Magellan Linux

  • Back to homepage
    • /[pkg-src]/trunk/kernel-alx/patches-4.9/0244-4.9.145-all-fixes.patch

    Contents of /trunk/kernel-alx/patches-4.9/0244-4.9.145-all-fixes.patch

    Parent Directory Parent Directory | Revision Log Revision Log

    Revision 3297 - (show annotations) (download)
    Tue Mar 12 10:43:06 2019 UTC (5 years, 1 month ago) by niro
    File size: 48413 byte(s) 
    -linux-4.9.145
    1 diff --git a/Makefile b/Makefile
    2 index c62b2b529724..1499c7ba2874 100644
    3 --- a/Makefile
    4 +++ b/Makefile
    5 @@ -1,6 +1,6 @@
    6 VERSION = 4
    7 PATCHLEVEL = 9
    8 -SUBLEVEL = 144
    9 +SUBLEVEL = 145
    10 EXTRAVERSION =
    11 NAME = Roaring Lionus
    12
    13 @@ -512,13 +512,15 @@ endif
    14 ifeq ($(cc-name),clang)
    15 ifneq ($(CROSS_COMPILE),)
    16 CLANG_TARGET := -target $(notdir $(CROSS_COMPILE:%-=%))
    17 -GCC_TOOLCHAIN := $(realpath $(dir $(shell which $(LD)))/..)
    18 +GCC_TOOLCHAIN_DIR := $(dir $(shell which $(LD)))
    19 +CLANG_PREFIX := --prefix=$(GCC_TOOLCHAIN_DIR)
    20 +GCC_TOOLCHAIN := $(realpath $(GCC_TOOLCHAIN_DIR)/..)
    21 endif
    22 ifneq ($(GCC_TOOLCHAIN),)
    23 CLANG_GCC_TC := -gcc-toolchain $(GCC_TOOLCHAIN)
    24 endif
    25 -KBUILD_CFLAGS += $(CLANG_TARGET) $(CLANG_GCC_TC)
    26 -KBUILD_AFLAGS += $(CLANG_TARGET) $(CLANG_GCC_TC)
    27 +KBUILD_CFLAGS += $(CLANG_TARGET) $(CLANG_GCC_TC) $(CLANG_PREFIX)
    28 +KBUILD_AFLAGS += $(CLANG_TARGET) $(CLANG_GCC_TC) $(CLANG_PREFIX)
    29 KBUILD_CPPFLAGS += $(call cc-option,-Qunused-arguments,)
    30 KBUILD_CFLAGS += $(call cc-disable-warning, unused-variable)
    31 KBUILD_CFLAGS += $(call cc-disable-warning, format-invalid-specifier)
    32 diff --git a/arch/arc/configs/zebu_hs_defconfig b/arch/arc/configs/zebu_hs_defconfig
    33 index 9f6166be7145..3346829b02bb 100644
    34 --- a/arch/arc/configs/zebu_hs_defconfig
    35 +++ b/arch/arc/configs/zebu_hs_defconfig
    36 @@ -11,7 +11,6 @@ CONFIG_NAMESPACES=y
    37 # CONFIG_UTS_NS is not set
    38 # CONFIG_PID_NS is not set
    39 CONFIG_BLK_DEV_INITRD=y
    40 -CONFIG_INITRAMFS_SOURCE="../../arc_initramfs_hs/"
    41 CONFIG_EXPERT=y
    42 CONFIG_PERF_EVENTS=y
    43 # CONFIG_COMPAT_BRK is not set
    44 diff --git a/arch/arc/configs/zebu_hs_smp_defconfig b/arch/arc/configs/zebu_hs_smp_defconfig
    45 index 44e9693f4257..4471f9c37d7e 100644
    46 --- a/arch/arc/configs/zebu_hs_smp_defconfig
    47 +++ b/arch/arc/configs/zebu_hs_smp_defconfig
    48 @@ -11,7 +11,6 @@ CONFIG_NAMESPACES=y
    49 # CONFIG_UTS_NS is not set
    50 # CONFIG_PID_NS is not set
    51 CONFIG_BLK_DEV_INITRD=y
    52 -CONFIG_INITRAMFS_SOURCE="../../arc_initramfs_hs/"
    53 CONFIG_EMBEDDED=y
    54 CONFIG_PERF_EVENTS=y
    55 # CONFIG_VM_EVENT_COUNTERS is not set
    56 diff --git a/drivers/dma/cppi41.c b/drivers/dma/cppi41.c
    57 index 55c1782e3623..2ceb5a26f860 100644
    58 --- a/drivers/dma/cppi41.c
    59 +++ b/drivers/dma/cppi41.c
    60 @@ -717,8 +717,22 @@ static int cppi41_stop_chan(struct dma_chan *chan)
    61
    62 desc_phys = lower_32_bits(c->desc_phys);
    63 desc_num = (desc_phys - cdd->descs_phys) / sizeof(struct cppi41_desc);
    64 - if (!cdd->chan_busy[desc_num])
    65 + if (!cdd->chan_busy[desc_num]) {
    66 + struct cppi41_channel *cc, *_ct;
    67 +
    68 + /*
    69 + * channels might still be in the pendling list if
    70 + * cppi41_dma_issue_pending() is called after
    71 + * cppi41_runtime_suspend() is called
    72 + */
    73 + list_for_each_entry_safe(cc, _ct, &cdd->pending, node) {
    74 + if (cc != c)
    75 + continue;
    76 + list_del(&cc->node);
    77 + break;
    78 + }
    79 return 0;
    80 + }
    81
    82 ret = cppi41_tear_down_chan(c);
    83 if (ret)
    84 diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h
    85 index 8913f357e78f..6f4c84d824e6 100644
    86 --- a/drivers/hid/hid-ids.h
    87 +++ b/drivers/hid/hid-ids.h
    88 @@ -965,6 +965,7 @@
    89 #define USB_VENDOR_ID_SYMBOL 0x05e0
    90 #define USB_DEVICE_ID_SYMBOL_SCANNER_1 0x0800
    91 #define USB_DEVICE_ID_SYMBOL_SCANNER_2 0x1300
    92 +#define USB_DEVICE_ID_SYMBOL_SCANNER_3 0x1200
    93
    94 #define USB_VENDOR_ID_SYNAPTICS 0x06cb
    95 #define USB_DEVICE_ID_SYNAPTICS_TP 0x0001
    96 diff --git a/drivers/hid/hid-input.c b/drivers/hid/hid-input.c
    97 index 5ff6dd8147b6..fc7ada26457e 100644
    98 --- a/drivers/hid/hid-input.c
    99 +++ b/drivers/hid/hid-input.c
    100 @@ -324,6 +324,9 @@ static const struct hid_device_id hid_battery_quirks[] = {
    101 { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_ELECOM,
    102 USB_DEVICE_ID_ELECOM_BM084),
    103 HID_BATTERY_QUIRK_IGNORE },
    104 + { HID_USB_DEVICE(USB_VENDOR_ID_SYMBOL,
    105 + USB_DEVICE_ID_SYMBOL_SCANNER_3),
    106 + HID_BATTERY_QUIRK_IGNORE },
    107 {}
    108 };
    109
    110 diff --git a/drivers/iommu/intel-iommu.c b/drivers/iommu/intel-iommu.c
    111 index 2558a381e118..f8c8537f0587 100644
    112 --- a/drivers/iommu/intel-iommu.c
    113 +++ b/drivers/iommu/intel-iommu.c
    114 @@ -3054,7 +3054,7 @@ static int copy_context_table(struct intel_iommu *iommu,
    115 }
    116
    117 if (old_ce)
    118 - iounmap(old_ce);
    119 + memunmap(old_ce);
    120
    121 ret = 0;
    122 if (devfn < 0x80)
    123 diff --git a/drivers/iommu/intel-svm.c b/drivers/iommu/intel-svm.c
    124 index f846f0140a9d..7dc2f8d415b6 100644
    125 --- a/drivers/iommu/intel-svm.c
    126 +++ b/drivers/iommu/intel-svm.c
    127 @@ -558,7 +558,7 @@ static irqreturn_t prq_event_thread(int irq, void *d)
    128 pr_err("%s: Page request without PASID: %08llx %08llx\n",
    129 iommu->name, ((unsigned long long *)req)[0],
    130 ((unsigned long long *)req)[1]);
    131 - goto bad_req;
    132 + goto no_pasid;
    133 }
    134
    135 if (!svm || svm->pasid != req->pasid) {
    136 diff --git a/drivers/iommu/ipmmu-vmsa.c b/drivers/iommu/ipmmu-vmsa.c
    137 index 85b5e75c7faa..3d2e9ca78f02 100644
    138 --- a/drivers/iommu/ipmmu-vmsa.c
    139 +++ b/drivers/iommu/ipmmu-vmsa.c
    140 @@ -372,6 +372,9 @@ static int ipmmu_domain_init_context(struct ipmmu_vmsa_domain *domain)
    141
    142 static void ipmmu_domain_destroy_context(struct ipmmu_vmsa_domain *domain)
    143 {
    144 + if (!domain->mmu)
    145 + return;
    146 +
    147 /*
    148 * Disable the context. Flush the TLB as required when modifying the
    149 * context registers.
