Magellan Linux

  • Back to homepage
    • /[pkg-src]/trunk/kernel-alx/patches-5.4/0268-5.4.169-all-fixes.patch

    Contents of /trunk/kernel-alx/patches-5.4/0268-5.4.169-all-fixes.patch

    Parent Directory Parent Directory | Revision Log Revision Log

    Revision 3635 - (show annotations) (download)
    Mon Oct 24 12:34:12 2022 UTC (18 months, 3 weeks ago) by niro
    File size: 51867 byte(s) 
    -sync kernel patches
    1 diff --git a/Documentation/admin-guide/kernel-parameters.txt b/Documentation/admin-guide/kernel-parameters.txt
    2 index b11e1fd95ee5f..e7f71df9daf1c 100644
    3 --- a/Documentation/admin-guide/kernel-parameters.txt
    4 +++ b/Documentation/admin-guide/kernel-parameters.txt
    5 @@ -2112,8 +2112,12 @@
    6 Default is 1 (enabled)
    7
    8 kvm-intel.emulate_invalid_guest_state=
    9 - [KVM,Intel] Enable emulation of invalid guest states
    10 - Default is 0 (disabled)
    11 + [KVM,Intel] Disable emulation of invalid guest state.
    12 + Ignored if kvm-intel.enable_unrestricted_guest=1, as
    13 + guest state is never invalid for unrestricted guests.
    14 + This param doesn't apply to nested guests (L2), as KVM
    15 + never emulates invalid L2 guest state.
    16 + Default is 1 (enabled)
    17
    18 kvm-intel.flexpriority=
    19 [KVM,Intel] Disable FlexPriority feature (TPR shadow).
    20 diff --git a/Documentation/hwmon/lm90.rst b/Documentation/hwmon/lm90.rst
    21 index 953315987c06e..03851cbe637ce 100644
    22 --- a/Documentation/hwmon/lm90.rst
    23 +++ b/Documentation/hwmon/lm90.rst
    24 @@ -123,6 +123,18 @@ Supported chips:
    25
    26 http://www.maxim-ic.com/quick_view2.cfm/qv_pk/3497
    27
    28 + * Maxim MAX6654
    29 +
    30 + Prefix: 'max6654'
    31 +
    32 + Addresses scanned: I2C 0x18, 0x19, 0x1a, 0x29, 0x2a, 0x2b,
    33 +
    34 + 0x4c, 0x4d and 0x4e
    35 +
    36 + Datasheet: Publicly available at the Maxim website
    37 +
    38 + https://www.maximintegrated.com/en/products/sensors/MAX6654.html
    39 +
    40 * Maxim MAX6657
    41
    42 Prefix: 'max6657'
    43 @@ -253,6 +265,16 @@ Supported chips:
    44
    45 http://www.ti.com/litv/pdf/sbos686
    46
    47 + * Texas Instruments TMP461
    48 +
    49 + Prefix: 'tmp461'
    50 +
    51 + Addresses scanned: I2C 0x48 through 0x4F
    52 +
    53 + Datasheet: Publicly available at TI website
    54 +
    55 + https://www.ti.com/lit/gpn/tmp461
    56 +
    57 Author: Jean Delvare <jdelvare@suse.de>
    58
    59
    60 @@ -301,6 +323,13 @@ ADT7461, ADT7461A, NCT1008:
    61 * Extended temperature range (breaks compatibility)
    62 * Lower resolution for remote temperature
    63
    64 +MAX6654:
    65 + * Better local resolution
    66 + * Selectable address
    67 + * Remote sensor type selection
    68 + * Extended temperature range
    69 + * Extended resolution only available when conversion rate <= 1 Hz
    70 +
    71 MAX6657 and MAX6658:
    72 * Better local resolution
    73 * Remote sensor type selection
    74 @@ -336,8 +365,8 @@ SA56004X:
    75
    76 All temperature values are given in degrees Celsius. Resolution
    77 is 1.0 degree for the local temperature, 0.125 degree for the remote
    78 -temperature, except for the MAX6657, MAX6658 and MAX6659 which have a
    79 -resolution of 0.125 degree for both temperatures.
    80 +temperature, except for the MAX6654, MAX6657, MAX6658 and MAX6659 which have
    81 +a resolution of 0.125 degree for both temperatures.
    82
    83 Each sensor has its own high and low limits, plus a critical limit.
    84 Additionally, there is a relative hysteresis value common to both critical
    85 diff --git a/Documentation/networking/bonding.txt b/Documentation/networking/bonding.txt
    86 index e3abfbd32f71e..b020e6ce6dd49 100644
    87 --- a/Documentation/networking/bonding.txt
    88 +++ b/Documentation/networking/bonding.txt
    89 @@ -191,11 +191,12 @@ ad_actor_sys_prio
    90 ad_actor_system
    91
    92 In an AD system, this specifies the mac-address for the actor in
    93 - protocol packet exchanges (LACPDUs). The value cannot be NULL or
    94 - multicast. It is preferred to have the local-admin bit set for this
    95 - mac but driver does not enforce it. If the value is not given then
    96 - system defaults to using the masters' mac address as actors' system
    97 - address.
    98 + protocol packet exchanges (LACPDUs). The value cannot be a multicast
    99 + address. If the all-zeroes MAC is specified, bonding will internally
    100 + use the MAC of the bond itself. It is preferred to have the
    101 + local-admin bit set for this mac but driver does not enforce it. If
    102 + the value is not given then system defaults to using the masters'
    103 + mac address as actors' system address.
    104
    105 This parameter has effect only in 802.3ad mode and is available through
    106 SysFs interface.
    107 diff --git a/Makefile b/Makefile
    108 index c23f5b17d239f..151fd24540125 100644
    109 --- a/Makefile
    110 +++ b/Makefile
    111 @@ -1,7 +1,7 @@
    112 # SPDX-License-Identifier: GPL-2.0
    113 VERSION = 5
    114 PATCHLEVEL = 4
    115 -SUBLEVEL = 168
    116 +SUBLEVEL = 169
    117 EXTRAVERSION =
    118 NAME = Kleptomaniac Octopus
    119
    120 diff --git a/arch/arm/kernel/entry-armv.S b/arch/arm/kernel/entry-armv.S
    121 index b62d74a2c73a5..4937d514318ec 100644
    122 --- a/arch/arm/kernel/entry-armv.S
    123 +++ b/arch/arm/kernel/entry-armv.S
    124 @@ -596,11 +596,9 @@ call_fpe:
    125 tstne r0, #0x04000000 @ bit 26 set on both ARM and Thumb-2
    126 reteq lr
    127 and r8, r0, #0x00000f00 @ mask out CP number
    128 - THUMB( lsr r8, r8, #8 )
    129 mov r7, #1
    130 - add r6, r10, #TI_USED_CP
    131 - ARM( strb r7, [r6, r8, lsr #8] ) @ set appropriate used_cp[]
    132 - THUMB( strb r7, [r6, r8] ) @ set appropriate used_cp[]
    133 + add r6, r10, r8, lsr #8 @ add used_cp[] array offset first
    134 + strb r7, [r6, #TI_USED_CP] @ set appropriate used_cp[]
    135 #ifdef CONFIG_IWMMXT
    136 @ Test if we need to give access to iWMMXt coprocessors
    137 ldr r5, [r10, #TI_FLAGS]
    138 @@ -609,7 +607,7 @@ call_fpe:
    139 bcs iwmmxt_task_enable
    140 #endif
    141 ARM( add pc, pc, r8, lsr #6 )
    142 - THUMB( lsl r8, r8, #2 )
    143 + THUMB( lsr r8, r8, #6 )
    144 THUMB( add pc, r8 )
    145 nop
    146
    147 diff --git a/arch/arm64/boot/dts/allwinner/sun50i-h5-orangepi-zero-plus.dts b/arch/arm64/boot/dts/allwinner/sun50i-h5-orangepi-zero-plus.dts
    148 index db6ea7b58999b..19f930f43936e 100644
    149 --- a/arch/arm64/boot/dts/allwinner/sun50i-h5-orangepi-zero-plus.dts
    150 +++ b/arch/arm64/boot/dts/allwinner/sun50i-h5-orangepi-zero-plus.dts
    151 @@ -72,7 +72,7 @@
    152 pinctrl-0 = <&emac_rgmii_pins>;
    153 phy-supply = <&reg_gmac_3v3>;
    154 phy-handle = <&ext_rgmii_phy>;
    155 - phy-mode = "rgmii";
    156 + phy-mode = "rgmii-id";
    157 status = "okay";
    158 };
    159
    160 diff --git a/arch/parisc/kernel/syscall.S b/arch/parisc/kernel/syscall.S
    161 index a37814cb66c76..8b616aada6492 100644
    162 --- a/arch/parisc/kernel/syscall.S
    163 +++ b/arch/parisc/kernel/syscall.S
    164 @@ -478,7 +478,7 @@ lws_start:
    165 extrd,u %r1,PSW_W_BIT,1,%r1
    166 /* sp must be aligned on 4, so deposit the W bit setting into
    167 * the bottom of sp temporarily */
    168 - or,ev %r1,%r30,%r30
    169 + or,od %r1,%r30,%r30
    170
    171 /* Clip LWS number to a 32-bit value for 32-bit processes */
    172 depdi 0, 31, 32, %r20
    173 diff --git a/arch/x86/include/asm/pgtable.h b/arch/x86/include/asm/pgtable.h
    174 index ea85f23d9e227..1ae7c20f54691 100644
    175 --- a/arch/x86/include/asm/pgtable.h
    176 +++ b/arch/x86/include/asm/pgtable.h
    177 @@ -1375,8 +1375,8 @@ static inline pmd_t pmd_swp_clear_soft_dirty(pmd_t pmd)
    178 #endif
    179 #endif
    180
    181 -#define PKRU_AD_BIT 0x1
    182 -#define PKRU_WD_BIT 0x2
    183 +#define PKRU_AD_BIT 0x1u
    184 +#define PKRU_WD_BIT 0x2u
    185 #define PKRU_BITS_PER_PKEY 2
    186
    187 #ifdef CONFIG_X86_INTEL_MEMORY_PROTECTION_KEYS
    188 diff --git a/drivers/char/ipmi/ipmi_msghandler.c b/drivers/char/ipmi/ipmi_msghandler.c
    189 index 8a93d5a494fff..ad2e6d55d4a59 100644
    190 --- a/drivers/char/ipmi/ipmi_msghandler.c
    191 +++ b/drivers/char/ipmi/ipmi_msghandler.c
    192 @@ -2938,7 +2938,7 @@ cleanup_bmc_device(struct kref *ref)
    193 * with removing the device attributes while reading a device
    194 * attribute.
