_reg(struct kvm_vcpu *vcpu, const struct kvm_one_reg *reg)
    183     (off + (KVM_REG_SIZE(reg->id) / sizeof(__u32))) >= nr_regs)
    184     return -ENOENT;
    185    
    186     + if (validate_core_offset(reg))
    187     + return -EINVAL;
    188     +
    189     if (KVM_REG_SIZE(reg->id) > sizeof(tmp))
    190     return -EINVAL;
    191    
    192     @@ -107,17 +152,25 @@ static int set_core_reg(struct kvm_vcpu *vcpu, const struct kvm_one_reg *reg)
    193     }
    194    
    195     if (off == KVM_REG_ARM_CORE_REG(regs.pstate)) {
    196     - u32 mode = (*(u32 *)valp) & COMPAT_PSR_MODE_MASK;
    197     + u64 mode = (*(u64 *)valp) & COMPAT_PSR_MODE_MASK;
    198     switch (mode) {
    199     case COMPAT_PSR_MODE_USR:
    200     + if (!system_supports_32bit_el0())
    201     + return -EINVAL;
    202     + break;
    203     case COMPAT_PSR_MODE_FIQ:
    204     case COMPAT_PSR_MODE_IRQ:
    205     case COMPAT_PSR_MODE_SVC:
    206     case COMPAT_PSR_MODE_ABT:
    207     case COMPAT_PSR_MODE_UND:
    208     + if (!vcpu_el1_is_32bit(vcpu))
    209     + return -EINVAL;
    210     + break;
    211     case PSR_MODE_EL0t:
    212     case PSR_MODE_EL1t:
    213     case PSR_MODE_EL1h:
    214     + if (vcpu_el1_is_32bit(vcpu))
    215     + return -EINVAL;
    216     break;
    217     default:
    218     err = -EINVAL;
    219     diff --git a/arch/powerpc/kernel/machine_kexec.c b/arch/powerpc/kernel/machine_kexec.c
    220     index 2694d078741d..9dafd7af39b8 100644
    221     --- a/arch/powerpc/kernel/machine_kexec.c
    222     +++ b/arch/powerpc/kernel/machine_kexec.c
    223     @@ -186,7 +186,12 @@ void __init reserve_crashkernel(void)
    224     (unsigned long)(crashk_res.start >> 20),
    225     (unsigned long)(memblock_phys_mem_size() >> 20));
    226    
    227     - memblock_reserve(crashk_res.start, crash_size);
    228     + if (!memblock_is_region_memory(crashk_res.start, crash_size) ||
    229     + memblock_reserve(crashk_res.start, crash_size)) {
    230     + pr_err("Failed to reserve memory for crashkernel!\n");
    231     + crashk_res.start = crashk_res.end = 0;
    232     + return;
    233     + }
    234     }
    235    
    236     int overlaps_crashkernel(unsigned long start, unsigned long size)
    237     diff --git a/arch/powerpc/platforms/powernv/pci-ioda.c b/arch/powerpc/platforms/powernv/pci-ioda.c
    238     index f52cc6fd4290..8015e40bc7ee 100644
    239     --- a/arch/powerpc/platforms/powernv/pci-ioda.c
    240     +++ b/arch/powerpc/platforms/powernv/pci-ioda.c
    241     @@ -2623,7 +2623,7 @@ static long pnv_pci_ioda2_table_alloc_pages(int nid, __u64 bus_offset,
    242     level_shift = entries_shift + 3;
    243     level_shift = max_t(unsigned, level_shift, PAGE_SHIFT);
    244    
    245     - if ((level_shift - 3) * levels + page_shift >= 60)
    246     + if ((level_shift - 3) * levels + page_shift >= 55)
    247     return -EINVAL;
    248    
    249     /* Allocate TCE table */
    250     diff --git a/arch/s390/mm/extmem.c b/arch/s390/mm/extmem.c
    251     index 02042b6b66bf..e6665a6e105e 100644
    252     --- a/arch/s390/mm/extmem.c
    253     +++ b/arch/s390/mm/extmem.c
    254     @@ -79,7 +79,7 @@ struct qin64 {
    255     struct dcss_segment {
    256     struct list_head list;
    257     char dcss_name[8];
    258     - char res_name[15];
    259     + char res_name[16];
    260     unsigned long start_addr;
    261     unsigned long end;
    262     atomic_t ref_count;
    263     @@ -432,7 +432,7 @@ __segment_load (char *name, int do_nonshared, unsigned long *addr, unsigned long
    264     memcpy(&seg->res_name, seg->dcss_name, 8);
    265     EBCASC(seg->res_name, 8);
    266     seg->res_name[8] = '\0';
    267     - strncat(seg->res_name, " (DCSS)", 7);
    268     + strlcat(seg->res_name, " (DCSS)", sizeof(seg->res_name));
    269     seg->res->name = seg->res_name;
    270     rc = seg->vm_segtype;
    271     if (rc == SEG_TYPE_SC ||
    272     diff --git a/arch/s390/mm/pgalloc.c b/arch/s390/mm/pgalloc.c
    273     index 995f78532cc2..781a044e1702 100644
    274     --- a/arch/s390/mm/pgalloc.c
    275     +++ b/arch/s390/mm/pgalloc.c
    276     @@ -26,7 +26,7 @@ static struct ctl_table page_table_sysctl[] = {
    277     .data = &page_table_allocate_pgste,
    278     .maxlen = sizeof(int),
    279     .mode = S_IRUGO | S_IWUSR,
    280     - .proc_handler = proc_dointvec,
    281     + .proc_handler = proc_dointvec_minmax,
    282     .extra1 = &page_table_allocate_pgste_min,
    283     .extra2 = &page_table_allocate_pgste_max,
    284     },
    285     diff --git a/arch/x86/entry/entry_64.S b/arch/x86/entry/entry_64.S
    286     index 76c1d85e749b..870e941c1947 100644
    287     --- a/arch/x86/entry/entry_64.S
    288     +++ b/arch/x86/entry/entry_64.S
    289     @@ -91,7 +91,7 @@ ENDPROC(native_usergs_sysret64)
    290     .endm
    291    
    292     .macro TRACE_IRQS_IRETQ_DEBUG
    293     - bt $9, EFLAGS(%rsp) /* interrupts off? */
    294     + btl $9, EFLAGS(%rsp) /* interrupts off? */
    295     jnc 1f
    296     TRACE_IRQS_ON_DEBUG
    297     1:
    298     @@ -485,7 +485,7 @@ retint_kernel:
    299     #ifdef CONFIG_PREEMPT
    300     /* Interrupts are off */
    301     /* Check if we need preemption */
    302     - bt $9, EFLAGS(%rsp) /* were interrupts off? */
    303     + btl $9, EFLAGS(%rsp) /* were interrupts off? */
    304     jnc 1f
    305     0: cmpl $0, PER_CPU_VAR(__preempt_count)
    306     jnz 1f
    307     diff --git a/arch/x86/events/intel/lbr.c b/arch/x86/events/intel/lbr.c
    308     index 5d103a87e984..2c3c7abf678b 100644
    309     --- a/arch/x86/events/intel/lbr.c
    310     +++ b/arch/x86/events/intel/lbr.c
    311     @@ -342,7 +342,7 @@ static void __intel_pmu_lbr_restore(struct x86_perf_task_context *task_ctx)
    312    
    313     mask = x86_pmu.lbr_nr - 1;
    314     tos = task_ctx->tos;
    315     - for (i = 0; i < tos; i++) {
    316     + for (i = 0; i < task_ctx->valid_lbrs; i++) {
    317     lbr_idx = (tos - i) & mask;
    318     wrlbr_from(lbr_idx, task_ctx->lbr_from[i]);
    319     wrlbr_to (lbr_idx, task_ctx->lbr_to[i]);
    320     @@ -350,6 +350,15 @@ static void __intel_pmu_lbr_restore(struct x86_perf_task_context *task_ctx)
    321     if (x86_pmu.intel_cap.lbr_format == LBR_FORMAT_INFO)
    322     wrmsrl(MSR_LBR_INFO_0 + lbr_idx, task_ctx->lbr_info[i]);
    323     }
    324     +
    325     + for (; i < x86_pmu.lbr_nr; i++) {
    326     + lbr_idx = (tos - i) & mask;
    327     + wrlbr_from(lbr_idx, 0);
    328     + wrlbr_to(lbr_idx, 0);
    329     + if (x86_pmu.intel_cap.lbr_format == LBR_FORMAT_INFO)
    330     + wrmsrl(MSR_LBR_INFO_0 + lbr_idx, 0);
    331     + }
    332     +
    333     wrmsrl(x86_pmu.lbr_tos, tos);
    334     task_ctx->lbr_stack_state = LBR_NONE;
    335     }
    336     @@ -357,7 +366,7 @@ static void __intel_pmu_lbr_restore(struct x86_perf_task_context *task_ctx)
    337     static void __intel_pmu_lbr_save(struct x86_perf_task_context *task_ctx)
    338     {
    339     unsigned lbr_idx, mask;
    340     - u64 tos;
    341     + u64 tos, from;
    342     int i;
    343    
    344     if (task_ctx->lbr_callstack_users == 0) {
    345     @@ -367,13 +376,17 @@ static void __intel_pmu_lbr_save(struct x86_perf_task_context *task_ctx)
    346    
    347     mask = x86_pmu.lbr_nr - 1;
    348     tos = intel_pmu_lbr_tos();
    349     - for (i = 0; i < tos; i++) {
    350     + for (i = 0; i < x86_pmu.lbr_nr; i++) {
    351     lbr_idx = (tos - i) & mask;
    352     - task_ctx->lbr_from[i] = rdlbr_from(lbr_idx);
    353     + from = rdlbr_from(lbr_idx);
    354     + if (!from)
    355     + break;
    356     + task_ctx->lbr_from[i] = from;
    357     task_ctx->lbr_to[i] = rdlbr_to(lbr_idx);
    358     if (x86_pmu.intel_cap.lbr_format == LBR_FORMAT_INFO)
    359     rdmsrl(MSR_LBR_INFO_0 + lbr_idx, task_ctx->lbr_info[i]);
    360     }
    361     + task_ctx->valid_lbrs = i;
    362     task_ctx->tos = tos;
    363     task_ctx->lbr_stack_state = LBR_VALID;
    364     }
    365     @@ -522,7 +535,7 @@ static void intel_pmu_lbr_read_32(struct cpu_hw_events *cpuc)
    366     */
    367     static void intel_pmu_lbr_read_64(struct cpu_hw_events *cpuc)
    368     {
    369     - bool need_info = false;
    370     + bool need_info = false, call_stack = false;
    371     unsigned long mask = x86_pmu.lbr_nr - 1;
    372     int lbr_format = x86_pmu.intel_cap.lbr_format;
    373     u64 tos = intel_pmu_lbr_tos();
    374     @@ -533,7 +546,7 @@ static void intel_pmu_lbr_read_64(struct cpu_hw_events *cpuc)
    375     if (cpuc->lbr_sel) {
    376     need_info = !(cpuc->lbr_sel->config & LBR_NO_INFO);
    377     if (cpuc->lbr_sel->config & LBR_CALL_STACK)
    378     - num = tos;
    379     + call_stack = true;
    380     }
    381    
    382     for (i = 0; i < num; i++) {
    383     @@ -546,6 +559,13 @@ static void intel_pmu_lbr_read_64(struct cpu_hw_events *cpuc)
    384     from = rdlbr_from(lbr_idx);
    385     to = rdlbr_to(lbr_idx);
    386    
    387     + /*
    388     + * Read LBR call stack entries
    389     + * until invalid entry (0s) is detected.
    390     + */
    391     + if (call_stack && !from)
    392     + break;
    393     +
    394     if (lbr_format == LBR_FORMAT_INFO && need_info) {
    395     u64 info;
    396    
    397     diff --git a/arch/x86/events/perf_event.h b/arch/x86/events/perf_event.h
    398     index f3563179290b..1bfebbc4d156 100644
    399     --- a/arch/x86/events/perf_event.h
    400     +++ b/arch/x86/events/perf_event.h
    401     @@ -633,6 +633,7 @@ struct x86_perf_task_context {
    402     u64 lbr_to[MAX_LBR_ENTRIES];
    403     u64 lbr_info[MAX_LBR_ENTRIES];
    404     int tos;
    405     + int valid_lbrs;
    406     int lbr_callstack_users;
    407     int lbr_stack_state;
    408     };
    409     diff --git a/arch/x86/kernel/tsc_msr.c b/arch/x86/kernel/tsc_msr.c
    410     index 0fe720d64fef..3f818ce985c0 100644
    411     --- a/arch/x86/kernel/tsc_msr.c
    412     +++ b/arch/x86/kernel/tsc_msr.c
    413     @@ -12,6 +12,7 @@
    414     #include <asm/setup.h>
    415     #include <asm/apic.h>
    416     #include <asm/param.h>
    417     +#include <asm/tsc.h>
    418    
    419     #define MAX_NUM_FREQS 9
    420    
    421     diff --git a/arch/x86/mm/numa_emulation.c b/arch/x86/mm/numa_emulation.c
    422     index a8f90ce3dedf..dc6d99017f3f 100644
    423     --- a/arch/x86/mm/numa_emulation.c
    424     +++ b/arch/x86/mm/numa_emulation.c
    425     @@ -60,7 +60,7 @@ static int __init emu_setup_memblk(struct numa_meminfo *ei,
    426     eb->nid = nid;
    427    
    428     if (emu_nid_to_phys[nid] == NUMA_NO_NODE)
    429     - emu_nid_to_phys[nid] = nid;
    430     + emu_nid_to_phys[nid] = pb->nid;
    431    
    432     pb->start += size;
    433     if (pb->start >= pb->end) {
    434     diff --git a/crypto/ablkcipher.c b/crypto/ablkcipher.c
    435     index 860c9e5dfd7a..3bc0e76eaaef 100644
    436     --- a/crypto/ablkcipher.c
    437     +++ b/crypto/ablkcipher.c
    438     @@ -367,6 +367,7 @@ static int crypto_ablkcipher_report(struct sk_buff *skb, struct crypto_alg *alg)
    439     strncpy(rblkcipher.type, "ablkcipher", sizeof(rblkcipher.type));
    440     strncpy(rblkcipher.geniv, alg->cra_ablkcipher.geniv ?: "<default>",
    441     sizeof(rblkcipher.geniv));
    442     + rblkcipher.geniv[sizeof(rblkcipher.geniv) - 1] = '\0';
    443    
    444     rblkcipher.blocksize = alg->cra_blocksize;
    445     rblkcipher.min_keysize = alg->cra_ablkcipher.min_keysize;
    446     @@ -441,6 +442,7 @@ static int crypto_givcipher_report(struct sk_buff *skb, struct crypto_alg *alg)
    447     strncpy(rblkcipher.type, "givcipher", sizeof(rblkcipher.type));
    448     strncpy(rblkcipher.geniv, alg->cra_ablkcipher.geniv ?: "<built-in>",
    449     sizeof(rblkcipher.geniv));
    450     + rblkcipher.geniv[sizeof(rblkcipher.geniv) - 1] = '\0';
    451    
    452     rblkcipher.blocksize = alg->cra_blocksize;
    453     rblkcipher.min_keysize = alg->cra_ablkcipher.min_keysize;
    454     diff --git a/crypto/blkcipher.c b/crypto/blkcipher.c
    455     index 27f98666763a..59a0936ed8bc 100644
    456     --- a/crypto/blkcipher.c
    457     +++ b/crypto/blkcipher.c
    458     @@ -510,6 +510,7 @@ static int crypto_blkcipher_report(struct sk_buff *skb, struct crypto_alg *alg)
    459     strncpy(rblkcipher.type, "blkcipher", sizeof(rblkcipher.type));
    460     strncpy(rblkcipher.geniv, alg->cra_blkcipher.geniv ?: "<default>",
    461     sizeof(rblkcipher.geniv));
    462     + rblkcipher.geniv[sizeof(rblkcipher.geniv) - 1] = '\0';
    463    
    464     rblkcipher.blocksize = alg->cra_blocksize;
    465     rblkcipher.min_keysize = alg->cra_blkcipher.min_keysize;
    466     diff --git a/drivers/block/floppy.c b/drivers/block/floppy.c
    467     index e3d8e4ced4a2..a321d7d849c6 100644
    468     --- a/drivers/block/floppy.c
    469     +++ b/drivers/block/floppy.c
    470     @@ -3459,6 +3459,9 @@ static int fd_locked_ioctl(struct block_device *bdev, fmode_t mode, unsigned int
    471     (struct floppy_struct **)&outparam);
    472     if (ret)
    473     return ret;
    474     + memcpy(&inparam.g, outparam,
    475     + offsetof(struct floppy_struct, name));
    476     + outparam = &inparam.g;
    477     break;
    478     case FDMSGON:
    479     UDP->flags |= FTD_MSG;
    480     diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c
    481     index 44bccb1afa06..8dce1a890078 100644
    482     --- a/drivers/bluetooth/btusb.c
    483     +++ b/drivers/bluetooth/btusb.c
    484     @@ -349,6 +349,7 @@ static const struct usb_device_id blacklist_table[] = {
    485     { USB_DEVICE(0x7392, 0xa611), .driver_info = BTUSB_REALTEK },
    486    
    487     /* Additional Realtek 8723DE Bluetooth devices */
    488     + { USB_DEVICE(0x0bda, 0xb009), .driver_info = BTUSB_REALTEK },
    489     { USB_DEVICE(0x2ff8, 0xb011), .driver_info = BTUSB_REALTEK },
    490    
    491     /* Additional Realtek 8821AE Bluetooth devices */
    492     diff --git a/drivers/edac/edac_mc_sysfs.c b/drivers/edac/edac_mc_sysfs.c
    493     index 4e0f8e720ad9..40d792e96b75 100644
    494     --- a/drivers/edac/edac_mc_sysfs.c
    495     +++ b/drivers/edac/edac_mc_sysfs.c
    496     @@ -1059,14 +1059,14 @@ int __init edac_mc_sysfs_init(void)
    497    
    498     err = device_add(mci_pdev);
    499     if (err < 0)
    500     - goto out_dev_free;
    501     + goto out_put_device;
    502    