    150 diff --git a/drivers/media/platform/omap3isp/isp.c b/drivers/media/platform/omap3isp/isp.c
    151 index 1e98b4845ea1..a21b12c5c085 100644
    152 --- a/drivers/media/platform/omap3isp/isp.c
    153 +++ b/drivers/media/platform/omap3isp/isp.c
    154 @@ -1591,6 +1591,8 @@ static void isp_pm_complete(struct device *dev)
    155
    156 static void isp_unregister_entities(struct isp_device *isp)
    157 {
    158 + media_device_unregister(&isp->media_dev);
    159 +
    160 omap3isp_csi2_unregister_entities(&isp->isp_csi2a);
    161 omap3isp_ccp2_unregister_entities(&isp->isp_ccp2);
    162 omap3isp_ccdc_unregister_entities(&isp->isp_ccdc);
    163 @@ -1601,7 +1603,6 @@ static void isp_unregister_entities(struct isp_device *isp)
    164 omap3isp_stat_unregister_entities(&isp->isp_hist);
    165
    166 v4l2_device_unregister(&isp->v4l2_dev);
    167 - media_device_unregister(&isp->media_dev);
    168 media_device_cleanup(&isp->media_dev);
    169 }
    170
    171 diff --git a/drivers/mtd/nand/qcom_nandc.c b/drivers/mtd/nand/qcom_nandc.c
    172 index dc4943134649..9f6c9a34b9eb 100644
    173 --- a/drivers/mtd/nand/qcom_nandc.c
    174 +++ b/drivers/mtd/nand/qcom_nandc.c
    175 @@ -142,15 +142,15 @@
    176 #define NAND_VERSION_MINOR_SHIFT 16
    177
    178 /* NAND OP_CMDs */
    179 -#define PAGE_READ 0x2
    180 -#define PAGE_READ_WITH_ECC 0x3
    181 -#define PAGE_READ_WITH_ECC_SPARE 0x4
    182 -#define PROGRAM_PAGE 0x6
    183 -#define PAGE_PROGRAM_WITH_ECC 0x7
    184 -#define PROGRAM_PAGE_SPARE 0x9
    185 -#define BLOCK_ERASE 0xa
    186 -#define FETCH_ID 0xb
    187 -#define RESET_DEVICE 0xd
    188 +#define OP_PAGE_READ 0x2
    189 +#define OP_PAGE_READ_WITH_ECC 0x3
    190 +#define OP_PAGE_READ_WITH_ECC_SPARE 0x4
    191 +#define OP_PROGRAM_PAGE 0x6
    192 +#define OP_PAGE_PROGRAM_WITH_ECC 0x7
    193 +#define OP_PROGRAM_PAGE_SPARE 0x9
    194 +#define OP_BLOCK_ERASE 0xa
    195 +#define OP_FETCH_ID 0xb
    196 +#define OP_RESET_DEVICE 0xd
    197
    198 /* Default Value for NAND_DEV_CMD_VLD */
    199 #define NAND_DEV_CMD_VLD_VAL (READ_START_VLD | WRITE_START_VLD | \
    200 @@ -425,11 +425,11 @@ static void update_rw_regs(struct qcom_nand_host *host, int num_cw, bool read)
    201
    202 if (read) {
    203 if (host->use_ecc)
    204 - cmd = PAGE_READ_WITH_ECC | PAGE_ACC | LAST_PAGE;
    205 + cmd = OP_PAGE_READ_WITH_ECC | PAGE_ACC | LAST_PAGE;
    206 else
    207 - cmd = PAGE_READ | PAGE_ACC | LAST_PAGE;
    208 + cmd = OP_PAGE_READ | PAGE_ACC | LAST_PAGE;
    209 } else {
    210 - cmd = PROGRAM_PAGE | PAGE_ACC | LAST_PAGE;
    211 + cmd = OP_PROGRAM_PAGE | PAGE_ACC | LAST_PAGE;
    212 }
    213
    214 if (host->use_ecc) {
    215 @@ -662,7 +662,7 @@ static int nandc_param(struct qcom_nand_host *host)
    216 * in use. we configure the controller to perform a raw read of 512
    217 * bytes to read onfi params
    218 */
    219 - nandc_set_reg(nandc, NAND_FLASH_CMD, PAGE_READ | PAGE_ACC | LAST_PAGE);
    220 + nandc_set_reg(nandc, NAND_FLASH_CMD, OP_PAGE_READ | PAGE_ACC | LAST_PAGE);
    221 nandc_set_reg(nandc, NAND_ADDR0, 0);
    222 nandc_set_reg(nandc, NAND_ADDR1, 0);
    223 nandc_set_reg(nandc, NAND_DEV0_CFG0, 0 << CW_PER_PAGE
    224 @@ -715,7 +715,7 @@ static int erase_block(struct qcom_nand_host *host, int page_addr)
    225 struct qcom_nand_controller *nandc = get_qcom_nand_controller(chip);
    226
    227 nandc_set_reg(nandc, NAND_FLASH_CMD,
    228 - BLOCK_ERASE | PAGE_ACC | LAST_PAGE);
    229 + OP_BLOCK_ERASE | PAGE_ACC | LAST_PAGE);
    230 nandc_set_reg(nandc, NAND_ADDR0, page_addr);
    231 nandc_set_reg(nandc, NAND_ADDR1, 0);
    232 nandc_set_reg(nandc, NAND_DEV0_CFG0,
    233 @@ -746,7 +746,7 @@ static int read_id(struct qcom_nand_host *host, int column)
    234 if (column == -1)
    235 return 0;
    236
    237 - nandc_set_reg(nandc, NAND_FLASH_CMD, FETCH_ID);
    238 + nandc_set_reg(nandc, NAND_FLASH_CMD, OP_FETCH_ID);
    239 nandc_set_reg(nandc, NAND_ADDR0, column);
    240 nandc_set_reg(nandc, NAND_ADDR1, 0);
    241 nandc_set_reg(nandc, NAND_FLASH_CHIP_SELECT, DM_EN);
    242 @@ -766,7 +766,7 @@ static int reset(struct qcom_nand_host *host)
    243 struct nand_chip *chip = &host->chip;
    244 struct qcom_nand_controller *nandc = get_qcom_nand_controller(chip);
    245
    246 - nandc_set_reg(nandc, NAND_FLASH_CMD, RESET_DEVICE);
    247 + nandc_set_reg(nandc, NAND_FLASH_CMD, OP_RESET_DEVICE);
    248 nandc_set_reg(nandc, NAND_EXEC_CMD, 1);
    249
    250 write_reg_dma(nandc, NAND_FLASH_CMD, 1);
    251 diff --git a/drivers/net/can/rcar/rcar_can.c b/drivers/net/can/rcar/rcar_can.c
    252 index 788459f6bf5c..9b2c3bd00f8b 100644
    253 --- a/drivers/net/can/rcar/rcar_can.c
    254 +++ b/drivers/net/can/rcar/rcar_can.c
    255 @@ -24,6 +24,9 @@
    256
    257 #define RCAR_CAN_DRV_NAME "rcar_can"
    258
    259 +#define RCAR_SUPPORTED_CLOCKS (BIT(CLKR_CLKP1) | BIT(CLKR_CLKP2) | \
    260 + BIT(CLKR_CLKEXT))
    261 +
    262 /* Mailbox configuration:
    263 * mailbox 60 - 63 - Rx FIFO mailboxes
    264 * mailbox 56 - 59 - Tx FIFO mailboxes
    265 @@ -789,7 +792,7 @@ static int rcar_can_probe(struct platform_device *pdev)
    266 goto fail_clk;
    267 }
    268
    269 - if (clock_select >= ARRAY_SIZE(clock_names)) {
    270 + if (!(BIT(clock_select) & RCAR_SUPPORTED_CLOCKS)) {
    271 err = -EINVAL;
    272 dev_err(&pdev->dev, "invalid CAN clock selected\n");
    273 goto fail_clk;
    274 diff --git a/drivers/net/ethernet/amd/sunlance.c b/drivers/net/ethernet/amd/sunlance.c
    275 index 9b56b40259dc..3153465d4d02 100644
    276 --- a/drivers/net/ethernet/amd/sunlance.c
    277 +++ b/drivers/net/ethernet/amd/sunlance.c
    278 @@ -1419,7 +1419,7 @@ static int sparc_lance_probe_one(struct platform_device *op,
    279
    280 prop = of_get_property(nd, "tpe-link-test?", NULL);
    281 if (!prop)
    282 - goto no_link_test;
    283 + goto node_put;
    284
    285 if (strcmp(prop, "true")) {
    286 printk(KERN_NOTICE "SunLance: warning: overriding option "
    287 @@ -1428,6 +1428,8 @@ static int sparc_lance_probe_one(struct platform_device *op,
    288 "to ecd@skynet.be\n");
    289 auxio_set_lte(AUXIO_LTE_ON);
    290 }
    291 +node_put:
    292 + of_node_put(nd);
    293 no_link_test:
    294 lp->auto_select = 1;
    295 lp->tpe = 0;
    296 diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x.h b/drivers/net/ethernet/broadcom/bnx2x/bnx2x.h
    297 index f3f2d66432ab..d5e4c42662b6 100644
    298 --- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x.h
    299 +++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x.h
    300 @@ -2187,6 +2187,13 @@ void bnx2x_igu_clear_sb_gen(struct bnx2x *bp, u8 func, u8 idu_sb_id,
    301 #define PMF_DMAE_C(bp) (BP_PORT(bp) * MAX_DMAE_C_PER_PORT + \
    302 E1HVN_MAX)
    303
    304 +/* Following is the DMAE channel number allocation for the clients.
    305 + * MFW: OCBB/OCSD implementations use DMAE channels 14/15 respectively.