    195 */
    196 - schedule_work(&bmc->remove_work);
    197 + queue_work(remove_work_wq, &bmc->remove_work);
    198 }
    199
    200 /*
    201 @@ -5156,22 +5156,27 @@ static int ipmi_init_msghandler(void)
    202 if (initialized)
    203 goto out;
    204
    205 - init_srcu_struct(&ipmi_interfaces_srcu);
    206 -
    207 - timer_setup(&ipmi_timer, ipmi_timeout, 0);
    208 - mod_timer(&ipmi_timer, jiffies + IPMI_TIMEOUT_JIFFIES);
    209 -
    210 - atomic_notifier_chain_register(&panic_notifier_list, &panic_block);
    211 + rv = init_srcu_struct(&ipmi_interfaces_srcu);
    212 + if (rv)
    213 + goto out;
    214
    215 remove_work_wq = create_singlethread_workqueue("ipmi-msghandler-remove-wq");
    216 if (!remove_work_wq) {
    217 pr_err("unable to create ipmi-msghandler-remove-wq workqueue");
    218 rv = -ENOMEM;
    219 - goto out;
    220 + goto out_wq;
    221 }
    222
    223 + timer_setup(&ipmi_timer, ipmi_timeout, 0);
    224 + mod_timer(&ipmi_timer, jiffies + IPMI_TIMEOUT_JIFFIES);
    225 +
    226 + atomic_notifier_chain_register(&panic_notifier_list, &panic_block);
    227 +
    228 initialized = true;
    229
    230 +out_wq:
    231 + if (rv)
    232 + cleanup_srcu_struct(&ipmi_interfaces_srcu);
    233 out:
    234 mutex_unlock(&ipmi_interfaces_mutex);
    235 return rv;
    236 diff --git a/drivers/char/ipmi/ipmi_ssif.c b/drivers/char/ipmi/ipmi_ssif.c
    237 index 8ac390c2b5147..bb42a1c92cae5 100644
    238 --- a/drivers/char/ipmi/ipmi_ssif.c
    239 +++ b/drivers/char/ipmi/ipmi_ssif.c
    240 @@ -1704,6 +1704,9 @@ static int ssif_probe(struct i2c_client *client, const struct i2c_device_id *id)
    241 }
    242 }
    243
    244 + ssif_info->client = client;
    245 + i2c_set_clientdata(client, ssif_info);
    246 +
    247 rv = ssif_check_and_remove(client, ssif_info);
    248 /* If rv is 0 and addr source is not SI_ACPI, continue probing */
    249 if (!rv && ssif_info->addr_source == SI_ACPI) {
    250 @@ -1724,9 +1727,6 @@ static int ssif_probe(struct i2c_client *client, const struct i2c_device_id *id)
    251 ipmi_addr_src_to_str(ssif_info->addr_source),
    252 client->addr, client->adapter->name, slave_addr);
    253
    254 - ssif_info->client = client;
    255 - i2c_set_clientdata(client, ssif_info);
    256 -
    257 /* Now check for system interface capabilities */
    258 msg[0] = IPMI_NETFN_APP_REQUEST << 2;
    259 msg[1] = IPMI_GET_SYSTEM_INTERFACE_CAPABILITIES_CMD;
    260 @@ -1926,6 +1926,7 @@ static int ssif_probe(struct i2c_client *client, const struct i2c_device_id *id)
    261
    262 dev_err(&ssif_info->client->dev,
    263 "Unable to start IPMI SSIF: %d\n", rv);
    264 + i2c_set_clientdata(client, NULL);
    265 kfree(ssif_info);
    266 }
    267 kfree(resp);
    268 diff --git a/drivers/hid/hid-holtek-mouse.c b/drivers/hid/hid-holtek-mouse.c
    269 index b7172c48ef9f0..7c907939bfae1 100644
    270 --- a/drivers/hid/hid-holtek-mouse.c
    271 +++ b/drivers/hid/hid-holtek-mouse.c
    272 @@ -65,8 +65,23 @@ static __u8 *holtek_mouse_report_fixup(struct hid_device *hdev, __u8 *rdesc,
    273 static int holtek_mouse_probe(struct hid_device *hdev,
    274 const struct hid_device_id *id)
    275 {
    276 + int ret;
    277 +
    278 if (!hid_is_usb(hdev))
    279 return -EINVAL;
    280 +
    281 + ret = hid_parse(hdev);
    282 + if (ret) {
    283 + hid_err(hdev, "hid parse failed: %d\n", ret);
    284 + return ret;
    285 + }
    286 +
    287 + ret = hid_hw_start(hdev, HID_CONNECT_DEFAULT);
    288 + if (ret) {
    289 + hid_err(hdev, "hw start failed: %d\n", ret);
    290 + return ret;
    291 + }
    292 +
    293 return 0;
    294 }
    295
    296 diff --git a/drivers/hwmon/Kconfig b/drivers/hwmon/Kconfig
    297 index 13a6b4afb4b36..049563d503b68 100644
    298 --- a/drivers/hwmon/Kconfig
    299 +++ b/drivers/hwmon/Kconfig
    300 @@ -1132,10 +1132,11 @@ config SENSORS_LM90
    301 help
    302 If you say yes here you get support for National Semiconductor LM90,
    303 LM86, LM89 and LM99, Analog Devices ADM1032, ADT7461, and ADT7461A,
    304 - Maxim MAX6646, MAX6647, MAX6648, MAX6649, MAX6657, MAX6658, MAX6659,
    305 - MAX6680, MAX6681, MAX6692, MAX6695, MAX6696, ON Semiconductor NCT1008,
    306 - Winbond/Nuvoton W83L771W/G/AWG/ASG, Philips SA56004, GMT G781, and
    307 - Texas Instruments TMP451 sensor chips.
    308 + Maxim MAX6646, MAX6647, MAX6648, MAX6649, MAX6654, MAX6657, MAX6658,
    309 + MAX6659, MAX6680, MAX6681, MAX6692, MAX6695, MAX6696,
    310 + ON Semiconductor NCT1008, Winbond/Nuvoton W83L771W/G/AWG/ASG,
    311 + Philips SA56004, GMT G781, Texas Instruments TMP451 and TMP461
    312 + sensor chips.
    313
    314 This driver can also be built as a module. If so, the module
    315 will be called lm90.
    316 diff --git a/drivers/hwmon/lm90.c b/drivers/hwmon/lm90.c
    317 index 9b3c9f390ef81..9abb4507f572b 100644
    318 --- a/drivers/hwmon/lm90.c
    319 +++ b/drivers/hwmon/lm90.c
    320 @@ -35,6 +35,15 @@
    321 * explicitly as max6659, or if its address is not 0x4c.
    322 * These chips lack the remote temperature offset feature.
    323 *
    324 + * This driver also supports the MAX6654 chip made by Maxim. This chip can be
    325 + * at 9 different addresses, similar to MAX6680/MAX6681. The MAX6654 is similar
    326 + * to MAX6657/MAX6658/MAX6659, but does not support critical temperature
    327 + * limits. Extended range is available by setting the configuration register
    328 + * accordingly, and is done during initialization. Extended precision is only
    329 + * available at conversion rates of 1 Hz and slower. Note that extended
    330 + * precision is not enabled by default, as this driver initializes all chips
    331 + * to 2 Hz by design.
    332 + *
    333 * This driver also supports the MAX6646, MAX6647, MAX6648, MAX6649 and
    334 * MAX6692 chips made by Maxim. These are again similar to the LM86,
    335 * but they use unsigned temperature values and can report temperatures
    336 @@ -61,10 +70,10 @@
    337 * This driver also supports the G781 from GMT. This device is compatible
    338 * with the ADM1032.
    339 *
    340 - * This driver also supports TMP451 from Texas Instruments. This device is
    341 - * supported in both compatibility and extended mode. It's mostly compatible
    342 - * with ADT7461 except for local temperature low byte register and max
    343 - * conversion rate.
    344 + * This driver also supports TMP451 and TMP461 from Texas Instruments.
    345 + * Those devices are supported in both compatibility and extended mode.
    346 + * They are mostly compatible with ADT7461 except for local temperature
    347 + * low byte register and max conversion rate.
    348 *
    349 * Since the LM90 was the first chipset supported by this driver, most
    350 * comments will refer to this chipset, but are actually general and
    351 @@ -94,8 +103,8 @@
    352 * have address 0x4d.
    353 * MAX6647 has address 0x4e.
    354 * MAX6659 can have address 0x4c, 0x4d or 0x4e.
    355 - * MAX6680 and MAX6681 can have address 0x18, 0x19, 0x1a, 0x29, 0x2a, 0x2b,
    356 - * 0x4c, 0x4d or 0x4e.
    357 + * MAX6654, MAX6680, and MAX6681 can have address 0x18, 0x19, 0x1a, 0x29,
    358 + * 0x2a, 0x2b, 0x4c, 0x4d or 0x4e.
    359 * SA56004 can have address 0x48 through 0x4F.