    503     edac_dbg(0, "device %s created\n", dev_name(mci_pdev));
    504    
    505     return 0;
    506    
    507     - out_dev_free:
    508     - kfree(mci_pdev);
    509     + out_put_device:
    510     + put_device(mci_pdev);
    511     out:
    512     return err;
    513     }
    514     diff --git a/drivers/edac/i7core_edac.c b/drivers/edac/i7core_edac.c
    515     index 8a68a5e943ea..b60932026e34 100644
    516     --- a/drivers/edac/i7core_edac.c
    517     +++ b/drivers/edac/i7core_edac.c
    518     @@ -1177,15 +1177,14 @@ static int i7core_create_sysfs_devices(struct mem_ctl_info *mci)
    519    
    520     rc = device_add(pvt->addrmatch_dev);
    521     if (rc < 0)
    522     - return rc;
    523     + goto err_put_addrmatch;
    524    
    525     if (!pvt->is_registered) {
    526     pvt->chancounts_dev = kzalloc(sizeof(*pvt->chancounts_dev),
    527     GFP_KERNEL);
    528     if (!pvt->chancounts_dev) {
    529     - put_device(pvt->addrmatch_dev);
    530     - device_del(pvt->addrmatch_dev);
    531     - return -ENOMEM;
    532     + rc = -ENOMEM;
    533     + goto err_del_addrmatch;
    534     }
    535    
    536     pvt->chancounts_dev->type = &all_channel_counts_type;
    537     @@ -1199,9 +1198,18 @@ static int i7core_create_sysfs_devices(struct mem_ctl_info *mci)
    538    
    539     rc = device_add(pvt->chancounts_dev);
    540     if (rc < 0)
    541     - return rc;
    542     + goto err_put_chancounts;
    543     }
    544     return 0;
    545     +
    546     +err_put_chancounts:
    547     + put_device(pvt->chancounts_dev);
    548     +err_del_addrmatch:
    549     + device_del(pvt->addrmatch_dev);
    550     +err_put_addrmatch:
    551     + put_device(pvt->addrmatch_dev);
    552     +
    553     + return rc;
    554     }
    555    
    556     static void i7core_delete_sysfs_devices(struct mem_ctl_info *mci)
    557     @@ -1211,11 +1219,11 @@ static void i7core_delete_sysfs_devices(struct mem_ctl_info *mci)
    558     edac_dbg(1, "\n");
    559    
    560     if (!pvt->is_registered) {
    561     - put_device(pvt->chancounts_dev);
    562     device_del(pvt->chancounts_dev);
    563     + put_device(pvt->chancounts_dev);
    564     }
    565     - put_device(pvt->addrmatch_dev);
    566     device_del(pvt->addrmatch_dev);
    567     + put_device(pvt->addrmatch_dev);
    568     }
    569    
    570     /****************************************************************************
    571     diff --git a/drivers/gpio/gpio-menz127.c b/drivers/gpio/gpio-menz127.c
    572     index a1210e330571..95061d25895b 100644
    573     --- a/drivers/gpio/gpio-menz127.c
    574     +++ b/drivers/gpio/gpio-menz127.c
    575     @@ -56,9 +56,9 @@ static int men_z127_debounce(struct gpio_chip *gc, unsigned gpio,
    576     rnd = fls(debounce) - 1;
    577    
    578     if (rnd && (debounce & BIT(rnd - 1)))
    579     - debounce = round_up(debounce, MEN_Z127_DB_MIN_US);
    580     + debounce = roundup(debounce, MEN_Z127_DB_MIN_US);
    581     else
    582     - debounce = round_down(debounce, MEN_Z127_DB_MIN_US);
    583     + debounce = rounddown(debounce, MEN_Z127_DB_MIN_US);
    584    
    585     if (debounce > MEN_Z127_DB_MAX_US)
    586     debounce = MEN_Z127_DB_MAX_US;
    587     diff --git a/drivers/gpu/drm/amd/amdgpu/gfx_v8_0.c b/drivers/gpu/drm/amd/amdgpu/gfx_v8_0.c
    588     index 564362e8b486..c8a5cf5365a9 100644
    589     --- a/drivers/gpu/drm/amd/amdgpu/gfx_v8_0.c
    590     +++ b/drivers/gpu/drm/amd/amdgpu/gfx_v8_0.c
    591     @@ -5551,6 +5551,11 @@ static int gfx_v8_0_set_powergating_state(void *handle,
    592     if (!(adev->pg_flags & AMD_PG_SUPPORT_GFX_PG))
    593     return 0;
    594    
    595     + if (adev->pg_flags & (AMD_PG_SUPPORT_GFX_SMG |
    596     + AMD_PG_SUPPORT_RLC_SMU_HS |
    597     + AMD_PG_SUPPORT_CP |
    598     + AMD_PG_SUPPORT_GFX_DMG))
    599     + adev->gfx.rlc.funcs->enter_safe_mode(adev);
    600     switch (adev->asic_type) {
    601     case CHIP_CARRIZO:
    602     case CHIP_STONEY:
    603     @@ -5586,7 +5591,11 @@ static int gfx_v8_0_set_powergating_state(void *handle,
    604     default:
    605     break;
    606     }
    607     -
    608     + if (adev->pg_flags & (AMD_PG_SUPPORT_GFX_SMG |
    609     + AMD_PG_SUPPORT_RLC_SMU_HS |
    610     + AMD_PG_SUPPORT_CP |
    611     + AMD_PG_SUPPORT_GFX_DMG))
    612     + adev->gfx.rlc.funcs->exit_safe_mode(adev);
    613     return 0;
    614     }
    615    
    616     diff --git a/drivers/gpu/drm/amd/amdgpu/kv_dpm.c b/drivers/gpu/drm/amd/amdgpu/kv_dpm.c
    617     index 71d2856222fa..f61c489e5f6d 100644
    618     --- a/drivers/gpu/drm/amd/amdgpu/kv_dpm.c
    619     +++ b/drivers/gpu/drm/amd/amdgpu/kv_dpm.c
    620     @@ -1350,8 +1350,6 @@ static int kv_dpm_enable(struct amdgpu_device *adev)
    621     return ret;
    622     }
    623    
    624     - kv_update_current_ps(adev, adev->pm.dpm.boot_ps);
    625     -
    626     if (adev->irq.installed &&
    627     amdgpu_is_internal_thermal_sensor(adev->pm.int_thermal_type)) {
    628     ret = kv_set_thermal_temperature_range(adev, KV_TEMP_RANGE_MIN, KV_TEMP_RANGE_MAX);
    629     @@ -3086,7 +3084,7 @@ static int kv_dpm_hw_init(void *handle)
    630     else
    631     adev->pm.dpm_enabled = true;
    632     mutex_unlock(&adev->pm.mutex);
    633     -
    634     + amdgpu_pm_compute_clocks(adev);
    635     return ret;
    636     }
    637    
    638     diff --git a/drivers/gpu/drm/amd/amdgpu/si_dpm.c b/drivers/gpu/drm/amd/amdgpu/si_dpm.c
    639     index 3fa8320e49c1..4826befc1bc3 100644
    640     --- a/drivers/gpu/drm/amd/amdgpu/si_dpm.c
    641     +++ b/drivers/gpu/drm/amd/amdgpu/si_dpm.c
    642     @@ -6959,7 +6959,6 @@ static int si_dpm_enable(struct amdgpu_device *adev)
    643    
    644     si_enable_auto_throttle_source(adev, AMDGPU_DPM_AUTO_THROTTLE_SRC_THERMAL, true);
    645     si_thermal_start_thermal_controller(adev);
    646     - ni_update_current_ps(adev, boot_ps);
    647    
    648     return 0;
    649     }
    650     @@ -7836,7 +7835,7 @@ static int si_dpm_hw_init(void *handle)
    651     else
    652     adev->pm.dpm_enabled = true;
    653     mutex_unlock(&adev->pm.mutex);
    654     -
    655     + amdgpu_pm_compute_clocks(adev);
    656     return ret;
    657     }
    658    
    659     diff --git a/drivers/gpu/drm/sun4i/sun4i_drv.c b/drivers/gpu/drm/sun4i/sun4i_drv.c
    660     index aad2f4a2a0ef..97828faf2a1f 100644
    661     --- a/drivers/gpu/drm/sun4i/sun4i_drv.c
    662     +++ b/drivers/gpu/drm/sun4i/sun4i_drv.c
    663     @@ -283,7 +283,6 @@ static int sun4i_drv_add_endpoints(struct device *dev,
    664     remote = of_graph_get_remote_port_parent(ep);
    665     if (!remote) {
    666     DRM_DEBUG_DRIVER("Error retrieving the output node\n");
    667     - of_node_put(remote);
    668     continue;
    669     }
    670    
    671     @@ -297,11 +296,13 @@ static int sun4i_drv_add_endpoints(struct device *dev,
    672    
    673     if (of_graph_parse_endpoint(ep, &endpoint)) {
    674     DRM_DEBUG_DRIVER("Couldn't parse endpoint\n");
    675     + of_node_put(remote);
    676     continue;
    677     }
    678    
    679     if (!endpoint.id) {
    680     DRM_DEBUG_DRIVER("Endpoint is our panel... skipping\n");
    681     + of_node_put(remote);
    682     continue;
    683     }
    684     }
    685     diff --git a/drivers/hid/hid-ntrig.c b/drivers/hid/hid-ntrig.c
    686     index 1b0084d4af2e..28373dab60ae 100644
    687     --- a/drivers/hid/hid-ntrig.c
    688     +++ b/drivers/hid/hid-ntrig.c
    689     @@ -955,6 +955,8 @@ static int ntrig_probe(struct hid_device *hdev, const struct hid_device_id *id)
    690    
    691     ret = sysfs_create_group(&hdev->dev.kobj,
    692     &ntrig_attribute_group);
    693     + if (ret)
    694     + hid_err(hdev, "cannot create sysfs group\n");
    695    
    696     return 0;
    697     err_free:
    698     diff --git a/drivers/hwmon/adt7475.c b/drivers/hwmon/adt7475.c
    699     index 3cefd1aeb24f..9c262d955331 100644
    700     --- a/drivers/hwmon/adt7475.c
    701     +++ b/drivers/hwmon/adt7475.c
    702     @@ -274,14 +274,18 @@ static inline u16 volt2reg(int channel, long volt, u8 bypass_attn)
    703     return clamp_val(reg, 0, 1023) & (0xff << 2);
    704     }
    705    
    706     -static u16 adt7475_read_word(struct i2c_client *client, int reg)
    707     +static int adt7475_read_word(struct i2c_client *client, int reg)
    708     {
    709     - u16 val;
    710     + int val1, val2;
    711    
    712     - val = i2c_smbus_read_byte_data(client, reg);
    713     - val |= (i2c_smbus_read_byte_data(client, reg + 1) << 8);
    714     + val1 = i2c_smbus_read_byte_data(client, reg);
    715     + if (val1 < 0)
    716     + return val1;
    717     + val2 = i2c_smbus_read_byte_data(client, reg + 1);
    718     + if (val2 < 0)
    719     + return val2;
    720    
    721     - return val;
    722     + return val1 | (val2 << 8);
    723     }
    724    
    725     static void adt7475_write_word(struct i2c_client *client, int reg, u16 val)
    726     diff --git a/drivers/hwmon/ina2xx.c b/drivers/hwmon/ina2xx.c
    727     index ac63e562071f..9ac6e1673375 100644
    728     --- a/drivers/hwmon/ina2xx.c
    729     +++ b/drivers/hwmon/ina2xx.c
    730     @@ -17,7 +17,7 @@
    731     * Bi-directional Current/Power Monitor with I2C Interface
    732     * Datasheet: http://www.ti.com/product/ina230
    733     *
    734     - * Copyright (C) 2012 Lothar Felten <l-felten@ti.com>
    735     + * Copyright (C) 2012 Lothar Felten <lothar.felten@gmail.com>
    736     * Thanks to Jan Volkering
    737     *
    738     * This program is free software; you can redistribute it and/or modify
    739     @@ -328,6 +328,15 @@ static int ina2xx_set_shunt(struct ina2xx_data *data, long val)
    740     return 0;
    741     }
    742    
    743     +static ssize_t ina2xx_show_shunt(struct device *dev,
    744     + struct device_attribute *da,
    745     + char *buf)
    746     +{
    747     + struct ina2xx_data *data = dev_get_drvdata(dev);
    748     +
    749     + return snprintf(buf, PAGE_SIZE, "%li\n", data->rshunt);
    750     +}
    751     +
    752     static ssize_t ina2xx_store_shunt(struct device *dev,
    753     struct device_attribute *da,
    754     const char *buf, size_t count)
    755     @@ -402,7 +411,7 @@ static SENSOR_DEVICE_ATTR(power1_input, S_IRUGO, ina2xx_show_value, NULL,
    756    
    757     /* shunt resistance */
    758     static SENSOR_DEVICE_ATTR(shunt_resistor, S_IRUGO | S_IWUSR,
    759     - ina2xx_show_value, ina2xx_store_shunt,
    760     + ina2xx_show_shunt, ina2xx_store_shunt,
    761     INA2XX_CALIBRATION);
    762    
    763     /* update interval (ina226 only) */
    764     diff --git a/drivers/i2c/busses/i2c-i801.c b/drivers/i2c/busses/i2c-i801.c
    765     index 663017f1d078..26f1691f67ab 100644
    766     --- a/drivers/i2c/busses/i2c-i801.c
    767     +++ b/drivers/i2c/busses/i2c-i801.c
    768     @@ -1408,6 +1408,13 @@ static void i801_add_tco(struct i801_priv *priv)
    769     }
    770    
    771     #ifdef CONFIG_ACPI
    772     +static bool i801_acpi_is_smbus_ioport(const struct i801_priv *priv,
    773     + acpi_physical_address address)
    774     +{
    775     + return address >= priv->smba &&
    776     + address <= pci_resource_end(priv->pci_dev, SMBBAR);
    777     +}
    778     +
    779     static acpi_status
    780     i801_acpi_io_handler(u32 function, acpi_physical_address address, u32 bits,
    781     u64 *value, void *handler_context, void *region_context)
    782     @@ -1423,7 +1430,7 @@ i801_acpi_io_handler(u32 function, acpi_physical_address address, u32 bits,
    783     */
    784     mutex_lock(&priv->acpi_lock);
    785    
    786     - if (!priv->acpi_reserved) {
    787     + if (!priv->acpi_reserved && i801_acpi_is_smbus_ioport(priv, address)) {
    788     priv->acpi_reserved = true;
    789    
    790     dev_warn(&pdev->dev, "BIOS is accessing SMBus registers\n");
    791     diff --git a/drivers/infiniband/core/rw.c b/drivers/infiniband/core/rw.c
    792     index dbfd854c32c9..1d90a122fe5e 100644
    793     --- a/drivers/infiniband/core/rw.c
    794     +++ b/drivers/infiniband/core/rw.c
    795     @@ -87,7 +87,7 @@ static int rdma_rw_init_one_mr(struct ib_qp *qp, u8 port_num,
    796     }
    797    
    798     ret = ib_map_mr_sg(reg->mr, sg, nents, &offset, PAGE_SIZE);
    799     - if (ret < nents) {
    800     + if (ret < 0 || ret < nents) {
    801     ib_mr_pool_put(qp, &qp->rdma_mrs, reg->mr);
    802     return -EINVAL;
    803     }
    804     diff --git a/drivers/infiniband/hw/hfi1/pio.c b/drivers/infiniband/hw/hfi1/pio.c
    805     index d89b8745d4c1..c2982bbc82b3 100644
    806     --- a/drivers/infiniband/hw/hfi1/pio.c
    807     +++ b/drivers/infiniband/hw/hfi1/pio.c
    808     @@ -88,6 +88,7 @@ void pio_send_control(struct hfi1_devdata *dd, int op)
    809     unsigned long flags;
    810     int write = 1; /* write sendctrl back */
    811     int flush = 0; /* re-read sendctrl to make sure it is flushed */
    812     + int i;
    813    
    814     spin_lock_irqsave(&dd->sendctrl_lock, flags);
    815    
    816     @@ -97,9 +98,13 @@ void pio_send_control(struct hfi1_devdata *dd, int op)
    817     reg |= SEND_CTRL_SEND_ENABLE_SMASK;
    818     /* Fall through */
    819     case PSC_DATA_VL_ENABLE:
    820     + mask = 0;
    821     + for (i = 0; i < ARRAY_SIZE(dd->vld); i++)
    822     + if (!dd->vld[i].mtu)
    823     + mask |= BIT_ULL(i);
    824     /* Disallow sending on VLs not enabled */
    825     - mask = (((~0ull) << num_vls) & SEND_CTRL_UNSUPPORTED_VL_MASK) <<
    826     - SEND_CTRL_UNSUPPORTED_VL_SHIFT;
    827     + mask = (mask & SEND_CTRL_UNSUPPORTED_VL_MASK) <<
    828     + SEND_CTRL_UNSUPPORTED_VL_SHIFT;
    829     reg = (reg & ~SEND_CTRL_UNSUPPORTED_VL_SMASK) | mask;
    830     break;
    831     case PSC_GLOBAL_DISABLE:
    832     diff --git a/drivers/infiniband/hw/hfi1/user_sdma.c b/drivers/infiniband/hw/hfi1/user_sdma.c
    833     index 77697d690f3e..018a41562704 100644
    834     --- a/drivers/infiniband/hw/hfi1/user_sdma.c
    835     +++ b/drivers/infiniband/hw/hfi1/user_sdma.c
    836     @@ -956,7 +956,7 @@ static int user_sdma_send_pkts(struct user_sdma_request *req, unsigned maxpkts)
    837     if (ACCESS_ONCE(iovec->offset) == iovec->iov.iov_len) {
    838     if (++req->iov_idx == req->data_iovs) {
    839     ret = -EFAULT;
    840     - goto free_txreq;