    306 + * Driver: 0-3 and 8-11 (for PF dmae operations)
    307 + * 4 and 12 (for stats requests)
    308 + */
    309 +#define BNX2X_FW_DMAE_C 13 /* Channel for FW DMAE operations */
    310 +
    311 /* PCIE link and speed */
    312 #define PCICFG_LINK_WIDTH 0x1f00000
    313 #define PCICFG_LINK_WIDTH_SHIFT 20
    314 diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sp.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sp.c
    315 index cea6bdcde33f..bf760c9cff6a 100644
    316 --- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sp.c
    317 +++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sp.c
    318 @@ -6149,6 +6149,7 @@ static inline int bnx2x_func_send_start(struct bnx2x *bp,
    319 rdata->sd_vlan_tag = cpu_to_le16(start_params->sd_vlan_tag);
    320 rdata->path_id = BP_PATH(bp);
    321 rdata->network_cos_mode = start_params->network_cos_mode;
    322 + rdata->dmae_cmd_id = BNX2X_FW_DMAE_C;
    323
    324 rdata->vxlan_dst_port = cpu_to_le16(start_params->vxlan_dst_port);
    325 rdata->geneve_dst_port = cpu_to_le16(start_params->geneve_dst_port);
    326 diff --git a/drivers/net/ethernet/faraday/ftmac100.c b/drivers/net/ethernet/faraday/ftmac100.c
    327 index dce5f7b7f772..05e1f923f49e 100644
    328 --- a/drivers/net/ethernet/faraday/ftmac100.c
    329 +++ b/drivers/net/ethernet/faraday/ftmac100.c
    330 @@ -865,11 +865,10 @@ static irqreturn_t ftmac100_interrupt(int irq, void *dev_id)
    331 struct net_device *netdev = dev_id;
    332 struct ftmac100 *priv = netdev_priv(netdev);
    333
    334 - if (likely(netif_running(netdev))) {
    335 - /* Disable interrupts for polling */
    336 - ftmac100_disable_all_int(priv);
    337 + /* Disable interrupts for polling */
    338 + ftmac100_disable_all_int(priv);
    339 + if (likely(netif_running(netdev)))
    340 napi_schedule(&priv->napi);
    341 - }
    342
    343 return IRQ_HANDLED;
    344 }
    345 diff --git a/drivers/net/ethernet/mellanox/mlx4/alloc.c b/drivers/net/ethernet/mellanox/mlx4/alloc.c
    346 index 249a4584401a..b89a34fa3601 100644
    347 --- a/drivers/net/ethernet/mellanox/mlx4/alloc.c
    348 +++ b/drivers/net/ethernet/mellanox/mlx4/alloc.c
    349 @@ -339,7 +339,7 @@ void mlx4_zone_allocator_destroy(struct mlx4_zone_allocator *zone_alloc)
    350 static u32 __mlx4_alloc_from_zone(struct mlx4_zone_entry *zone, int count,
    351 int align, u32 skip_mask, u32 *puid)
    352 {
    353 - u32 uid;
    354 + u32 uid = 0;
    355 u32 res;
    356 struct mlx4_zone_allocator *zone_alloc = zone->allocator;
    357 struct mlx4_zone_entry *curr_node;
    358 diff --git a/drivers/net/ethernet/mellanox/mlx4/mlx4.h b/drivers/net/ethernet/mellanox/mlx4/mlx4.h
    359 index 086920b615af..df5d86fa0a92 100644
    360 --- a/drivers/net/ethernet/mellanox/mlx4/mlx4.h
    361 +++ b/drivers/net/ethernet/mellanox/mlx4/mlx4.h
    362 @@ -542,8 +542,8 @@ struct slave_list {
    363 struct resource_allocator {
    364 spinlock_t alloc_lock; /* protect quotas */
    365 union {
    366 - int res_reserved;
    367 - int res_port_rsvd[MLX4_MAX_PORTS];
    368 + unsigned int res_reserved;
    369 + unsigned int res_port_rsvd[MLX4_MAX_PORTS];
    370 };
    371 union {
    372 int res_free;
    373 diff --git a/drivers/net/ethernet/mellanox/mlx4/mr.c b/drivers/net/ethernet/mellanox/mlx4/mr.c
    374 index 395b5463cfd9..3637474cab8a 100644
    375 --- a/drivers/net/ethernet/mellanox/mlx4/mr.c
    376 +++ b/drivers/net/ethernet/mellanox/mlx4/mr.c
    377 @@ -366,6 +366,7 @@ int mlx4_mr_hw_write_mpt(struct mlx4_dev *dev, struct mlx4_mr *mmr,
    378 container_of((void *)mpt_entry, struct mlx4_cmd_mailbox,
    379 buf);
    380
    381 + (*mpt_entry)->lkey = 0;
    382 err = mlx4_SW2HW_MPT(dev, mailbox, key);
    383 }
    384
    385 diff --git a/drivers/net/ethernet/qlogic/qed/qed_int.c b/drivers/net/ethernet/qlogic/qed/qed_int.c
    386 index 2adedc6fb6cf..fd19372db2f8 100644
    387 --- a/drivers/net/ethernet/qlogic/qed/qed_int.c
    388 +++ b/drivers/net/ethernet/qlogic/qed/qed_int.c
    389 @@ -2135,6 +2135,8 @@ static int qed_int_attentions(struct qed_hwfn *p_hwfn)
    390 */
    391 do {
    392 index = p_sb_attn->sb_index;
    393 + /* finish reading index before the loop condition */
    394 + dma_rmb();
    395 attn_bits = le32_to_cpu(p_sb_attn->atten_bits);
    396 attn_acks = le32_to_cpu(p_sb_attn->atten_ack);
    397 } while (index != p_sb_attn->sb_index);
    398 diff --git a/drivers/net/ethernet/qlogic/qed/qed_main.c b/drivers/net/ethernet/qlogic/qed/qed_main.c
    399 index 1ed13a165e58..a769196628d9 100644
    400 --- a/drivers/net/ethernet/qlogic/qed/qed_main.c
    401 +++ b/drivers/net/ethernet/qlogic/qed/qed_main.c
    402 @@ -1395,9 +1395,9 @@ static int qed_drain(struct qed_dev *cdev)
    403 return -EBUSY;
    404 }
    405 rc = qed_mcp_drain(hwfn, ptt);
    406 + qed_ptt_release(hwfn, ptt);
    407 if (rc)
    408 return rc;
    409 - qed_ptt_release(hwfn, ptt);
    410 }
    411
    412 return 0;
    413 diff --git a/drivers/net/team/team.c b/drivers/net/team/team.c
    414 index 9670aa23ffb9..94b05dd827af 100644
    415 --- a/drivers/net/team/team.c
    416 +++ b/drivers/net/team/team.c
    417 @@ -989,8 +989,6 @@ static void team_port_disable(struct team *team,
    418 team->en_port_count--;
    419 team_queue_override_port_del(team, port);
    420 team_adjust_ops(team);
    421 - team_notify_peers(team);
    422 - team_mcast_rejoin(team);
    423 team_lower_state_changed(port);
    424 }
    425
    426 diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmutil/d11.c b/drivers/net/wireless/broadcom/brcm80211/brcmutil/d11.c
    427 index e7584b842dce..eb5db94f5745 100644
    428 --- a/drivers/net/wireless/broadcom/brcm80211/brcmutil/d11.c
    429 +++ b/drivers/net/wireless/broadcom/brcm80211/brcmutil/d11.c
    430 @@ -193,6 +193,9 @@ static void brcmu_d11ac_decchspec(struct brcmu_chan *ch)
    431 }
    432 break;
    433 case BRCMU_CHSPEC_D11AC_BW_160:
    434 + ch->bw = BRCMU_CHAN_BW_160;
    435 + ch->sb = brcmu_maskget16(ch->chspec, BRCMU_CHSPEC_D11AC_SB_MASK,
    436 + BRCMU_CHSPEC_D11AC_SB_SHIFT);
    437 switch (ch->sb) {
    438 case BRCMU_CHAN_SB_LLL:
    439 ch->control_ch_num -= CH_70MHZ_APART;
    440 diff --git a/drivers/net/wireless/mac80211_hwsim.c b/drivers/net/wireless/mac80211_hwsim.c
    441 index cbb3e902e347..0852a1aad075 100644
    442 --- a/drivers/net/wireless/mac80211_hwsim.c
    443 +++ b/drivers/net/wireless/mac80211_hwsim.c
    444 @@ -2633,6 +2633,10 @@ static int mac80211_hwsim_new_radio(struct genl_info *info,
    445 if (param->no_vif)
    446 ieee80211_hw_set(hw, NO_AUTO_VIF);
    447
    448 + tasklet_hrtimer_init(&data->beacon_timer,
    449 + mac80211_hwsim_beacon,
    450 + CLOCK_MONOTONIC, HRTIMER_MODE_ABS);
    451 +
    452 err = ieee80211_register_hw(hw);
    453 if (err < 0) {
    454 printk(KERN_DEBUG "mac80211_hwsim: ieee80211_register_hw failed (%d)\n",
    455 @@ -2657,10 +2661,6 @@ static int mac80211_hwsim_new_radio(struct genl_info *info,
    456 data->debugfs,
    457 data, &hwsim_simulate_radar);
    458
    459 - tasklet_hrtimer_init(&data->beacon_timer,
    460 - mac80211_hwsim_beacon,
    461 - CLOCK_MONOTONIC, HRTIMER_MODE_ABS);
    462 -
    463 spin_lock_bh(&hwsim_radio_lock);
    464 list_add_tail(&data->list, &hwsim_radios);
    465 spin_unlock_bh(&hwsim_radio_lock);
    466 diff --git a/drivers/s390/virtio/virtio_ccw.c b/drivers/s390/virtio/virtio_ccw.c