    360 */
    361
    362 @@ -104,7 +113,7 @@ static const unsigned short normal_i2c[] = {
    363 0x4d, 0x4e, 0x4f, I2C_CLIENT_END };
    364
    365 enum chips { lm90, adm1032, lm99, lm86, max6657, max6659, adt7461, max6680,
    366 - max6646, w83l771, max6696, sa56004, g781, tmp451 };
    367 + max6646, w83l771, max6696, sa56004, g781, tmp451, tmp461, max6654 };
    368
    369 /*
    370 * The LM90 registers
    371 @@ -145,7 +154,7 @@ enum chips { lm90, adm1032, lm99, lm86, max6657, max6659, adt7461, max6680,
    372 #define LM90_REG_R_TCRIT_HYST 0x21
    373 #define LM90_REG_W_TCRIT_HYST 0x21
    374
    375 -/* MAX6646/6647/6649/6657/6658/6659/6695/6696 registers */
    376 +/* MAX6646/6647/6649/6654/6657/6658/6659/6695/6696 registers */
    377
    378 #define MAX6657_REG_R_LOCAL_TEMPL 0x11
    379 #define MAX6696_REG_R_STATUS2 0x12
    380 @@ -160,8 +169,12 @@ enum chips { lm90, adm1032, lm99, lm86, max6657, max6659, adt7461, max6680,
    381
    382 #define LM90_MAX_CONVRATE_MS 16000 /* Maximum conversion rate in ms */
    383
    384 -/* TMP451 registers */
    385 +/* TMP451/TMP461 registers */
    386 #define TMP451_REG_R_LOCAL_TEMPL 0x15
    387 +#define TMP451_REG_CONALERT 0x22
    388 +
    389 +#define TMP461_REG_CHEN 0x16
    390 +#define TMP461_REG_DFC 0x24
    391
    392 /*
    393 * Device flags
    394 @@ -174,7 +187,10 @@ enum chips { lm90, adm1032, lm99, lm86, max6657, max6659, adt7461, max6680,
    395 #define LM90_HAVE_EMERGENCY_ALARM (1 << 5)/* emergency alarm */
    396 #define LM90_HAVE_TEMP3 (1 << 6) /* 3rd temperature sensor */
    397 #define LM90_HAVE_BROKEN_ALERT (1 << 7) /* Broken alert */
    398 -#define LM90_PAUSE_FOR_CONFIG (1 << 8) /* Pause conversion for config */
    399 +#define LM90_HAVE_EXTENDED_TEMP (1 << 8) /* extended temperature support*/
    400 +#define LM90_PAUSE_FOR_CONFIG (1 << 9) /* Pause conversion for config */
    401 +#define LM90_HAVE_CRIT (1 << 10)/* Chip supports CRIT/OVERT register */
    402 +#define LM90_HAVE_CRIT_ALRM_SWP (1 << 11)/* critical alarm bits swapped */
    403
    404 /* LM90 status */
    405 #define LM90_STATUS_LTHRM (1 << 0) /* local THERM limit tripped */
    406 @@ -184,6 +200,7 @@ enum chips { lm90, adm1032, lm99, lm86, max6657, max6659, adt7461, max6680,
    407 #define LM90_STATUS_RHIGH (1 << 4) /* remote high temp limit tripped */
    408 #define LM90_STATUS_LLOW (1 << 5) /* local low temp limit tripped */
    409 #define LM90_STATUS_LHIGH (1 << 6) /* local high temp limit tripped */
    410 +#define LM90_STATUS_BUSY (1 << 7) /* conversion is ongoing */
    411
    412 #define MAX6696_STATUS2_R2THRM (1 << 1) /* remote2 THERM limit tripped */
    413 #define MAX6696_STATUS2_R2OPEN (1 << 2) /* remote2 is an open circuit */
    414 @@ -209,6 +226,7 @@ static const struct i2c_device_id lm90_id[] = {
    415 { "max6646", max6646 },
    416 { "max6647", max6646 },
    417 { "max6649", max6646 },
    418 + { "max6654", max6654 },
    419 { "max6657", max6657 },
    420 { "max6658", max6657 },
    421 { "max6659", max6659 },
    422 @@ -220,6 +238,7 @@ static const struct i2c_device_id lm90_id[] = {
    423 { "w83l771", w83l771 },
    424 { "sa56004", sa56004 },
    425 { "tmp451", tmp451 },
    426 + { "tmp461", tmp461 },
    427 { }
    428 };
    429 MODULE_DEVICE_TABLE(i2c, lm90_id);
    430 @@ -269,6 +288,10 @@ static const struct of_device_id __maybe_unused lm90_of_match[] = {
    431 .compatible = "dallas,max6649",
    432 .data = (void *)max6646
    433 },
    434 + {
    435 + .compatible = "dallas,max6654",
    436 + .data = (void *)max6654
    437 + },
    438 {
    439 .compatible = "dallas,max6657",
    440 .data = (void *)max6657
    441 @@ -313,6 +336,10 @@ static const struct of_device_id __maybe_unused lm90_of_match[] = {
    442 .compatible = "ti,tmp451",
    443 .data = (void *)tmp451
    444 },
    445 + {
    446 + .compatible = "ti,tmp461",
    447 + .data = (void *)tmp461
    448 + },
    449 { },
    450 };
    451 MODULE_DEVICE_TABLE(of, lm90_of_match);
    452 @@ -331,80 +358,98 @@ struct lm90_params {
    453 static const struct lm90_params lm90_params[] = {
    454 [adm1032] = {
    455 .flags = LM90_HAVE_OFFSET | LM90_HAVE_REM_LIMIT_EXT
    456 - | LM90_HAVE_BROKEN_ALERT,
    457 + | LM90_HAVE_BROKEN_ALERT | LM90_HAVE_CRIT,
    458 .alert_alarms = 0x7c,
    459 .max_convrate = 10,
    460 },
    461 [adt7461] = {
    462 .flags = LM90_HAVE_OFFSET | LM90_HAVE_REM_LIMIT_EXT
    463 - | LM90_HAVE_BROKEN_ALERT,
    464 + | LM90_HAVE_BROKEN_ALERT | LM90_HAVE_EXTENDED_TEMP
    465 + | LM90_HAVE_CRIT,
    466 .alert_alarms = 0x7c,
    467 .max_convrate = 10,
    468 },
    469 [g781] = {
    470 .flags = LM90_HAVE_OFFSET | LM90_HAVE_REM_LIMIT_EXT
    471 - | LM90_HAVE_BROKEN_ALERT,
    472 + | LM90_HAVE_BROKEN_ALERT | LM90_HAVE_CRIT,
    473 .alert_alarms = 0x7c,
    474 .max_convrate = 8,
    475 },
    476 [lm86] = {
    477 - .flags = LM90_HAVE_OFFSET | LM90_HAVE_REM_LIMIT_EXT,
    478 + .flags = LM90_HAVE_OFFSET | LM90_HAVE_REM_LIMIT_EXT
    479 + | LM90_HAVE_CRIT,
    480 .alert_alarms = 0x7b,
    481 .max_convrate = 9,
    482 },
    483 [lm90] = {
    484 - .flags = LM90_HAVE_OFFSET | LM90_HAVE_REM_LIMIT_EXT,
    485 + .flags = LM90_HAVE_OFFSET | LM90_HAVE_REM_LIMIT_EXT
    486 + | LM90_HAVE_CRIT,
    487 .alert_alarms = 0x7b,
    488 .max_convrate = 9,
    489 },
    490 [lm99] = {
    491 - .flags = LM90_HAVE_OFFSET | LM90_HAVE_REM_LIMIT_EXT,
    492 + .flags = LM90_HAVE_OFFSET | LM90_HAVE_REM_LIMIT_EXT
    493 + | LM90_HAVE_CRIT,
    494 .alert_alarms = 0x7b,
    495 .max_convrate = 9,
    496 },
    497 [max6646] = {
    498 + .flags = LM90_HAVE_CRIT,
    499 .alert_alarms = 0x7c,
    500 .max_convrate = 6,
    501 .reg_local_ext = MAX6657_REG_R_LOCAL_TEMPL,
    502 },
    503 + [max6654] = {
    504 + .alert_alarms = 0x7c,
    505 + .max_convrate = 7,
    506 + .reg_local_ext = MAX6657_REG_R_LOCAL_TEMPL,
    507 + },
    508 [max6657] = {
    509 - .flags = LM90_PAUSE_FOR_CONFIG,
    510 + .flags = LM90_PAUSE_FOR_CONFIG | LM90_HAVE_CRIT,
    511 .alert_alarms = 0x7c,
    512 .max_convrate = 8,
    513 .reg_local_ext = MAX6657_REG_R_LOCAL_TEMPL,
    514 },
    515 [max6659] = {
    516 - .flags = LM90_HAVE_EMERGENCY,
    517 + .flags = LM90_HAVE_EMERGENCY | LM90_HAVE_CRIT,
    518 .alert_alarms = 0x7c,
    519 .max_convrate = 8,
    520 .reg_local_ext = MAX6657_REG_R_LOCAL_TEMPL,
    521 },
    522 [max6680] = {
    523 - .flags = LM90_HAVE_OFFSET,
    524 + .flags = LM90_HAVE_OFFSET | LM90_HAVE_CRIT
    525 + | LM90_HAVE_CRIT_ALRM_SWP,
    526 .alert_alarms = 0x7c,
    527 .max_convrate = 7,
    528 },
    529 [max6696] = {
    530 .flags = LM90_HAVE_EMERGENCY
    531 - | LM90_HAVE_EMERGENCY_ALARM | LM90_HAVE_TEMP3,
    532 + | LM90_HAVE_EMERGENCY_ALARM | LM90_HAVE_TEMP3 | LM90_HAVE_CRIT,
    533 .alert_alarms = 0x1c7c,
    534 .max_convrate = 6,
    535 .reg_local_ext = MAX6657_REG_R_LOCAL_TEMPL,
    536 },
    537 [w83l771] = {
    538 - .flags = LM90_HAVE_OFFSET | LM90_HAVE_REM_LIMIT_EXT,
    539 + .flags = LM90_HAVE_OFFSET | LM90_HAVE_REM_LIMIT_EXT | LM90_HAVE_CRIT,
    540 .alert_alarms = 0x7c,
    541 .max_convrate = 8,
    542 },
    543 [sa56004] = {
    544 - .flags = LM90_HAVE_OFFSET | LM90_HAVE_REM_LIMIT_EXT,
    545 + .flags = LM90_HAVE_OFFSET | LM90_HAVE_REM_LIMIT_EXT | LM90_HAVE_CRIT,
    546 .alert_alarms = 0x7b,
    547 .max_convrate = 9,
    548 .reg_local_ext = SA56004_REG_R_LOCAL_TEMPL,
    549 },
    550 [tmp451] = {
    551 .flags = LM90_HAVE_OFFSET | LM90_HAVE_REM_LIMIT_EXT
    552 - | LM90_HAVE_BROKEN_ALERT,
    553 + | LM90_HAVE_BROKEN_ALERT | LM90_HAVE_EXTENDED_TEMP | LM90_HAVE_CRIT,
    554 + .alert_alarms = 0x7c,
    555 + .max_convrate = 9,
    556 + .reg_local_ext = TMP451_REG_R_LOCAL_TEMPL,
    557 + },
    558 + [tmp461] = {
    559 + .flags = LM90_HAVE_OFFSET | LM90_HAVE_REM_LIMIT_EXT
    560 + | LM90_HAVE_BROKEN_ALERT | LM90_HAVE_EXTENDED_TEMP | LM90_HAVE_CRIT,
    561 .alert_alarms = 0x7c,
    562 .max_convrate = 9,
    563 .reg_local_ext = TMP451_REG_R_LOCAL_TEMPL,
    564 @@ -632,20 +677,22 @@ static int lm90_update_limits(struct device *dev)
    565 struct i2c_client *client = data->client;
    566 int val;
    567
    568 - val = lm90_read_reg(client, LM90_REG_R_LOCAL_CRIT);
    569 - if (val < 0)
    570 - return val;
    571 - data->temp8[LOCAL_CRIT] = val;