    841     + goto free_tx;
    842     }
    843     iovec = &req->iovs[req->iov_idx];
    844     WARN_ON(iovec->offset);
    845     diff --git a/drivers/infiniband/hw/hfi1/verbs.c b/drivers/infiniband/hw/hfi1/verbs.c
    846     index 01a380efea6b..14ddb7506085 100644
    847     --- a/drivers/infiniband/hw/hfi1/verbs.c
    848     +++ b/drivers/infiniband/hw/hfi1/verbs.c
    849     @@ -1511,12 +1511,18 @@ static int hfi1_check_ah(struct ib_device *ibdev, struct ib_ah_attr *ah_attr)
    850     struct hfi1_pportdata *ppd;
    851     struct hfi1_devdata *dd;
    852     u8 sc5;
    853     + u8 sl;
    854    
    855     /* test the mapping for validity */
    856     ibp = to_iport(ibdev, ah_attr->port_num);
    857     ppd = ppd_from_ibp(ibp);
    858     - sc5 = ibp->sl_to_sc[ah_attr->sl];
    859     dd = dd_from_ppd(ppd);
    860     +
    861     + sl = ah_attr->sl;
    862     + if (sl >= ARRAY_SIZE(ibp->sl_to_sc))
    863     + return -EINVAL;
    864     +
    865     + sc5 = ibp->sl_to_sc[sl];
    866     if (sc_to_vlt(dd, sc5) > num_vls && sc_to_vlt(dd, sc5) != 0xf)
    867     return -EINVAL;
    868     return 0;
    869     diff --git a/drivers/infiniband/ulp/srp/ib_srp.c b/drivers/infiniband/ulp/srp/ib_srp.c
    870     index 463ea592a42a..646359025574 100644
    871     --- a/drivers/infiniband/ulp/srp/ib_srp.c
    872     +++ b/drivers/infiniband/ulp/srp/ib_srp.c
    873     @@ -2639,7 +2639,7 @@ static int srp_reset_device(struct scsi_cmnd *scmnd)
    874     {
    875     struct srp_target_port *target = host_to_target(scmnd->device->host);
    876     struct srp_rdma_ch *ch;
    877     - int i;
    878     + int i, j;
    879     u8 status;
    880    
    881     shost_printk(KERN_ERR, target->scsi_host, "SRP reset_device called\n");
    882     @@ -2653,8 +2653,8 @@ static int srp_reset_device(struct scsi_cmnd *scmnd)
    883    
    884     for (i = 0; i < target->ch_count; i++) {
    885     ch = &target->ch[i];
    886     - for (i = 0; i < target->req_ring_size; ++i) {
    887     - struct srp_request *req = &ch->req_ring[i];
    888     + for (j = 0; j < target->req_ring_size; ++j) {
    889     + struct srp_request *req = &ch->req_ring[j];
    890    
    891     srp_finish_req(ch, req, scmnd->device, DID_RESET << 16);
    892     }
    893     diff --git a/drivers/input/mouse/elantech.c b/drivers/input/mouse/elantech.c
    894     index 4e77adbfa835..c120afd9c46a 100644
    895     --- a/drivers/input/mouse/elantech.c
    896     +++ b/drivers/input/mouse/elantech.c
    897     @@ -1176,6 +1176,8 @@ static const struct dmi_system_id elantech_dmi_has_middle_button[] = {
    898     static const char * const middle_button_pnp_ids[] = {
    899     "LEN2131", /* ThinkPad P52 w/ NFC */
    900     "LEN2132", /* ThinkPad P52 */
    901     + "LEN2133", /* ThinkPad P72 w/ NFC */
    902     + "LEN2134", /* ThinkPad P72 */
    903     NULL
    904     };
    905    
    906     diff --git a/drivers/iommu/amd_iommu.c b/drivers/iommu/amd_iommu.c
    907     index 0c910a863581..16199b36a11e 100644
    908     --- a/drivers/iommu/amd_iommu.c
    909     +++ b/drivers/iommu/amd_iommu.c
    910     @@ -2452,9 +2452,9 @@ static void __unmap_single(struct dma_ops_domain *dma_dom,
    911     }
    912    
    913     if (amd_iommu_unmap_flush) {
    914     - dma_ops_free_iova(dma_dom, dma_addr, pages);
    915     domain_flush_tlb(&dma_dom->domain);
    916     domain_flush_complete(&dma_dom->domain);
    917     + dma_ops_free_iova(dma_dom, dma_addr, pages);
    918     } else {
    919     queue_add(dma_dom, dma_addr, pages);
    920     }
    921     diff --git a/drivers/md/md-cluster.c b/drivers/md/md-cluster.c
    922     index fcc2b5746a9f..e870b09b2c84 100644
    923     --- a/drivers/md/md-cluster.c
    924     +++ b/drivers/md/md-cluster.c
    925     @@ -302,15 +302,6 @@ static void recover_bitmaps(struct md_thread *thread)
    926     while (cinfo->recovery_map) {
    927     slot = fls64((u64)cinfo->recovery_map) - 1;
    928    
    929     - /* Clear suspend_area associated with the bitmap */
    930     - spin_lock_irq(&cinfo->suspend_lock);
    931     - list_for_each_entry_safe(s, tmp, &cinfo->suspend_list, list)
    932     - if (slot == s->slot) {
    933     - list_del(&s->list);
    934     - kfree(s);
    935     - }
    936     - spin_unlock_irq(&cinfo->suspend_lock);
    937     -
    938     snprintf(str, 64, "bitmap%04d", slot);
    939     bm_lockres = lockres_init(mddev, str, NULL, 1);
    940     if (!bm_lockres) {
    941     @@ -329,6 +320,16 @@ static void recover_bitmaps(struct md_thread *thread)
    942     pr_err("md-cluster: Could not copy data from bitmap %d\n", slot);
    943     goto clear_bit;
    944     }
    945     +
    946     + /* Clear suspend_area associated with the bitmap */
    947     + spin_lock_irq(&cinfo->suspend_lock);
    948     + list_for_each_entry_safe(s, tmp, &cinfo->suspend_list, list)
    949     + if (slot == s->slot) {
    950     + list_del(&s->list);
    951     + kfree(s);
    952     + }
    953     + spin_unlock_irq(&cinfo->suspend_lock);
    954     +
    955     if (hi > 0) {
    956     if (lo < mddev->recovery_cp)
    957     mddev->recovery_cp = lo;
    958     diff --git a/drivers/media/i2c/soc_camera/ov772x.c b/drivers/media/i2c/soc_camera/ov772x.c
    959     index 7e68762b3a4b..fa1cb246a66a 100644
    960     --- a/drivers/media/i2c/soc_camera/ov772x.c
    961     +++ b/drivers/media/i2c/soc_camera/ov772x.c
    962     @@ -834,7 +834,7 @@ static int ov772x_set_params(struct ov772x_priv *priv,
    963     * set COM8
    964     */
    965     if (priv->band_filter) {
    966     - ret = ov772x_mask_set(client, COM8, BNDF_ON_OFF, 1);
    967     + ret = ov772x_mask_set(client, COM8, BNDF_ON_OFF, BNDF_ON_OFF);
    968     if (!ret)
    969     ret = ov772x_mask_set(client, BDBASE,
    970     0xff, 256 - priv->band_filter);
    971     diff --git a/drivers/media/platform/exynos4-is/fimc-isp-video.c b/drivers/media/platform/exynos4-is/fimc-isp-video.c
    972     index 400ce0cb0c0d..e00fa03ddc3e 100644
    973     --- a/drivers/media/platform/exynos4-is/fimc-isp-video.c
    974     +++ b/drivers/media/platform/exynos4-is/fimc-isp-video.c
    975     @@ -384,12 +384,17 @@ static void __isp_video_try_fmt(struct fimc_isp *isp,
    976     struct v4l2_pix_format_mplane *pixm,
    977     const struct fimc_fmt **fmt)
    978     {
    979     - *fmt = fimc_isp_find_format(&pixm->pixelformat, NULL, 2);
    980     + const struct fimc_fmt *__fmt;
    981     +
    982     + __fmt = fimc_isp_find_format(&pixm->pixelformat, NULL, 2);
    983     +
    984     + if (fmt)
    985     + *fmt = __fmt;
    986    
    987     pixm->colorspace = V4L2_COLORSPACE_SRGB;
    988     pixm->field = V4L2_FIELD_NONE;
    989     - pixm->num_planes = (*fmt)->memplanes;
    990     - pixm->pixelformat = (*fmt)->fourcc;
    991     + pixm->num_planes = __fmt->memplanes;
    992     + pixm->pixelformat = __fmt->fourcc;
    993     /*
    994     * TODO: double check with the docmentation these width/height
    995     * constraints are correct.
    996     diff --git a/drivers/media/platform/fsl-viu.c b/drivers/media/platform/fsl-viu.c
    997     index ae8c6b35a357..7f0ed5a26da9 100644
    998     --- a/drivers/media/platform/fsl-viu.c
    999     +++ b/drivers/media/platform/fsl-viu.c
    1000     @@ -1417,7 +1417,7 @@ static int viu_of_probe(struct platform_device *op)
    1001     sizeof(struct viu_reg), DRV_NAME)) {
    1002     dev_err(&op->dev, "Error while requesting mem region\n");
    1003     ret = -EBUSY;
    1004     - goto err;
    1005     + goto err_irq;
    1006     }
    1007    
    1008     /* remap registers */
    1009     @@ -1425,7 +1425,7 @@ static int viu_of_probe(struct platform_device *op)
    1010     if (!viu_regs) {
    1011     dev_err(&op->dev, "Can't map register set\n");
    1012     ret = -ENOMEM;
    1013     - goto err;
    1014     + goto err_irq;
    1015     }
    1016    
    1017     /* Prepare our private structure */
    1018     @@ -1433,7 +1433,7 @@ static int viu_of_probe(struct platform_device *op)
    1019     if (!viu_dev) {
    1020     dev_err(&op->dev, "Can't allocate private structure\n");
    1021     ret = -ENOMEM;
    1022     - goto err;
    1023     + goto err_irq;
    1024     }
    1025    
    1026     viu_dev->vr = viu_regs;
    1027     @@ -1449,16 +1449,21 @@ static int viu_of_probe(struct platform_device *op)
    1028     ret = v4l2_device_register(viu_dev->dev, &viu_dev->v4l2_dev);
    1029     if (ret < 0) {
    1030     dev_err(&op->dev, "v4l2_device_register() failed: %d\n", ret);
    1031     - goto err;
    1032     + goto err_irq;
    1033     }
    1034    
    1035     ad = i2c_get_adapter(0);
    1036     + if (!ad) {
    1037     + ret = -EFAULT;
    1038     + dev_err(&op->dev, "couldn't get i2c adapter\n");
    1039     + goto err_v4l2;
    1040     + }
    1041    
    1042     v4l2_ctrl_handler_init(&viu_dev->hdl, 5);
    1043     if (viu_dev->hdl.error) {
    1044     ret = viu_dev->hdl.error;
    1045     dev_err(&op->dev, "couldn't register control\n");
    1046     - goto err_vdev;
    1047     + goto err_i2c;
    1048     }
    1049     /* This control handler will inherit the control(s) from the
    1050     sub-device(s). */
    1051     @@ -1476,7 +1481,7 @@ static int viu_of_probe(struct platform_device *op)
    1052     vdev = video_device_alloc();
    1053     if (vdev == NULL) {
    1054     ret = -ENOMEM;
    1055     - goto err_vdev;
    1056     + goto err_hdl;
    1057     }
    1058    
    1059     *vdev = viu_template;
    1060     @@ -1497,7 +1502,7 @@ static int viu_of_probe(struct platform_device *op)
    1061     ret = video_register_device(viu_dev->vdev, VFL_TYPE_GRABBER, -1);
    1062     if (ret < 0) {
    1063     video_device_release(viu_dev->vdev);
    1064     - goto err_vdev;
    1065     + goto err_unlock;
    1066     }
    1067    
    1068     /* enable VIU clock */
    1069     @@ -1505,12 +1510,12 @@ static int viu_of_probe(struct platform_device *op)
    1070     if (IS_ERR(clk)) {
    1071     dev_err(&op->dev, "failed to lookup the clock!\n");
    1072     ret = PTR_ERR(clk);
    1073     - goto err_clk;
    1074     + goto err_vdev;
    1075     }
    1076     ret = clk_prepare_enable(clk);
    1077     if (ret) {
    1078     dev_err(&op->dev, "failed to enable the clock!\n");
    1079     - goto err_clk;
    1080     + goto err_vdev;
    1081     }
    1082     viu_dev->clk = clk;
    1083    
    1084     @@ -1521,7 +1526,7 @@ static int viu_of_probe(struct platform_device *op)
    1085     if (request_irq(viu_dev->irq, viu_intr, 0, "viu", (void *)viu_dev)) {
    1086     dev_err(&op->dev, "Request VIU IRQ failed.\n");
    1087     ret = -ENODEV;
    1088     - goto err_irq;
    1089     + goto err_clk;
    1090     }
    1091    
    1092     mutex_unlock(&viu_dev->lock);
    1093     @@ -1529,16 +1534,19 @@ static int viu_of_probe(struct platform_device *op)
    1094     dev_info(&op->dev, "Freescale VIU Video Capture Board\n");
    1095     return ret;
    1096    
    1097     -err_irq:
    1098     - clk_disable_unprepare(viu_dev->clk);
    1099     err_clk:
    1100     - video_unregister_device(viu_dev->vdev);
    1101     + clk_disable_unprepare(viu_dev->clk);
    1102     err_vdev:
    1103     - v4l2_ctrl_handler_free(&viu_dev->hdl);
    1104     + video_unregister_device(viu_dev->vdev);
    1105     +err_unlock:
    1106     mutex_unlock(&viu_dev->lock);
    1107     +err_hdl:
    1108     + v4l2_ctrl_handler_free(&viu_dev->hdl);
    1109     +err_i2c:
    1110     i2c_put_adapter(ad);
    1111     +err_v4l2:
    1112     v4l2_device_unregister(&viu_dev->v4l2_dev);
    1113     -err:
    1114     +err_irq:
    1115     irq_dispose_mapping(viu_irq);
    1116     return ret;
    1117     }
    1118     diff --git a/drivers/media/platform/omap3isp/isp.c b/drivers/media/platform/omap3isp/isp.c
    1119     index 15a86bb4e61c..1e98b4845ea1 100644
    1120     --- a/drivers/media/platform/omap3isp/isp.c
    1121     +++ b/drivers/media/platform/omap3isp/isp.c
    1122     @@ -304,7 +304,7 @@ static struct clk *isp_xclk_src_get(struct of_phandle_args *clkspec, void *data)
    1123     static int isp_xclk_init(struct isp_device *isp)
    1124     {
    1125     struct device_node *np = isp->dev->of_node;
    1126     - struct clk_init_data init;
    1127     + struct clk_init_data init = { 0 };
    1128     unsigned int i;
    1129    
    1130     for (i = 0; i < ARRAY_SIZE(isp->xclks); ++i)
    1131     diff --git a/drivers/media/platform/s3c-camif/camif-capture.c b/drivers/media/platform/s3c-camif/camif-capture.c
    1132     index 5c9db0910a76..d9710b5dd375 100644
    1133     --- a/drivers/media/platform/s3c-camif/camif-capture.c
    1134     +++ b/drivers/media/platform/s3c-camif/camif-capture.c
    1135     @@ -117,6 +117,8 @@ static int sensor_set_power(struct camif_dev *camif, int on)
    1136    
    1137     if (camif->sensor.power_count == !on)
    1138     err = v4l2_subdev_call(sensor->sd, core, s_power, on);
    1139     + if (err == -ENOIOCTLCMD)
    1140     + err = 0;
    1141     if (!err)
    1142     sensor->power_count += on ? 1 : -1;
    1143    
    1144     diff --git a/drivers/media/usb/tm6000/tm6000-dvb.c b/drivers/media/usb/tm6000/tm6000-dvb.c
    1145     index 0426b210383b..ee88ae83230c 100644
    1146     --- a/drivers/media/usb/tm6000/tm6000-dvb.c
    1147     +++ b/drivers/media/usb/tm6000/tm6000-dvb.c
    1148     @@ -273,6 +273,11 @@ static int register_dvb(struct tm6000_core *dev)
    1149    
    1150     ret = dvb_register_adapter(&dvb->adapter, "Trident TVMaster 6000 DVB-T",
    1151     THIS_MODULE, &dev->udev->dev, adapter_nr);
    1152     + if (ret < 0) {
    1153     + pr_err("tm6000: couldn't register the adapter!\n");
    1154     + goto err;
    1155     + }
    1156     +
    1157     dvb->adapter.priv = dev;
    1158    
    1159     if (dvb->frontend) {
    1160     diff --git a/drivers/media/usb/uvc/uvc_video.c b/drivers/media/usb/uvc/uvc_video.c
    1161     index b5589d5f5da4..48503f30b3a2 100644
    1162     --- a/drivers/media/usb/uvc/uvc_video.c
    1163     +++ b/drivers/media/usb/uvc/uvc_video.c
    1164     @@ -163,14 +163,27 @@ static void uvc_fixup_video_ctrl(struct uvc_streaming *stream,
    1165     }
    1166     }
    1167    
    1168     +static size_t uvc_video_ctrl_size(struct uvc_streaming *stream)
    1169     +{
    1170     + /*
    1171     + * Return the size of the video probe and commit controls, which depends
    1172     + * on the protocol version.