    467 index 8688ad4c825f..3493d449911c 100644
    468 --- a/drivers/s390/virtio/virtio_ccw.c
    469 +++ b/drivers/s390/virtio/virtio_ccw.c
    470 @@ -59,6 +59,7 @@ struct virtio_ccw_device {
    471 unsigned int revision; /* Transport revision */
    472 wait_queue_head_t wait_q;
    473 spinlock_t lock;
    474 + struct mutex io_lock; /* Serializes I/O requests */
    475 struct list_head virtqueues;
    476 unsigned long indicators;
    477 unsigned long indicators2;
    478 @@ -307,6 +308,7 @@ static int ccw_io_helper(struct virtio_ccw_device *vcdev,
    479 unsigned long flags;
    480 int flag = intparm & VIRTIO_CCW_INTPARM_MASK;
    481
    482 + mutex_lock(&vcdev->io_lock);
    483 do {
    484 spin_lock_irqsave(get_ccwdev_lock(vcdev->cdev), flags);
    485 ret = ccw_device_start(vcdev->cdev, ccw, intparm, 0, 0);
    486 @@ -319,7 +321,9 @@ static int ccw_io_helper(struct virtio_ccw_device *vcdev,
    487 cpu_relax();
    488 } while (ret == -EBUSY);
    489 wait_event(vcdev->wait_q, doing_io(vcdev, flag) == 0);
    490 - return ret ? ret : vcdev->err;
    491 + ret = ret ? ret : vcdev->err;
    492 + mutex_unlock(&vcdev->io_lock);
    493 + return ret;
    494 }
    495
    496 static void virtio_ccw_drop_indicator(struct virtio_ccw_device *vcdev,
    497 @@ -837,6 +841,7 @@ static void virtio_ccw_get_config(struct virtio_device *vdev,
    498 int ret;
    499 struct ccw1 *ccw;
    500 void *config_area;
    501 + unsigned long flags;
    502
    503 ccw = kzalloc(sizeof(*ccw), GFP_DMA | GFP_KERNEL);
    504 if (!ccw)
    505 @@ -855,11 +860,13 @@ static void virtio_ccw_get_config(struct virtio_device *vdev,
    506 if (ret)
    507 goto out_free;
    508
    509 + spin_lock_irqsave(&vcdev->lock, flags);
    510 memcpy(vcdev->config, config_area, offset + len);
    511 - if (buf)
    512 - memcpy(buf, &vcdev->config[offset], len);
    513 if (vcdev->config_ready < offset + len)
    514 vcdev->config_ready = offset + len;
    515 + spin_unlock_irqrestore(&vcdev->lock, flags);
    516 + if (buf)
    517 + memcpy(buf, config_area + offset, len);
    518
    519 out_free:
    520 kfree(config_area);
    521 @@ -873,6 +880,7 @@ static void virtio_ccw_set_config(struct virtio_device *vdev,
    522 struct virtio_ccw_device *vcdev = to_vc_device(vdev);
    523 struct ccw1 *ccw;
    524 void *config_area;
    525 + unsigned long flags;
    526
    527 ccw = kzalloc(sizeof(*ccw), GFP_DMA | GFP_KERNEL);
    528 if (!ccw)
    529 @@ -885,9 +893,11 @@ static void virtio_ccw_set_config(struct virtio_device *vdev,
    530 /* Make sure we don't overwrite fields. */
    531 if (vcdev->config_ready < offset)
    532 virtio_ccw_get_config(vdev, 0, NULL, offset);
    533 + spin_lock_irqsave(&vcdev->lock, flags);
    534 memcpy(&vcdev->config[offset], buf, len);
    535 /* Write the config area to the host. */
    536 memcpy(config_area, vcdev->config, sizeof(vcdev->config));
    537 + spin_unlock_irqrestore(&vcdev->lock, flags);
    538 ccw->cmd_code = CCW_CMD_WRITE_CONF;
    539 ccw->flags = 0;
    540 ccw->count = offset + len;
    541 @@ -1233,6 +1243,7 @@ static int virtio_ccw_online(struct ccw_device *cdev)
    542 init_waitqueue_head(&vcdev->wait_q);
    543 INIT_LIST_HEAD(&vcdev->virtqueues);
    544 spin_lock_init(&vcdev->lock);
    545 + mutex_init(&vcdev->io_lock);
    546
    547 spin_lock_irqsave(get_ccwdev_lock(cdev), flags);
    548 dev_set_drvdata(&cdev->dev, vcdev);
    549 diff --git a/drivers/scsi/sr_ioctl.c b/drivers/scsi/sr_ioctl.c
    550 index 03054c0e7689..3c3e8115f73d 100644
    551 --- a/drivers/scsi/sr_ioctl.c
    552 +++ b/drivers/scsi/sr_ioctl.c
    553 @@ -187,30 +187,25 @@ int sr_do_ioctl(Scsi_CD *cd, struct packet_command *cgc)
    554 struct scsi_device *SDev;
    555 struct scsi_sense_hdr sshdr;
    556 int result, err = 0, retries = 0;
    557 - struct request_sense *sense = cgc->sense;
    558 + unsigned char sense_buffer[SCSI_SENSE_BUFFERSIZE];
    559
    560 SDev = cd->device;
    561
    562 - if (!sense) {
    563 - sense = kmalloc(SCSI_SENSE_BUFFERSIZE, GFP_KERNEL);
    564 - if (!sense) {
    565 - err = -ENOMEM;
    566 - goto out;
    567 - }
    568 - }
    569 -
    570 retry:
    571 if (!scsi_block_when_processing_errors(SDev)) {
    572 err = -ENODEV;
    573 goto out;
    574 }
    575
    576 - memset(sense, 0, sizeof(*sense));
    577 + memset(sense_buffer, 0, sizeof(sense_buffer));
    578 result = scsi_execute(SDev, cgc->cmd, cgc->data_direction,
    579 - cgc->buffer, cgc->buflen, (char *)sense,
    580 + cgc->buffer, cgc->buflen, sense_buffer,
    581 cgc->timeout, IOCTL_RETRIES, 0, NULL);
    582
    583 - scsi_normalize_sense((char *)sense, sizeof(*sense), &sshdr);
    584 + scsi_normalize_sense(sense_buffer, sizeof(sense_buffer), &sshdr);
    585 +
    586 + if (cgc->sense)
    587 + memcpy(cgc->sense, sense_buffer, sizeof(*cgc->sense));
    588
    589 /* Minimal error checking. Ignore cases we know about, and report the rest. */
    590 if (driver_byte(result) != 0) {
    591 @@ -261,8 +256,6 @@ int sr_do_ioctl(Scsi_CD *cd, struct packet_command *cgc)
    592
    593 /* Wake up a process waiting for device */
    594 out:
    595 - if (!cgc->sense)
    596 - kfree(sense);
    597 cgc->stat = err;
    598 return err;
    599 }
    600 diff --git a/drivers/staging/lustre/lnet/lnet/config.c b/drivers/staging/lustre/lnet/lnet/config.c
    601 index 9e2183ff847e..7a4d5a013797 100644
    602 --- a/drivers/staging/lustre/lnet/lnet/config.c
    603 +++ b/drivers/staging/lustre/lnet/lnet/config.c
    604 @@ -354,8 +354,7 @@ lnet_parse_networks(struct list_head *nilist, char *networks)
    605 CERROR("Can't allocate net interface name\n");
    606 goto failed;
    607 }
    608 - strncpy(ni->ni_interfaces[niface], iface,
    609 - strlen(iface));
    610 + strcpy(ni->ni_interfaces[niface], iface);
    611 niface++;
    612 iface = comma;
    613 } while (iface);
    614 diff --git a/drivers/staging/lustre/lustre/lmv/lmv_obd.c b/drivers/staging/lustre/lustre/lmv/lmv_obd.c
    615 index 9e63171c1ec3..514f078749bb 100644
    616 --- a/drivers/staging/lustre/lustre/lmv/lmv_obd.c
    617 +++ b/drivers/staging/lustre/lustre/lmv/lmv_obd.c
    618 @@ -684,7 +684,7 @@ repeat_fid2path:
    619 memmove(ptr + strlen(gf->gf_path) + 1, ptr,
    620 strlen(ori_gf->gf_path));
    621
    622 - strncpy(ptr, gf->gf_path, strlen(gf->gf_path));
    623 + strcpy(ptr, gf->gf_path);
    624 ptr += strlen(gf->gf_path);
    625 *ptr = '/';
    626 }
    627 diff --git a/drivers/staging/rtl8712/mlme_linux.c b/drivers/staging/rtl8712/mlme_linux.c
    628 index af7c4a47738a..590d43c034e6 100644
    629 --- a/drivers/staging/rtl8712/mlme_linux.c
    630 +++ b/drivers/staging/rtl8712/mlme_linux.c
    631 @@ -158,7 +158,7 @@ void r8712_report_sec_ie(struct _adapter *adapter, u8 authmode, u8 *sec_ie)
    632 p = buff;
    633 p += sprintf(p, "ASSOCINFO(ReqIEs=");
    634 len = sec_ie[1] + 2;
    635 - len = (len < IW_CUSTOM_MAX) ? len : IW_CUSTOM_MAX - 1;
    636 + len = (len < IW_CUSTOM_MAX) ? len : IW_CUSTOM_MAX;
    637 for (i = 0; i < len; i++)
    638 p += sprintf(p, "%02x", sec_ie[i]);
    639 p += sprintf(p, ")");
    640 diff --git a/drivers/staging/rtl8712/rtl871x_mlme.c b/drivers/staging/rtl8712/rtl871x_mlme.c
    641 index c1feef3da26c..9a5da7f84524 100644
    642 --- a/drivers/staging/rtl8712/rtl871x_mlme.c
    643 +++ b/drivers/staging/rtl8712/rtl871x_mlme.c
