diff options
| -rw-r--r-- | 0000_README | 4 | ||||
| -rw-r--r-- | 1130_linux-4.9.131.patch | 2733 |
2 files changed, 2737 insertions, 0 deletions
diff --git a/0000_README b/0000_README index 776fab97..5b6207f8 100644 --- a/0000_README +++ b/0000_README @@ -563,6 +563,10 @@ Patch: 1129_linux-4.9.130.patch From: http://www.kernel.org Desc: Linux 4.9.130 +Patch: 1130_linux-4.9.131.patch +From: http://www.kernel.org +Desc: Linux 4.9.131 + Patch: 1500_XATTR_USER_PREFIX.patch From: https://bugs.gentoo.org/show_bug.cgi?id=470644 Desc: Support for namespace user.pax.* on tmpfs. diff --git a/1130_linux-4.9.131.patch b/1130_linux-4.9.131.patch new file mode 100644 index 00000000..118d8230 --- /dev/null +++ b/1130_linux-4.9.131.patch @@ -0,0 +1,2733 @@ +diff --git a/Documentation/hwmon/ina2xx b/Documentation/hwmon/ina2xx +index cfd31d94c872..f8bf14055c2f 100644 +--- a/Documentation/hwmon/ina2xx ++++ b/Documentation/hwmon/ina2xx +@@ -32,7 +32,7 @@ Supported chips: + Datasheet: Publicly available at the Texas Instruments website + http://www.ti.com/ + +-Author: Lothar Felten <l-felten@ti.com> ++Author: Lothar Felten <lothar.felten@gmail.com> + + Description + ----------- +diff --git a/Makefile b/Makefile +index b98e04a5e1e5..73c4e9a8c127 100644 +--- a/Makefile ++++ b/Makefile +@@ -1,6 +1,6 @@ + VERSION = 4 + PATCHLEVEL = 9 +-SUBLEVEL = 130 ++SUBLEVEL = 131 + EXTRAVERSION = + NAME = Roaring Lionus + +diff --git a/arch/arm/boot/dts/dra7.dtsi b/arch/arm/boot/dts/dra7.dtsi +index ce54a70b7695..a1a928064b53 100644 +--- a/arch/arm/boot/dts/dra7.dtsi ++++ b/arch/arm/boot/dts/dra7.dtsi +@@ -1770,7 +1770,7 @@ + }; + }; + +- dcan1: can@481cc000 { ++ dcan1: can@4ae3c000 { + compatible = "ti,dra7-d_can"; + ti,hwmods = "dcan1"; + reg = <0x4ae3c000 0x2000>; +@@ -1780,7 +1780,7 @@ + status = "disabled"; + }; + +- dcan2: can@481d0000 { ++ dcan2: can@48480000 { + compatible = "ti,dra7-d_can"; + ti,hwmods = "dcan2"; + reg = <0x48480000 0x2000>; +diff --git a/arch/arm/mach-mvebu/pmsu.c b/arch/arm/mach-mvebu/pmsu.c +index f39bd51bce18..faaf7c3aaf9f 100644 +--- a/arch/arm/mach-mvebu/pmsu.c ++++ b/arch/arm/mach-mvebu/pmsu.c +@@ -116,8 +116,8 @@ void mvebu_pmsu_set_cpu_boot_addr(int hw_cpu, void *boot_addr) + PMSU_BOOT_ADDR_REDIRECT_OFFSET(hw_cpu)); + } + +-extern unsigned char mvebu_boot_wa_start; +-extern unsigned char mvebu_boot_wa_end; ++extern unsigned char mvebu_boot_wa_start[]; ++extern unsigned char mvebu_boot_wa_end[]; + + /* + * This function sets up the boot address workaround needed for SMP +@@ -130,7 +130,7 @@ int mvebu_setup_boot_addr_wa(unsigned int crypto_eng_target, + phys_addr_t resume_addr_reg) + { + void __iomem *sram_virt_base; +- u32 code_len = &mvebu_boot_wa_end - &mvebu_boot_wa_start; ++ u32 code_len = mvebu_boot_wa_end - mvebu_boot_wa_start; + + mvebu_mbus_del_window(BOOTROM_BASE, BOOTROM_SIZE); + mvebu_mbus_add_window_by_id(crypto_eng_target, crypto_eng_attribute, +diff --git a/arch/arm/mach-omap2/omap_hwmod_reset.c b/arch/arm/mach-omap2/omap_hwmod_reset.c +index b68f9c0aff0b..d5ddba00bb73 100644 +--- a/arch/arm/mach-omap2/omap_hwmod_reset.c ++++ b/arch/arm/mach-omap2/omap_hwmod_reset.c +@@ -92,11 +92,13 @@ static void omap_rtc_wait_not_busy(struct omap_hwmod *oh) + */ + void omap_hwmod_rtc_unlock(struct omap_hwmod *oh) + { +- local_irq_disable(); ++ unsigned long flags; ++ ++ local_irq_save(flags); + omap_rtc_wait_not_busy(oh); + omap_hwmod_write(OMAP_RTC_KICK0_VALUE, oh, OMAP_RTC_KICK0_REG); + omap_hwmod_write(OMAP_RTC_KICK1_VALUE, oh, OMAP_RTC_KICK1_REG); +- local_irq_enable(); ++ local_irq_restore(flags); + } + + /** +@@ -110,9 +112,11 @@ void omap_hwmod_rtc_unlock(struct omap_hwmod *oh) + */ + void omap_hwmod_rtc_lock(struct omap_hwmod *oh) + { +- local_irq_disable(); ++ unsigned long flags; ++ ++ local_irq_save(flags); + omap_rtc_wait_not_busy(oh); + omap_hwmod_write(0x0, oh, OMAP_RTC_KICK0_REG); + omap_hwmod_write(0x0, oh, OMAP_RTC_KICK1_REG); +- local_irq_enable(); ++ local_irq_restore(flags); + } +diff --git a/arch/arm64/include/asm/kvm_emulate.h b/arch/arm64/include/asm/kvm_emulate.h +index fe39e6841326..ba0d52c22b50 100644 +--- a/arch/arm64/include/asm/kvm_emulate.h ++++ b/arch/arm64/include/asm/kvm_emulate.h +@@ -42,6 +42,11 @@ void kvm_inject_vabt(struct kvm_vcpu *vcpu); + void kvm_inject_dabt(struct kvm_vcpu *vcpu, unsigned long addr); + void kvm_inject_pabt(struct kvm_vcpu *vcpu, unsigned long addr); + ++static inline bool vcpu_el1_is_32bit(struct kvm_vcpu *vcpu) ++{ ++ return !(vcpu->arch.hcr_el2 & HCR_RW); ++} ++ + static inline void vcpu_reset_hcr(struct kvm_vcpu *vcpu) + { + vcpu->arch.hcr_el2 = HCR_GUEST_FLAGS; +diff --git a/arch/arm64/kvm/guest.c b/arch/arm64/kvm/guest.c +index d3e0a2ffb383..e41a7b4f3a9b 100644 +--- a/arch/arm64/kvm/guest.c ++++ b/arch/arm64/kvm/guest.c +@@ -57,6 +57,45 @@ static u64 core_reg_offset_from_id(u64 id) + return id & ~(KVM_REG_ARCH_MASK | KVM_REG_SIZE_MASK | KVM_REG_ARM_CORE); + } + ++static int validate_core_offset(const struct kvm_one_reg *reg) ++{ ++ u64 off = core_reg_offset_from_id(reg->id); ++ int size; ++ ++ switch (off) { ++ case KVM_REG_ARM_CORE_REG(regs.regs[0]) ... ++ KVM_REG_ARM_CORE_REG(regs.regs[30]): ++ case KVM_REG_ARM_CORE_REG(regs.sp): ++ case KVM_REG_ARM_CORE_REG(regs.pc): ++ case KVM_REG_ARM_CORE_REG(regs.pstate): ++ case KVM_REG_ARM_CORE_REG(sp_el1): ++ case KVM_REG_ARM_CORE_REG(elr_el1): ++ case KVM_REG_ARM_CORE_REG(spsr[0]) ... ++ KVM_REG_ARM_CORE_REG(spsr[KVM_NR_SPSR - 1]): ++ size = sizeof(__u64); ++ break; ++ ++ case KVM_REG_ARM_CORE_REG(fp_regs.vregs[0]) ... ++ KVM_REG_ARM_CORE_REG(fp_regs.vregs[31]): ++ size = sizeof(__uint128_t); ++ break; ++ ++ case KVM_REG_ARM_CORE_REG(fp_regs.fpsr): ++ case KVM_REG_ARM_CORE_REG(fp_regs.fpcr): ++ size = sizeof(__u32); ++ break; ++ ++ default: ++ return -EINVAL; ++ } ++ ++ if (KVM_REG_SIZE(reg->id) == size && ++ IS_ALIGNED(off, size / sizeof(__u32))) ++ return 0; ++ ++ return -EINVAL; ++} ++ + static int get_core_reg(struct kvm_vcpu *vcpu, const struct kvm_one_reg *reg) + { + /* +@@ -76,6 +115,9 @@ static int get_core_reg(struct kvm_vcpu *vcpu, const struct kvm_one_reg *reg) + (off + (KVM_REG_SIZE(reg->id) / sizeof(__u32))) >= nr_regs) + return -ENOENT; + ++ if (validate_core_offset(reg)) ++ return -EINVAL; ++ + if (copy_to_user(uaddr, ((u32 *)regs) + off, KVM_REG_SIZE(reg->id))) + return -EFAULT; + +@@ -98,6 +140,9 @@ static int set_core_reg(struct kvm_vcpu *vcpu, const struct kvm_one_reg *reg) + (off + (KVM_REG_SIZE(reg->id) / sizeof(__u32))) >= nr_regs) + return -ENOENT; + ++ if (validate_core_offset(reg)) ++ return -EINVAL; ++ + if (KVM_REG_SIZE(reg->id) > sizeof(tmp)) + return -EINVAL; + +@@ -107,17 +152,25 @@ static int set_core_reg(struct kvm_vcpu *vcpu, const struct kvm_one_reg *reg) + } + + if (off == KVM_REG_ARM_CORE_REG(regs.pstate)) { +- u32 mode = (*(u32 *)valp) & COMPAT_PSR_MODE_MASK; ++ u64 mode = (*(u64 *)valp) & COMPAT_PSR_MODE_MASK; + switch (mode) { + case COMPAT_PSR_MODE_USR: ++ if (!system_supports_32bit_el0()) ++ return -EINVAL; ++ break; + case COMPAT_PSR_MODE_FIQ: + case COMPAT_PSR_MODE_IRQ: + case COMPAT_PSR_MODE_SVC: + case COMPAT_PSR_MODE_ABT: + case COMPAT_PSR_MODE_UND: ++ if (!vcpu_el1_is_32bit(vcpu)) ++ return -EINVAL; ++ break; + case PSR_MODE_EL0t: + case PSR_MODE_EL1t: + case PSR_MODE_EL1h: ++ if (vcpu_el1_is_32bit(vcpu)) ++ return -EINVAL; + break; + default: + err = -EINVAL; +diff --git a/arch/powerpc/kernel/machine_kexec.c b/arch/powerpc/kernel/machine_kexec.c +index 2694d078741d..9dafd7af39b8 100644 +--- a/arch/powerpc/kernel/machine_kexec.c ++++ b/arch/powerpc/kernel/machine_kexec.c +@@ -186,7 +186,12 @@ void __init reserve_crashkernel(void) + (unsigned long)(crashk_res.start >> 20), + (unsigned long)(memblock_phys_mem_size() >> 20)); + +- memblock_reserve(crashk_res.start, crash_size); ++ if (!memblock_is_region_memory(crashk_res.start, crash_size) || ++ memblock_reserve(crashk_res.start, crash_size)) { ++ pr_err("Failed to reserve memory for crashkernel!\n"); ++ crashk_res.start = crashk_res.end = 0; ++ return; ++ } + } + + int overlaps_crashkernel(unsigned long start, unsigned long size) +diff --git a/arch/powerpc/platforms/powernv/pci-ioda.c b/arch/powerpc/platforms/powernv/pci-ioda.c +index f52cc6fd4290..8015e40bc7ee 100644 +--- a/arch/powerpc/platforms/powernv/pci-ioda.c ++++ b/arch/powerpc/platforms/powernv/pci-ioda.c +@@ -2623,7 +2623,7 @@ static long pnv_pci_ioda2_table_alloc_pages(int nid, __u64 bus_offset, + level_shift = entries_shift + 3; + level_shift = max_t(unsigned, level_shift, PAGE_SHIFT); + +- if ((level_shift - 3) * levels + page_shift >= 60) ++ if ((level_shift - 3) * levels + page_shift >= 55) + return -EINVAL; + + /* Allocate TCE table */ +diff --git a/arch/s390/mm/extmem.c b/arch/s390/mm/extmem.c +index 02042b6b66bf..e6665a6e105e 100644 +--- a/arch/s390/mm/extmem.c ++++ b/arch/s390/mm/extmem.c +@@ -79,7 +79,7 @@ struct qin64 { + struct dcss_segment { + struct list_head list; + char dcss_name[8]; +- char res_name[15]; ++ char res_name[16]; + unsigned long start_addr; + unsigned long end; + atomic_t ref_count; +@@ -432,7 +432,7 @@ __segment_load (char *name, int do_nonshared, unsigned long *addr, unsigned long + memcpy(&seg->res_name, seg->dcss_name, 8); + EBCASC(seg->res_name, 8); + seg->res_name[8] = '\0'; +- strncat(seg->res_name, " (DCSS)", 7); ++ strlcat(seg->res_name, " (DCSS)", sizeof(seg->res_name)); + seg->res->name = seg->res_name; + rc = seg->vm_segtype; + if (rc == SEG_TYPE_SC || +diff --git a/arch/s390/mm/pgalloc.c b/arch/s390/mm/pgalloc.c +index 995f78532cc2..781a044e1702 100644 +--- a/arch/s390/mm/pgalloc.c ++++ b/arch/s390/mm/pgalloc.c +@@ -26,7 +26,7 @@ static struct ctl_table page_table_sysctl[] = { + .data = &page_table_allocate_pgste, + .maxlen = sizeof(int), + .mode = S_IRUGO | S_IWUSR, +- .proc_handler = proc_dointvec, ++ .proc_handler = proc_dointvec_minmax, + .extra1 = &page_table_allocate_pgste_min, + .extra2 = &page_table_allocate_pgste_max, + }, +diff --git a/arch/x86/entry/entry_64.S b/arch/x86/entry/entry_64.S +index 76c1d85e749b..870e941c1947 100644 +--- a/arch/x86/entry/entry_64.S ++++ b/arch/x86/entry/entry_64.S +@@ -91,7 +91,7 @@ ENDPROC(native_usergs_sysret64) + .endm + + .macro TRACE_IRQS_IRETQ_DEBUG +- bt $9, EFLAGS(%rsp) /* interrupts off? */ ++ btl $9, EFLAGS(%rsp) /* interrupts off? */ + jnc 1f + TRACE_IRQS_ON_DEBUG + 1: +@@ -485,7 +485,7 @@ retint_kernel: + #ifdef CONFIG_PREEMPT + /* Interrupts are off */ + /* Check if we need preemption */ +- bt $9, EFLAGS(%rsp) /* were interrupts off? */ ++ btl $9, EFLAGS(%rsp) /* were interrupts off? */ + jnc 1f + 0: cmpl $0, PER_CPU_VAR(__preempt_count) + jnz 1f +diff --git a/arch/x86/events/intel/lbr.c b/arch/x86/events/intel/lbr.c +index 5d103a87e984..2c3c7abf678b 100644 +--- a/arch/x86/events/intel/lbr.c ++++ b/arch/x86/events/intel/lbr.c +@@ -342,7 +342,7 @@ static void __intel_pmu_lbr_restore(struct x86_perf_task_context *task_ctx) + + mask = x86_pmu.lbr_nr - 1; + tos = task_ctx->tos; +- for (i = 0; i < tos; i++) { ++ for (i = 0; i < task_ctx->valid_lbrs; i++) { + lbr_idx = (tos - i) & mask; + wrlbr_from(lbr_idx, task_ctx->lbr_from[i]); + wrlbr_to (lbr_idx, task_ctx->lbr_to[i]); +@@ -350,6 +350,15 @@ static void __intel_pmu_lbr_restore(struct x86_perf_task_context *task_ctx) + if (x86_pmu.intel_cap.lbr_format == LBR_FORMAT_INFO) + wrmsrl(MSR_LBR_INFO_0 + lbr_idx, task_ctx->lbr_info[i]); + } ++ ++ for (; i < x86_pmu.lbr_nr; i++) { ++ lbr_idx = (tos - i) & mask; ++ wrlbr_from(lbr_idx, 0); ++ wrlbr_to(lbr_idx, 0); ++ if (x86_pmu.intel_cap.lbr_format == LBR_FORMAT_INFO) ++ wrmsrl(MSR_LBR_INFO_0 + lbr_idx, 0); ++ } ++ + wrmsrl(x86_pmu.lbr_tos, tos); + task_ctx->lbr_stack_state = LBR_NONE; + } +@@ -357,7 +366,7 @@ static void __intel_pmu_lbr_restore(struct x86_perf_task_context *task_ctx) + static void __intel_pmu_lbr_save(struct x86_perf_task_context *task_ctx) + { + unsigned lbr_idx, mask; +- u64 tos; ++ u64 tos, from; + int i; + + if (task_ctx->lbr_callstack_users == 0) { +@@ -367,13 +376,17 @@ static void __intel_pmu_lbr_save(struct x86_perf_task_context *task_ctx) + + mask = x86_pmu.lbr_nr - 1; + tos = intel_pmu_lbr_tos(); +- for (i = 0; i < tos; i++) { ++ for (i = 0; i < x86_pmu.lbr_nr; i++) { + lbr_idx = (tos - i) & mask; +- task_ctx->lbr_from[i] = rdlbr_from(lbr_idx); ++ from = rdlbr_from(lbr_idx); ++ if (!from) ++ break; ++ task_ctx->lbr_from[i] = from; + task_ctx->lbr_to[i] = rdlbr_to(lbr_idx); + if (x86_pmu.intel_cap.lbr_format == LBR_FORMAT_INFO) + rdmsrl(MSR_LBR_INFO_0 + lbr_idx, task_ctx->lbr_info[i]); + } ++ task_ctx->valid_lbrs = i; + task_ctx->tos = tos; + task_ctx->lbr_stack_state = LBR_VALID; + } +@@ -522,7 +535,7 @@ static void intel_pmu_lbr_read_32(struct cpu_hw_events *cpuc) + */ + static void intel_pmu_lbr_read_64(struct cpu_hw_events *cpuc) + { +- bool need_info = false; ++ bool need_info = false, call_stack = false; + unsigned long mask = x86_pmu.lbr_nr - 1; + int lbr_format = x86_pmu.intel_cap.lbr_format; + u64 tos = intel_pmu_lbr_tos(); +@@ -533,7 +546,7 @@ static void intel_pmu_lbr_read_64(struct cpu_hw_events *cpuc) + if (cpuc->lbr_sel) { + need_info = !(cpuc->lbr_sel->config & LBR_NO_INFO); + if (cpuc->lbr_sel->config & LBR_CALL_STACK) +- num = tos; ++ call_stack = true; + } + + for (i = 0; i < num; i++) { +@@ -546,6 +559,13 @@ static void intel_pmu_lbr_read_64(struct cpu_hw_events *cpuc) + from = rdlbr_from(lbr_idx); + to = rdlbr_to(lbr_idx); + ++ /* ++ * Read LBR call stack entries ++ * until invalid entry (0s) is detected. ++ */ ++ if (call_stack && !from) ++ break; ++ + if (lbr_format == LBR_FORMAT_INFO && need_info) { + u64 info; + +diff --git a/arch/x86/events/perf_event.h b/arch/x86/events/perf_event.h +index f3563179290b..1bfebbc4d156 100644 +--- a/arch/x86/events/perf_event.h ++++ b/arch/x86/events/perf_event.h +@@ -633,6 +633,7 @@ struct x86_perf_task_context { + u64 lbr_to[MAX_LBR_ENTRIES]; + u64 lbr_info[MAX_LBR_ENTRIES]; + int tos; ++ int valid_lbrs; + int lbr_callstack_users; + int lbr_stack_state; + }; +diff --git a/arch/x86/kernel/tsc_msr.c b/arch/x86/kernel/tsc_msr.c +index 0fe720d64fef..3f818ce985c0 100644 +--- a/arch/x86/kernel/tsc_msr.c ++++ b/arch/x86/kernel/tsc_msr.c +@@ -12,6 +12,7 @@ + #include <asm/setup.h> + #include <asm/apic.h> + #include <asm/param.h> ++#include <asm/tsc.h> + + #define MAX_NUM_FREQS 9 + +diff --git a/arch/x86/mm/numa_emulation.c b/arch/x86/mm/numa_emulation.c +index a8f90ce3dedf..dc6d99017f3f 100644 +--- a/arch/x86/mm/numa_emulation.c ++++ b/arch/x86/mm/numa_emulation.c +@@ -60,7 +60,7 @@ static int __init emu_setup_memblk(struct numa_meminfo *ei, + eb->nid = nid; + + if (emu_nid_to_phys[nid] == NUMA_NO_NODE) +- emu_nid_to_phys[nid] = nid; ++ emu_nid_to_phys[nid] = pb->nid; + + pb->start += size; + if (pb->start >= pb->end) { +diff --git a/crypto/ablkcipher.c b/crypto/ablkcipher.c +index 860c9e5dfd7a..3bc0e76eaaef 100644 +--- a/crypto/ablkcipher.c ++++ b/crypto/ablkcipher.c +@@ -367,6 +367,7 @@ static int crypto_ablkcipher_report(struct sk_buff *skb, struct crypto_alg *alg) + strncpy(rblkcipher.type, "ablkcipher", sizeof(rblkcipher.type)); + strncpy(rblkcipher.geniv, alg->cra_ablkcipher.geniv ?: "<default>", + sizeof(rblkcipher.geniv)); ++ rblkcipher.geniv[sizeof(rblkcipher.geniv) - 1] = '\0'; + + rblkcipher.blocksize = alg->cra_blocksize; + rblkcipher.min_keysize = alg->cra_ablkcipher.min_keysize; +@@ -441,6 +442,7 @@ static int crypto_givcipher_report(struct sk_buff *skb, struct crypto_alg *alg) + strncpy(rblkcipher.type, "givcipher", sizeof(rblkcipher.type)); + strncpy(rblkcipher.geniv, alg->cra_ablkcipher.geniv ?: "<built-in>", + sizeof(rblkcipher.geniv)); ++ rblkcipher.geniv[sizeof(rblkcipher.geniv) - 1] = '\0'; + + rblkcipher.blocksize = alg->cra_blocksize; + rblkcipher.min_keysize = alg->cra_ablkcipher.min_keysize; +diff --git a/crypto/blkcipher.c b/crypto/blkcipher.c +index 27f98666763a..59a0936ed8bc 100644 +--- a/crypto/blkcipher.c ++++ b/crypto/blkcipher.c +@@ -510,6 +510,7 @@ static int crypto_blkcipher_report(struct sk_buff *skb, struct crypto_alg *alg) + strncpy(rblkcipher.type, "blkcipher", sizeof(rblkcipher.type)); + strncpy(rblkcipher.geniv, alg->cra_blkcipher.geniv ?: "<default>", + sizeof(rblkcipher.geniv)); ++ rblkcipher.geniv[sizeof(rblkcipher.geniv) - 1] = '\0'; + + rblkcipher.blocksize = alg->cra_blocksize; + rblkcipher.min_keysize = alg->cra_blkcipher.min_keysize; +diff --git a/drivers/block/floppy.c b/drivers/block/floppy.c +index e3d8e4ced4a2..a321d7d849c6 100644 +--- a/drivers/block/floppy.c ++++ b/drivers/block/floppy.c +@@ -3459,6 +3459,9 @@ static int fd_locked_ioctl(struct block_device *bdev, fmode_t mode, unsigned int + (struct floppy_struct **)&outparam); + if (ret) + return ret; ++ memcpy(&inparam.g, outparam, ++ offsetof(struct floppy_struct, name)); ++ outparam = &inparam.g; + break; + case FDMSGON: + UDP->flags |= FTD_MSG; +diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c +index 44bccb1afa06..8dce1a890078 100644 +--- a/drivers/bluetooth/btusb.c ++++ b/drivers/bluetooth/btusb.c +@@ -349,6 +349,7 @@ static const struct usb_device_id blacklist_table[] = { + { USB_DEVICE(0x7392, 0xa611), .driver_info = BTUSB_REALTEK }, + + /* Additional Realtek 8723DE Bluetooth devices */ ++ { USB_DEVICE(0x0bda, 0xb009), .driver_info = BTUSB_REALTEK }, + { USB_DEVICE(0x2ff8, 0xb011), .driver_info = BTUSB_REALTEK }, + + /* Additional Realtek 8821AE Bluetooth devices */ +diff --git a/drivers/edac/edac_mc_sysfs.c b/drivers/edac/edac_mc_sysfs.c +index 4e0f8e720ad9..40d792e96b75 100644 +--- a/drivers/edac/edac_mc_sysfs.c ++++ b/drivers/edac/edac_mc_sysfs.c +@@ -1059,14 +1059,14 @@ int __init edac_mc_sysfs_init(void) + + err = device_add(mci_pdev); + if (err < 0) +- goto out_dev_free; ++ goto out_put_device; + + edac_dbg(0, "device %s created\n", dev_name(mci_pdev)); + + return 0; + +- out_dev_free: +- kfree(mci_pdev); ++ out_put_device: ++ put_device(mci_pdev); + out: + return err; + } +diff --git a/drivers/edac/i7core_edac.c b/drivers/edac/i7core_edac.c +index 8a68a5e943ea..b60932026e34 100644 +--- a/drivers/edac/i7core_edac.c ++++ b/drivers/edac/i7core_edac.c +@@ -1177,15 +1177,14 @@ static int i7core_create_sysfs_devices(struct mem_ctl_info *mci) + + rc = device_add(pvt->addrmatch_dev); + if (rc < 0) +- return rc; ++ goto err_put_addrmatch; + + if (!pvt->is_registered) { + pvt->chancounts_dev = kzalloc(sizeof(*pvt->chancounts_dev), + GFP_KERNEL); + if (!pvt->chancounts_dev) { +- put_device(pvt->addrmatch_dev); +- device_del(pvt->addrmatch_dev); +- return -ENOMEM; ++ rc = -ENOMEM; ++ goto err_del_addrmatch; + } + + pvt->chancounts_dev->type = &all_channel_counts_type; +@@ -1199,9 +1198,18 @@ static int i7core_create_sysfs_devices(struct mem_ctl_info *mci) + + rc = device_add(pvt->chancounts_dev); + if (rc < 0) +- return rc; ++ goto err_put_chancounts; + } + return 0; ++ ++err_put_chancounts: ++ put_device(pvt->chancounts_dev); ++err_del_addrmatch: ++ device_del(pvt->addrmatch_dev); ++err_put_addrmatch: ++ put_device(pvt->addrmatch_dev); ++ ++ return rc; + } + + static void i7core_delete_sysfs_devices(struct mem_ctl_info *mci) +@@ -1211,11 +1219,11 @@ static void i7core_delete_sysfs_devices(struct mem_ctl_info *mci) + edac_dbg(1, "\n"); + + if (!pvt->is_registered) { +- put_device(pvt->chancounts_dev); + device_del(pvt->chancounts_dev); ++ put_device(pvt->chancounts_dev); + } +- put_device(pvt->addrmatch_dev); + device_del(pvt->addrmatch_dev); ++ put_device(pvt->addrmatch_dev); + } + + /**************************************************************************** +diff --git a/drivers/gpio/gpio-menz127.c b/drivers/gpio/gpio-menz127.c +index a1210e330571..95061d25895b 100644 +--- a/drivers/gpio/gpio-menz127.c ++++ b/drivers/gpio/gpio-menz127.c +@@ -56,9 +56,9 @@ static int men_z127_debounce(struct gpio_chip *gc, unsigned gpio, + rnd = fls(debounce) - 1; + + if (rnd && (debounce & BIT(rnd - 1))) +- debounce = round_up(debounce, MEN_Z127_DB_MIN_US); ++ debounce = roundup(debounce, MEN_Z127_DB_MIN_US); + else +- debounce = round_down(debounce, MEN_Z127_DB_MIN_US); ++ debounce = rounddown(debounce, MEN_Z127_DB_MIN_US); + + if (debounce > MEN_Z127_DB_MAX_US) + debounce = MEN_Z127_DB_MAX_US; +diff --git a/drivers/gpu/drm/amd/amdgpu/gfx_v8_0.c b/drivers/gpu/drm/amd/amdgpu/gfx_v8_0.c +index 564362e8b486..c8a5cf5365a9 100644 +--- a/drivers/gpu/drm/amd/amdgpu/gfx_v8_0.c ++++ b/drivers/gpu/drm/amd/amdgpu/gfx_v8_0.c +@@ -5551,6 +5551,11 @@ static int gfx_v8_0_set_powergating_state(void *handle, + if (!(adev->pg_flags & AMD_PG_SUPPORT_GFX_PG)) + return 0; + ++ if (adev->pg_flags & (AMD_PG_SUPPORT_GFX_SMG | ++ AMD_PG_SUPPORT_RLC_SMU_HS | ++ AMD_PG_SUPPORT_CP | ++ AMD_PG_SUPPORT_GFX_DMG)) ++ adev->gfx.rlc.funcs->enter_safe_mode(adev); + switch (adev->asic_type) { + case CHIP_CARRIZO: + case CHIP_STONEY: +@@ -5586,7 +5591,11 @@ static int gfx_v8_0_set_powergating_state(void *handle, + default: + break; + } +- ++ if (adev->pg_flags & (AMD_PG_SUPPORT_GFX_SMG | ++ AMD_PG_SUPPORT_RLC_SMU_HS | ++ AMD_PG_SUPPORT_CP | ++ AMD_PG_SUPPORT_GFX_DMG)) ++ adev->gfx.rlc.funcs->exit_safe_mode(adev); + return 0; + } + +diff --git a/drivers/gpu/drm/amd/amdgpu/kv_dpm.c b/drivers/gpu/drm/amd/amdgpu/kv_dpm.c +index 71d2856222fa..f61c489e5f6d 100644 +--- a/drivers/gpu/drm/amd/amdgpu/kv_dpm.c ++++ b/drivers/gpu/drm/amd/amdgpu/kv_dpm.c +@@ -1350,8 +1350,6 @@ static int kv_dpm_enable(struct amdgpu_device *adev) + return ret; + } + +- kv_update_current_ps(adev, adev->pm.dpm.boot_ps); +- + if (adev->irq.installed && + amdgpu_is_internal_thermal_sensor(adev->pm.int_thermal_type)) { + ret = kv_set_thermal_temperature_range(adev, KV_TEMP_RANGE_MIN, KV_TEMP_RANGE_MAX); +@@ -3086,7 +3084,7 @@ static int kv_dpm_hw_init(void *handle) + else + adev->pm.dpm_enabled = true; + mutex_unlock(&adev->pm.mutex); +- ++ amdgpu_pm_compute_clocks(adev); + return ret; + } + +diff --git a/drivers/gpu/drm/amd/amdgpu/si_dpm.c b/drivers/gpu/drm/amd/amdgpu/si_dpm.c +index 3fa8320e49c1..4826befc1bc3 100644 +--- a/drivers/gpu/drm/amd/amdgpu/si_dpm.c ++++ b/drivers/gpu/drm/amd/amdgpu/si_dpm.c +@@ -6959,7 +6959,6 @@ static int si_dpm_enable(struct amdgpu_device *adev) + + si_enable_auto_throttle_source(adev, AMDGPU_DPM_AUTO_THROTTLE_SRC_THERMAL, true); + si_thermal_start_thermal_controller(adev); +- ni_update_current_ps(adev, boot_ps); + + return 