    1173     + */
    1174     + if (stream->dev->uvc_version < 0x0110)
    1175     + return 26;
    1176     + else if (stream->dev->uvc_version < 0x0150)
    1177     + return 34;
    1178     + else
    1179     + return 48;
    1180     +}
    1181     +
    1182     static int uvc_get_video_ctrl(struct uvc_streaming *stream,
    1183     struct uvc_streaming_control *ctrl, int probe, __u8 query)
    1184     {
    1185     + __u16 size = uvc_video_ctrl_size(stream);
    1186     __u8 *data;
    1187     - __u16 size;
    1188     int ret;
    1189    
    1190     - size = stream->dev->uvc_version >= 0x0110 ? 34 : 26;
    1191     if ((stream->dev->quirks & UVC_QUIRK_PROBE_DEF) &&
    1192     query == UVC_GET_DEF)
    1193     return -EIO;
    1194     @@ -225,7 +238,7 @@ static int uvc_get_video_ctrl(struct uvc_streaming *stream,
    1195     ctrl->dwMaxVideoFrameSize = get_unaligned_le32(&data[18]);
    1196     ctrl->dwMaxPayloadTransferSize = get_unaligned_le32(&data[22]);
    1197    
    1198     - if (size == 34) {
    1199     + if (size >= 34) {
    1200     ctrl->dwClockFrequency = get_unaligned_le32(&data[26]);
    1201     ctrl->bmFramingInfo = data[30];
    1202     ctrl->bPreferedVersion = data[31];
    1203     @@ -254,11 +267,10 @@ out:
    1204     static int uvc_set_video_ctrl(struct uvc_streaming *stream,
    1205     struct uvc_streaming_control *ctrl, int probe)
    1206     {
    1207     + __u16 size = uvc_video_ctrl_size(stream);
    1208     __u8 *data;
    1209     - __u16 size;
    1210     int ret;
    1211    
    1212     - size = stream->dev->uvc_version >= 0x0110 ? 34 : 26;
    1213     data = kzalloc(size, GFP_KERNEL);
    1214     if (data == NULL)
    1215     return -ENOMEM;
    1216     @@ -275,7 +287,7 @@ static int uvc_set_video_ctrl(struct uvc_streaming *stream,
    1217     put_unaligned_le32(ctrl->dwMaxVideoFrameSize, &data[18]);
    1218     put_unaligned_le32(ctrl->dwMaxPayloadTransferSize, &data[22]);
    1219    
    1220     - if (size == 34) {
    1221     + if (size >= 34) {
    1222     put_unaligned_le32(ctrl->dwClockFrequency, &data[26]);
    1223     data[30] = ctrl->bmFramingInfo;
    1224     data[31] = ctrl->bPreferedVersion;
    1225     diff --git a/drivers/media/v4l2-core/v4l2-event.c b/drivers/media/v4l2-core/v4l2-event.c
    1226     index 8d3171c6bee8..567d86835f00 100644
    1227     --- a/drivers/media/v4l2-core/v4l2-event.c
    1228     +++ b/drivers/media/v4l2-core/v4l2-event.c
    1229     @@ -119,14 +119,6 @@ static void __v4l2_event_queue_fh(struct v4l2_fh *fh, const struct v4l2_event *e
    1230     if (sev == NULL)
    1231     return;
    1232    
    1233     - /*
    1234     - * If the event has been added to the fh->subscribed list, but its
    1235     - * add op has not completed yet elems will be 0, treat this as
    1236     - * not being subscribed.
    1237     - */
    1238     - if (!sev->elems)
    1239     - return;
    1240     -
    1241     /* Increase event sequence number on fh. */
    1242     fh->sequence++;
    1243    
    1244     @@ -212,6 +204,7 @@ int v4l2_event_subscribe(struct v4l2_fh *fh,
    1245     struct v4l2_subscribed_event *sev, *found_ev;
    1246     unsigned long flags;
    1247     unsigned i;
    1248     + int ret = 0;
    1249    
    1250     if (sub->type == V4L2_EVENT_ALL)
    1251     return -EINVAL;
    1252     @@ -229,31 +222,36 @@ int v4l2_event_subscribe(struct v4l2_fh *fh,
    1253     sev->flags = sub->flags;
    1254     sev->fh = fh;
    1255     sev->ops = ops;
    1256     + sev->elems = elems;
    1257     +
    1258     + mutex_lock(&fh->subscribe_lock);
    1259    
    1260     spin_lock_irqsave(&fh->vdev->fh_lock, flags);
    1261     found_ev = v4l2_event_subscribed(fh, sub->type, sub->id);
    1262     - if (!found_ev)
    1263     - list_add(&sev->list, &fh->subscribed);
    1264     spin_unlock_irqrestore(&fh->vdev->fh_lock, flags);
    1265    
    1266     if (found_ev) {
    1267     + /* Already listening */
    1268     kfree(sev);
    1269     - return 0; /* Already listening */
    1270     + goto out_unlock;
    1271     }
    1272    
    1273     if (sev->ops && sev->ops->add) {
    1274     - int ret = sev->ops->add(sev, elems);
    1275     + ret = sev->ops->add(sev, elems);
    1276     if (ret) {
    1277     - sev->ops = NULL;
    1278     - v4l2_event_unsubscribe(fh, sub);
    1279     - return ret;
    1280     + kfree(sev);
    1281     + goto out_unlock;
    1282     }
    1283     }
    1284    
    1285     - /* Mark as ready for use */
    1286     - sev->elems = elems;
    1287     + spin_lock_irqsave(&fh->vdev->fh_lock, flags);
    1288     + list_add(&sev->list, &fh->subscribed);
    1289     + spin_unlock_irqrestore(&fh->vdev->fh_lock, flags);
    1290    
    1291     - return 0;
    1292     +out_unlock:
    1293     + mutex_unlock(&fh->subscribe_lock);
    1294     +
    1295     + return ret;
    1296     }
    1297     EXPORT_SYMBOL_GPL(v4l2_event_subscribe);
    1298    
    1299     @@ -292,6 +290,8 @@ int v4l2_event_unsubscribe(struct v4l2_fh *fh,
    1300     return 0;
    1301     }
    1302    
    1303     + mutex_lock(&fh->subscribe_lock);
    1304     +
    1305     spin_lock_irqsave(&fh->vdev->fh_lock, flags);
    1306    
    1307     sev = v4l2_event_subscribed(fh, sub->type, sub->id);
    1308     @@ -309,6 +309,8 @@ int v4l2_event_unsubscribe(struct v4l2_fh *fh,
    1309     if (sev && sev->ops && sev->ops->del)
    1310     sev->ops->del(sev);
    1311    
    1312     + mutex_unlock(&fh->subscribe_lock);
    1313     +
    1314     kfree(sev);
    1315    
    1316     return 0;
    1317     diff --git a/drivers/media/v4l2-core/v4l2-fh.c b/drivers/media/v4l2-core/v4l2-fh.c
    1318     index c183f0996fa1..0c5e69070586 100644
    1319     --- a/drivers/media/v4l2-core/v4l2-fh.c
    1320     +++ b/drivers/media/v4l2-core/v4l2-fh.c
    1321     @@ -50,6 +50,7 @@ void v4l2_fh_init(struct v4l2_fh *fh, struct video_device *vdev)
    1322     INIT_LIST_HEAD(&fh->available);
    1323     INIT_LIST_HEAD(&fh->subscribed);
    1324     fh->sequence = -1;
    1325     + mutex_init(&fh->subscribe_lock);
    1326     }
    1327     EXPORT_SYMBOL_GPL(v4l2_fh_init);
    1328    
    1329     @@ -95,6 +96,7 @@ void v4l2_fh_exit(struct v4l2_fh *fh)
    1330     return;
    1331     v4l_disable_media_source(fh->vdev);
    1332     v4l2_event_unsubscribe_all(fh);
    1333     + mutex_destroy(&fh->subscribe_lock);
    1334     fh->vdev = NULL;
    1335     }
    1336     EXPORT_SYMBOL_GPL(v4l2_fh_exit);
    1337     diff --git a/drivers/misc/tsl2550.c b/drivers/misc/tsl2550.c
    1338     index 87a13374fdc0..eb5761067310 100644
    1339     --- a/drivers/misc/tsl2550.c
    1340     +++ b/drivers/misc/tsl2550.c
    1341     @@ -177,7 +177,7 @@ static int tsl2550_calculate_lux(u8 ch0, u8 ch1)
    1342     } else
    1343     lux = 0;
    1344     else
    1345     - return -EAGAIN;
    1346     + return 0;
    1347    
    1348     /* LUX range check */
    1349     return lux > TSL2550_MAX_LUX ? TSL2550_MAX_LUX : lux;
    1350     diff --git a/drivers/misc/vmw_vmci/vmci_queue_pair.c b/drivers/misc/vmw_vmci/vmci_queue_pair.c
    1351     index f735ab4ba84e..5927db046a87 100644
    1352     --- a/drivers/misc/vmw_vmci/vmci_queue_pair.c
    1353     +++ b/drivers/misc/vmw_vmci/vmci_queue_pair.c
    1354     @@ -755,7 +755,7 @@ static int qp_host_get_user_memory(u64 produce_uva,
    1355     retval = get_user_pages_fast((uintptr_t) produce_uva,
    1356     produce_q->kernel_if->num_pages, 1,
    1357     produce_q->kernel_if->u.h.header_page);
    1358     - if (retval < produce_q->kernel_if->num_pages) {
    1359     + if (retval < (int)produce_q->kernel_if->num_pages) {
    1360     pr_debug("get_user_pages_fast(produce) failed (retval=%d)",
    1361     retval);
    1362     qp_release_pages(produce_q->kernel_if->u.h.header_page,
    1363     @@ -767,7 +767,7 @@ static int qp_host_get_user_memory(u64 produce_uva,
    1364     retval = get_user_pages_fast((uintptr_t) consume_uva,
    1365     consume_q->kernel_if->num_pages, 1,
    1366     consume_q->kernel_if->u.h.header_page);
    1367     - if (retval < consume_q->kernel_if->num_pages) {
    1368     + if (retval < (int)consume_q->kernel_if->num_pages) {
    1369     pr_debug("get_user_pages_fast(consume) failed (retval=%d)",
    1370     retval);
    1371     qp_release_pages(consume_q->kernel_if->u.h.header_page,
    1372     diff --git a/drivers/net/ethernet/hisilicon/hns/hnae.h b/drivers/net/ethernet/hisilicon/hns/hnae.h
    1373     index e093cbf26c8c..f9d68453c81d 100644
    1374     --- a/drivers/net/ethernet/hisilicon/hns/hnae.h
    1375     +++ b/drivers/net/ethernet/hisilicon/hns/hnae.h
    1376     @@ -213,10 +213,10 @@ struct hnae_desc_cb {
    1377    
    1378     /* priv data for the desc, e.g. skb when use with ip stack*/
    1379     void *priv;
    1380     - u16 page_offset;
    1381     - u16 reuse_flag;
    1382     + u32 page_offset;
    1383     + u32 length; /* length of the buffer */
    1384    
    1385     - u16 length; /* length of the buffer */
    1386     + u16 reuse_flag;
    1387    
    1388     /* desc type, used by the ring user to mark the type of the priv data */
    1389     u16 type;
    1390     diff --git a/drivers/net/ethernet/hisilicon/hns/hns_enet.c b/drivers/net/ethernet/hisilicon/hns/hns_enet.c
    1391     index 111e1aab7d83..8a2a07e21324 100644
    1392     --- a/drivers/net/ethernet/hisilicon/hns/hns_enet.c
    1393     +++ b/drivers/net/ethernet/hisilicon/hns/hns_enet.c
    1394     @@ -529,7 +529,7 @@ static void hns_nic_reuse_page(struct sk_buff *skb, int i,
    1395     }
    1396    
    1397     skb_add_rx_frag(skb, i, desc_cb->priv, desc_cb->page_offset + pull_len,
    1398     - size - pull_len, truesize - pull_len);
    1399     + size - pull_len, truesize);
    1400    
    1401     /* avoid re-using remote pages,flag default unreuse */
    1402     if (unlikely(page_to_nid(desc_cb->priv) != numa_node_id()))
    1403     diff --git a/drivers/net/ethernet/intel/e1000/e1000_ethtool.c b/drivers/net/ethernet/intel/e1000/e1000_ethtool.c
    1404     index 975eeb885ca2..e84574b1eae7 100644
    1405     --- a/drivers/net/ethernet/intel/e1000/e1000_ethtool.c
    1406     +++ b/drivers/net/ethernet/intel/e1000/e1000_ethtool.c
    1407     @@ -645,14 +645,14 @@ static int e1000_set_ringparam(struct net_device *netdev,
    1408     adapter->tx_ring = tx_old;
    1409     e1000_free_all_rx_resources(adapter);
    1410     e1000_free_all_tx_resources(adapter);
    1411     - kfree(tx_old);
    1412     - kfree(rx_old);
    1413     adapter->rx_ring = rxdr;
    1414     adapter->tx_ring = txdr;
    1415     err = e1000_up(adapter);
    1416     if (err)
    1417     goto err_setup;
    1418     }
    1419     + kfree(tx_old);
    1420     + kfree(rx_old);
    1421    
    1422     clear_bit(__E1000_RESETTING, &adapter->flags);
    1423     return 0;
    1424     @@ -665,7 +665,8 @@ err_setup_rx:
    1425     err_alloc_rx:
    1426     kfree(txdr);
    1427     err_alloc_tx:
    1428     - e1000_up(adapter);
    1429     + if (netif_running(adapter->netdev))
    1430     + e1000_up(adapter);
    1431     err_setup:
    1432     clear_bit(__E1000_RESETTING, &adapter->flags);
    1433     return err;
    1434     diff --git a/drivers/net/ethernet/qlogic/qed/qed_mcp.c b/drivers/net/ethernet/qlogic/qed/qed_mcp.c
    1435     index eaa242df4131..e175fcd73739 100644
    1436     --- a/drivers/net/ethernet/qlogic/qed/qed_mcp.c
    1437     +++ b/drivers/net/ethernet/qlogic/qed/qed_mcp.c
    1438     @@ -97,18 +97,57 @@ int qed_mcp_free(struct qed_hwfn *p_hwfn)
    1439     return 0;
    1440     }
    1441    
    1442     +/* Maximum of 1 sec to wait for the SHMEM ready indication */
    1443     +#define QED_MCP_SHMEM_RDY_MAX_RETRIES 20
    1444     +#define QED_MCP_SHMEM_RDY_ITER_MS 50
    1445     +
    1446     static int qed_load_mcp_offsets(struct qed_hwfn *p_hwfn, struct qed_ptt *p_ptt)
    1447     {
    1448     struct qed_mcp_info *p_info = p_hwfn->mcp_info;
    1449     + u8 cnt = QED_MCP_SHMEM_RDY_MAX_RETRIES;
    1450     + u8 msec = QED_MCP_SHMEM_RDY_ITER_MS;
    1451     u32 drv_mb_offsize, mfw_mb_offsize;
    1452     u32 mcp_pf_id = MCP_PF_ID(p_hwfn);
    1453    
    1454     p_info->public_base = qed_rd(p_hwfn, p_ptt, MISC_REG_SHARED_MEM_ADDR);
    1455     - if (!p_info->public_base)
    1456     - return 0;
    1457     + if (!p_info->public_base) {
    1458     + DP_NOTICE(p_hwfn,
    1459     + "The address of the MCP scratch-pad is not configured\n");
    1460     + return -EINVAL;
    1461     + }
    1462    
    1463     p_info->public_base |= GRCBASE_MCP;
    1464    
    1465     + /* Get the MFW MB address and number of supported messages */
    1466     + mfw_mb_offsize = qed_rd(p_hwfn, p_ptt,
    1467     + SECTION_OFFSIZE_ADDR(p_info->public_base,
    1468     + PUBLIC_MFW_MB));
    1469     + p_info->mfw_mb_addr = SECTION_ADDR(mfw_mb_offsize, mcp_pf_id);
    1470     + p_info->mfw_mb_length = (u16)qed_rd(p_hwfn, p_ptt,
    1471     + p_info->mfw_mb_addr +
    1472     + offsetof(struct public_mfw_mb,
    1473     + sup_msgs));
    1474     +
    1475     + /* The driver can notify that there was an MCP reset, and might read the
    1476     + * SHMEM values before the MFW has completed initializing them.