    644 @@ -1365,7 +1365,7 @@ sint r8712_restruct_sec_ie(struct _adapter *adapter, u8 *in_ie,
    645 u8 *out_ie, uint in_len)
    646 {
    647 u8 authmode = 0, match;
    648 - u8 sec_ie[255], uncst_oui[4], bkup_ie[255];
    649 + u8 sec_ie[IW_CUSTOM_MAX], uncst_oui[4], bkup_ie[255];
    650 u8 wpa_oui[4] = {0x0, 0x50, 0xf2, 0x01};
    651 uint ielength, cnt, remove_cnt;
    652 int iEntry;
    653 diff --git a/drivers/tty/serial/8250/8250_mtk.c b/drivers/tty/serial/8250/8250_mtk.c
    654 index ce0cc471bfc3..91db9ca1c6c9 100644
    655 --- a/drivers/tty/serial/8250/8250_mtk.c
    656 +++ b/drivers/tty/serial/8250/8250_mtk.c
    657 @@ -225,17 +225,17 @@ static int mtk8250_probe(struct platform_device *pdev)
    658
    659 platform_set_drvdata(pdev, data);
    660
    661 - pm_runtime_enable(&pdev->dev);
    662 - if (!pm_runtime_enabled(&pdev->dev)) {
    663 - err = mtk8250_runtime_resume(&pdev->dev);
    664 - if (err)
    665 - return err;
    666 - }
    667 + err = mtk8250_runtime_resume(&pdev->dev);
    668 + if (err)
    669 + return err;
    670
    671 data->line = serial8250_register_8250_port(&uart);
    672 if (data->line < 0)
    673 return data->line;
    674
    675 + pm_runtime_set_active(&pdev->dev);
    676 + pm_runtime_enable(&pdev->dev);
    677 +
    678 return 0;
    679 }
    680
    681 @@ -246,13 +246,11 @@ static int mtk8250_remove(struct platform_device *pdev)
    682 pm_runtime_get_sync(&pdev->dev);
    683
    684 serial8250_unregister_port(data->line);
    685 + mtk8250_runtime_suspend(&pdev->dev);
    686
    687 pm_runtime_disable(&pdev->dev);
    688 pm_runtime_put_noidle(&pdev->dev);
    689
    690 - if (!pm_runtime_status_suspended(&pdev->dev))
    691 - mtk8250_runtime_suspend(&pdev->dev);
    692 -
    693 return 0;
    694 }
    695
    696 diff --git a/drivers/tty/serial/kgdboc.c b/drivers/tty/serial/kgdboc.c
    697 index c448225ef5ca..f2b0d8cee8ef 100644
    698 --- a/drivers/tty/serial/kgdboc.c
    699 +++ b/drivers/tty/serial/kgdboc.c
    700 @@ -232,7 +232,7 @@ static void kgdboc_put_char(u8 chr)
    701
    702 static int param_set_kgdboc_var(const char *kmessage, struct kernel_param *kp)
    703 {
    704 - int len = strlen(kmessage);
    705 + size_t len = strlen(kmessage);
    706
    707 if (len >= MAX_CONFIG_LEN) {
    708 printk(KERN_ERR "kgdboc: config string too long\n");
    709 @@ -254,7 +254,7 @@ static int param_set_kgdboc_var(const char *kmessage, struct kernel_param *kp)
    710
    711 strcpy(config, kmessage);
    712 /* Chop out \n char as a result of echo */
    713 - if (config[len - 1] == '\n')
    714 + if (len && config[len - 1] == '\n')
    715 config[len - 1] = '\0';
    716
    717 if (configured == 1)
    718 diff --git a/drivers/tty/tty_port.c b/drivers/tty/tty_port.c
    719 index c3f9d93ba227..7f2f20b74d1d 100644
    720 --- a/drivers/tty/tty_port.c
    721 +++ b/drivers/tty/tty_port.c
    722 @@ -531,7 +531,8 @@ void tty_port_close(struct tty_port *port, struct tty_struct *tty,
    723 if (tty_port_close_start(port, tty, filp) == 0)
    724 return;
    725 tty_port_shutdown(port, tty);
    726 - set_bit(TTY_IO_ERROR, &tty->flags);
    727 + if (!port->console)
    728 + set_bit(TTY_IO_ERROR, &tty->flags);
    729 tty_port_close_end(port, tty);
    730 tty_port_tty_set(port, NULL);
    731 }
    732 diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c
    733 index 851f5a553de2..67679f619c3b 100644
    734 --- a/drivers/usb/core/hub.c
    735 +++ b/drivers/usb/core/hub.c
    736 @@ -2225,7 +2225,7 @@ static int usb_enumerate_device_otg(struct usb_device *udev)
    737 /* descriptor may appear anywhere in config */
    738 err = __usb_get_extra_descriptor(udev->rawdescriptors[0],
    739 le16_to_cpu(udev->config[0].desc.wTotalLength),
    740 - USB_DT_OTG, (void **) &desc);
    741 + USB_DT_OTG, (void **) &desc, sizeof(*desc));
    742 if (err || !(desc->bmAttributes & USB_OTG_HNP))
    743 return 0;
    744
    745 diff --git a/drivers/usb/core/quirks.c b/drivers/usb/core/quirks.c
    746 index 808437c5ec49..cf378b1ed373 100644
    747 --- a/drivers/usb/core/quirks.c
    748 +++ b/drivers/usb/core/quirks.c
    749 @@ -188,6 +188,10 @@ static const struct usb_device_id usb_quirk_list[] = {
    750 /* Midiman M-Audio Keystation 88es */
    751 { USB_DEVICE(0x0763, 0x0192), .driver_info = USB_QUIRK_RESET_RESUME },
    752
    753 + /* SanDisk Ultra Fit and Ultra Flair */
    754 + { USB_DEVICE(0x0781, 0x5583), .driver_info = USB_QUIRK_NO_LPM },
    755 + { USB_DEVICE(0x0781, 0x5591), .driver_info = USB_QUIRK_NO_LPM },
    756 +
    757 /* M-Systems Flash Disk Pioneers */
    758 { USB_DEVICE(0x08ec, 0x1000), .driver_info = USB_QUIRK_RESET_RESUME },
    759
    760 diff --git a/drivers/usb/core/usb.c b/drivers/usb/core/usb.c
    761 index 891261b43c67..f3996ba71a59 100644
    762 --- a/drivers/usb/core/usb.c
    763 +++ b/drivers/usb/core/usb.c
    764 @@ -696,14 +696,14 @@ EXPORT_SYMBOL_GPL(usb_get_current_frame_number);
    765 */
    766
    767 int __usb_get_extra_descriptor(char *buffer, unsigned size,
    768 - unsigned char type, void **ptr)
    769 + unsigned char type, void **ptr, size_t minsize)
    770 {
    771 struct usb_descriptor_header *header;
    772
    773 while (size >= sizeof(struct usb_descriptor_header)) {
    774 header = (struct usb_descriptor_header *)buffer;
    775
    776 - if (header->bLength < 2) {
    777 + if (header->bLength < 2 || header->bLength > size) {
    778 printk(KERN_ERR
    779 "%s: bogus descriptor, type %d length %d\n",
    780 usbcore_name,
    781 @@ -712,7 +712,7 @@ int __usb_get_extra_descriptor(char *buffer, unsigned size,
    782 return -1;
    783 }
    784
    785 - if (header->bDescriptorType == type) {
    786 + if (header->bDescriptorType == type && header->bLength >= minsize) {
    787 *ptr = header;
    788 return 0;
    789 }
    790 diff --git a/drivers/usb/host/hwa-hc.c b/drivers/usb/host/hwa-hc.c
    791 index 1db0626c8bf4..97750f162f01 100644
    792 --- a/drivers/usb/host/hwa-hc.c
    793 +++ b/drivers/usb/host/hwa-hc.c
    794 @@ -654,7 +654,7 @@ static int hwahc_security_create(struct hwahc *hwahc)
    795 top = itr + itr_size;
    796 result = __usb_get_extra_descriptor(usb_dev->rawdescriptors[index],
    797 le16_to_cpu(usb_dev->actconfig->desc.wTotalLength),
    798 - USB_DT_SECURITY, (void **) &secd);
    799 + USB_DT_SECURITY, (void **) &secd, sizeof(*secd));
    800 if (result == -1) {
    801 dev_warn(dev, "BUG? WUSB host has no security descriptors\n");
    802 return 0;
    803 diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c
    804 index e9f5f9c32b49..7ff32088cfa4 100644
    805 --- a/drivers/usb/host/xhci.c
    806 +++ b/drivers/usb/host/xhci.c
    807 @@ -4398,6 +4398,14 @@ static u16 xhci_calculate_u1_timeout(struct xhci_hcd *xhci,
    808 {
    809 unsigned long long timeout_ns;
    810
    811 + /* Prevent U1 if service interval is shorter than U1 exit latency */
    812 + if (usb_endpoint_xfer_int(desc) || usb_endpoint_xfer_isoc(desc)) {
    813 + if (xhci_service_interval_to_ns(desc) <= udev->u1_params.mel) {
    814 + dev_dbg(&udev->dev, "Disable U1, ESIT shorter than exit latency\n");
    815 + return USB3_LPM_DISABLED;
    816 + }
    817 + }
    818 +
    819 if (xhci->quirks & XHCI_INTEL_HOST)
    820 timeout_ns = xhci_calculate_intel_u1_timeout(udev, desc);
    821 else
    822 @@ -4454,6 +4462,14 @@ static u16 xhci_calculate_u2_timeout(struct xhci_hcd *xhci,
    823 {
    824 unsigned long long timeout_ns;