    572 + if (data->flags & LM90_HAVE_CRIT) {
    573 + val = lm90_read_reg(client, LM90_REG_R_LOCAL_CRIT);
    574 + if (val < 0)
    575 + return val;
    576 + data->temp8[LOCAL_CRIT] = val;
    577
    578 - val = lm90_read_reg(client, LM90_REG_R_REMOTE_CRIT);
    579 - if (val < 0)
    580 - return val;
    581 - data->temp8[REMOTE_CRIT] = val;
    582 + val = lm90_read_reg(client, LM90_REG_R_REMOTE_CRIT);
    583 + if (val < 0)
    584 + return val;
    585 + data->temp8[REMOTE_CRIT] = val;
    586
    587 - val = lm90_read_reg(client, LM90_REG_R_TCRIT_HYST);
    588 - if (val < 0)
    589 - return val;
    590 - data->temp_hyst = val;
    591 + val = lm90_read_reg(client, LM90_REG_R_TCRIT_HYST);
    592 + if (val < 0)
    593 + return val;
    594 + data->temp_hyst = val;
    595 + }
    596
    597 val = lm90_read_reg(client, LM90_REG_R_REMOTE_LOWH);
    598 if (val < 0)
    599 @@ -773,7 +820,7 @@ static int lm90_update_device(struct device *dev)
    600 val = lm90_read_reg(client, LM90_REG_R_STATUS);
    601 if (val < 0)
    602 return val;
    603 - data->alarms = val; /* lower 8 bit of alarms */
    604 + data->alarms = val & ~LM90_STATUS_BUSY;
    605
    606 if (data->kind == max6696) {
    607 val = lm90_select_remote_channel(data, 1);
    608 @@ -979,7 +1026,7 @@ static int lm90_get_temp11(struct lm90_data *data, int index)
    609 s16 temp11 = data->temp11[index];
    610 int temp;
    611
    612 - if (data->kind == adt7461 || data->kind == tmp451)
    613 + if (data->flags & LM90_HAVE_EXTENDED_TEMP)
    614 temp = temp_from_u16_adt7461(data, temp11);
    615 else if (data->kind == max6646)
    616 temp = temp_from_u16(temp11);
    617 @@ -1013,7 +1060,7 @@ static int lm90_set_temp11(struct lm90_data *data, int index, long val)
    618 if (data->kind == lm99 && index <= 2)
    619 val -= 16000;
    620
    621 - if (data->kind == adt7461 || data->kind == tmp451)
    622 + if (data->flags & LM90_HAVE_EXTENDED_TEMP)
    623 data->temp11[index] = temp_to_u16_adt7461(data, val);
    624 else if (data->kind == max6646)
    625 data->temp11[index] = temp_to_u8(val) << 8;
    626 @@ -1040,7 +1087,7 @@ static int lm90_get_temp8(struct lm90_data *data, int index)
    627 s8 temp8 = data->temp8[index];
    628 int temp;
    629
    630 - if (data->kind == adt7461 || data->kind == tmp451)
    631 + if (data->flags & LM90_HAVE_EXTENDED_TEMP)
    632 temp = temp_from_u8_adt7461(data, temp8);
    633 else if (data->kind == max6646)
    634 temp = temp_from_u8(temp8);
    635 @@ -1073,7 +1120,7 @@ static int lm90_set_temp8(struct lm90_data *data, int index, long val)
    636 if (data->kind == lm99 && index == 3)
    637 val -= 16000;
    638
    639 - if (data->kind == adt7461 || data->kind == tmp451)
    640 + if (data->flags & LM90_HAVE_EXTENDED_TEMP)
    641 data->temp8[index] = temp_to_u8_adt7461(data, val);
    642 else if (data->kind == max6646)
    643 data->temp8[index] = temp_to_u8(val);
    644 @@ -1091,7 +1138,7 @@ static int lm90_get_temphyst(struct lm90_data *data, int index)
    645 {
    646 int temp;
    647
    648 - if (data->kind == adt7461 || data->kind == tmp451)
    649 + if (data->flags & LM90_HAVE_EXTENDED_TEMP)
    650 temp = temp_from_u8_adt7461(data, data->temp8[index]);
    651 else if (data->kind == max6646)
    652 temp = temp_from_u8(data->temp8[index]);
    653 @@ -1111,7 +1158,7 @@ static int lm90_set_temphyst(struct lm90_data *data, long val)
    654 int temp;
    655 int err;
    656
    657 - if (data->kind == adt7461 || data->kind == tmp451)
    658 + if (data->flags & LM90_HAVE_EXTENDED_TEMP)
    659 temp = temp_from_u8_adt7461(data, data->temp8[LOCAL_CRIT]);
    660 else if (data->kind == max6646)
    661 temp = temp_from_u8(data->temp8[LOCAL_CRIT]);
    662 @@ -1147,6 +1194,7 @@ static const u8 lm90_temp_emerg_index[3] = {
    663 static const u8 lm90_min_alarm_bits[3] = { 5, 3, 11 };
    664 static const u8 lm90_max_alarm_bits[3] = { 6, 4, 12 };
    665 static const u8 lm90_crit_alarm_bits[3] = { 0, 1, 9 };
    666 +static const u8 lm90_crit_alarm_bits_swapped[3] = { 1, 0, 9 };
    667 static const u8 lm90_emergency_alarm_bits[3] = { 15, 13, 14 };
    668 static const u8 lm90_fault_bits[3] = { 0, 2, 10 };
    669
    670 @@ -1172,7 +1220,10 @@ static int lm90_temp_read(struct device *dev, u32 attr, int channel, long *val)
    671 *val = (data->alarms >> lm90_max_alarm_bits[channel]) & 1;
    672 break;
    673 case hwmon_temp_crit_alarm:
    674 - *val = (data->alarms >> lm90_crit_alarm_bits[channel]) & 1;
    675 + if (data->flags & LM90_HAVE_CRIT_ALRM_SWP)
    676 + *val = (data->alarms >> lm90_crit_alarm_bits_swapped[channel]) & 1;
    677 + else
    678 + *val = (data->alarms >> lm90_crit_alarm_bits[channel]) & 1;
    679 break;
    680 case hwmon_temp_emergency_alarm:
    681 *val = (data->alarms >> lm90_emergency_alarm_bits[channel]) & 1;
    682 @@ -1420,12 +1471,11 @@ static int lm90_detect(struct i2c_client *client,
    683 if (man_id < 0 || chip_id < 0 || config1 < 0 || convrate < 0)
    684 return -ENODEV;
    685
    686 - if (man_id == 0x01 || man_id == 0x5C || man_id == 0x41) {
    687 + if (man_id == 0x01 || man_id == 0x5C || man_id == 0xA1) {
    688 config2 = i2c_smbus_read_byte_data(client, LM90_REG_R_CONFIG2);
    689 if (config2 < 0)
    690 return -ENODEV;
    691 - } else
    692 - config2 = 0; /* Make compiler happy */
    693 + }
    694
    695 if ((address == 0x4C || address == 0x4D)
    696 && man_id == 0x01) { /* National Semiconductor */
    697 @@ -1557,6 +1607,16 @@ static int lm90_detect(struct i2c_client *client,
    698 && (config1 & 0x3f) == 0x00
    699 && convrate <= 0x07) {
    700 name = "max6646";
    701 + } else
    702 + /*
    703 + * The chip_id of the MAX6654 holds the revision of the chip.
    704 + * The lowest 3 bits of the config1 register are unused and
    705 + * should return zero when read.
    706 + */
    707 + if (chip_id == 0x08
    708 + && (config1 & 0x07) == 0x00
    709 + && convrate <= 0x07) {
    710 + name = "max6654";
    711 }
    712 } else
    713 if (address == 0x4C
    714 @@ -1589,18 +1649,26 @@ static int lm90_detect(struct i2c_client *client,
    715 && convrate <= 0x08)
    716 name = "g781";
    717 } else
    718 - if (address == 0x4C
    719 - && man_id == 0x55) { /* Texas Instruments */
    720 - int local_ext;
    721 + if (man_id == 0x55 && chip_id == 0x00 &&
    722 + (config1 & 0x1B) == 0x00 && convrate <= 0x09) {
    723 + int local_ext, conalert, chen, dfc;
    724
    725 local_ext = i2c_smbus_read_byte_data(client,
    726 TMP451_REG_R_LOCAL_TEMPL);
    727 -
    728 - if (chip_id == 0x00 /* TMP451 */
    729 - && (config1 & 0x1B) == 0x00
    730 - && convrate <= 0x09
    731 - && (local_ext & 0x0F) == 0x00)
    732 - name = "tmp451";
    733 + conalert = i2c_smbus_read_byte_data(client,
    734 + TMP451_REG_CONALERT);
    735 + chen = i2c_smbus_read_byte_data(client, TMP461_REG_CHEN);
    736 + dfc = i2c_smbus_read_byte_data(client, TMP461_REG_DFC);
    737 +
    738 + if ((local_ext & 0x0F) == 0x00 &&
    739 + (conalert & 0xf1) == 0x01 &&
    740 + (chen & 0xfc) == 0x00 &&
    741 + (dfc & 0xfc) == 0x00) {
    742 + if (address == 0x4c && !(chen & 0x03))
    743 + name = "tmp451";
    744 + else if (address >= 0x48 && address <= 0x4f)
    745 + name = "tmp461";
    746 + }
    747 }
    748
    749 if (!name) { /* identification failed */
    750 @@ -1647,7 +1715,7 @@ static int lm90_init_client(struct i2c_client *client, struct lm90_data *data)
    751 lm90_set_convrate(client, data, 500); /* 500ms; 2Hz conversion rate */
    752
    753 /* Check Temperature Range Select */
    754 - if (data->kind == adt7461 || data->kind == tmp451) {
    755 + if (data->flags & LM90_HAVE_EXTENDED_TEMP) {
    756 if (config & 0x04)
    757 data->flags |= LM90_FLAG_ADT7461_EXT;
    758 }
    759 @@ -1660,6 +1728,15 @@ static int lm90_init_client(struct i2c_client *client, struct lm90_data *data)
    760 if (data->kind == max6680)
    761 config |= 0x18;
    762
    763 + /*
    764 + * Put MAX6654 into extended range (0x20, extend minimum range from
    765 + * 0 degrees to -64 degrees). Note that extended resolution is not
    766 + * possible on the MAX6654 unless conversion rate is set to 1 Hz or
    767 + * slower, which is intentionally not done by default.