0; + } +@@ -7836,7 +7835,7 @@ static int si_dpm_hw_init(void *handle) + else + adev->pm.dpm_enabled = true; + mutex_unlock(&adev->pm.mutex); +- ++ amdgpu_pm_compute_clocks(adev); + return ret; + } + +diff --git a/drivers/gpu/drm/sun4i/sun4i_drv.c b/drivers/gpu/drm/sun4i/sun4i_drv.c +index aad2f4a2a0ef..97828faf2a1f 100644 +--- a/drivers/gpu/drm/sun4i/sun4i_drv.c ++++ b/drivers/gpu/drm/sun4i/sun4i_drv.c +@@ -283,7 +283,6 @@ static int sun4i_drv_add_endpoints(struct device *dev, + remote = of_graph_get_remote_port_parent(ep); + if (!remote) { + DRM_DEBUG_DRIVER("Error retrieving the output node\n"); +- of_node_put(remote); + continue; + } + +@@ -297,11 +296,13 @@ static int sun4i_drv_add_endpoints(struct device *dev, + + if (of_graph_parse_endpoint(ep, &endpoint)) { + DRM_DEBUG_DRIVER("Couldn't parse endpoint\n"); ++ of_node_put(remote); + continue; + } + + if (!endpoint.id) { + DRM_DEBUG_DRIVER("Endpoint is our panel... skipping\n"); ++ of_node_put(remote); + continue; + } + } +diff --git a/drivers/hid/hid-ntrig.c b/drivers/hid/hid-ntrig.c +index 1b0084d4af2e..28373dab60ae 100644 +--- a/drivers/hid/hid-ntrig.c ++++ b/drivers/hid/hid-ntrig.c +@@ -955,6 +955,8 @@ static int ntrig_probe(struct hid_device *hdev, const struct hid_device_id *id) + + ret = sysfs_create_group(&hdev->dev.kobj, + &ntrig_attribute_group); ++ if (ret) ++ hid_err(hdev, "cannot create sysfs group\n"); + + return 0; + err_free: +diff --git a/drivers/hwmon/adt7475.c b/drivers/hwmon/adt7475.c +index 3cefd1aeb24f..9c262d955331 100644 +--- a/drivers/hwmon/adt7475.c ++++ b/drivers/hwmon/adt7475.c +@@ -274,14 +274,18 @@ static inline u16 volt2reg(int channel, long volt, u8 bypass_attn) + return clamp_val(reg, 0, 1023) & (0xff << 2); + } + +-static u16 adt7475_read_word(struct i2c_client *client, int reg) ++static int adt7475_read_word(struct i2c_client *client, int reg) + { +- u16 val; ++ int val1, val2; + +- val = i2c_smbus_read_byte_data(client, reg); +- val |= (i2c_smbus_read_byte_data(client, reg + 1) << 8); ++ val1 = i2c_smbus_read_byte_data(client, reg); ++ if (val1 < 0) ++ return val1; ++ val2 = i2c_smbus_read_byte_data(client, reg + 1); ++ if (val2 < 0) ++ return val2; + +- return val; ++ return val1 | (val2 << 8); + } + + static void adt7475_write_word(struct i2c_client *client, int reg, u16 val) +diff --git a/drivers/hwmon/ina2xx.c b/drivers/hwmon/ina2xx.c +index ac63e562071f..9ac6e1673375 100644 +--- a/drivers/hwmon/ina2xx.c ++++ b/drivers/hwmon/ina2xx.c +@@ -17,7 +17,7 @@ + * Bi-directional Current/Power Monitor with I2C Interface + * Datasheet: http://www.ti.com/product/ina230 + * +- * Copyright (C) 2012 Lothar Felten <l-felten@ti.com> ++ * Copyright (C) 2012 Lothar Felten <lothar.felten@gmail.com> + * Thanks to Jan Volkering + * + * This program is free software; you can redistribute it and/or modify +@@ -328,6 +328,15 @@ static int ina2xx_set_shunt(struct ina2xx_data *data, long val) + return 0; + } + ++static ssize_t ina2xx_show_shunt(struct device *dev, ++ struct device_attribute *da, ++ char *buf) ++{ ++ struct ina2xx_data *data = dev_get_drvdata(dev); ++ ++ return snprintf(buf, PAGE_SIZE, "%li\n", data->rshunt); ++} ++ + static ssize_t ina2xx_store_shunt(struct device *dev, + struct device_attribute *da, + const char *buf, size_t count) +@@ -402,7 +411,7 @@ static SENSOR_DEVICE_ATTR(power1_input, S_IRUGO, ina2xx_show_value, NULL, + + /* shunt resistance */ + static SENSOR_DEVICE_ATTR(shunt_resistor, S_IRUGO | S_IWUSR, +- ina2xx_show_value, ina2xx_store_shunt, ++ ina2xx_show_shunt, ina2xx_store_shunt, + INA2XX_CALIBRATION); + + /* update interval (ina226 only) */ +diff --git a/drivers/i2c/busses/i2c-i801.c b/drivers/i2c/busses/i2c-i801.c +index 663017f1d078..26f1691f67ab 100644 +--- a/drivers/i2c/busses/i2c-i801.c ++++ b/drivers/i2c/busses/i2c-i801.c +@@ -1408,6 +1408,13 @@ static void i801_add_tco(struct i801_priv *priv) + } + + #ifdef CONFIG_ACPI ++static bool i801_acpi_is_smbus_ioport(const struct i801_priv *priv, ++ acpi_physical_address address) ++{ ++ return address >= priv->smba && ++ address <= pci_resource_end(priv->pci_dev, SMBBAR); ++} ++ + static acpi_status + i801_acpi_io_handler(u32 function, acpi_physical_address address, u32 bits, + u64 *value, void *handler_context, void *region_context) +@@ -1423,7 +1430,7 @@ i801_acpi_io_handler(u32 function, acpi_physical_address address, u32 bits, + */ + mutex_lock(&priv->acpi_lock); + +- if (!priv->acpi_reserved) { ++ if (!priv->acpi_reserved && i801_acpi_is_smbus_ioport(priv, address)) { + priv->acpi_reserved = true; + + dev_warn(&pdev->dev, "BIOS is accessing SMBus registers\n"); +diff --git a/drivers/infiniband/core/rw.c b/drivers/infiniband/core/rw.c +index dbfd854c32c9..1d90a122fe5e 100644 +--- a/drivers/infiniband/core/rw.c ++++ b/drivers/infiniband/core/rw.c +@@ -87,7 +87,7 @@ static int rdma_rw_init_one_mr(struct ib_qp *qp, u8 port_num, + } + + ret = ib_map_mr_sg(reg->mr, sg, nents, &offset, PAGE_SIZE); +- if (ret < nents) { ++ if (ret < 0 || ret < nents) { + ib_mr_pool_put(qp, &qp->rdma_mrs, reg->mr); + return -EINVAL; + } +diff --git a/drivers/infiniband/hw/hfi1/pio.c b/drivers/infiniband/hw/hfi1/pio.c +index d89b8745d4c1..c2982bbc82b3 100644 +--- a/drivers/infiniband/hw/hfi1/pio.c ++++ b/drivers/infiniband/hw/hfi1/pio.c +@@ -88,6 +88,7 @@ void pio_send_control(struct hfi1_devdata *dd, int op) + unsigned long flags; + int write = 1; /* write sendctrl back */ + int flush = 0; /* re-read sendctrl to