    825
    826 + /* Prevent U2 if service interval is shorter than U2 exit latency */
    827 + if (usb_endpoint_xfer_int(desc) || usb_endpoint_xfer_isoc(desc)) {
    828 + if (xhci_service_interval_to_ns(desc) <= udev->u2_params.mel) {
    829 + dev_dbg(&udev->dev, "Disable U2, ESIT shorter than exit latency\n");
    830 + return USB3_LPM_DISABLED;
    831 + }
    832 + }
    833 +
    834 if (xhci->quirks & XHCI_INTEL_HOST)
    835 timeout_ns = xhci_calculate_intel_u2_timeout(udev, desc);
    836 else
    837 diff --git a/drivers/usb/misc/appledisplay.c b/drivers/usb/misc/appledisplay.c
    838 index 2d3c656e0bff..b8092bcf89a2 100644
    839 --- a/drivers/usb/misc/appledisplay.c
    840 +++ b/drivers/usb/misc/appledisplay.c
    841 @@ -64,6 +64,7 @@ static const struct usb_device_id appledisplay_table[] = {
    842 { APPLEDISPLAY_DEVICE(0x921c) },
    843 { APPLEDISPLAY_DEVICE(0x921d) },
    844 { APPLEDISPLAY_DEVICE(0x9222) },
    845 + { APPLEDISPLAY_DEVICE(0x9226) },
    846 { APPLEDISPLAY_DEVICE(0x9236) },
    847
    848 /* Terminating entry */
    849 diff --git a/drivers/vhost/vsock.c b/drivers/vhost/vsock.c
    850 index 0ec970ca64ce..f800f89068db 100644
    851 --- a/drivers/vhost/vsock.c
    852 +++ b/drivers/vhost/vsock.c
    853 @@ -15,6 +15,7 @@
    854 #include <net/sock.h>
    855 #include <linux/virtio_vsock.h>
    856 #include <linux/vhost.h>
    857 +#include <linux/hashtable.h>
    858
    859 #include <net/af_vsock.h>
    860 #include "vhost.h"
    861 @@ -27,14 +28,14 @@ enum {
    862
    863 /* Used to track all the vhost_vsock instances on the system. */
    864 static DEFINE_SPINLOCK(vhost_vsock_lock);
    865 -static LIST_HEAD(vhost_vsock_list);
    866 +static DEFINE_READ_MOSTLY_HASHTABLE(vhost_vsock_hash, 8);
    867
    868 struct vhost_vsock {
    869 struct vhost_dev dev;
    870 struct vhost_virtqueue vqs[2];
    871
    872 - /* Link to global vhost_vsock_list, protected by vhost_vsock_lock */
    873 - struct list_head list;
    874 + /* Link to global vhost_vsock_hash, writes use vhost_vsock_lock */
    875 + struct hlist_node hash;
    876
    877 struct vhost_work send_pkt_work;
    878 spinlock_t send_pkt_list_lock;
    879 @@ -50,12 +51,14 @@ static u32 vhost_transport_get_local_cid(void)
    880 return VHOST_VSOCK_DEFAULT_HOST_CID;
    881 }
    882
    883 +/* Callers that dereference the return value must hold vhost_vsock_lock or the
    884 + * RCU read lock.
    885 + */
    886 static struct vhost_vsock *vhost_vsock_get(u32 guest_cid)
    887 {
    888 struct vhost_vsock *vsock;
    889
    890 - spin_lock_bh(&vhost_vsock_lock);
    891 - list_for_each_entry(vsock, &vhost_vsock_list, list) {
    892 + hash_for_each_possible_rcu(vhost_vsock_hash, vsock, hash, guest_cid) {
    893 u32 other_cid = vsock->guest_cid;
    894
    895 /* Skip instances that have no CID yet */
    896 @@ -63,11 +66,9 @@ static struct vhost_vsock *vhost_vsock_get(u32 guest_cid)
    897 continue;
    898
    899 if (other_cid == guest_cid) {
    900 - spin_unlock_bh(&vhost_vsock_lock);
    901 return vsock;
    902 }
    903 }
    904 - spin_unlock_bh(&vhost_vsock_lock);
    905
    906 return NULL;
    907 }
    908 @@ -198,9 +199,12 @@ vhost_transport_send_pkt(struct virtio_vsock_pkt *pkt)
    909 struct vhost_virtqueue *vq;
    910 int len = pkt->len;
    911
    912 + rcu_read_lock();
    913 +
    914 /* Find the vhost_vsock according to guest context id */
    915 vsock = vhost_vsock_get(le64_to_cpu(pkt->hdr.dst_cid));
    916 if (!vsock) {
    917 + rcu_read_unlock();
    918 virtio_transport_free_pkt(pkt);
    919 return -ENODEV;
    920 }
    921 @@ -215,6 +219,8 @@ vhost_transport_send_pkt(struct virtio_vsock_pkt *pkt)
    922 spin_unlock_bh(&vsock->send_pkt_list_lock);
    923
    924 vhost_work_queue(&vsock->dev, &vsock->send_pkt_work);
    925 +
    926 + rcu_read_unlock();
    927 return len;
    928 }
    929
    930 @@ -224,12 +230,15 @@ vhost_transport_cancel_pkt(struct vsock_sock *vsk)
    931 struct vhost_vsock *vsock;
    932 struct virtio_vsock_pkt *pkt, *n;
    933 int cnt = 0;
    934 + int ret = -ENODEV;
    935 LIST_HEAD(freeme);
    936
    937 + rcu_read_lock();
    938 +
    939 /* Find the vhost_vsock according to guest context id */
    940 vsock = vhost_vsock_get(vsk->remote_addr.svm_cid);
    941 if (!vsock)
    942 - return -ENODEV;
    943 + goto out;
    944
    945 spin_lock_bh(&vsock->send_pkt_list_lock);
    946 list_for_each_entry_safe(pkt, n, &vsock->send_pkt_list, list) {
    947 @@ -255,7 +264,10 @@ vhost_transport_cancel_pkt(struct vsock_sock *vsk)
    948 vhost_poll_queue(&tx_vq->poll);
    949 }
    950
    951 - return 0;
    952 + ret = 0;
    953 +out:
    954 + rcu_read_unlock();
    955 + return ret;
    956 }
    957
    958 static struct virtio_vsock_pkt *
    959 @@ -521,10 +533,6 @@ static int vhost_vsock_dev_open(struct inode *inode, struct file *file)
    960 spin_lock_init(&vsock->send_pkt_list_lock);
    961 INIT_LIST_HEAD(&vsock->send_pkt_list);
    962 vhost_work_init(&vsock->send_pkt_work, vhost_transport_send_pkt_work);
    963 -
    964 - spin_lock_bh(&vhost_vsock_lock);
    965 - list_add_tail(&vsock->list, &vhost_vsock_list);
    966 - spin_unlock_bh(&vhost_vsock_lock);
    967 return 0;
    968
    969 out:
    970 @@ -565,9 +573,13 @@ static int vhost_vsock_dev_release(struct inode *inode, struct file *file)
    971 struct vhost_vsock *vsock = file->private_data;
    972
    973 spin_lock_bh(&vhost_vsock_lock);
    974 - list_del(&vsock->list);
    975 + if (vsock->guest_cid)
    976 + hash_del_rcu(&vsock->hash);
    977 spin_unlock_bh(&vhost_vsock_lock);
    978
    979 + /* Wait for other CPUs to finish using vsock */
    980 + synchronize_rcu();
    981 +
    982 /* Iterating over all connections for all CIDs to find orphans is
    983 * inefficient. Room for improvement here. */
    984 vsock_for_each_connected_socket(vhost_vsock_reset_orphans);
    985 @@ -607,12 +619,18 @@ static int vhost_vsock_set_cid(struct vhost_vsock *vsock, u64 guest_cid)
    986 return -EINVAL;
    987
    988 /* Refuse if CID is already in use */
    989 + spin_lock_bh(&vhost_vsock_lock);
    990 other = vhost_vsock_get(guest_cid);
    991 - if (other && other != vsock)
    992 + if (other && other != vsock) {
    993 + spin_unlock_bh(&vhost_vsock_lock);
    994 return -EADDRINUSE;
    995 + }
    996 +
    997 + if (vsock->guest_cid)
    998 + hash_del_rcu(&vsock->hash);
    999
    1000 - spin_lock_bh(&vhost_vsock_lock);
    1001 vsock->guest_cid = guest_cid;
    1002 + hash_add_rcu(vhost_vsock_hash, &vsock->hash, guest_cid);
    1003 spin_unlock_bh(&vhost_vsock_lock);
    1004
    1005 return 0;
    1006 diff --git a/fs/cifs/dir.c b/fs/cifs/dir.c
    1007 index 331ddd07e505..e98e24eaa6a8 100644
    1008 --- a/fs/cifs/dir.c
    1009 +++ b/fs/cifs/dir.c
    1010 @@ -163,7 +163,7 @@ cifs_bp_rename_retry:
    1011
    1012 cifs_dbg(FYI, "using cifs_sb prepath <%s>\n", cifs_sb->prepath);
    1013 memcpy(full_path+dfsplen+1, cifs_sb->prepath, pplen-1);
    1014 - full_path[dfsplen] = '\\';
    1015 + full_path[dfsplen] = dirsep;
    1016 for (i = 0; i < pplen-1; i++)
    1017 if (full_path[dfsplen+1+i] == '/')
    1018 full_path[dfsplen+1+i] = CIFS_DIR_SEP(cifs_sb);
    1019 diff --git a/include/linux/usb.h b/include/linux/usb.h
    1020 index eba1f10e8cfd..346665a0c49d 100644
    1021 --- a/include/linux/usb.h
    1022 +++ b/include/linux/usb.h