    1477     + * To avoid this, the "sup_msgs" field in the MFW mailbox is used as a
    1478     + * data ready indication.
    1479     + */
    1480     + while (!p_info->mfw_mb_length && --cnt) {
    1481     + msleep(msec);
    1482     + p_info->mfw_mb_length =
    1483     + (u16)qed_rd(p_hwfn, p_ptt,
    1484     + p_info->mfw_mb_addr +
    1485     + offsetof(struct public_mfw_mb, sup_msgs));
    1486     + }
    1487     +
    1488     + if (!cnt) {
    1489     + DP_NOTICE(p_hwfn,
    1490     + "Failed to get the SHMEM ready notification after %d msec\n",
    1491     + QED_MCP_SHMEM_RDY_MAX_RETRIES * msec);
    1492     + return -EBUSY;
    1493     + }
    1494     +
    1495     /* Calculate the driver and MFW mailbox address */
    1496     drv_mb_offsize = qed_rd(p_hwfn, p_ptt,
    1497     SECTION_OFFSIZE_ADDR(p_info->public_base,
    1498     @@ -118,13 +157,6 @@ static int qed_load_mcp_offsets(struct qed_hwfn *p_hwfn, struct qed_ptt *p_ptt)
    1499     "drv_mb_offsiz = 0x%x, drv_mb_addr = 0x%x mcp_pf_id = 0x%x\n",
    1500     drv_mb_offsize, p_info->drv_mb_addr, mcp_pf_id);
    1501    
    1502     - /* Set the MFW MB address */
    1503     - mfw_mb_offsize = qed_rd(p_hwfn, p_ptt,
    1504     - SECTION_OFFSIZE_ADDR(p_info->public_base,
    1505     - PUBLIC_MFW_MB));
    1506     - p_info->mfw_mb_addr = SECTION_ADDR(mfw_mb_offsize, mcp_pf_id);
    1507     - p_info->mfw_mb_length = (u16)qed_rd(p_hwfn, p_ptt, p_info->mfw_mb_addr);
    1508     -
    1509     /* Get the current driver mailbox sequence before sending
    1510     * the first command
    1511     */
    1512     @@ -1198,31 +1230,61 @@ qed_mcp_send_drv_version(struct qed_hwfn *p_hwfn,
    1513     return rc;
    1514     }
    1515    
    1516     +/* A maximal 100 msec waiting time for the MCP to halt */
    1517     +#define QED_MCP_HALT_SLEEP_MS 10
    1518     +#define QED_MCP_HALT_MAX_RETRIES 10
    1519     +
    1520     int qed_mcp_halt(struct qed_hwfn *p_hwfn, struct qed_ptt *p_ptt)
    1521     {
    1522     - u32 resp = 0, param = 0;
    1523     + u32 resp = 0, param = 0, cpu_state, cnt = 0;
    1524     int rc;
    1525    
    1526     rc = qed_mcp_cmd(p_hwfn, p_ptt, DRV_MSG_CODE_MCP_HALT, 0, &resp,
    1527     &param);
    1528     - if (rc)
    1529     + if (rc) {
    1530     DP_ERR(p_hwfn, "MCP response failure, aborting\n");
    1531     + return rc;
    1532     + }
    1533    
    1534     - return rc;
    1535     + do {
    1536     + msleep(QED_MCP_HALT_SLEEP_MS);
    1537     + cpu_state = qed_rd(p_hwfn, p_ptt, MCP_REG_CPU_STATE);
    1538     + if (cpu_state & MCP_REG_CPU_STATE_SOFT_HALTED)
    1539     + break;
    1540     + } while (++cnt < QED_MCP_HALT_MAX_RETRIES);
    1541     +
    1542     + if (cnt == QED_MCP_HALT_MAX_RETRIES) {
    1543     + DP_NOTICE(p_hwfn,
    1544     + "Failed to halt the MCP [CPU_MODE = 0x%08x, CPU_STATE = 0x%08x]\n",
    1545     + qed_rd(p_hwfn, p_ptt, MCP_REG_CPU_MODE), cpu_state);
    1546     + return -EBUSY;
    1547     + }
    1548     +
    1549     + return 0;
    1550     }
    1551    
    1552     +#define QED_MCP_RESUME_SLEEP_MS 10
    1553     +
    1554     int qed_mcp_resume(struct qed_hwfn *p_hwfn, struct qed_ptt *p_ptt)
    1555     {
    1556     - u32 value, cpu_mode;
    1557     + u32 cpu_mode, cpu_state;
    1558    
    1559     qed_wr(p_hwfn, p_ptt, MCP_REG_CPU_STATE, 0xffffffff);
    1560    
    1561     - value = qed_rd(p_hwfn, p_ptt, MCP_REG_CPU_MODE);
    1562     - value &= ~MCP_REG_CPU_MODE_SOFT_HALT;
    1563     - qed_wr(p_hwfn, p_ptt, MCP_REG_CPU_MODE, value);
    1564     cpu_mode = qed_rd(p_hwfn, p_ptt, MCP_REG_CPU_MODE);
    1565     + cpu_mode &= ~MCP_REG_CPU_MODE_SOFT_HALT;
    1566     + qed_wr(p_hwfn, p_ptt, MCP_REG_CPU_MODE, cpu_mode);
    1567     + msleep(QED_MCP_RESUME_SLEEP_MS);
    1568     + cpu_state = qed_rd(p_hwfn, p_ptt, MCP_REG_CPU_STATE);
    1569    
    1570     - return (cpu_mode & MCP_REG_CPU_MODE_SOFT_HALT) ? -EAGAIN : 0;
    1571     + if (cpu_state & MCP_REG_CPU_STATE_SOFT_HALTED) {
    1572     + DP_NOTICE(p_hwfn,
    1573     + "Failed to resume the MCP [CPU_MODE = 0x%08x, CPU_STATE = 0x%08x]\n",
    1574     + cpu_mode, cpu_state);
    1575     + return -EBUSY;
    1576     + }
    1577     +
    1578     + return 0;
    1579     }
    1580    
    1581     int qed_mcp_set_led(struct qed_hwfn *p_hwfn,
    1582     diff --git a/drivers/net/ethernet/qlogic/qed/qed_reg_addr.h b/drivers/net/ethernet/qlogic/qed/qed_reg_addr.h
    1583     index b414a0542177..56be1d6adfcc 100644
    1584     --- a/drivers/net/ethernet/qlogic/qed/qed_reg_addr.h
    1585     +++ b/drivers/net/ethernet/qlogic/qed/qed_reg_addr.h
    1586     @@ -510,6 +510,7 @@
    1587     0
    1588     #define MCP_REG_CPU_STATE \
    1589     0xe05004UL
    1590     +#define MCP_REG_CPU_STATE_SOFT_HALTED (0x1UL << 10)
    1591     #define MCP_REG_CPU_EVENT_MASK \
    1592     0xe05008UL
    1593     #define PGLUE_B_REG_PF_BAR0_SIZE \
    1594     diff --git a/drivers/net/phy/xilinx_gmii2rgmii.c b/drivers/net/phy/xilinx_gmii2rgmii.c
    1595     index 2e5150b0b8d5..7a14e8170e82 100644
    1596     --- a/drivers/net/phy/xilinx_gmii2rgmii.c
    1597     +++ b/drivers/net/phy/xilinx_gmii2rgmii.c
    1598     @@ -40,8 +40,11 @@ static int xgmiitorgmii_read_status(struct phy_device *phydev)
    1599     {
    1600     struct gmii2rgmii *priv = phydev->priv;
    1601     u16 val = 0;
    1602     + int err;
    1603    
    1604     - priv->phy_drv->read_status(phydev);
    1605     + err = priv->phy_drv->read_status(phydev);
    1606     + if (err < 0)
    1607     + return err;
    1608    
    1609     val = mdiobus_read(phydev->mdio.bus, priv->addr, XILINX_GMII2RGMII_REG);
    1610     val &= ~XILINX_GMII2RGMII_SPEED_MASK;
    1611     @@ -81,6 +84,11 @@ static int xgmiitorgmii_probe(struct mdio_device *mdiodev)
    1612     return -EPROBE_DEFER;
    1613     }
    1614    
    1615     + if (!priv->phy_dev->drv) {
    1616     + dev_info(dev, "Attached phy not ready\n");
    1617     + return -EPROBE_DEFER;
    1618     + }
    1619     +
    1620     priv->addr = mdiodev->addr;
    1621     priv->phy_drv = priv->phy_dev->drv;
    1622     memcpy(&priv->conv_phy_drv, priv->phy_dev->drv,
    1623     diff --git a/drivers/net/wireless/ath/ath10k/htt_rx.c b/drivers/net/wireless/ath/ath10k/htt_rx.c
    1624     index ba1fe61e6ea6..a3c218047597 100644
    1625     --- a/drivers/net/wireless/ath/ath10k/htt_rx.c
    1626     +++ b/drivers/net/wireless/ath/ath10k/htt_rx.c
    1627     @@ -214,11 +214,12 @@ int ath10k_htt_rx_ring_refill(struct ath10k *ar)
    1628     spin_lock_bh(&htt->rx_ring.lock);
    1629     ret = ath10k_htt_rx_ring_fill_n(htt, (htt->rx_ring.fill_level -
    1630     htt->rx_ring.fill_cnt));
    1631     - spin_unlock_bh(&htt->rx_ring.lock);
    1632    
    1633     if (ret)
    1634     ath10k_htt_rx_ring_free(htt);
    1635    
    1636     + spin_unlock_bh(&htt->rx_ring.lock);
    1637     +
    1638     return ret;
    1639     }
    1640    
    1641     @@ -230,7 +231,9 @@ void ath10k_htt_rx_free(struct ath10k_htt *htt)
    1642     skb_queue_purge(&htt->rx_in_ord_compl_q);
    1643     skb_queue_purge(&htt->tx_fetch_ind_q);
    1644    
    1645     + spin_lock_bh(&htt->rx_ring.lock);
    1646     ath10k_htt_rx_ring_free(htt);
    1647     + spin_unlock_bh(&htt->rx_ring.lock);
    1648    
    1649     dma_free_coherent(htt->ar->dev,
    1650     (htt->rx_ring.size *
    1651     diff --git a/drivers/net/wireless/rndis_wlan.c b/drivers/net/wireless/rndis_wlan.c
    1652     index 15b2350d9f45..c9f8847dc123 100644
    1653     --- a/drivers/net/wireless/rndis_wlan.c
    1654     +++ b/drivers/net/wireless/rndis_wlan.c
    1655     @@ -2921,6 +2921,8 @@ static void rndis_wlan_auth_indication(struct usbnet *usbdev,
    1656    
    1657     while (buflen >= sizeof(*auth_req)) {
    1658     auth_req = (void *)buf;
    1659     + if (buflen < le32_to_cpu(auth_req->length))
    1660     + return;
    1661     type = "unknown";
    1662     flags = le32_to_cpu(auth_req->flags);
    1663     pairwise_error = false;
    1664     diff --git a/drivers/net/wireless/ti/wlcore/cmd.c b/drivers/net/wireless/ti/wlcore/cmd.c
    1665     index 7f4da727bb7b..96f83f09b8c5 100644
    1666     --- a/drivers/net/wireless/ti/wlcore/cmd.c
    1667     +++ b/drivers/net/wireless/ti/wlcore/cmd.c
    1668     @@ -35,6 +35,7 @@
    1669     #include "wl12xx_80211.h"
    1670     #include "cmd.h"
    1671     #include "event.h"
    1672     +#include "ps.h"
    1673     #include "tx.h"
    1674     #include "hw_ops.h"
    1675    
    1676     @@ -191,6 +192,10 @@ int wlcore_cmd_wait_for_event_or_timeout(struct wl1271 *wl,
    1677    
    1678     timeout_time = jiffies + msecs_to_jiffies(WL1271_EVENT_TIMEOUT);
    1679    
    1680     + ret = wl1271_ps_elp_wakeup(wl);
    1681     + if (ret < 0)
    1682     + return ret;
    1683     +
    1684     do {
    1685     if (time_after(jiffies, timeout_time)) {
    1686     wl1271_debug(DEBUG_CMD, "timeout waiting for event %d",
    1687     @@ -222,6 +227,7 @@ int wlcore_cmd_wait_for_event_or_timeout(struct wl1271 *wl,
    1688     } while (!event);
    1689    
    1690     out:
    1691     + wl1271_ps_elp_sleep(wl);
    1692     kfree(events_vector);
    1693     return ret;
    1694     }
    1695     diff --git a/drivers/power/reset/vexpress-poweroff.c b/drivers/power/reset/vexpress-poweroff.c
    1696     index 102f95a09460..e9e749f87517 100644
    1697     --- a/drivers/power/reset/vexpress-poweroff.c
    1698     +++ b/drivers/power/reset/vexpress-poweroff.c
    1699     @@ -35,6 +35,7 @@ static void vexpress_reset_do(struct device *dev, const char *what)
    1700     }
    1701    
    1702     static struct device *vexpress_power_off_device;
    1703     +static atomic_t vexpress_restart_nb_refcnt = ATOMIC_INIT(0);
    1704    
    1705     static void vexpress_power_off(void)
    1706     {
    1707     @@ -99,10 +100,13 @@ static int _vexpress_register_restart_handler(struct device *dev)
    1708     int err;
    1709    
    1710     vexpress_restart_device = dev;
    1711     - err = register_restart_handler(&vexpress_restart_nb);
    1712     - if (err) {
    1713     - dev_err(dev, "cannot register restart handler (err=%d)\n", err);
    1714     - return err;
    1715     + if (atomic_inc_return(&vexpress_restart_nb_refcnt) == 1) {
    1716     + err = register_restart_handler(&vexpress_restart_nb);
    1717     + if (err) {
    1718     + dev_err(dev, "cannot register restart handler (err=%d)\n", err);
    1719     + atomic_dec(&vexpress_restart_nb_refcnt);
    1720     + return err;
    1721     + }
    1722     }
    1723     device_create_file(dev, &dev_attr_active);
    1724    
    1725     diff --git a/drivers/power/supply/power_supply_core.c b/drivers/power/supply/power_supply_core.c
    1726     index a74d8ca383a1..9e05ae0430a9 100644
    1727     --- a/drivers/power/supply/power_supply_core.c
    1728     +++ b/drivers/power/supply/power_supply_core.c
    1729     @@ -14,6 +14,7 @@
    1730     #include <linux/types.h>
    1731     #include <linux/init.h>
    1732     #include <linux/slab.h>
    1733     +#include <linux/delay.h>
    1734     #include <linux/device.h>
    1735     #include <linux/notifier.h>
    1736     #include <linux/err.h>
    1737     @@ -138,8 +139,13 @@ static void power_supply_deferred_register_work(struct work_struct *work)
    1738     struct power_supply *psy = container_of(work, struct power_supply,
    1739     deferred_register_work.work);
    1740    
    1741     - if (psy->dev.parent)
    1742     - mutex_lock(&psy->dev.parent->mutex);
    1743     + if (psy->dev.parent) {
    1744     + while (!mutex_trylock(&psy->dev.parent->mutex)) {
    1745     + if (psy->removing)
    1746     + return;
    1747     + msleep(10);
    1748     + }
    1749     + }
    1750    
    1751     power_supply_changed(psy);
    1752    
    1753     @@ -944,6 +950,7 @@ EXPORT_SYMBOL_GPL(devm_power_supply_register_no_ws);
    1754     void power_supply_unregister(struct power_supply *psy)
    1755     {
    1756     WARN_ON(atomic_dec_return(&psy->use_cnt));
    1757     + psy->removing = true;
    1758     cancel_work_sync(&psy->changed_work);
    1759     cancel_delayed_work_sync(&psy->deferred_register_work);
    1760     sysfs_remove_link(&psy->dev.kobj, "powers");
    1761     diff --git a/drivers/regulator/core.c b/drivers/regulator/core.c
    1762     index 178fcda12cec..18d57c0efe9f 100644
    1763     --- a/drivers/regulator/core.c
    1764     +++ b/drivers/regulator/core.c
    1765     @@ -4054,13 +4054,13 @@ regulator_register(const struct regulator_desc *regulator_desc,
    1766     !rdev->desc->fixed_uV)
    1767     rdev->is_switch = true;
    1768    
    1769     + dev_set_drvdata(&rdev->dev, rdev);
    1770     ret = device_register(&rdev->dev);
    1771     if (ret != 0) {
    1772     put_device(&rdev->dev);
    1773     goto unset_supplies;
    1774     }
    1775    
    1776     - dev_set_drvdata(&rdev->dev, rdev);
    1777     rdev_init_debugfs(rdev);
    1778    
    1779     /* try to resolve regulators supply since a new one was registered */
    1780     diff --git a/drivers/scsi/bnx2i/bnx2i_hwi.c b/drivers/scsi/bnx2i/bnx2i_hwi.c
    1781     index 42921dbba927..4ca10501647b 100644
    1782     --- a/drivers/scsi/bnx2i/bnx2i_hwi.c
    1783     +++ b/drivers/scsi/bnx2i/bnx2i_hwi.c
    1784     @@ -2742,6 +2742,8 @@ int bnx2i_map_ep_dbell_regs(struct bnx2i_endpoint *ep)
    1785     BNX2X_DOORBELL_PCI_BAR);
    1786     reg_off = (1 << BNX2X_DB_SHIFT) * (cid_num & 0x1FFFF);
    1787     ep->qp.ctx_base = ioremap_nocache(reg_base + reg_off, 4);
    1788     + if (!ep->qp.ctx_base)
    1789     + return -ENOMEM;
    1790     goto arm_cq;
    1791     }
    1792    
    1793     diff --git a/drivers/scsi/ibmvscsi/ibmvscsi.c b/drivers/scsi/ibmvscsi/ibmvscsi.c
    1794     index d9534ee6ef52..e1730227b448 100644
    1795     --- a/drivers/scsi/ibmvscsi/ibmvscsi.c
    1796     +++ b/drivers/scsi/ibmvscsi/ibmvscsi.c
    1797     @@ -93,7 +93,7 @@ static int max_requests = IBMVSCSI_MAX_REQUESTS_DEFAULT;
    1798     static int max_events = IBMVSCSI_MAX_REQUESTS_DEFAULT + 2;
    1799     static int fast_fail = 1;
    1800     static int client_reserve = 1;
    1801     -static char partition_name[97] = "UNKNOWN";
    1802     +static char partition_name[96] = "UNKNOWN";
    1803     static unsigned int partition_number = -1;
    1804    