    768 + */
    769 + if (data->kind == max6654)
    770 + config |= 0x20;
    771 +
    772 /*
    773 * Select external channel 0 for max6695/96
    774 */
    775 @@ -1806,11 +1883,14 @@ static int lm90_probe(struct i2c_client *client,
    776 info->config = data->channel_config;
    777
    778 data->channel_config[0] = HWMON_T_INPUT | HWMON_T_MIN | HWMON_T_MAX |
    779 - HWMON_T_CRIT | HWMON_T_CRIT_HYST | HWMON_T_MIN_ALARM |
    780 - HWMON_T_MAX_ALARM | HWMON_T_CRIT_ALARM;
    781 + HWMON_T_MIN_ALARM | HWMON_T_MAX_ALARM;
    782 data->channel_config[1] = HWMON_T_INPUT | HWMON_T_MIN | HWMON_T_MAX |
    783 - HWMON_T_CRIT | HWMON_T_CRIT_HYST | HWMON_T_MIN_ALARM |
    784 - HWMON_T_MAX_ALARM | HWMON_T_CRIT_ALARM | HWMON_T_FAULT;
    785 + HWMON_T_MIN_ALARM | HWMON_T_MAX_ALARM | HWMON_T_FAULT;
    786 +
    787 + if (data->flags & LM90_HAVE_CRIT) {
    788 + data->channel_config[0] |= HWMON_T_CRIT | HWMON_T_CRIT_ALARM | HWMON_T_CRIT_HYST;
    789 + data->channel_config[1] |= HWMON_T_CRIT | HWMON_T_CRIT_ALARM | HWMON_T_CRIT_HYST;
    790 + }
    791
    792 if (data->flags & LM90_HAVE_OFFSET)
    793 data->channel_config[1] |= HWMON_T_OFFSET;
    794 diff --git a/drivers/infiniband/hw/qib/qib_user_sdma.c b/drivers/infiniband/hw/qib/qib_user_sdma.c
    795 index 5fd28574124fb..fde848b00202b 100644
    796 --- a/drivers/infiniband/hw/qib/qib_user_sdma.c
    797 +++ b/drivers/infiniband/hw/qib/qib_user_sdma.c
    798 @@ -941,7 +941,7 @@ static int qib_user_sdma_queue_pkts(const struct qib_devdata *dd,
    799 &addrlimit) ||
    800 addrlimit > type_max(typeof(pkt->addrlimit))) {
    801 ret = -EINVAL;
    802 - goto free_pbc;
    803 + goto free_pkt;
    804 }
    805 pkt->addrlimit = addrlimit;
    806
    807 diff --git a/drivers/input/mouse/elantech.c b/drivers/input/mouse/elantech.c
    808 index 0b5ed963cb0e1..3e78c26025815 100644
    809 --- a/drivers/input/mouse/elantech.c
    810 +++ b/drivers/input/mouse/elantech.c
    811 @@ -1588,7 +1588,13 @@ static const struct dmi_system_id no_hw_res_dmi_table[] = {
    812 */
    813 static int elantech_change_report_id(struct psmouse *psmouse)
    814 {
    815 - unsigned char param[2] = { 0x10, 0x03 };
    816 + /*
    817 + * NOTE: the code is expecting to receive param[] as an array of 3
    818 + * items (see __ps2_command()), even if in this case only 2 are
    819 + * actually needed. Make sure the array size is 3 to avoid potential
    820 + * stack out-of-bound accesses.
    821 + */
    822 + unsigned char param[3] = { 0x10, 0x03 };
    823
    824 if (elantech_write_reg_params(psmouse, 0x7, param) ||
    825 elantech_read_reg_params(psmouse, 0x7, param) ||
    826 diff --git a/drivers/input/touchscreen/atmel_mxt_ts.c b/drivers/input/touchscreen/atmel_mxt_ts.c
    827 index ae60442efda0d..fb31a9d43162b 100644
    828 --- a/drivers/input/touchscreen/atmel_mxt_ts.c
    829 +++ b/drivers/input/touchscreen/atmel_mxt_ts.c
    830 @@ -1794,7 +1794,7 @@ static int mxt_read_info_block(struct mxt_data *data)
    831 if (error) {
    832 dev_err(&client->dev, "Error %d parsing object table\n", error);
    833 mxt_free_object_table(data);
    834 - goto err_free_mem;
    835 + return error;
    836 }
    837
    838 data->object_table = (struct mxt_object *)(id_buf + MXT_OBJECT_START);
    839 diff --git a/drivers/mmc/core/core.c b/drivers/mmc/core/core.c
    840 index 8f94c25395080..d7bda1fa0a6e2 100644
    841 --- a/drivers/mmc/core/core.c
    842 +++ b/drivers/mmc/core/core.c
    843 @@ -2364,7 +2364,7 @@ void mmc_start_host(struct mmc_host *host)
    844 _mmc_detect_change(host, 0, false);
    845 }
    846
    847 -void mmc_stop_host(struct mmc_host *host)
    848 +void __mmc_stop_host(struct mmc_host *host)
    849 {
    850 if (host->slot.cd_irq >= 0) {
    851 mmc_gpio_set_cd_wake(host, false);
    852 @@ -2373,6 +2373,11 @@ void mmc_stop_host(struct mmc_host *host)
    853
    854 host->rescan_disable = 1;
    855 cancel_delayed_work_sync(&host->detect);
    856 +}
    857 +
    858 +void mmc_stop_host(struct mmc_host *host)
    859 +{
    860 + __mmc_stop_host(host);
    861
    862 /* clear pm flags now and let card drivers set them as needed */
    863 host->pm_flags = 0;
    864 diff --git a/drivers/mmc/core/core.h b/drivers/mmc/core/core.h
    865 index db3c9c68875d8..a6c814fdbf0a9 100644
    866 --- a/drivers/mmc/core/core.h
    867 +++ b/drivers/mmc/core/core.h
    868 @@ -69,6 +69,7 @@ static inline void mmc_delay(unsigned int ms)
    869
    870 void mmc_rescan(struct work_struct *work);
    871 void mmc_start_host(struct mmc_host *host);
    872 +void __mmc_stop_host(struct mmc_host *host);
    873 void mmc_stop_host(struct mmc_host *host);
    874
    875 void _mmc_detect_change(struct mmc_host *host, unsigned long delay,
    876 diff --git a/drivers/mmc/core/host.c b/drivers/mmc/core/host.c
    877 index f7339590a84c8..e955f1ef25643 100644
    878 --- a/drivers/mmc/core/host.c
    879 +++ b/drivers/mmc/core/host.c
    880 @@ -76,9 +76,18 @@ static void mmc_host_classdev_release(struct device *dev)
    881 kfree(host);
    882 }
    883
    884 +static int mmc_host_classdev_shutdown(struct device *dev)
    885 +{
    886 + struct mmc_host *host = cls_dev_to_mmc_host(dev);
    887 +
    888 + __mmc_stop_host(host);
    889 + return 0;
    890 +}
    891 +
    892 static struct class mmc_host_class = {
    893 .name = "mmc_host",
    894 .dev_release = mmc_host_classdev_release,
    895 + .shutdown_pre = mmc_host_classdev_shutdown,
    896 .pm = MMC_HOST_CLASS_DEV_PM_OPS,
    897 };
    898
    899 diff --git a/drivers/mmc/host/sdhci-tegra.c b/drivers/mmc/host/sdhci-tegra.c
    900 index c105356ad4cb7..65dfe75120ed6 100644
    901 --- a/drivers/mmc/host/sdhci-tegra.c
    902 +++ b/drivers/mmc/host/sdhci-tegra.c
    903 @@ -340,23 +340,6 @@ static void tegra_sdhci_set_tap(struct sdhci_host *host, unsigned int tap)
    904 }
    905 }
    906
    907 -static void tegra_sdhci_hs400_enhanced_strobe(struct mmc_host *mmc,
    908 - struct mmc_ios *ios)
    909 -{
    910 - struct sdhci_host *host = mmc_priv(mmc);
    911 - u32 val;
    912 -
    913 - val = sdhci_readl(host, SDHCI_TEGRA_VENDOR_SYS_SW_CTRL);
    914 -
    915 - if (ios->enhanced_strobe)
    916 - val |= SDHCI_TEGRA_SYS_SW_CTRL_ENHANCED_STROBE;
    917 - else
    918 - val &= ~SDHCI_TEGRA_SYS_SW_CTRL_ENHANCED_STROBE;
    919 -
    920 - sdhci_writel(host, val, SDHCI_TEGRA_VENDOR_SYS_SW_CTRL);
    921 -
    922 -}
    923 -
    924 static void tegra_sdhci_reset(struct sdhci_host *host, u8 mask)
    925 {
    926 struct sdhci_pltfm_host *pltfm_host = sdhci_priv(host);
    927 @@ -768,6 +751,32 @@ static void tegra_sdhci_set_clock(struct sdhci_host *host, unsigned int clock)
    928 }
    929 }
    930
    931 +static void tegra_sdhci_hs400_enhanced_strobe(struct mmc_host *mmc,
    932 + struct mmc_ios *ios)
    933 +{
    934 + struct sdhci_host *host = mmc_priv(mmc);
    935 + u32 val;
    936 +
    937 + val = sdhci_readl(host, SDHCI_TEGRA_VENDOR_SYS_SW_CTRL);
    938 +
    939 + if (ios->enhanced_strobe) {
    940 + val |= SDHCI_TEGRA_SYS_SW_CTRL_ENHANCED_STROBE;
    941 + /*
    942 + * When CMD13 is sent from mmc_select_hs400es() after
    943 + * switching to HS400ES mode, the bus is operating at
    944 + * either MMC_HIGH_26_MAX_DTR or MMC_HIGH_52_MAX_DTR.