    1023 @@ -336,11 +336,11 @@ struct usb_host_bos {
    1024 };
    1025
    1026 int __usb_get_extra_descriptor(char *buffer, unsigned size,
    1027 - unsigned char type, void **ptr);
    1028 + unsigned char type, void **ptr, size_t min);
    1029 #define usb_get_extra_descriptor(ifpoint, type, ptr) \
    1030 __usb_get_extra_descriptor((ifpoint)->extra, \
    1031 (ifpoint)->extralen, \
    1032 - type, (void **)ptr)
    1033 + type, (void **)ptr, sizeof(**(ptr)))
    1034
    1035 /* ----------------------------------------------------------------------- */
    1036
    1037 diff --git a/include/sound/pcm_params.h b/include/sound/pcm_params.h
    1038 index c704357775fc..2af7bb3ee57d 100644
    1039 --- a/include/sound/pcm_params.h
    1040 +++ b/include/sound/pcm_params.h
    1041 @@ -247,11 +247,13 @@ static inline int snd_interval_empty(const struct snd_interval *i)
    1042 static inline int snd_interval_single(const struct snd_interval *i)
    1043 {
    1044 return (i->min == i->max ||
    1045 - (i->min + 1 == i->max && i->openmax));
    1046 + (i->min + 1 == i->max && (i->openmin || i->openmax)));
    1047 }
    1048
    1049 static inline int snd_interval_value(const struct snd_interval *i)
    1050 {
    1051 + if (i->openmin && !i->openmax)
    1052 + return i->max;
    1053 return i->min;
    1054 }
    1055
    1056 diff --git a/lib/swiotlb.c b/lib/swiotlb.c
    1057 index b7812df04437..7ff9dc36c2f8 100644
    1058 --- a/lib/swiotlb.c
    1059 +++ b/lib/swiotlb.c
    1060 @@ -17,6 +17,8 @@
    1061 * 08/12/11 beckyb Add highmem support
    1062 */
    1063
    1064 +#define pr_fmt(fmt) "software IO TLB: " fmt
    1065 +
    1066 #include <linux/cache.h>
    1067 #include <linux/dma-mapping.h>
    1068 #include <linux/mm.h>
    1069 @@ -147,20 +149,16 @@ static bool no_iotlb_memory;
    1070 void swiotlb_print_info(void)
    1071 {
    1072 unsigned long bytes = io_tlb_nslabs << IO_TLB_SHIFT;
    1073 - unsigned char *vstart, *vend;
    1074
    1075 if (no_iotlb_memory) {
    1076 - pr_warn("software IO TLB: No low mem\n");
    1077 + pr_warn("No low mem\n");
    1078 return;
    1079 }
    1080
    1081 - vstart = phys_to_virt(io_tlb_start);
    1082 - vend = phys_to_virt(io_tlb_end);
    1083 -
    1084 - printk(KERN_INFO "software IO TLB [mem %#010llx-%#010llx] (%luMB) mapped at [%p-%p]\n",
    1085 + pr_info("mapped [mem %#010llx-%#010llx] (%luMB)\n",
    1086 (unsigned long long)io_tlb_start,
    1087 (unsigned long long)io_tlb_end,
    1088 - bytes >> 20, vstart, vend - 1);
    1089 + bytes >> 20);
    1090 }
    1091
    1092 int __init swiotlb_init_with_tbl(char *tlb, unsigned long nslabs, int verbose)
    1093 @@ -234,7 +232,7 @@ swiotlb_init(int verbose)
    1094 if (io_tlb_start)
    1095 memblock_free_early(io_tlb_start,
    1096 PAGE_ALIGN(io_tlb_nslabs << IO_TLB_SHIFT));
    1097 - pr_warn("Cannot allocate SWIOTLB buffer");
    1098 + pr_warn("Cannot allocate buffer");
    1099 no_iotlb_memory = true;
    1100 }
    1101
    1102 @@ -276,8 +274,8 @@ swiotlb_late_init_with_default_size(size_t default_size)
    1103 return -ENOMEM;
    1104 }
    1105 if (order != get_order(bytes)) {
    1106 - printk(KERN_WARNING "Warning: only able to allocate %ld MB "
    1107 - "for software IO TLB\n", (PAGE_SIZE << order) >> 20);
    1108 + pr_warn("only able to allocate %ld MB\n",
    1109 + (PAGE_SIZE << order) >> 20);
    1110 io_tlb_nslabs = SLABS_PER_PAGE << order;
    1111 }
    1112 rc = swiotlb_late_init_with_tbl(vstart, io_tlb_nslabs);
    1113 @@ -691,7 +689,7 @@ swiotlb_alloc_coherent(struct device *hwdev, size_t size,
    1114 return ret;
    1115
    1116 err_warn:
    1117 - pr_warn("swiotlb: coherent allocation failed for device %s size=%zu\n",
    1118 + pr_warn("coherent allocation failed for device %s size=%zu\n",
    1119 dev_name(hwdev), size);
    1120 dump_stack();
    1121
    1122 diff --git a/mm/page_alloc.c b/mm/page_alloc.c
    1123 index 28240ce475d6..3af727d95c17 100644
    1124 --- a/mm/page_alloc.c
    1125 +++ b/mm/page_alloc.c
    1126 @@ -3530,8 +3530,6 @@ __alloc_pages_slowpath(gfp_t gfp_mask, unsigned int order,
    1127 enum compact_result compact_result;
    1128 int compaction_retries;
    1129 int no_progress_loops;
    1130 - unsigned long alloc_start = jiffies;
    1131 - unsigned int stall_timeout = 10 * HZ;
    1132 unsigned int cpuset_mems_cookie;
    1133
    1134 /*
    1135 @@ -3704,14 +3702,6 @@ retry:
    1136 if (order > PAGE_ALLOC_COSTLY_ORDER && !(gfp_mask & __GFP_REPEAT))
    1137 goto nopage;
    1138
    1139 - /* Make sure we know about allocations which stall for too long */
    1140 - if (time_after(jiffies, alloc_start + stall_timeout)) {
    1141 - warn_alloc(gfp_mask,
    1142 - "page allocation stalls for %ums, order:%u",
    1143 - jiffies_to_msecs(jiffies-alloc_start), order);
    1144 - stall_timeout += 10 * HZ;
    1145 - }
    1146 -
    1147 if (should_reclaim_retry(gfp_mask, order, ac, alloc_flags,
    1148 did_some_progress > 0, &no_progress_loops))
    1149 goto retry;
    1150 diff --git a/net/batman-adv/fragmentation.c b/net/batman-adv/fragmentation.c
    1151 index 57215e3fd1a0..a06b6041f3e0 100644
    1152 --- a/net/batman-adv/fragmentation.c
    1153 +++ b/net/batman-adv/fragmentation.c
    1154 @@ -264,7 +264,7 @@ batadv_frag_merge_packets(struct hlist_head *chain)
    1155 kfree(entry);
    1156
    1157 packet = (struct batadv_frag_packet *)skb_out->data;
    1158 - size = ntohs(packet->total_size);
    1159 + size = ntohs(packet->total_size) + hdr_size;
    1160
    1161 /* Make room for the rest of the fragments. */
    1162 if (pskb_expand_head(skb_out, 0, size - skb_out->len, GFP_ATOMIC) < 0) {
    1163 diff --git a/net/mac80211/iface.c b/net/mac80211/iface.c
    1164 index 760ba8ec2944..5768560cbfc3 100644
    1165 --- a/net/mac80211/iface.c
    1166 +++ b/net/mac80211/iface.c
    1167 @@ -1025,6 +1025,8 @@ static void ieee80211_do_stop(struct ieee80211_sub_if_data *sdata,
    1168 if (local->open_count == 0)
    1169 ieee80211_clear_tx_pending(local);
    1170
    1171 + sdata->vif.bss_conf.beacon_int = 0;
    1172 +
    1173 /*
    1174 * If the interface goes down while suspended, presumably because
    1175 * the device was unplugged and that happens before our resume,
    1176 diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c
    1177 index 474655a2aeae..93c332737e86 100644
    1178 --- a/net/mac80211/rx.c
    1179 +++ b/net/mac80211/rx.c
    1180 @@ -1230,6 +1230,7 @@ ieee80211_rx_h_check_dup(struct ieee80211_rx_data *rx)
    1181 return RX_CONTINUE;
    1182
    1183 if (ieee80211_is_ctl(hdr->frame_control) ||
    1184 + ieee80211_is_nullfunc(hdr->frame_control) ||
    1185 ieee80211_is_qos_nullfunc(hdr->frame_control) ||
    1186 is_multicast_ether_addr(hdr->addr1))
    1187 return RX_CONTINUE;
    1188 diff --git a/net/mac80211/status.c b/net/mac80211/status.c
    1189 index 7892bac21eac..246d113bd755 100644
    1190 --- a/net/mac80211/status.c
    1191 +++ b/net/mac80211/status.c
    1192 @@ -660,6 +660,8 @@ void ieee80211_tx_status_noskb(struct ieee80211_hw *hw,
    1193 /* Track when last TDLS packet was ACKed */
    1194 if (test_sta_flag(sta, WLAN_STA_TDLS_PEER_AUTH))
    1195 sta->status_stats.last_tdls_pkt_time = jiffies;
    1196 + } else if (test_sta_flag(sta, WLAN_STA_PS_STA)) {
    1197 + return;
    1198 } else {
    1199 ieee80211_lost_packet(sta, info);
    1200 }