    1805     static struct scsi_transport_template *ibmvscsi_transport_template;
    1806     @@ -259,7 +259,7 @@ static void gather_partition_info(void)
    1807    
    1808     ppartition_name = of_get_property(of_root, "ibm,partition-name", NULL);
    1809     if (ppartition_name)
    1810     - strncpy(partition_name, ppartition_name,
    1811     + strlcpy(partition_name, ppartition_name,
    1812     sizeof(partition_name));
    1813     p_number_ptr = of_get_property(of_root, "ibm,partition-no", NULL);
    1814     if (p_number_ptr)
    1815     diff --git a/drivers/scsi/megaraid/megaraid_sas_base.c b/drivers/scsi/megaraid/megaraid_sas_base.c
    1816     index 35cbd36f8d3b..090fdcdd15c9 100644
    1817     --- a/drivers/scsi/megaraid/megaraid_sas_base.c
    1818     +++ b/drivers/scsi/megaraid/megaraid_sas_base.c
    1819     @@ -6193,6 +6193,9 @@ megasas_resume(struct pci_dev *pdev)
    1820     goto fail_init_mfi;
    1821     }
    1822    
    1823     + if (megasas_get_ctrl_info(instance) != DCMD_SUCCESS)
    1824     + goto fail_init_mfi;
    1825     +
    1826     tasklet_init(&instance->isr_tasklet, instance->instancet->tasklet,
    1827     (unsigned long)instance);
    1828    
    1829     diff --git a/drivers/spi/spi-rspi.c b/drivers/spi/spi-rspi.c
    1830     index a816f07e168e..093c9cf92bfd 100644
    1831     --- a/drivers/spi/spi-rspi.c
    1832     +++ b/drivers/spi/spi-rspi.c
    1833     @@ -597,11 +597,13 @@ static int rspi_dma_transfer(struct rspi_data *rspi, struct sg_table *tx,
    1834    
    1835     ret = wait_event_interruptible_timeout(rspi->wait,
    1836     rspi->dma_callbacked, HZ);
    1837     - if (ret > 0 && rspi->dma_callbacked)
    1838     + if (ret > 0 && rspi->dma_callbacked) {
    1839     ret = 0;
    1840     - else if (!ret) {
    1841     - dev_err(&rspi->master->dev, "DMA timeout\n");
    1842     - ret = -ETIMEDOUT;
    1843     + } else {
    1844     + if (!ret) {
    1845     + dev_err(&rspi->master->dev, "DMA timeout\n");
    1846     + ret = -ETIMEDOUT;
    1847     + }
    1848     if (tx)
    1849     dmaengine_terminate_all(rspi->master->dma_tx);
    1850     if (rx)
    1851     @@ -1313,12 +1315,36 @@ static const struct platform_device_id spi_driver_ids[] = {
    1852    
    1853     MODULE_DEVICE_TABLE(platform, spi_driver_ids);
    1854    
    1855     +#ifdef CONFIG_PM_SLEEP
    1856     +static int rspi_suspend(struct device *dev)
    1857     +{
    1858     + struct platform_device *pdev = to_platform_device(dev);
    1859     + struct rspi_data *rspi = platform_get_drvdata(pdev);
    1860     +
    1861     + return spi_master_suspend(rspi->master);
    1862     +}
    1863     +
    1864     +static int rspi_resume(struct device *dev)
    1865     +{
    1866     + struct platform_device *pdev = to_platform_device(dev);
    1867     + struct rspi_data *rspi = platform_get_drvdata(pdev);
    1868     +
    1869     + return spi_master_resume(rspi->master);
    1870     +}
    1871     +
    1872     +static SIMPLE_DEV_PM_OPS(rspi_pm_ops, rspi_suspend, rspi_resume);
    1873     +#define DEV_PM_OPS &rspi_pm_ops
    1874     +#else
    1875     +#define DEV_PM_OPS NULL
    1876     +#endif /* CONFIG_PM_SLEEP */
    1877     +
    1878     static struct platform_driver rspi_driver = {
    1879     .probe = rspi_probe,
    1880     .remove = rspi_remove,
    1881     .id_table = spi_driver_ids,
    1882     .driver = {
    1883     .name = "renesas_spi",
    1884     + .pm = DEV_PM_OPS,
    1885     .of_match_table = of_match_ptr(rspi_of_match),
    1886     },
    1887     };
    1888     diff --git a/drivers/spi/spi-sh-msiof.c b/drivers/spi/spi-sh-msiof.c
    1889     index cbf02ebb30a2..711ea523b325 100644
    1890     --- a/drivers/spi/spi-sh-msiof.c
    1891     +++ b/drivers/spi/spi-sh-msiof.c
    1892     @@ -373,7 +373,8 @@ static void sh_msiof_spi_set_mode_regs(struct sh_msiof_spi_priv *p,
    1893    
    1894     static void sh_msiof_reset_str(struct sh_msiof_spi_priv *p)
    1895     {
    1896     - sh_msiof_write(p, STR, sh_msiof_read(p, STR));
    1897     + sh_msiof_write(p, STR,
    1898     + sh_msiof_read(p, STR) & ~(STR_TDREQ | STR_RDREQ));
    1899     }
    1900    
    1901     static void sh_msiof_spi_write_fifo_8(struct sh_msiof_spi_priv *p,
    1902     @@ -1275,12 +1276,37 @@ static const struct platform_device_id spi_driver_ids[] = {
    1903     };
    1904     MODULE_DEVICE_TABLE(platform, spi_driver_ids);
    1905    
    1906     +#ifdef CONFIG_PM_SLEEP
    1907     +static int sh_msiof_spi_suspend(struct device *dev)
    1908     +{
    1909     + struct platform_device *pdev = to_platform_device(dev);
    1910     + struct sh_msiof_spi_priv *p = platform_get_drvdata(pdev);
    1911     +
    1912     + return spi_master_suspend(p->master);
    1913     +}
    1914     +
    1915     +static int sh_msiof_spi_resume(struct device *dev)
    1916     +{
    1917     + struct platform_device *pdev = to_platform_device(dev);
    1918     + struct sh_msiof_spi_priv *p = platform_get_drvdata(pdev);
    1919     +
    1920     + return spi_master_resume(p->master);
    1921     +}
    1922     +
    1923     +static SIMPLE_DEV_PM_OPS(sh_msiof_spi_pm_ops, sh_msiof_spi_suspend,
    1924     + sh_msiof_spi_resume);
    1925     +#define DEV_PM_OPS &sh_msiof_spi_pm_ops
    1926     +#else
    1927     +#define DEV_PM_OPS NULL
    1928     +#endif /* CONFIG_PM_SLEEP */
    1929     +
    1930     static struct platform_driver sh_msiof_spi_drv = {
    1931     .probe = sh_msiof_spi_probe,
    1932     .remove = sh_msiof_spi_remove,
    1933     .id_table = spi_driver_ids,
    1934     .driver = {
    1935     .name = "spi_sh_msiof",
    1936     + .pm = DEV_PM_OPS,
    1937     .of_match_table = of_match_ptr(sh_msiof_match),
    1938     },
    1939     };
    1940     diff --git a/drivers/spi/spi-tegra20-slink.c b/drivers/spi/spi-tegra20-slink.c
    1941     index 85c91f58b42f..af2880d0c112 100644
    1942     --- a/drivers/spi/spi-tegra20-slink.c
    1943     +++ b/drivers/spi/spi-tegra20-slink.c
    1944     @@ -1063,6 +1063,24 @@ static int tegra_slink_probe(struct platform_device *pdev)
    1945     goto exit_free_master;
    1946     }
    1947    
    1948     + /* disabled clock may cause interrupt storm upon request */
    1949     + tspi->clk = devm_clk_get(&pdev->dev, NULL);
    1950     + if (IS_ERR(tspi->clk)) {
    1951     + ret = PTR_ERR(tspi->clk);
    1952     + dev_err(&pdev->dev, "Can not get clock %d\n", ret);
    1953     + goto exit_free_master;
    1954     + }
    1955     + ret = clk_prepare(tspi->clk);
    1956     + if (ret < 0) {
    1957     + dev_err(&pdev->dev, "Clock prepare failed %d\n", ret);
    1958     + goto exit_free_master;
    1959     + }
    1960     + ret = clk_enable(tspi->clk);
    1961     + if (ret < 0) {
    1962     + dev_err(&pdev->dev, "Clock enable failed %d\n", ret);
    1963     + goto exit_free_master;
    1964     + }
    1965     +
    1966     spi_irq = platform_get_irq(pdev, 0);
    1967     tspi->irq = spi_irq;
    1968     ret = request_threaded_irq(tspi->irq, tegra_slink_isr,
    1969     @@ -1071,14 +1089,7 @@ static int tegra_slink_probe(struct platform_device *pdev)
    1970     if (ret < 0) {
    1971     dev_err(&pdev->dev, "Failed to register ISR for IRQ %d\n",
    1972     tspi->irq);
    1973     - goto exit_free_master;
    1974     - }
    1975     -
    1976     - tspi->clk = devm_clk_get(&pdev->dev, NULL);
    1977     - if (IS_ERR(tspi->clk)) {
    1978     - dev_err(&pdev->dev, "can not get clock\n");
    1979     - ret = PTR_ERR(tspi->clk);
    1980     - goto exit_free_irq;
    1981     + goto exit_clk_disable;
    1982     }
    1983    
    1984     tspi->rst = devm_reset_control_get(&pdev->dev, "spi");
    1985     @@ -1138,6 +1149,8 @@ exit_rx_dma_free:
    1986     tegra_slink_deinit_dma_param(tspi, true);
    1987     exit_free_irq:
    1988     free_irq(spi_irq, tspi);
    1989     +exit_clk_disable:
    1990     + clk_disable(tspi->clk);
    1991     exit_free_master:
    1992     spi_master_put(master);
    1993     return ret;
    1994     @@ -1150,6 +1163,8 @@ static int tegra_slink_remove(struct platform_device *pdev)
    1995    
    1996     free_irq(tspi->irq, tspi);
    1997    
    1998     + clk_disable(tspi->clk);
    1999     +
    2000     if (tspi->tx_dma_chan)
    2001     tegra_slink_deinit_dma_param(tspi, false);
    2002    
    2003     diff --git a/drivers/staging/android/ashmem.c b/drivers/staging/android/ashmem.c
    2004     index 6d690e5fa9bb..c6314d1552ea 100644
    2005     --- a/drivers/staging/android/ashmem.c
    2006     +++ b/drivers/staging/android/ashmem.c
    2007     @@ -383,6 +383,12 @@ static int ashmem_mmap(struct file *file, struct vm_area_struct *vma)
    2008     goto out;
    2009     }
    2010    
    2011     + /* requested mapping size larger than object size */
    2012     + if (vma->vm_end - vma->vm_start > PAGE_ALIGN(asma->size)) {
    2013     + ret = -EINVAL;
    2014     + goto out;
    2015     + }
    2016     +
    2017     /* requested protection bits must match our allowed protection mask */
    2018     if (unlikely((vma->vm_flags & ~calc_vm_prot_bits(asma->prot_mask, 0)) &
    2019     calc_vm_prot_bits(PROT_MASK, 0))) {
    2020     diff --git a/drivers/staging/rts5208/sd.c b/drivers/staging/rts5208/sd.c
    2021     index b0bbb36f8988..9e63bdf2afe7 100644
    2022     --- a/drivers/staging/rts5208/sd.c
    2023     +++ b/drivers/staging/rts5208/sd.c
    2024     @@ -4976,7 +4976,7 @@ int sd_execute_write_data(struct scsi_cmnd *srb, struct rtsx_chip *chip)
    2025     goto SD_Execute_Write_Cmd_Failed;
    2026     }
    2027    
    2028     - rtsx_write_register(chip, SD_BYTE_CNT_L, 0xFF, 0x00);
    2029     + retval = rtsx_write_register(chip, SD_BYTE_CNT_L, 0xFF, 0x00);
    2030     if (retval != STATUS_SUCCESS) {
    2031     rtsx_trace(chip);
    2032     goto SD_Execute_Write_Cmd_Failed;
    2033     diff --git a/drivers/target/iscsi/iscsi_target_auth.c b/drivers/target/iscsi/iscsi_target_auth.c
    2034     index f06e74ea10d3..f0d97305575d 100644
    2035     --- a/drivers/target/iscsi/iscsi_target_auth.c
    2036     +++ b/drivers/target/iscsi/iscsi_target_auth.c
    2037     @@ -26,15 +26,6 @@
    2038     #include "iscsi_target_nego.h"
    2039     #include "iscsi_target_auth.h"
    2040    
    2041     -static void chap_binaryhex_to_asciihex(char *dst, char *src, int src_len)
    2042     -{
    2043     - int i;
    2044     -
    2045     - for (i = 0; i < src_len; i++) {
    2046     - sprintf(&dst[i*2], "%02x", (int) src[i] & 0xff);
    2047     - }
    2048     -}
    2049     -
    2050     static void chap_gen_challenge(
    2051     struct iscsi_conn *conn,
    2052     int caller,
    2053     @@ -47,7 +38,7 @@ static void chap_gen_challenge(
    2054     memset(challenge_asciihex, 0, CHAP_CHALLENGE_LENGTH * 2 + 1);
    2055    
    2056     get_random_bytes(chap->challenge, CHAP_CHALLENGE_LENGTH);
    2057     - chap_binaryhex_to_asciihex(challenge_asciihex, chap->challenge,
    2058     + bin2hex(challenge_asciihex, chap->challenge,
    2059     CHAP_CHALLENGE_LENGTH);
    2060     /*
    2061     * Set CHAP_C, and copy the generated challenge into c_str.
    2062     @@ -281,7 +272,7 @@ static int chap_server_compute_md5(
    2063     goto out;
    2064     }
    2065    
    2066     - chap_binaryhex_to_asciihex(response, server_digest, MD5_SIGNATURE_SIZE);
    2067     + bin2hex(response, server_digest, MD5_SIGNATURE_SIZE);
    2068     pr_debug("[server] MD5 Server Digest: %s\n", response);
    2069    
    2070     if (memcmp(server_digest, client_digest, MD5_SIGNATURE_SIZE) != 0) {
    2071     @@ -403,7 +394,7 @@ static int chap_server_compute_md5(
    2072     /*
    2073     * Convert response from binary hex to ascii hext.
    2074     */
    2075     - chap_binaryhex_to_asciihex(response, digest, MD5_SIGNATURE_SIZE);
    2076     + bin2hex(response, digest, MD5_SIGNATURE_SIZE);
    2077     *nr_out_len += sprintf(nr_out_ptr + *nr_out_len, "CHAP_R=0x%s",
    2078     response);
    2079     *nr_out_len += 1;
    2080     diff --git a/drivers/target/iscsi/iscsi_target_tpg.c b/drivers/target/iscsi/iscsi_target_tpg.c
    2081     index 63e1dcc5914d..761b065a40bb 100644
    2082     --- a/drivers/target/iscsi/iscsi_target_tpg.c
    2083     +++ b/drivers/target/iscsi/iscsi_target_tpg.c
    2084     @@ -637,8 +637,7 @@ int iscsit_ta_authentication(struct iscsi_portal_group *tpg, u32 authentication)
    2085     none = strstr(buf1, NONE);
    2086     if (none)
    2087     goto out;
    2088     - strncat(buf1, ",", strlen(","));
    2089     - strncat(buf1, NONE, strlen(NONE));
    2090     + strlcat(buf1, "," NONE, sizeof(buf1));
    2091     if (iscsi_update_param_value(param, buf1) < 0)
    2092     return -EINVAL;
    2093     }
    2094     diff --git a/drivers/thermal/of-thermal.c b/drivers/thermal/of-thermal.c
    2095     index d04ec3b9e5ff..8a70b57d129c 100644
    2096     --- a/drivers/thermal/of-thermal.c
    2097     +++ b/drivers/thermal/of-thermal.c
    2098     @@ -278,10 +278,13 @@ static int of_thermal_set_mode(struct thermal_zone_device *tz,
    2099    
    2100     mutex_lock(&tz->lock);
    2101    
    2102     - if (mode == THERMAL_DEVICE_ENABLED)
    2103     + if (mode == THERMAL_DEVICE_ENABLED) {
    2104     tz->polling_delay = data->polling_delay;
    2105     - else
    2106     + tz->passive_delay = data->passive_delay;
    2107     + } else {
    2108     tz->polling_delay = 0;
    2109     + tz->passive_delay = 0;
    2110     + }
    2111    
    2112     mutex_unlock(&tz->lock);
    2113    
    2114     diff --git a/drivers/tty/serial/8250/serial_cs.c b/drivers/tty/serial/8250/serial_cs.c
    2115     index 933c2688dd7e..8106353ce7aa 100644
    2116     --- a/drivers/tty/serial/8250/serial_cs.c
    2117     +++ b/drivers/tty/serial/8250/serial_cs.c
    2118     @@ -637,8 +637,10 @@ static int serial_config(struct pcmcia_device *link)
    2119     (link->has_func_id) &&
    2120     (link->socket->pcmcia_pfc == 0) &&
    2121     ((link->func_id == CISTPL_FUNCID_MULTI) ||
    2122     - (link->func_id == CISTPL_FUNCID_SERIAL)))
    2123     - pcmcia_loop_config(link, serial_check_for_multi, info);
    2124     + (link->func_id == CISTPL_FUNCID_SERIAL))) {
    2125     + if (pcmcia_loop_config(link, serial_check_for_multi, info))
    2126     + goto failed;
    2127     + }
    2128    
    2129     /*
    2130     * Apply any multi-port quirk.