make sure it is flushed */ ++ int i; + + spin_lock_irqsave(&dd->sendctrl_lock, flags); + +@@ -97,9 +98,13 @@ void pio_send_control(struct hfi1_devdata *dd, int op) + reg |= SEND_CTRL_SEND_ENABLE_SMASK; + /* Fall through */ + case PSC_DATA_VL_ENABLE: ++ mask = 0; ++ for (i = 0; i < ARRAY_SIZE(dd->vld); i++) ++ if (!dd->vld[i].mtu) ++ mask |= BIT_ULL(i); + /* Disallow sending on VLs not enabled */ +- mask = (((~0ull) << num_vls) & SEND_CTRL_UNSUPPORTED_VL_MASK) << +- SEND_CTRL_UNSUPPORTED_VL_SHIFT; ++ mask = (mask & SEND_CTRL_UNSUPPORTED_VL_MASK) << ++ SEND_CTRL_UNSUPPORTED_VL_SHIFT; + reg = (reg & ~SEND_CTRL_UNSUPPORTED_VL_SMASK) | mask; + break; + case PSC_GLOBAL_DISABLE: +diff --git a/drivers/infiniband/hw/hfi1/user_sdma.c b/drivers/infiniband/hw/hfi1/user_sdma.c +index 77697d690f3e..018a41562704 100644 +--- a/drivers/infiniband/hw/hfi1/user_sdma.c ++++ b/drivers/infiniband/hw/hfi1/user_sdma.c +@@ -956,7 +956,7 @@ static int user_sdma_send_pkts(struct user_sdma_request *req, unsigned maxpkts) + if (ACCESS_ONCE(iovec->offset) == iovec->iov.iov_len) { + if (++req->iov_idx == req->data_iovs) { + ret = -EFAULT; +- goto free_txreq; ++ goto free_tx; + } + iovec = &req->iovs[req->iov_idx]; + WARN_ON(iovec->offset); +diff --git a/drivers/infiniband/hw/hfi1/verbs.c b/drivers/infiniband/hw/hfi1/verbs.c +index 01a380efea6b..14ddb7506085 100644 +--- a/drivers/infiniband/hw/hfi1/verbs.c ++++ b/drivers/infiniband/hw/hfi1/verbs.c +@@ -1511,12 +1511,18 @@ static int hfi1_check_ah(struct ib_device *ibdev, struct ib_ah_attr *ah_attr) + struct hfi1_pportdata *ppd; + struct hfi1_devdata *dd; + u8 sc5; ++ u8 sl; + + /* test the mapping for validity */ + ibp = to_iport(ibdev, ah_attr->port_num); + ppd = ppd_from_ibp(ibp); +- sc5 = ibp->sl_to_sc[ah_attr->sl]; + dd = dd_from_ppd(ppd); ++ ++ sl = ah_attr->sl; ++ if (sl >= ARRAY_SIZE(ibp->sl_to_sc)) ++ return -EINVAL; ++ ++ sc5 = ibp->sl_to_sc[sl]; + if (sc_to_vlt(dd, sc5) > num_vls && sc_to_vlt(dd, sc5) != 0xf) + return -EINVAL; + return 0; +diff --git a/drivers/infiniband/ulp/srp/ib_srp.c b/drivers/infiniband/ulp/srp/ib_srp.c +index 463ea592a42a..646359025574 100644 +--- a/drivers/infiniband/ulp/srp/ib_srp.c ++++ b/drivers/infiniband/ulp/srp/ib_srp.c +@@ -2639,7 +2639,7 @@ static int srp_reset_device(struct scsi_cmnd *scmnd) + { + struct srp_target_port *target = host_to_target(scmnd->device->host); + struct srp_rdma_ch *ch; +- int i; ++ int i, j; + u8 status; + + shost_printk(KERN_ERR, target->scsi_host, "SRP reset_device called\n"); +@@ -2653,8 +2653,8 @@ static int srp_reset_device(struct scsi_cmnd *scmnd) + + for (i = 0; i < target->ch_count; i++) { + ch = &target->ch[i]; +- for (i = 0; i < target->req_ring_size; ++i) { +- struct srp_request *req = &ch->req_ring[i]; ++ for (j = 0; j < target->req_ring_size; ++j) { ++ struct srp_request *req = &ch->req_ring[j]; + + srp_finish_req(ch, req, scmnd->device, DID_RESET << 16); + } +diff --git a/drivers/input/mouse/elantech.c b/drivers/input/mouse/elantech.c +index 4e77adbfa835..c120afd9c46a 100644 +--- a/drivers/input/mouse/elantech.c ++++ b/drivers/input/mouse/elantech.c +@@ -1176,6 +1176,8 @@ static const struct dmi_system_id elantech_dmi_has_middle_button[] = { + static const char * const middle_button_pnp_ids[] = { + "LEN2131", /* ThinkPad P52 w/ NFC */ + "LEN2132", /* ThinkPad P52 */ ++ "LEN2133", /* ThinkPad P72 w/ NFC */ ++ "LEN2134", /* ThinkPad P72 */ + NULL + }; + +diff --git a/drivers/iommu/amd_iommu.c b/drivers/iommu/amd_iommu.c +index 0c910a863581..16199b36a11e 100644 +--- a/drivers/iommu/amd_iommu.c ++++ b/drivers/iommu/amd_iommu.c +@@ -2452,9 +2452,9 @@ static void __unmap_single(struct dma_ops_domain *dma_dom, + } + + if (amd_iommu_unmap_flush) { +- dma_ops_free_iova(dma_dom, dma_addr, pages); + domain_flush_tlb(&dma_dom->domain); + domain_flush_complete(&dma_dom->domain); ++ dma_ops_free_iova(dma_dom, dma_addr, pages); + } else { + queue_add(dma_dom, dma_addr, pages); + } +diff --git a/drivers/md/md-cluster.c b/drivers/md/md-cluster.c +index fcc2b5746a9f..e870b09b2c84 100644 +--- a/drivers/md/md-cluster.c ++++ b/drivers/md/md-cluster.c +@@ -302,15 +302,6 @@ static void recover_bitmaps(struct md_thread *thread) + while (cinfo->recovery_map) { + slot = fls64((u64)cinfo->recovery_map) - 1; + +- /* Clear suspend_area associated with the bitmap */ +- spin_lock_irq(&cinfo->suspend_lock); +- list_for_each_entry_safe(s, tmp, &cinfo->suspend_list, list) +- if (slot == s->slot) { +- list_del(&s->list); +- kfree(s); +- } +- spin_unlock_irq(&cinfo->suspend_lock); +- + snprintf(str, 64, "bitmap%04d", slot); + bm_lockres = lockres_init(mddev, str, NULL, 1); + if (!bm_lockres) { +@@ -329,6 +320,16 @@ static void recover_bitmaps(struct md_thread *thread) + pr_err("md-cluster: Could not copy data from bitmap %d\n", slot); + goto clear_bit; + } ++ ++ /* Clear suspend_area associated with the bitmap */ ++ spin_lock_irq(&cinfo->suspend_lock); ++ list_for_each_entry_safe(s, tmp, &cinfo->suspend_list, list) ++ if (slot == s->slot) { ++ list_del(&s->list); ++ kfree(s); ++ } ++ spin_unlock_irq(&cinfo->suspend_lock); ++ + if (hi > 0) { + if (lo < mddev->recovery_cp) + mddev->recovery_cp = lo; +diff --git a/drivers/media/i2c/soc_camera/ov772x.c b/drivers/media/i2c/soc_camera/ov772x.c +index 7e68762b3a4b..fa1cb246a66a 100644 +--- a/drivers/media/i2c/soc_camera/ov772x.c ++++ b/drivers/media/i2c/soc_camera/ov772x.c +@@ -834,7 +834,7 @@ static int ov772x_set_params(struct ov772x_priv *priv, + * set COM8 + */ + if (priv->band_filter) { +- ret = ov772x_mask_set(client, COM8, BNDF_ON_OFF, 