    945 + * To meet Tegra SDHCI requirement at HS400ES mode, force SDHCI
    946 + * interface clock to MMC_HS200_MAX_DTR (200 MHz) so that host
    947 + * controller CAR clock and the interface clock are rate matched.
    948 + */
    949 + tegra_sdhci_set_clock(host, MMC_HS200_MAX_DTR);
    950 + } else {
    951 + val &= ~SDHCI_TEGRA_SYS_SW_CTRL_ENHANCED_STROBE;
    952 + }
    953 +
    954 + sdhci_writel(host, val, SDHCI_TEGRA_VENDOR_SYS_SW_CTRL);
    955 +}
    956 +
    957 static unsigned int tegra_sdhci_get_max_clock(struct sdhci_host *host)
    958 {
    959 struct sdhci_pltfm_host *pltfm_host = sdhci_priv(host);
    960 diff --git a/drivers/net/bonding/bond_options.c b/drivers/net/bonding/bond_options.c
    961 index 215c109232893..933087d85549a 100644
    962 --- a/drivers/net/bonding/bond_options.c
    963 +++ b/drivers/net/bonding/bond_options.c
    964 @@ -1452,7 +1452,7 @@ static int bond_option_ad_actor_system_set(struct bonding *bond,
    965 mac = (u8 *)&newval->value;
    966 }
    967
    968 - if (!is_valid_ether_addr(mac))
    969 + if (is_multicast_ether_addr(mac))
    970 goto err;
    971
    972 netdev_dbg(bond->dev, "Setting ad_actor_system to %pM\n", mac);
    973 diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_sriov.h b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_sriov.h
    974 index 5f327659efa7a..85b688f60b876 100644
    975 --- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_sriov.h
    976 +++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_sriov.h
    977 @@ -202,7 +202,7 @@ int qlcnic_sriov_get_vf_vport_info(struct qlcnic_adapter *,
    978 struct qlcnic_info *, u16);
    979 int qlcnic_sriov_cfg_vf_guest_vlan(struct qlcnic_adapter *, u16, u8);
    980 void qlcnic_sriov_free_vlans(struct qlcnic_adapter *);
    981 -void qlcnic_sriov_alloc_vlans(struct qlcnic_adapter *);
    982 +int qlcnic_sriov_alloc_vlans(struct qlcnic_adapter *);
    983 bool qlcnic_sriov_check_any_vlan(struct qlcnic_vf_info *);
    984 void qlcnic_sriov_del_vlan_id(struct qlcnic_sriov *,
    985 struct qlcnic_vf_info *, u16);
    986 diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_sriov_common.c b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_sriov_common.c
    987 index f7c2f32237cb0..400bc2c3f222e 100644
    988 --- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_sriov_common.c
    989 +++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_sriov_common.c
    990 @@ -433,7 +433,7 @@ static int qlcnic_sriov_set_guest_vlan_mode(struct qlcnic_adapter *adapter,
    991 struct qlcnic_cmd_args *cmd)
    992 {
    993 struct qlcnic_sriov *sriov = adapter->ahw->sriov;
    994 - int i, num_vlans;
    995 + int i, num_vlans, ret;
    996 u16 *vlans;
    997
    998 if (sriov->allowed_vlans)
    999 @@ -444,7 +444,9 @@ static int qlcnic_sriov_set_guest_vlan_mode(struct qlcnic_adapter *adapter,
    1000 dev_info(&adapter->pdev->dev, "Number of allowed Guest VLANs = %d\n",
    1001 sriov->num_allowed_vlans);
    1002
    1003 - qlcnic_sriov_alloc_vlans(adapter);
    1004 + ret = qlcnic_sriov_alloc_vlans(adapter);
    1005 + if (ret)
    1006 + return ret;
    1007
    1008 if (!sriov->any_vlan)
    1009 return 0;
    1010 @@ -2160,7 +2162,7 @@ static int qlcnic_sriov_vf_resume(struct qlcnic_adapter *adapter)
    1011 return err;
    1012 }
    1013
    1014 -void qlcnic_sriov_alloc_vlans(struct qlcnic_adapter *adapter)
    1015 +int qlcnic_sriov_alloc_vlans(struct qlcnic_adapter *adapter)
    1016 {
    1017 struct qlcnic_sriov *sriov = adapter->ahw->sriov;
    1018 struct qlcnic_vf_info *vf;
    1019 @@ -2170,7 +2172,11 @@ void qlcnic_sriov_alloc_vlans(struct qlcnic_adapter *adapter)
    1020 vf = &sriov->vf_info[i];
    1021 vf->sriov_vlans = kcalloc(sriov->num_allowed_vlans,
    1022 sizeof(*vf->sriov_vlans), GFP_KERNEL);
    1023 + if (!vf->sriov_vlans)
    1024 + return -ENOMEM;
    1025 }
    1026 +
    1027 + return 0;
    1028 }
    1029
    1030 void qlcnic_sriov_free_vlans(struct qlcnic_adapter *adapter)
    1031 diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_sriov_pf.c b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_sriov_pf.c
    1032 index 5632da05145a5..ed218ed2f466d 100644
    1033 --- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_sriov_pf.c
    1034 +++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_sriov_pf.c
    1035 @@ -598,7 +598,9 @@ static int __qlcnic_pci_sriov_enable(struct qlcnic_adapter *adapter,
    1036 if (err)
    1037 goto del_flr_queue;
    1038
    1039 - qlcnic_sriov_alloc_vlans(adapter);
    1040 + err = qlcnic_sriov_alloc_vlans(adapter);
    1041 + if (err)
    1042 + goto del_flr_queue;
    1043
    1044 return err;
    1045
    1046 diff --git a/drivers/net/ethernet/sfc/falcon/rx.c b/drivers/net/ethernet/sfc/falcon/rx.c
    1047 index 05ea3523890a9..d516f81ab37a7 100644
    1048 --- a/drivers/net/ethernet/sfc/falcon/rx.c
    1049 +++ b/drivers/net/ethernet/sfc/falcon/rx.c
    1050 @@ -726,7 +726,10 @@ static void ef4_init_rx_recycle_ring(struct ef4_nic *efx,
    1051 efx->rx_bufs_per_page);
    1052 rx_queue->page_ring = kcalloc(page_ring_size,
    1053 sizeof(*rx_queue->page_ring), GFP_KERNEL);
    1054 - rx_queue->page_ptr_mask = page_ring_size - 1;
    1055 + if (!rx_queue->page_ring)
    1056 + rx_queue->page_ptr_mask = 0;
    1057 + else
    1058 + rx_queue->page_ptr_mask = page_ring_size - 1;
    1059 }
    1060
    1061 void ef4_init_rx_queue(struct ef4_rx_queue *rx_queue)
    1062 diff --git a/drivers/net/ethernet/smsc/smc911x.c b/drivers/net/ethernet/smsc/smc911x.c
    1063 index 7b65e79d6ae91..82ca29b6781b2 100644
    1064 --- a/drivers/net/ethernet/smsc/smc911x.c
    1065 +++ b/drivers/net/ethernet/smsc/smc911x.c
    1066 @@ -2069,6 +2069,11 @@ static int smc911x_drv_probe(struct platform_device *pdev)
    1067
    1068 ndev->dma = (unsigned char)-1;
    1069 ndev->irq = platform_get_irq(pdev, 0);
    1070 + if (ndev->irq < 0) {
    1071 + ret = ndev->irq;
    1072 + goto release_both;
    1073 + }
    1074 +
    1075 lp = netdev_priv(ndev);
    1076 lp->netdev = ndev;
    1077 #ifdef SMC_DYNAMIC_BUS_CONFIG
    1078 diff --git a/drivers/net/fjes/fjes_main.c b/drivers/net/fjes/fjes_main.c
    1079 index b89b4a3800a4d..bef0133696c31 100644
    1080 --- a/drivers/net/fjes/fjes_main.c
    1081 +++ b/drivers/net/fjes/fjes_main.c
    1082 @@ -1269,6 +1269,11 @@ static int fjes_probe(struct platform_device *plat_dev)
    1083 hw->hw_res.start = res->start;
    1084 hw->hw_res.size = resource_size(res);
    1085 hw->hw_res.irq = platform_get_irq(plat_dev, 0);
    1086 + if (hw->hw_res.irq < 0) {
    1087 + err = hw->hw_res.irq;
    1088 + goto err_free_control_wq;
    1089 + }
    1090 +
    1091 err = fjes_hw_init(&adapter->hw);
    1092 if (err)
    1093 goto err_free_control_wq;
    1094 diff --git a/drivers/net/hamradio/mkiss.c b/drivers/net/hamradio/mkiss.c
    1095 index 352f9e75954ce..d2eb33f53993b 100644
    1096 --- a/drivers/net/hamradio/mkiss.c
    1097 +++ b/drivers/net/hamradio/mkiss.c
    1098 @@ -793,13 +793,14 @@ static void mkiss_close(struct tty_struct *tty)
    1099 */
    1100 netif_stop_queue(ax->dev);
    1101
    1102 - /* Free all AX25 frame buffers. */
    1103 + unregister_netdev(ax->dev);
    1104 +
    1105 + /* Free all AX25 frame buffers after unreg. */
    1106 kfree(ax->rbuff);
    1107 kfree(ax->xbuff);
    1108
    1109 ax->tty = NULL;
    1110
    1111 - unregister_netdev(ax->dev);
    1112 free_netdev(ax->dev);
    1113 }
    1114
    1115 diff --git a/drivers/net/usb/lan78xx.c b/drivers/net/usb/lan78xx.c
    1116 index 2d98373f7a71d..ce3c8f476d75c 100644
    1117 --- a/drivers/net/usb/lan78xx.c
    1118 +++ b/drivers/net/usb/lan78xx.c
    1119 @@ -64,6 +64,8 @@
    1120 #define LAN7801_USB_PRODUCT_ID (0x7801)
    1121 #define LAN78XX_EEPROM_MAGIC (0x78A5)
    1122 #define LAN78XX_OTP_MAGIC (0x78F3)
    1123 +#define AT29M2AF_USB_VENDOR_ID (0x07C9)
    1124 +#define AT29M2AF_USB_PRODUCT_ID (0x0012)
    1125
    1126 #define MII_READ 1
    1127 #define MII_WRITE 0
    1128 @@ -4153,6 +4155,10 @@ static const struct usb_device_id products[] = {
    1129 /* LAN7801 USB Gigabit Ethernet Device */
    1130 USB_DEVICE(LAN78XX_USB_VENDOR_ID, LAN7801_USB_PRODUCT_ID),
    1131 },
    1132 + {
    1133 + /* ATM2-AF USB Gigabit Ethernet Device */
    1134 + USB_DEVICE(AT29M2AF_USB_VENDOR_ID, AT29M2AF_USB_PRODUCT_ID),
    1135 + },
    1136 {},
    1137 };
    1138 MODULE_DEVICE_TABLE(usb, products);
    1139 diff --git a/drivers/pinctrl/mediatek/pinctrl-mtk-common-v2.c b/drivers/pinctrl/mediatek/pinctrl-mtk-common-v2.c
    1140 index 20e1c890e73b3..c3e6f3c1b4743 100644
    1141 --- a/drivers/pinctrl/mediatek/pinctrl-mtk-common-v2.c
    1142 +++ b/drivers/pinctrl/mediatek/pinctrl-mtk-common-v2.c
    1143 @@ -236,8 +236,12 @@ static int mtk_xt_get_gpio_n(void *data, unsigned long eint_n,
    1144 desc = (const struct mtk_pin_desc *)hw->soc->pins;
    1145 *gpio_chip = &hw->chip;
    1146
    1147 - /* Be greedy to guess first gpio_n is equal to eint_n */
    1148 - if (desc[eint_n].eint.eint_n == eint_n)
    1149 + /*
    1150 + * Be greedy to guess first gpio_n is equal to eint_n.