    1201 diff --git a/net/mac80211/tx.c b/net/mac80211/tx.c
    1202 index 58fba4e569e6..6a0fb9dbc1ba 100644
    1203 --- a/net/mac80211/tx.c
    1204 +++ b/net/mac80211/tx.c
    1205 @@ -434,8 +434,8 @@ ieee80211_tx_h_multicast_ps_buf(struct ieee80211_tx_data *tx)
    1206 if (ieee80211_hw_check(&tx->local->hw, QUEUE_CONTROL))
    1207 info->hw_queue = tx->sdata->vif.cab_queue;
    1208
    1209 - /* no stations in PS mode */
    1210 - if (!atomic_read(&ps->num_sta_ps))
    1211 + /* no stations in PS mode and no buffered packets */
    1212 + if (!atomic_read(&ps->num_sta_ps) && skb_queue_empty(&ps->bc_buf))
    1213 return TX_CONTINUE;
    1214
    1215 info->flags |= IEEE80211_TX_CTL_SEND_AFTER_DTIM;
    1216 diff --git a/net/sunrpc/auth_gss/auth_gss.c b/net/sunrpc/auth_gss/auth_gss.c
    1217 index 16cea00c959b..591d378d1a18 100644
    1218 --- a/net/sunrpc/auth_gss/auth_gss.c
    1219 +++ b/net/sunrpc/auth_gss/auth_gss.c
    1220 @@ -1736,6 +1736,7 @@ priv_release_snd_buf(struct rpc_rqst *rqstp)
    1221 for (i=0; i < rqstp->rq_enc_pages_num; i++)
    1222 __free_page(rqstp->rq_enc_pages[i]);
    1223 kfree(rqstp->rq_enc_pages);
    1224 + rqstp->rq_release_snd_buf = NULL;
    1225 }
    1226
    1227 static int
    1228 @@ -1744,6 +1745,9 @@ alloc_enc_pages(struct rpc_rqst *rqstp)
    1229 struct xdr_buf *snd_buf = &rqstp->rq_snd_buf;
    1230 int first, last, i;
    1231
    1232 + if (rqstp->rq_release_snd_buf)
    1233 + rqstp->rq_release_snd_buf(rqstp);
    1234 +
    1235 if (snd_buf->page_len == 0) {
    1236 rqstp->rq_enc_pages_num = 0;
    1237 return 0;
    1238 diff --git a/scripts/Kbuild.include b/scripts/Kbuild.include
    1239 index 123840d827e8..7f430778f418 100644
    1240 --- a/scripts/Kbuild.include
    1241 +++ b/scripts/Kbuild.include
    1242 @@ -162,12 +162,13 @@ cc-ifversion = $(shell [ $(cc-version) $(1) $(2) ] && echo $(3) || echo $(4))
    1243 # cc-ldoption
    1244 # Usage: ldflags += $(call cc-ldoption, -Wl$(comma)--hash-style=both)
    1245 cc-ldoption = $(call try-run,\
    1246 - $(CC) $(1) -nostdlib -x c /dev/null -o "$$TMP",$(1),$(2))
    1247 + $(CC) $(1) $(KBUILD_CPPFLAGS) $(CC_OPTION_CFLAGS) -nostdlib -x c /dev/null -o "$$TMP",$(1),$(2))
    1248
    1249 # ld-option
    1250 # Usage: LDFLAGS += $(call ld-option, -X)
    1251 ld-option = $(call try-run,\
    1252 - $(CC) -x c /dev/null -c -o "$$TMPO" ; $(LD) $(1) "$$TMPO" -o "$$TMP",$(1),$(2))
    1253 + $(CC) $(KBUILD_CPPFLAGS) $(CC_OPTION_CFLAGS) -x c /dev/null -c -o "$$TMPO"; \
    1254 + $(LD) $(LDFLAGS) $(1) "$$TMPO" -o "$$TMP",$(1),$(2))
    1255
    1256 # ar-option
    1257 # Usage: KBUILD_ARFLAGS := $(call ar-option,D)
    1258 diff --git a/sound/core/pcm_native.c b/sound/core/pcm_native.c
    1259 index 79018697b477..3586ab41dec4 100644
    1260 --- a/sound/core/pcm_native.c
    1261 +++ b/sound/core/pcm_native.c
    1262 @@ -35,6 +35,7 @@
    1263 #include <sound/timer.h>
    1264 #include <sound/minors.h>
    1265 #include <linux/uio.h>
    1266 +#include <linux/delay.h>
    1267
    1268 /*
    1269 * Compatibility
    1270 @@ -78,12 +79,12 @@ static DECLARE_RWSEM(snd_pcm_link_rwsem);
    1271 * and this may lead to a deadlock when the code path takes read sem
    1272 * twice (e.g. one in snd_pcm_action_nonatomic() and another in
    1273 * snd_pcm_stream_lock()). As a (suboptimal) workaround, let writer to
    1274 - * spin until it gets the lock.
    1275 + * sleep until all the readers are completed without blocking by writer.
    1276 */
    1277 -static inline void down_write_nonblock(struct rw_semaphore *lock)
    1278 +static inline void down_write_nonfifo(struct rw_semaphore *lock)
    1279 {
    1280 while (!down_write_trylock(lock))
    1281 - cond_resched();
    1282 + msleep(1);
    1283 }
    1284
    1285 /**
    1286 @@ -1825,7 +1826,7 @@ static int snd_pcm_link(struct snd_pcm_substream *substream, int fd)
    1287 res = -ENOMEM;
    1288 goto _nolock;
    1289 }
    1290 - down_write_nonblock(&snd_pcm_link_rwsem);
    1291 + down_write_nonfifo(&snd_pcm_link_rwsem);
    1292 write_lock_irq(&snd_pcm_link_rwlock);
    1293 if (substream->runtime->status->state == SNDRV_PCM_STATE_OPEN ||
    1294 substream->runtime->status->state != substream1->runtime->status->state ||
    1295 @@ -1872,7 +1873,7 @@ static int snd_pcm_unlink(struct snd_pcm_substream *substream)
    1296 struct snd_pcm_substream *s;
    1297 int res = 0;
    1298
    1299 - down_write_nonblock(&snd_pcm_link_rwsem);
    1300 + down_write_nonfifo(&snd_pcm_link_rwsem);
    1301 write_lock_irq(&snd_pcm_link_rwlock);
    1302 if (!snd_pcm_stream_linked(substream)) {
    1303 res = -EALREADY;
    1304 @@ -2224,7 +2225,8 @@ int snd_pcm_hw_constraints_complete(struct snd_pcm_substream *substream)
    1305
    1306 static void pcm_release_private(struct snd_pcm_substream *substream)
    1307 {
    1308 - snd_pcm_unlink(substream);
    1309 + if (snd_pcm_stream_linked(substream))
    1310 + snd_pcm_unlink(substream);
    1311 }
    1312
    1313 void snd_pcm_release_substream(struct snd_pcm_substream *substream)
    1314 diff --git a/sound/pci/hda/hda_intel.c b/sound/pci/hda/hda_intel.c
    1315 index 3557e3943ad5..fcd583efe011 100644
    1316 --- a/sound/pci/hda/hda_intel.c
    1317 +++ b/sound/pci/hda/hda_intel.c
    1318 @@ -2352,6 +2352,10 @@ static const struct pci_device_id azx_ids[] = {
    1319 /* AMD Hudson */
    1320 { PCI_DEVICE(0x1022, 0x780d),
    1321 .driver_data = AZX_DRIVER_GENERIC | AZX_DCAPS_PRESET_ATI_SB },
    1322 + /* AMD Stoney */
    1323 + { PCI_DEVICE(0x1022, 0x157a),
    1324 + .driver_data = AZX_DRIVER_GENERIC | AZX_DCAPS_PRESET_ATI_SB |
    1325 + AZX_DCAPS_PM_RUNTIME },
    1326 /* AMD Raven */
    1327 { PCI_DEVICE(0x1022, 0x15e3),
    1328 .driver_data = AZX_DRIVER_GENERIC | AZX_DCAPS_PRESET_ATI_SB |
    1329 diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
    1330 index 6c2668b4e3bc..0fd31cff483e 100644
    1331 --- a/sound/pci/hda/patch_realtek.c
    1332 +++ b/sound/pci/hda/patch_realtek.c
    1333 @@ -4489,9 +4489,18 @@ static void alc_fixup_tpt470_dock(struct hda_codec *codec,
    1334 { 0x19, 0x21a11010 }, /* dock mic */
    1335 { }
    1336 };
    1337 + /* Assure the speaker pin to be coupled with DAC NID 0x03; otherwise
    1338 + * the speaker output becomes too low by some reason on Thinkpads with
    1339 + * ALC298 codec
    1340 + */
    1341 + static hda_nid_t preferred_pairs[] = {
    1342 + 0x14, 0x03, 0x17, 0x02, 0x21, 0x02,
    1343 + 0
    1344 + };
    1345 struct alc_spec *spec = codec->spec;
    1346
    1347 if (action == HDA_FIXUP_ACT_PRE_PROBE) {
    1348 + spec->gen.preferred_dacs = preferred_pairs;
    1349 spec->parse_flags = HDA_PINCFG_NO_HP_FIXUP;
    1350 snd_hda_apply_pincfgs(codec, pincfgs);
    1351 } else if (action == HDA_FIXUP_ACT_INIT) {
    1352 diff --git a/sound/usb/card.c b/sound/usb/card.c
    1353 index 8906199a83e6..549b9b061694 100644
    1354 --- a/sound/usb/card.c
    1355 +++ b/sound/usb/card.c
    1356 @@ -644,9 +644,12 @@ static int usb_audio_probe(struct usb_interface *intf,
    1357
    1358 __error:
    1359 if (chip) {
    1360 + /* chip->active is inside the chip->card object,
    1361 + * decrement before memory is possibly returned.
    1362 + */
    1363 + atomic_dec(&chip->active);
    1364 if (!chip->num_interfaces)
    1365 snd_card_free(chip->card);
    1366 - atomic_dec(&chip->active);
    1367 }
    1368 mutex_unlock(&register_mutex);
    1369 return err;