    2131     diff --git a/drivers/tty/serial/cpm_uart/cpm_uart_core.c b/drivers/tty/serial/cpm_uart/cpm_uart_core.c
    2132     index d3e3d42c0c12..0040c29f651a 100644
    2133     --- a/drivers/tty/serial/cpm_uart/cpm_uart_core.c
    2134     +++ b/drivers/tty/serial/cpm_uart/cpm_uart_core.c
    2135     @@ -1068,8 +1068,8 @@ static int poll_wait_key(char *obuf, struct uart_cpm_port *pinfo)
    2136     /* Get the address of the host memory buffer.
    2137     */
    2138     bdp = pinfo->rx_cur;
    2139     - while (bdp->cbd_sc & BD_SC_EMPTY)
    2140     - ;
    2141     + if (bdp->cbd_sc & BD_SC_EMPTY)
    2142     + return NO_POLL_CHAR;
    2143    
    2144     /* If the buffer address is in the CPM DPRAM, don't
    2145     * convert it.
    2146     @@ -1104,7 +1104,11 @@ static int cpm_get_poll_char(struct uart_port *port)
    2147     poll_chars = 0;
    2148     }
    2149     if (poll_chars <= 0) {
    2150     - poll_chars = poll_wait_key(poll_buf, pinfo);
    2151     + int ret = poll_wait_key(poll_buf, pinfo);
    2152     +
    2153     + if (ret == NO_POLL_CHAR)
    2154     + return ret;
    2155     + poll_chars = ret;
    2156     pollp = poll_buf;
    2157     }
    2158     poll_chars--;
    2159     diff --git a/drivers/tty/serial/fsl_lpuart.c b/drivers/tty/serial/fsl_lpuart.c
    2160     index 937f5e10f165..e2ec04904f54 100644
    2161     --- a/drivers/tty/serial/fsl_lpuart.c
    2162     +++ b/drivers/tty/serial/fsl_lpuart.c
    2163     @@ -833,7 +833,8 @@ static inline int lpuart_start_rx_dma(struct lpuart_port *sport)
    2164     struct circ_buf *ring = &sport->rx_ring;
    2165     int ret, nent;
    2166     int bits, baud;
    2167     - struct tty_struct *tty = tty_port_tty_get(&sport->port.state->port);
    2168     + struct tty_port *port = &sport->port.state->port;
    2169     + struct tty_struct *tty = port->tty;
    2170     struct ktermios *termios = &tty->termios;
    2171    
    2172     baud = tty_get_baud_rate(tty);
    2173     diff --git a/drivers/tty/serial/imx.c b/drivers/tty/serial/imx.c
    2174     index b24edf634985..0d82be145c68 100644
    2175     --- a/drivers/tty/serial/imx.c
    2176     +++ b/drivers/tty/serial/imx.c
    2177     @@ -2197,6 +2197,14 @@ static int serial_imx_probe(struct platform_device *pdev)
    2178     ret);
    2179     return ret;
    2180     }
    2181     +
    2182     + ret = devm_request_irq(&pdev->dev, rtsirq, imx_rtsint, 0,
    2183     + dev_name(&pdev->dev), sport);
    2184     + if (ret) {
    2185     + dev_err(&pdev->dev, "failed to request rts irq: %d\n",
    2186     + ret);
    2187     + return ret;
    2188     + }
    2189     } else {
    2190     ret = devm_request_irq(&pdev->dev, rxirq, imx_int, 0,
    2191     dev_name(&pdev->dev), sport);
    2192     diff --git a/drivers/usb/class/cdc-wdm.c b/drivers/usb/class/cdc-wdm.c
    2193     index adc0f78dc54d..9f001659807a 100644
    2194     --- a/drivers/usb/class/cdc-wdm.c
    2195     +++ b/drivers/usb/class/cdc-wdm.c
    2196     @@ -470,7 +470,7 @@ static int service_outstanding_interrupt(struct wdm_device *desc)
    2197    
    2198     set_bit(WDM_RESPONDING, &desc->flags);
    2199     spin_unlock_irq(&desc->iuspin);
    2200     - rv = usb_submit_urb(desc->response, GFP_ATOMIC);
    2201     + rv = usb_submit_urb(desc->response, GFP_KERNEL);
    2202     spin_lock_irq(&desc->iuspin);
    2203     if (rv) {
    2204     dev_err(&desc->intf->dev,
    2205     diff --git a/drivers/usb/core/devio.c b/drivers/usb/core/devio.c
    2206     index 893ebae51029..988240e3cb58 100644
    2207     --- a/drivers/usb/core/devio.c
    2208     +++ b/drivers/usb/core/devio.c
    2209     @@ -1450,10 +1450,13 @@ static int proc_do_submiturb(struct usb_dev_state *ps, struct usbdevfs_urb *uurb
    2210     struct async *as = NULL;
    2211     struct usb_ctrlrequest *dr = NULL;
    2212     unsigned int u, totlen, isofrmlen;
    2213     - int i, ret, is_in, num_sgs = 0, ifnum = -1;
    2214     + int i, ret, num_sgs = 0, ifnum = -1;
    2215     int number_of_packets = 0;
    2216     unsigned int stream_id = 0;
    2217     void *buf;
    2218     + bool is_in;
    2219     + bool allow_short = false;
    2220     + bool allow_zero = false;
    2221     unsigned long mask = USBDEVFS_URB_SHORT_NOT_OK |
    2222     USBDEVFS_URB_BULK_CONTINUATION |
    2223     USBDEVFS_URB_NO_FSBR |
    2224     @@ -1487,6 +1490,8 @@ static int proc_do_submiturb(struct usb_dev_state *ps, struct usbdevfs_urb *uurb
    2225     u = 0;
    2226     switch (uurb->type) {
    2227     case USBDEVFS_URB_TYPE_CONTROL:
    2228     + if (is_in)
    2229     + allow_short = true;
    2230     if (!usb_endpoint_xfer_control(&ep->desc))
    2231     return -EINVAL;
    2232     /* min 8 byte setup packet */
    2233     @@ -1527,6 +1532,10 @@ static int proc_do_submiturb(struct usb_dev_state *ps, struct usbdevfs_urb *uurb
    2234     break;
    2235    
    2236     case USBDEVFS_URB_TYPE_BULK:
    2237     + if (!is_in)
    2238     + allow_zero = true;
    2239     + else
    2240     + allow_short = true;
    2241     switch (usb_endpoint_type(&ep->desc)) {
    2242     case USB_ENDPOINT_XFER_CONTROL:
    2243     case USB_ENDPOINT_XFER_ISOC:
    2244     @@ -1547,6 +1556,10 @@ static int proc_do_submiturb(struct usb_dev_state *ps, struct usbdevfs_urb *uurb
    2245     if (!usb_endpoint_xfer_int(&ep->desc))
    2246     return -EINVAL;
    2247     interrupt_urb:
    2248     + if (!is_in)
    2249     + allow_zero = true;
    2250     + else
    2251     + allow_short = true;
    2252     break;
    2253    
    2254     case USBDEVFS_URB_TYPE_ISO:
    2255     @@ -1691,16 +1704,21 @@ static int proc_do_submiturb(struct usb_dev_state *ps, struct usbdevfs_urb *uurb
    2256     u = (is_in ? URB_DIR_IN : URB_DIR_OUT);
    2257     if (uurb->flags & USBDEVFS_URB_ISO_ASAP)
    2258     u |= URB_ISO_ASAP;
    2259     - if (uurb->flags & USBDEVFS_URB_SHORT_NOT_OK && is_in)
    2260     + if (allow_short && uurb->flags & USBDEVFS_URB_SHORT_NOT_OK)
    2261     u |= URB_SHORT_NOT_OK;
    2262     if (uurb->flags & USBDEVFS_URB_NO_FSBR)
    2263     u |= URB_NO_FSBR;
    2264     - if (uurb->flags & USBDEVFS_URB_ZERO_PACKET)
    2265     + if (allow_zero && uurb->flags & USBDEVFS_URB_ZERO_PACKET)
    2266     u |= URB_ZERO_PACKET;
    2267     if (uurb->flags & USBDEVFS_URB_NO_INTERRUPT)
    2268     u |= URB_NO_INTERRUPT;
    2269     as->urb->transfer_flags = u;
    2270    
    2271     + if (!allow_short && uurb->flags & USBDEVFS_URB_SHORT_NOT_OK)
    2272     + dev_warn(&ps->dev->dev, "Requested nonsensical USBDEVFS_URB_SHORT_NOT_OK.\n");
    2273     + if (!allow_zero && uurb->flags & USBDEVFS_URB_ZERO_PACKET)
    2274     + dev_warn(&ps->dev->dev, "Requested nonsensical USBDEVFS_URB_ZERO_PACKET.\n");
    2275     +
    2276     as->urb->transfer_buffer_length = uurb->buffer_length;
    2277     as->urb->setup_packet = (unsigned char *)dr;
    2278     dr = NULL;
    2279     diff --git a/drivers/usb/core/driver.c b/drivers/usb/core/driver.c
    2280     index 0bb380a9fcf7..e9d6cf146fcc 100644
    2281     --- a/drivers/usb/core/driver.c
    2282     +++ b/drivers/usb/core/driver.c
    2283     @@ -509,7 +509,6 @@ int usb_driver_claim_interface(struct usb_driver *driver,
    2284     struct device *dev;
    2285     struct usb_device *udev;
    2286     int retval = 0;
    2287     - int lpm_disable_error = -ENODEV;
    2288    
    2289     if (!iface)
    2290     return -ENODEV;
    2291     @@ -530,16 +529,6 @@ int usb_driver_claim_interface(struct usb_driver *driver,
    2292    
    2293     iface->condition = USB_INTERFACE_BOUND;
    2294    
    2295     - /* See the comment about disabling LPM in usb_probe_interface(). */
    2296     - if (driver->disable_hub_initiated_lpm) {
    2297     - lpm_disable_error = usb_unlocked_disable_lpm(udev);
    2298     - if (lpm_disable_error) {
    2299     - dev_err(&iface->dev, "%s Failed to disable LPM for driver %s\n.",
    2300     - __func__, driver->name);
    2301     - return -ENOMEM;
    2302     - }
    2303     - }
    2304     -
    2305     /* Claimed interfaces are initially inactive (suspended) and
    2306     * runtime-PM-enabled, but only if the driver has autosuspend
    2307     * support. Otherwise they are marked active, to prevent the
    2308     @@ -558,9 +547,20 @@ int usb_driver_claim_interface(struct usb_driver *driver,
    2309     if (device_is_registered(dev))
    2310     retval = device_bind_driver(dev);
    2311    
    2312     - /* Attempt to re-enable USB3 LPM, if the disable was successful. */
    2313     - if (!lpm_disable_error)
    2314     - usb_unlocked_enable_lpm(udev);
    2315     + if (retval) {
    2316     + dev->driver = NULL;
    2317     + usb_set_intfdata(iface, NULL);
    2318     + iface->needs_remote_wakeup = 0;
    2319     + iface->condition = USB_INTERFACE_UNBOUND;
    2320     +
    2321     + /*
    2322     + * Unbound interfaces are always runtime-PM-disabled
    2323     + * and runtime-PM-suspended
    2324     + */
    2325     + if (driver->supports_autosuspend)
    2326     + pm_runtime_disable(dev);
    2327     + pm_runtime_set_suspended(dev);
    2328     + }
    2329    
    2330     return retval;
    2331     }
    2332     diff --git a/drivers/usb/core/usb.c b/drivers/usb/core/usb.c
    2333     index eaf1c3b06f02..891261b43c67 100644
    2334     --- a/drivers/usb/core/usb.c
    2335     +++ b/drivers/usb/core/usb.c
    2336     @@ -91,6 +91,8 @@ struct usb_host_interface *usb_find_alt_setting(
    2337     struct usb_interface_cache *intf_cache = NULL;
    2338     int i;
    2339    
    2340     + if (!config)
    2341     + return NULL;
    2342     for (i = 0; i < config->desc.bNumInterfaces; i++) {
    2343     if (config->intf_cache[i]->altsetting[0].desc.bInterfaceNumber
    2344     == iface_num) {
    2345     diff --git a/drivers/usb/serial/kobil_sct.c b/drivers/usb/serial/kobil_sct.c
    2346     index 813035f51fe7..7d252678c55a 100644
    2347     --- a/drivers/usb/serial/kobil_sct.c
    2348     +++ b/drivers/usb/serial/kobil_sct.c
    2349     @@ -408,12 +408,20 @@ static int kobil_tiocmget(struct tty_struct *tty)
    2350     transfer_buffer_length,
    2351     KOBIL_TIMEOUT);
    2352    
    2353     - dev_dbg(&port->dev, "%s - Send get_status_line_state URB returns: %i. Statusline: %02x\n",
    2354     - __func__, result, transfer_buffer[0]);
    2355     + dev_dbg(&port->dev, "Send get_status_line_state URB returns: %i\n",
    2356     + result);
    2357     + if (result < 1) {
    2358     + if (result >= 0)
    2359     + result = -EIO;
    2360     + goto out_free;
    2361     + }
    2362     +
    2363     + dev_dbg(&port->dev, "Statusline: %02x\n", transfer_buffer[0]);
    2364    
    2365     result = 0;
    2366     if ((transfer_buffer[0] & SUSBCR_GSL_DSR) != 0)
    2367     result = TIOCM_DSR;
    2368     +out_free:
    2369     kfree(transfer_buffer);
    2370     return result;
    2371     }
    2372     diff --git a/drivers/usb/wusbcore/security.c b/drivers/usb/wusbcore/security.c
    2373     index 8c9421b69da0..6bf86ca950b3 100644
    2374     --- a/drivers/usb/wusbcore/security.c
    2375     +++ b/drivers/usb/wusbcore/security.c
    2376     @@ -230,7 +230,7 @@ int wusb_dev_sec_add(struct wusbhc *wusbhc,
    2377    
    2378     result = usb_get_descriptor(usb_dev, USB_DT_SECURITY,
    2379     0, secd, sizeof(*secd));
    2380     - if (result < sizeof(*secd)) {
    2381     + if (result < (int)sizeof(*secd)) {
    2382     dev_err(dev, "Can't read security descriptor or "
    2383     "not enough data: %d\n", result);
    2384     goto out;
    2385     diff --git a/drivers/uwb/hwa-rc.c b/drivers/uwb/hwa-rc.c
    2386     index 9a53912bdfe9..5d3ba747ae17 100644
    2387     --- a/drivers/uwb/hwa-rc.c
    2388     +++ b/drivers/uwb/hwa-rc.c
    2389     @@ -873,6 +873,7 @@ error_get_version:
    2390     error_rc_add:
    2391     usb_put_intf(iface);
    2392     usb_put_dev(hwarc->usb_dev);
    2393     + kfree(hwarc);
    2394     error_alloc:
    2395     uwb_rc_put(uwb_rc);
    2396     error_rc_alloc:
    2397     diff --git a/fs/ext4/xattr.c b/fs/ext4/xattr.c
    2398     index fdcbe0f2814f..c19c96840480 100644
    2399     --- a/fs/ext4/xattr.c
    2400     +++ b/fs/ext4/xattr.c
    2401     @@ -1426,6 +1426,11 @@ static int ext4_xattr_make_inode_space(handle_t *handle, struct inode *inode,
    2402     last = IFIRST(header);
    2403     /* Find the entry best suited to be pushed into EA block */
    2404     for (; !IS_LAST_ENTRY(last); last = EXT4_XATTR_NEXT(last)) {
    2405     + /* never move system.data out of the inode */
    2406     + if ((last->e_name_len == 4) &&
    2407     + (last->e_name_index == EXT4_XATTR_INDEX_SYSTEM) &&
    2408     + !memcmp(last->e_name, "data", 4))
    2409     + continue;
    2410     total_size =
    2411     EXT4_XATTR_SIZE(le32_to_cpu(last->e_value_size)) +
    2412     EXT4_XATTR_LEN(last->e_name_len);
    2413     diff --git a/fs/nfsd/nfs4proc.c b/fs/nfsd/nfs4proc.c
    2414     index eef0caf6e67d..e9495516527d 100644
    2415     --- a/fs/nfsd/nfs4proc.c
    2416     +++ b/fs/nfsd/nfs4proc.c
    2417     @@ -1725,6 +1725,7 @@ nfsd4_proc_compound(struct svc_rqst *rqstp,
    2418     if (status) {
    2419     op = &args->ops[0];
    2420     op->status = status;
    2421     + resp->opcnt = 1;
    2422     goto encode_op;
    2423     }
    2424    
    2425     diff --git a/include/linux/arm-smccc.h b/include/linux/arm-smccc.h
    2426     index ca1d2cc2cdfa..18863d56273c 100644
    2427     --- a/include/linux/arm-smccc.h
    2428     +++ b/include/linux/arm-smccc.h
    2429     @@ -199,47 +199,57 @@ asmlinkage void __arm_smccc_hvc(unsigned long a0, unsigned long a1,
    2430    
    2431     #define __declare_arg_0(a0, res) \
    2432     struct arm_smccc_res *___res = res; \