    1151 + * Only eint virtual eint number is greater than gpio number.
    1152 + */
    1153 + if (hw->soc->npins > eint_n &&
    1154 + desc[eint_n].eint.eint_n == eint_n)
    1155 *gpio_n = eint_n;
    1156 else
    1157 *gpio_n = mtk_xt_find_eint_num(hw, eint_n);
    1158 diff --git a/drivers/pinctrl/stm32/pinctrl-stm32.c b/drivers/pinctrl/stm32/pinctrl-stm32.c
    1159 index 138cbc012cd89..f9abd4364fbaa 100644
    1160 --- a/drivers/pinctrl/stm32/pinctrl-stm32.c
    1161 +++ b/drivers/pinctrl/stm32/pinctrl-stm32.c
    1162 @@ -1186,10 +1186,10 @@ static int stm32_gpiolib_register_bank(struct stm32_pinctrl *pctl,
    1163 bank_nr = args.args[1] / STM32_GPIO_PINS_PER_BANK;
    1164 bank->gpio_chip.base = args.args[1];
    1165
    1166 - npins = args.args[2];
    1167 - while (!of_parse_phandle_with_fixed_args(np, "gpio-ranges", 3,
    1168 - ++i, &args))
    1169 - npins += args.args[2];
    1170 + /* get the last defined gpio line (offset + nb of pins) */
    1171 + npins = args.args[0] + args.args[2];
    1172 + while (!of_parse_phandle_with_fixed_args(np, "gpio-ranges", 3, ++i, &args))
    1173 + npins = max(npins, (int)(args.args[0] + args.args[2]));
    1174 } else {
    1175 bank_nr = pctl->nbanks;
    1176 bank->gpio_chip.base = bank_nr * STM32_GPIO_PINS_PER_BANK;
    1177 diff --git a/drivers/spi/spi-armada-3700.c b/drivers/spi/spi-armada-3700.c
    1178 index e450ee17787f0..4a4e2877414a1 100644
    1179 --- a/drivers/spi/spi-armada-3700.c
    1180 +++ b/drivers/spi/spi-armada-3700.c
    1181 @@ -906,7 +906,7 @@ static int a3700_spi_probe(struct platform_device *pdev)
    1182 return 0;
    1183
    1184 error_clk:
    1185 - clk_disable_unprepare(spi->clk);
    1186 + clk_unprepare(spi->clk);
    1187 error:
    1188 spi_master_put(master);
    1189 out:
    1190 diff --git a/drivers/tee/optee/shm_pool.c b/drivers/tee/optee/shm_pool.c
    1191 index c41a9a501a6e9..fa75024f16f7f 100644
    1192 --- a/drivers/tee/optee/shm_pool.c
    1193 +++ b/drivers/tee/optee/shm_pool.c
    1194 @@ -41,10 +41,8 @@ static int pool_op_alloc(struct tee_shm_pool_mgr *poolm,
    1195 goto err;
    1196 }
    1197
    1198 - for (i = 0; i < nr_pages; i++) {
    1199 - pages[i] = page;
    1200 - page++;
    1201 - }
    1202 + for (i = 0; i < nr_pages; i++)
    1203 + pages[i] = page + i;
    1204
    1205 shm->flags |= TEE_SHM_REGISTER;
    1206 rc = optee_shm_register(shm->ctx, shm, pages, nr_pages,
    1207 diff --git a/drivers/tty/serial/8250/8250_fintek.c b/drivers/tty/serial/8250/8250_fintek.c
    1208 index 31c91c2f8c6e7..e24161004ddc1 100644
    1209 --- a/drivers/tty/serial/8250/8250_fintek.c
    1210 +++ b/drivers/tty/serial/8250/8250_fintek.c
    1211 @@ -285,24 +285,6 @@ static void fintek_8250_set_max_fifo(struct fintek_8250 *pdata)
    1212 }
    1213 }
    1214
    1215 -static void fintek_8250_goto_highspeed(struct uart_8250_port *uart,
    1216 - struct fintek_8250 *pdata)
    1217 -{
    1218 - sio_write_reg(pdata, LDN, pdata->index);
    1219 -
    1220 - switch (pdata->pid) {
    1221 - case CHIP_ID_F81866: /* set uart clock for high speed serial mode */
    1222 - sio_write_mask_reg(pdata, F81866_UART_CLK,
    1223 - F81866_UART_CLK_MASK,
    1224 - F81866_UART_CLK_14_769MHZ);
    1225 -
    1226 - uart->port.uartclk = 921600 * 16;
    1227 - break;
    1228 - default: /* leave clock speed untouched */
    1229 - break;
    1230 - }
    1231 -}
    1232 -
    1233 static void fintek_8250_set_termios(struct uart_port *port,
    1234 struct ktermios *termios,
    1235 struct ktermios *old)
    1236 @@ -422,7 +404,6 @@ static int probe_setup_port(struct fintek_8250 *pdata,
    1237
    1238 fintek_8250_set_irq_mode(pdata, level_mode);
    1239 fintek_8250_set_max_fifo(pdata);
    1240 - fintek_8250_goto_highspeed(uart, pdata);
    1241
    1242 fintek_8250_exit_key(addr[i]);
    1243
    1244 diff --git a/drivers/usb/gadget/function/u_ether.c b/drivers/usb/gadget/function/u_ether.c
    1245 index 57da62e331848..271bd08f4a255 100644
    1246 --- a/drivers/usb/gadget/function/u_ether.c
    1247 +++ b/drivers/usb/gadget/function/u_ether.c
    1248 @@ -860,19 +860,23 @@ int gether_register_netdev(struct net_device *net)
    1249 {
    1250 struct eth_dev *dev;
    1251 struct usb_gadget *g;
    1252 - struct sockaddr sa;
    1253 int status;
    1254
    1255 if (!net->dev.parent)
    1256 return -EINVAL;
    1257 dev = netdev_priv(net);
    1258 g = dev->gadget;
    1259 +
    1260 + memcpy(net->dev_addr, dev->dev_mac, ETH_ALEN);
    1261 + net->addr_assign_type = NET_ADDR_RANDOM;
    1262 +
    1263 status = register_netdev(net);
    1264 if (status < 0) {
    1265 dev_dbg(&g->dev, "register_netdev failed, %d\n", status);
    1266 return status;
    1267 } else {
    1268 INFO(dev, "HOST MAC %pM\n", dev->host_mac);
    1269 + INFO(dev, "MAC %pM\n", dev->dev_mac);
    1270
    1271 /* two kinds of host-initiated state changes:
    1272 * - iff DATA transfer is active, carrier is "on"
    1273 @@ -880,15 +884,6 @@ int gether_register_netdev(struct net_device *net)
    1274 */
    1275 netif_carrier_off(net);
    1276 }
    1277 - sa.sa_family = net->type;
    1278 - memcpy(sa.sa_data, dev->dev_mac, ETH_ALEN);
    1279 - rtnl_lock();
    1280 - status = dev_set_mac_address(net, &sa, NULL);
    1281 - rtnl_unlock();
    1282 - if (status)
    1283 - pr_warn("cannot set self ethernet address: %d\n", status);
    1284 - else
    1285 - INFO(dev, "MAC %pM\n", dev->dev_mac);
    1286
    1287 return status;
    1288 }
    1289 diff --git a/fs/f2fs/xattr.c b/fs/f2fs/xattr.c
    1290 index 296b3189448a4..cf1bfed1e6621 100644
    1291 --- a/fs/f2fs/xattr.c
    1292 +++ b/fs/f2fs/xattr.c
    1293 @@ -661,8 +661,17 @@ static int __f2fs_setxattr(struct inode *inode, int index,
    1294 }
    1295
    1296 last = here;
    1297 - while (!IS_XATTR_LAST_ENTRY(last))
    1298 + while (!IS_XATTR_LAST_ENTRY(last)) {
    1299 + if ((void *)(last) + sizeof(__u32) > last_base_addr ||
    1300 + (void *)XATTR_NEXT_ENTRY(last) > last_base_addr) {
    1301 + f2fs_err(F2FS_I_SB(inode), "inode (%lu) has invalid last xattr entry, entry_size: %zu",
    1302 + inode->i_ino, ENTRY_SIZE(last));
    1303 + set_sbi_flag(F2FS_I_SB(inode), SBI_NEED_FSCK);
    1304 + error = -EFSCORRUPTED;
    1305 + goto exit;
    1306 + }
    1307 last = XATTR_NEXT_ENTRY(last);
    1308 + }
    1309
    1310 newsize = XATTR_ALIGN(sizeof(struct f2fs_xattr_entry) + len + size);
    1311
    1312 diff --git a/include/linux/virtio_net.h b/include/linux/virtio_net.h
    1313 index 04e87f4b9417c..a960de68ac69e 100644
    1314 --- a/include/linux/virtio_net.h