1); ++ ret = ov772x_mask_set(client, COM8, BNDF_ON_OFF, BNDF_ON_OFF); + if (!ret) + ret = ov772x_mask_set(client, BDBASE, + 0xff, 256 - priv->band_filter); +diff --git a/drivers/media/platform/exynos4-is/fimc-isp-video.c b/drivers/media/platform/exynos4-is/fimc-isp-video.c +index 400ce0cb0c0d..e00fa03ddc3e 100644 +--- a/drivers/media/platform/exynos4-is/fimc-isp-video.c ++++ b/drivers/media/platform/exynos4-is/fimc-isp-video.c +@@ -384,12 +384,17 @@ static void __isp_video_try_fmt(struct fimc_isp *isp, + struct v4l2_pix_format_mplane *pixm, + const struct fimc_fmt **fmt) + { +- *fmt = fimc_isp_find_format(&pixm->pixelformat, NULL, 2); ++ const struct fimc_fmt *__fmt; ++ ++ __fmt = fimc_isp_find_format(&pixm->pixelformat, NULL, 2); ++ ++ if (fmt) ++ *fmt = __fmt; + + pixm->colorspace = V4L2_COLORSPACE_SRGB; + pixm->field = V4L2_FIELD_NONE; +- pixm->num_planes = (*fmt)->memplanes; +- pixm->pixelformat = (*fmt)->fourcc; ++ pixm->num_planes = __fmt->memplanes; ++ pixm->pixelformat = __fmt->fourcc; + /* + * TODO: double check with the docmentation these width/height + * constraints are correct. +diff --git a/drivers/media/platform/fsl-viu.c b/drivers/media/platform/fsl-viu.c +index ae8c6b35a357..7f0ed5a26da9 100644 +--- a/drivers/media/platform/fsl-viu.c ++++ b/drivers/media/platform/fsl-viu.c +@@ -1417,7 +1417,7 @@ static int viu_of_probe(struct platform_device *op) + sizeof(struct viu_reg), DRV_NAME)) { + dev_err(&op->dev, "Error while requesting mem region\n"); + ret = -EBUSY; +- goto err; ++ goto err_irq; + } + + /* remap registers */ +@@ -1425,7 +1425,7 @@ static int viu_of_probe(struct platform_device *op) + if (!viu_regs) { + dev_err(&op->dev, "Can't map register set\n"); + ret = -ENOMEM; +- goto err; ++ goto err_irq; + } + + /* Prepare our private structure */ +@@ -1433,7 +1433,7 @@ static int viu_of_probe(struct platform_device *op) + if (!viu_dev) { + dev_err(&op->dev, "Can't allocate private structure\n"); + ret = -ENOMEM; +- goto err; ++ goto err_irq; + } + + viu_dev->vr = viu_regs; +@@ -1449,16 +1449,21 @@ static int viu_of_probe(struct platform_device *op) + ret = v4l2_device_register(viu_dev->dev, &viu_dev->v4l2_dev); + if (ret < 0) { + dev_err(&op->dev, "v4l2_device_register() failed: %d\n", ret); +- goto err; ++ goto err_irq; + } + + ad = i2c_get_adapter(0); ++ if (!ad) { ++ ret = -EFAULT; ++ dev_err(&op->dev, "couldn't get i2c adapter\n"); ++ goto err_v4l2; ++ } + + v4l2_ctrl_handler_init(&viu_dev->hdl, 5); + if (viu_dev->hdl.error) { + ret = viu_dev->hdl.error; + dev_err(&op->dev, "couldn't register control\n"); +- goto err_vdev; ++ goto err_i2c; + } + /* This control handler will inherit the control(s) from the + sub-device(s). */ +@@ -1476,7 +1481,7 @@ static int viu_of_probe(struct platform_device *op) + vdev = video_device_alloc(); + if (vdev == NULL) { + ret = -ENOMEM; +- goto err_vdev; ++ goto err_hdl; + } + + *vdev = viu_template; +@@ -1497,7 +1502,7 @@ static int viu_of_probe(struct platform_device *op) + ret = video_register_device(viu_dev->vdev, VFL_TYPE_GRABBER, -1); + if (ret < 0) { + video_device_release(viu_dev->vdev); +- goto err_vdev; ++ goto err_unlock; + } + + /* enable VIU clock */ +@@ -1505,12 +1510,12 @@ static int viu_of_probe(struct platform_device *op) + if (IS_ERR(clk)) { + dev_err(&op->dev, "failed to lookup the clock!\n"); + ret = PTR_ERR(clk); +- goto err_clk; ++ goto err_vdev; + } + ret = clk_prepare_enable(clk); + if (ret) { + dev_err(&op->dev, "failed to enable the clock!\n"); +- goto err_clk; ++ goto err_vdev; + } + viu_dev->clk = clk; + +@@ -1521,7 +1526,7 @@ static int viu_of_probe(struct platform_device *op) + if (request_irq(viu_dev->irq, viu_intr, 0, "viu", (void *)viu_dev)) { + dev_err(&op->dev, "Request VIU IRQ failed.\n"); + ret = -ENODEV; +- goto err_irq; ++ goto err_clk; + } + + mutex_unlock(&viu_dev->lock); +@@ -1529,16 +1534,19 @@ static int viu_of_probe(struct platform_device *op) + dev_info(&op->dev, "Freescale VIU Video Capture Board\n"); + return ret; + +-err_irq: +- clk_disable_unprepare(viu_dev->clk); + err_clk: +- video_unregister_device(viu_dev->vdev); ++ clk_disable_unprepare(viu_dev->clk); + err_vdev: +- v4l2_ctrl_handler_free(&viu_dev->hdl); ++ video_unregister_device(viu_dev->vdev); ++err_unlock: + mutex_unlock(&viu_dev->lock); ++err_hdl: ++ v4l2_ctrl_handler_free(&viu_dev->hdl); ++err_i2c: + i2c_put_adapter(ad); ++err_v4l2: + v4l2_device_unregister(&viu_dev->v4l2_dev); +-err: ++err_irq: + irq_dispose_mapping(viu_irq); + return ret; + } +diff --git a/drivers/media/platform/omap3isp/isp.c b/drivers/media/platform/omap3isp/isp.c +index 15a86bb4e61c..1e98b4845ea1 100644 +--- a/drivers/media/platform/omap3isp/isp.c ++++ b/drivers/media/platform/omap3isp/isp.c +@@ -304,7 +304,7 @@ static struct clk *isp_xclk_src_get(struct of_phandle_args *clkspec, void *data) + static int isp_xclk_init(struct isp_device *isp) + { + struct device_node *np = isp->dev->of_node; +- struct clk_init_data init; ++ struct clk_init_data init = { 0 }; + unsigned int i; + + for (i = 0; i < ARRAY_SIZE(isp->xclks); ++i) +diff --git a/drivers/media/platform/s3c-camif/camif-capture.c b/drivers/media/platform/s3c-camif/camif-capture.c +index 5c9db0910a76..d9710b5dd375 100644 +--- a/drivers/media/platform/s3c-camif/camif-capture.c ++++ b/drivers/media/platform/s3c-camif/camif-capture.c +@@ -117,6 +117,8 @@ static int sensor_set_power(struct camif_dev *camif, int on) + + if (camif->sensor.power_count == !on) + err = v4l2_subdev_call(sensor->sd, core, s_power, on); ++ if (err == -ENOIOCTLCMD) ++ err = 0; + if (!err) + sensor->power_count += on ? 