    2433     - register u32 r0 asm("r0") = a0; \
    2434     + register unsigned long r0 asm("r0") = (u32)a0; \
    2435     register unsigned long r1 asm("r1"); \
    2436     register unsigned long r2 asm("r2"); \
    2437     register unsigned long r3 asm("r3")
    2438    
    2439     #define __declare_arg_1(a0, a1, res) \
    2440     + typeof(a1) __a1 = a1; \
    2441     struct arm_smccc_res *___res = res; \
    2442     - register u32 r0 asm("r0") = a0; \
    2443     - register typeof(a1) r1 asm("r1") = a1; \
    2444     + register unsigned long r0 asm("r0") = (u32)a0; \
    2445     + register unsigned long r1 asm("r1") = __a1; \
    2446     register unsigned long r2 asm("r2"); \
    2447     register unsigned long r3 asm("r3")
    2448    
    2449     #define __declare_arg_2(a0, a1, a2, res) \
    2450     + typeof(a1) __a1 = a1; \
    2451     + typeof(a2) __a2 = a2; \
    2452     struct arm_smccc_res *___res = res; \
    2453     - register u32 r0 asm("r0") = a0; \
    2454     - register typeof(a1) r1 asm("r1") = a1; \
    2455     - register typeof(a2) r2 asm("r2") = a2; \
    2456     + register unsigned long r0 asm("r0") = (u32)a0; \
    2457     + register unsigned long r1 asm("r1") = __a1; \
    2458     + register unsigned long r2 asm("r2") = __a2; \
    2459     register unsigned long r3 asm("r3")
    2460    
    2461     #define __declare_arg_3(a0, a1, a2, a3, res) \
    2462     + typeof(a1) __a1 = a1; \
    2463     + typeof(a2) __a2 = a2; \
    2464     + typeof(a3) __a3 = a3; \
    2465     struct arm_smccc_res *___res = res; \
    2466     - register u32 r0 asm("r0") = a0; \
    2467     - register typeof(a1) r1 asm("r1") = a1; \
    2468     - register typeof(a2) r2 asm("r2") = a2; \
    2469     - register typeof(a3) r3 asm("r3") = a3
    2470     + register unsigned long r0 asm("r0") = (u32)a0; \
    2471     + register unsigned long r1 asm("r1") = __a1; \
    2472     + register unsigned long r2 asm("r2") = __a2; \
    2473     + register unsigned long r3 asm("r3") = __a3
    2474    
    2475     #define __declare_arg_4(a0, a1, a2, a3, a4, res) \
    2476     + typeof(a4) __a4 = a4; \
    2477     __declare_arg_3(a0, a1, a2, a3, res); \
    2478     - register typeof(a4) r4 asm("r4") = a4
    2479     + register unsigned long r4 asm("r4") = __a4
    2480    
    2481     #define __declare_arg_5(a0, a1, a2, a3, a4, a5, res) \
    2482     + typeof(a5) __a5 = a5; \
    2483     __declare_arg_4(a0, a1, a2, a3, a4, res); \
    2484     - register typeof(a5) r5 asm("r5") = a5
    2485     + register unsigned long r5 asm("r5") = __a5
    2486    
    2487     #define __declare_arg_6(a0, a1, a2, a3, a4, a5, a6, res) \
    2488     + typeof(a6) __a6 = a6; \
    2489     __declare_arg_5(a0, a1, a2, a3, a4, a5, res); \
    2490     - register typeof(a6) r6 asm("r6") = a6
    2491     + register unsigned long r6 asm("r6") = __a6
    2492    
    2493     #define __declare_arg_7(a0, a1, a2, a3, a4, a5, a6, a7, res) \
    2494     + typeof(a7) __a7 = a7; \
    2495     __declare_arg_6(a0, a1, a2, a3, a4, a5, a6, res); \
    2496     - register typeof(a7) r7 asm("r7") = a7
    2497     + register unsigned long r7 asm("r7") = __a7
    2498    
    2499     #define ___declare_args(count, ...) __declare_arg_ ## count(__VA_ARGS__)
    2500     #define __declare_args(count, ...) ___declare_args(count, __VA_ARGS__)
    2501     diff --git a/include/linux/platform_data/ina2xx.h b/include/linux/platform_data/ina2xx.h
    2502     index 9abc0ca7259b..9f0aa1b48c78 100644
    2503     --- a/include/linux/platform_data/ina2xx.h
    2504     +++ b/include/linux/platform_data/ina2xx.h
    2505     @@ -1,7 +1,7 @@
    2506     /*
    2507     * Driver for Texas Instruments INA219, INA226 power monitor chips
    2508     *
    2509     - * Copyright (C) 2012 Lothar Felten <l-felten@ti.com>
    2510     + * Copyright (C) 2012 Lothar Felten <lothar.felten@gmail.com>
    2511     *
    2512     * This program is free software; you can redistribute it and/or modify
    2513     * it under the terms of the GNU General Public License version 2 as
    2514     diff --git a/include/linux/power_supply.h b/include/linux/power_supply.h
    2515     index 3965503315ef..ad97baf7b8de 100644
    2516     --- a/include/linux/power_supply.h
    2517     +++ b/include/linux/power_supply.h
    2518     @@ -249,6 +249,7 @@ struct power_supply {
    2519     spinlock_t changed_lock;
    2520     bool changed;
    2521     bool initialized;
    2522     + bool removing;
    2523     atomic_t use_cnt;
    2524     #ifdef CONFIG_THERMAL
    2525     struct thermal_zone_device *tzd;
    2526     diff --git a/include/linux/slub_def.h b/include/linux/slub_def.h
    2527     index 75f56c2ef2d4..b6a59e8cd855 100644
    2528     --- a/include/linux/slub_def.h
    2529     +++ b/include/linux/slub_def.h
    2530     @@ -67,7 +67,8 @@ struct kmem_cache {
    2531     int size; /* The size of an object including meta data */
    2532     int object_size; /* The size of an object without meta data */
    2533     int offset; /* Free pointer offset. */
    2534     - int cpu_partial; /* Number of per cpu partial objects to keep around */
    2535     + /* Number of per cpu partial objects to keep around */
    2536     + unsigned int cpu_partial;
    2537     struct kmem_cache_order_objects oo;
    2538    
    2539     /* Allocation and freeing of slabs */
    2540     diff --git a/include/media/v4l2-fh.h b/include/media/v4l2-fh.h
    2541     index e19e6246e21c..d2671606cb5d 100644
    2542     --- a/include/media/v4l2-fh.h
    2543     +++ b/include/media/v4l2-fh.h
    2544     @@ -42,10 +42,13 @@ struct v4l2_ctrl_handler;
    2545     * @prio: priority of the file handler, as defined by &enum v4l2_priority
    2546     *
    2547     * @wait: event' s wait queue
    2548     + * @subscribe_lock: serialise changes to the subscribed list; guarantee that
    2549     + * the add and del event callbacks are orderly called
    2550     * @subscribed: list of subscribed events
    2551     * @available: list of events waiting to be dequeued
    2552     * @navailable: number of available events at @available list
    2553     * @sequence: event sequence number
    2554     + *
    2555     * @m2m_ctx: pointer to &struct v4l2_m2m_ctx
    2556     */
    2557     struct v4l2_fh {
    2558     @@ -56,6 +59,7 @@ struct v4l2_fh {
    2559    
    2560     /* Events */
    2561     wait_queue_head_t wait;
    2562     + struct mutex subscribe_lock;
    2563     struct list_head subscribed;
    2564     struct list_head available;
    2565     unsigned int navailable;
    2566     diff --git a/kernel/module.c b/kernel/module.c
    2567     index 0651f2d25fc9..2325c9821f2a 100644
    2568     --- a/kernel/module.c
    2569     +++ b/kernel/module.c
    2570     @@ -4011,7 +4011,7 @@ static unsigned long mod_find_symname(struct module *mod, const char *name)
    2571    
    2572     for (i = 0; i < kallsyms->num_symtab; i++)
    2573     if (strcmp(name, symname(kallsyms, i)) == 0 &&
    2574     - kallsyms->symtab[i].st_info != 'U')
    2575     + kallsyms->symtab[i].st_shndx != SHN_UNDEF)
    2576     return kallsyms->symtab[i].st_value;
    2577     return 0;
    2578     }
    2579     @@ -4057,6 +4057,10 @@ int module_kallsyms_on_each_symbol(int (*fn)(void *, const char *,
    2580     if (mod->state == MODULE_STATE_UNFORMED)
    2581     continue;
    2582     for (i = 0; i < kallsyms->num_symtab; i++) {
    2583     +
    2584     + if (kallsyms->symtab[i].st_shndx == SHN_UNDEF)
    2585     + continue;
    2586     +
    2587     ret = fn(data, symname(kallsyms, i),
    2588     mod, kallsyms->symtab[i].st_value);
    2589     if (ret != 0)
    2590     diff --git a/kernel/time/alarmtimer.c b/kernel/time/alarmtimer.c
    2591     index d67ef56ca9bc..a0ee81f49a87 100644
    2592     --- a/kernel/time/alarmtimer.c
    2593     +++ b/kernel/time/alarmtimer.c
    2594     @@ -786,7 +786,8 @@ static int alarm_timer_nsleep(const clockid_t which_clock, int flags,
    2595     /* Convert (if necessary) to absolute time */
    2596     if (flags != TIMER_ABSTIME) {
    2597     ktime_t now = alarm_bases[type].gettime();
    2598     - exp = ktime_add(now, exp);
    2599     +
    2600     + exp = ktime_add_safe(now, exp);
    2601     }
    2602    
    2603     if (alarmtimer_do_nsleep(&alarm, exp))
    2604     diff --git a/lib/klist.c b/lib/klist.c
    2605     index 0507fa5d84c5..f6b547812fe3 100644
    2606     --- a/lib/klist.c
    2607     +++ b/lib/klist.c
    2608     @@ -336,8 +336,9 @@ struct klist_node *klist_prev(struct klist_iter *i)
    2609     void (*put)(struct klist_node *) = i->i_klist->put;
    2610     struct klist_node *last = i->i_cur;
    2611     struct klist_node *prev;
    2612     + unsigned long flags;
    2613    
    2614     - spin_lock(&i->i_klist->k_lock);
    2615     + spin_lock_irqsave(&i->i_klist->k_lock, flags);
    2616    
    2617     if (last) {
    2618     prev = to_klist_node(last->n_node.prev);
    2619     @@ -356,7 +357,7 @@ struct klist_node *klist_prev(struct klist_iter *i)
    2620     prev = to_klist_node(prev->n_node.prev);
    2621     }
    2622    
    2623     - spin_unlock(&i->i_klist->k_lock);
    2624     + spin_unlock_irqrestore(&i->i_klist->k_lock, flags);
    2625    
    2626     if (put && last)
    2627     put(last);
    2628     @@ -377,8 +378,9 @@ struct klist_node *klist_next(struct klist_iter *i)
    2629     void (*put)(struct klist_node *) = i->i_klist->put;
    2630     struct klist_node *last = i->i_cur;
    2631     struct klist_node *next;
    2632     + unsigned long flags;
    2633    
    2634     - spin_lock(&i->i_klist->k_lock);
    2635     + spin_lock_irqsave(&i->i_klist->k_lock, flags);
    2636    
    2637     if (last) {
    2638     next = to_klist_node(last->n_node.next);
    2639     @@ -397,7 +399,7 @@ struct klist_node *klist_next(struct klist_iter *i)
    2640     next = to_klist_node(next->n_node.next);
    2641     }
    2642    
    2643     - spin_unlock(&i->i_klist->k_lock);
    2644     + spin_unlock_irqrestore(&i->i_klist->k_lock, flags);
    2645    
    2646     if (put && last)
    2647     put(last);
    2648     diff --git a/mm/slub.c b/mm/slub.c
    2649     index e0ce5dec84ba..131dee87a67c 100644
    2650     --- a/mm/slub.c
    2651     +++ b/mm/slub.c
    2652     @@ -1793,7 +1793,7 @@ static void *get_partial_node(struct kmem_cache *s, struct kmem_cache_node *n,
    2653     {
    2654     struct page *page, *page2;
    2655     void *object = NULL;
    2656     - int available = 0;
    2657     + unsigned int available = 0;
    2658     int objects;
    2659    
    2660     /*
    2661     @@ -4870,10 +4870,10 @@ static ssize_t cpu_partial_show(struct kmem_cache *s, char *buf)
    2662     static ssize_t cpu_partial_store(struct kmem_cache *s, const char *buf,
    2663     size_t length)
    2664     {
    2665     - unsigned long objects;
    2666     + unsigned int objects;
    2667     int err;
    2668    
    2669     - err = kstrtoul(buf, 10, &objects);
    2670     + err = kstrtouint(buf, 10, &objects);
    2671     if (err)
    2672     return err;
    2673     if (objects && !kmem_cache_has_cpu_partial(s))
    2674     diff --git a/net/6lowpan/iphc.c b/net/6lowpan/iphc.c
    2675     index 79f1fa22509a..23654f1902f3 100644
    2676     --- a/net/6lowpan/iphc.c
    2677     +++ b/net/6lowpan/iphc.c
    2678     @@ -745,6 +745,7 @@ int lowpan_header_decompress(struct sk_buff *skb, const struct net_device *dev,
    2679     hdr.hop_limit, &hdr.daddr);
    2680    
    2681     skb_push(skb, sizeof(hdr));
    2682     + skb_reset_mac_header(skb);
    2683     skb_reset_network_header(skb);
    2684     skb_copy_to_linear_data(skb, &hdr, sizeof(hdr));
    2685    
    2686     diff --git a/sound/aoa/core/gpio-feature.c b/sound/aoa/core/gpio-feature.c
    2687     index 71960089e207..65557421fe0b 100644
    2688     --- a/sound/aoa/core/gpio-feature.c
    2689     +++ b/sound/aoa/core/gpio-feature.c
    2690     @@ -88,8 +88,10 @@ static struct device_node *get_gpio(char *name,
    2691     }
    2692    
    2693     reg = of_get_property(np, "reg", NULL);
    2694     - if (!reg)
    2695     + if (!reg) {
    2696     + of_node_put(np);
    2697     return NULL;
    2698     + }
    2699    
    2700     *gpioptr = *reg;
    2701    
    2702     diff --git a/sound/pci/hda/hda_intel.c b/sound/pci/hda/hda_intel.c
    2703     index 4e331dd5ff47..f913809a7de3 100644
    2704     --- a/sound/pci/hda/hda_intel.c
    2705     +++ b/sound/pci/hda/hda_intel.c
    2706     @@ -2349,7 +2349,8 @@ static const struct pci_device_id azx_ids[] = {
    2707     .driver_data = AZX_DRIVER_GENERIC | AZX_DCAPS_PRESET_ATI_SB },
    2708     /* AMD Raven */
    2709     { PCI_DEVICE(0x1022, 0x15e3),
    2710     - .driver_data = AZX_DRIVER_GENERIC | AZX_DCAPS_PRESET_ATI_SB },
    2711     + .driver_data = AZX_DRIVER_GENERIC | AZX_DCAPS_PRESET_ATI_SB |
    2712     + AZX_DCAPS_PM_RUNTIME },
    2713     /* ATI HDMI */
    2714     { PCI_DEVICE(0x1002, 0x0002),
    2715     .driver_data = AZX_DRIVER_ATIHDMI_NS | AZX_DCAPS_PRESET_ATI_HDMI_NS },
    2716     diff --git a/sound/soc/soc-dapm.c b/sound/soc/soc-dapm.c
    2717     index 0b5d132bc3dd..8bfc534e3b34 100644
    2718     --- a/sound/soc/soc-dapm.c
    2719     +++ b/sound/soc/soc-dapm.c
    2720     @@ -3913,6 +3913,13 @@ int snd_soc_dapm_link_dai_widgets(struct snd_soc_card *card)
    2721     continue;
    2722     }
    2723    
    2724     + /* let users know there is no DAI to link */
    2725     + if (!dai_w->priv) {
    2726     + dev_dbg(card->dev, "dai widget %s has no DAI\n",
    2727     + dai_w->name);
    2728     + continue;
    2729     + }
    2730     +
    2731     dai = dai_w->priv;
    2732    
    2733     /* ...find all widgets with the same stream and link them */