    1315 +++ b/include/linux/virtio_net.h
    1316 @@ -7,9 +7,27 @@
    1317 #include <uapi/linux/udp.h>
    1318 #include <uapi/linux/virtio_net.h>
    1319
    1320 +static inline bool virtio_net_hdr_match_proto(__be16 protocol, __u8 gso_type)
    1321 +{
    1322 + switch (gso_type & ~VIRTIO_NET_HDR_GSO_ECN) {
    1323 + case VIRTIO_NET_HDR_GSO_TCPV4:
    1324 + return protocol == cpu_to_be16(ETH_P_IP);
    1325 + case VIRTIO_NET_HDR_GSO_TCPV6:
    1326 + return protocol == cpu_to_be16(ETH_P_IPV6);
    1327 + case VIRTIO_NET_HDR_GSO_UDP:
    1328 + return protocol == cpu_to_be16(ETH_P_IP) ||
    1329 + protocol == cpu_to_be16(ETH_P_IPV6);
    1330 + default:
    1331 + return false;
    1332 + }
    1333 +}
    1334 +
    1335 static inline int virtio_net_hdr_set_proto(struct sk_buff *skb,
    1336 const struct virtio_net_hdr *hdr)
    1337 {
    1338 + if (skb->protocol)
    1339 + return 0;
    1340 +
    1341 switch (hdr->gso_type & ~VIRTIO_NET_HDR_GSO_ECN) {
    1342 case VIRTIO_NET_HDR_GSO_TCPV4:
    1343 case VIRTIO_NET_HDR_GSO_UDP:
    1344 @@ -88,9 +106,12 @@ static inline int virtio_net_hdr_to_skb(struct sk_buff *skb,
    1345 if (!skb->protocol) {
    1346 __be16 protocol = dev_parse_header_protocol(skb);
    1347
    1348 - virtio_net_hdr_set_proto(skb, hdr);
    1349 - if (protocol && protocol != skb->protocol)
    1350 + if (!protocol)
    1351 + virtio_net_hdr_set_proto(skb, hdr);
    1352 + else if (!virtio_net_hdr_match_proto(protocol, hdr->gso_type))
    1353 return -EINVAL;
    1354 + else
    1355 + skb->protocol = protocol;
    1356 }
    1357 retry:
    1358 if (!skb_flow_dissect_flow_keys_basic(NULL, skb, &keys,
    1359 diff --git a/mm/mempolicy.c b/mm/mempolicy.c
    1360 index 87d165923fee2..2c4082f71d258 100644
    1361 --- a/mm/mempolicy.c
    1362 +++ b/mm/mempolicy.c
    1363 @@ -2143,8 +2143,9 @@ alloc_pages_vma(gfp_t gfp, int order, struct vm_area_struct *vma,
    1364 * memory as well.
    1365 */
    1366 if (!page && (gfp & __GFP_DIRECT_RECLAIM))
    1367 - page = __alloc_pages_node(hpage_node,
    1368 - gfp | __GFP_NORETRY, order);
    1369 + page = __alloc_pages_nodemask(gfp | __GFP_NORETRY,
    1370 + order, hpage_node,
    1371 + nmask);
    1372
    1373 goto out;
    1374 }
    1375 diff --git a/net/ax25/af_ax25.c b/net/ax25/af_ax25.c
    1376 index 2fdb1b573e8c8..1f84d41e22c36 100644
    1377 --- a/net/ax25/af_ax25.c
    1378 +++ b/net/ax25/af_ax25.c
    1379 @@ -85,8 +85,10 @@ static void ax25_kill_by_device(struct net_device *dev)
    1380 again:
    1381 ax25_for_each(s, &ax25_list) {
    1382 if (s->ax25_dev == ax25_dev) {
    1383 - s->ax25_dev = NULL;
    1384 spin_unlock_bh(&ax25_list_lock);
    1385 + lock_sock(s->sk);
    1386 + s->ax25_dev = NULL;
    1387 + release_sock(s->sk);
    1388 ax25_disconnect(s, ENETUNREACH);
    1389 spin_lock_bh(&ax25_list_lock);
    1390
    1391 diff --git a/net/netfilter/nfnetlink_log.c b/net/netfilter/nfnetlink_log.c
    1392 index 7ca2ca4bba055..b36af4741ad3c 100644
    1393 --- a/net/netfilter/nfnetlink_log.c
    1394 +++ b/net/netfilter/nfnetlink_log.c
    1395 @@ -557,7 +557,8 @@ __build_packet_message(struct nfnl_log_net *log,
    1396 goto nla_put_failure;
    1397
    1398 if (indev && skb->dev &&
    1399 - skb->mac_header != skb->network_header) {
    1400 + skb_mac_header_was_set(skb) &&
    1401 + skb_mac_header_len(skb) != 0) {
    1402 struct nfulnl_msg_packet_hw phw;
    1403 int len;
    1404
    1405 diff --git a/net/netfilter/nfnetlink_queue.c b/net/netfilter/nfnetlink_queue.c
    1406 index a8cb562da3fea..ca21f8f4a47c1 100644
    1407 --- a/net/netfilter/nfnetlink_queue.c
    1408 +++ b/net/netfilter/nfnetlink_queue.c
    1409 @@ -562,7 +562,8 @@ nfqnl_build_packet_message(struct net *net, struct nfqnl_instance *queue,
    1410 goto nla_put_failure;
    1411
    1412 if (indev && entskb->dev &&
    1413 - skb_mac_header_was_set(entskb)) {
    1414 + skb_mac_header_was_set(entskb) &&
    1415 + skb_mac_header_len(entskb) != 0) {
    1416 struct nfqnl_msg_packet_hw phw;
    1417 int len;
    1418
    1419 diff --git a/net/phonet/pep.c b/net/phonet/pep.c
    1420 index 4577e43cb7778..a07e13f63332c 100644
    1421 --- a/net/phonet/pep.c
    1422 +++ b/net/phonet/pep.c
    1423 @@ -946,6 +946,8 @@ static int pep_ioctl(struct sock *sk, int cmd, unsigned long arg)
    1424 ret = -EBUSY;
    1425 else if (sk->sk_state == TCP_ESTABLISHED)
    1426 ret = -EISCONN;
    1427 + else if (!pn->pn_sk.sobject)
    1428 + ret = -EADDRNOTAVAIL;
    1429 else
    1430 ret = pep_sock_enable(sk, NULL, 0);
    1431 release_sock(sk);
    1432 diff --git a/sound/core/jack.c b/sound/core/jack.c
    1433 index fb26196571a7c..8b209750c7a9c 100644
    1434 --- a/sound/core/jack.c
    1435 +++ b/sound/core/jack.c
    1436 @@ -220,6 +220,10 @@ int snd_jack_new(struct snd_card *card, const char *id, int type,
    1437 return -ENOMEM;
    1438
    1439 jack->id = kstrdup(id, GFP_KERNEL);
    1440 + if (jack->id == NULL) {
    1441 + kfree(jack);
    1442 + return -ENOMEM;
    1443 + }
    1444
    1445 /* don't creat input device for phantom jack */
    1446 if (!phantom_jack) {
    1447 diff --git a/sound/drivers/opl3/opl3_midi.c b/sound/drivers/opl3/opl3_midi.c
    1448 index 280cc79870cf8..ce38ec09d4087 100644
    1449 --- a/sound/drivers/opl3/opl3_midi.c
    1450 +++ b/sound/drivers/opl3/opl3_midi.c
    1451 @@ -398,7 +398,7 @@ void snd_opl3_note_on(void *p, int note, int vel, struct snd_midi_channel *chan)
    1452 }
    1453 if (instr_4op) {
    1454 vp2 = &opl3->voices[voice + 3];
    1455 - if (vp->state > 0) {
    1456 + if (vp2->state > 0) {
    1457 opl3_reg = reg_side | (OPL3_REG_KEYON_BLOCK +
    1458 voice_offset + 3);
    1459 reg_val = vp->keyon_reg & ~OPL3_KEYON_BIT;
    1460 diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
    1461 index 9514db7c2a86d..022799479a722 100644
    1462 --- a/sound/pci/hda/patch_realtek.c
    1463 +++ b/sound/pci/hda/patch_realtek.c
    1464 @@ -8101,6 +8101,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = {
    1465 SND_PCI_QUIRK(0x103c, 0x84da, "HP OMEN dc0019-ur", ALC295_FIXUP_HP_OMEN),
    1466 SND_PCI_QUIRK(0x103c, 0x84e7, "HP Pavilion 15", ALC269_FIXUP_HP_MUTE_LED_MIC3),
    1467 SND_PCI_QUIRK(0x103c, 0x8519, "HP Spectre x360 15-df0xxx", ALC285_FIXUP_HP_SPECTRE_X360),
    1468 + SND_PCI_QUIRK(0x103c, 0x860f, "HP ZBook 15 G6", ALC285_FIXUP_HP_GPIO_AMP_INIT),
    1469 SND_PCI_QUIRK(0x103c, 0x861f, "HP Elite Dragonfly G1", ALC285_FIXUP_HP_GPIO_AMP_INIT),
    1470 SND_PCI_QUIRK(0x103c, 0x869d, "HP", ALC236_FIXUP_HP_MUTE_LED),
    1471 SND_PCI_QUIRK(0x103c, 0x8724, "HP EliteBook 850 G7", ALC285_FIXUP_HP_GPIO_LED),