1 : -1; + +diff --git a/drivers/media/usb/tm6000/tm6000-dvb.c b/drivers/media/usb/tm6000/tm6000-dvb.c +index 0426b210383b..ee88ae83230c 100644 +--- a/drivers/media/usb/tm6000/tm6000-dvb.c ++++ b/drivers/media/usb/tm6000/tm6000-dvb.c +@@ -273,6 +273,11 @@ static int register_dvb(struct tm6000_core *dev) + + ret = dvb_register_adapter(&dvb->adapter, "Trident TVMaster 6000 DVB-T", + THIS_MODULE, &dev->udev->dev, adapter_nr); ++ if (ret < 0) { ++ pr_err("tm6000: couldn't register the adapter!\n"); ++ goto err; ++ } ++ + dvb->adapter.priv = dev; + + if (dvb->frontend) { +diff --git a/drivers/media/usb/uvc/uvc_video.c b/drivers/media/usb/uvc/uvc_video.c +index b5589d5f5da4..48503f30b3a2 100644 +--- a/drivers/media/usb/uvc/uvc_video.c ++++ b/drivers/media/usb/uvc/uvc_video.c +@@ -163,14 +163,27 @@ static void uvc_fixup_video_ctrl(struct uvc_streaming *stream, + } + } + ++static size_t uvc_video_ctrl_size(struct uvc_streaming *stream) ++{ ++ /* ++ * Return the size of the video probe and commit controls, which depends ++ * on the protocol version. ++ */ ++ if (stream->dev->uvc_version < 0x0110) ++ return 26; ++ else if (stream->dev->uvc_version < 0x0150) ++ return 34; ++ else ++ return 48; ++} ++ + static int uvc_get_video_ctrl(struct uvc_streaming *stream, + struct uvc_streaming_control *ctrl, int probe, __u8 query) + { ++ __u16 size = uvc_video_ctrl_size(stream); + __u8 *data; +- __u16 size; + int ret; + +- size = stream->dev->uvc_version >= 0x0110 ? 34 : 26; + if ((stream->dev->quirks & UVC_QUIRK_PROBE_DEF) && + query == UVC_GET_DEF) + return -EIO; +@@ -225,7 +238,7 @@ static int uvc_get_video_ctrl(struct uvc_streaming *stream, + ctrl->dwMaxVideoFrameSize = get_unaligned_le32(&data[18]); + ctrl->dwMaxPayloadTransferSize = get_unaligned_le32(&data[22]); + +- if (size == 34) { ++ if (size >= 34) { + ctrl->dwClockFrequency = get_unaligned_le32(&data[26]); + ctrl->bmFramingInfo = data[30]; + ctrl->bPreferedVersion = data[31]; +@@ -254,11 +267,10 @@ out: + static int uvc_set_video_ctrl(struct uvc_streaming *stream, + struct uvc_streaming_control *ctrl, int probe) + { ++ __u16 size = uvc_video_ctrl_size(stream); + __u8 *data; +- __u16 size; + int ret; + +- size = stream->dev->uvc_version >= 0x0110 ? 34 : 26; + data = kzalloc(size, GFP_KERNEL); + if (data == NULL) + return -ENOMEM; +@@ -275,7 +287,7 @@ static int uvc_set_video_ctrl(struct uvc_streaming *stream, + put_unaligned_le32(ctrl->dwMaxVideoFrameSize, &data[18]); + put_unaligned_le32(ctrl->dwMaxPayloadTransferSize, &data[22]); + +- if (size == 34) { ++ if (size >= 34) { + put_unaligned_le32(ctrl->dwClockFrequency, &data[26]); + data[30] = ctrl->bmFramingInfo; + data[31] = ctrl->bPreferedVersion; +diff --git a/drivers/media/v4l2-core/v4l2-event.c b/drivers/media/v4l2-core/v4l2-event.c +index 8d3171c6bee8..567d86835f00 100644 +--- a/drivers/media/v4l2-core/v4l2-event.c ++++ b/drivers/media/v4l2-core/v4l2-event.c +@@ -119,14 +119,6 @@ static void __v4l2_event_queue_fh(struct v4l2_fh *fh, const struct v4l2_event *e + if (sev == NULL) + return; + +- /* +- * If the event has been added to the fh->subscribed list, but its +- * add op has not completed yet elems will be 0, treat this as +- * not being subscribed. +- */ +- if (!sev->elems) +- return; +- + /* Increase event sequence number on fh. */ + fh->sequence++; + +@@ -212,6 +204,7 @@ int v4l2_event_subscribe(struct v4l2_fh *fh, + struct v4l2_subscribed_event *sev, *found_ev; + unsigned long flags; + unsigned i; ++ int ret = 0; + + if (sub->type == V4L2_EVENT_ALL) + return -EINVAL; +@@ -229,31 +222,36 @@ int v4l2_event_subscribe(struct v4l2_fh *fh, + sev->flags = sub->flags; + sev->fh = fh; + sev->ops = ops; ++ sev->elems = elems; ++ ++ mutex_lock(&fh->subscribe_lock); + + spin_lock_irqsave(&fh->vdev->fh_lock, flags); + found_ev = v4l2_event_subscribed(fh, sub->type, sub->id); +- if (!found_ev) +- list_add(&sev->list, &fh->subscribed); + spin_unlock_irqrestore(&fh->vdev->fh_lock, flags); + + if (found_ev) { ++ /* Already listening */ + kfree(sev); +- return 0; /* Already listening */ ++ goto out_unlock; + } + + if (sev->ops && sev->ops->add) { +- int ret = sev->ops->add(sev, elems); ++ ret = sev->ops->add(sev, elems); + if (ret) { +- sev->ops = NULL; +- v4l2_event_unsubscribe(fh, sub); +- return ret; ++ kfree(sev); ++ goto out_unlock; + } + } + +- /* Mark as ready for use */ +- sev->elems = elems; ++ spin_lock_irqsave(&fh->vdev->fh_lock, flags); ++ list_add(&sev->list, &fh->subscribed); ++ spin_unlock_irqrestore(&fh->vdev->fh_lock, flags); + +- return 0; ++out_unlock: ++ mutex_unlock(&fh->subscribe_lock); ++ ++ return ret; + } + EXPORT_SYMBOL_GPL(v4l2_event_subscribe); + +@@ -292,6 +290,8 @@ int v4l2_event_unsubscribe(struct v4l2_fh *fh, + return 0; + } + ++ mutex_lock(&fh->subscribe_lock); ++ + spin_lock_irqsave(&fh->vdev->fh_lock, flags); + + sev = v4l2_event_subscribed(fh, sub->type, sub->id); +@@ -309,6 +309,8 @@ int v4l2_event_unsubscribe(struct v4l2_fh *fh, + if (sev && sev->ops && sev->ops->del) + sev->ops->del(sev); + ++ mutex_unlock(&fh->subscribe_lock); ++ + kfree(sev); + + return 0; +diff --git a/drivers/media/v4l2-core/v4l2-fh.c b/drivers/media/v4l2-core/v4l2-fh.c +index c183f0996fa1..0c5e69070586 100644 +--- a/drivers/media/v4l2-core/v4l2-fh.c ++++ b/drivers/media/v4l2-core/v4l2-fh.c +@@ -50,6 +50,7 @@ void v4l2_fh_init(struct v4l2_fh *fh, struct video_device *vdev) + INIT_LIST_HEAD(&fh->available); + INIT_LIST_HEAD(&fh->subscribed); + fh->sequence = -1; ++ mutex_init(&fh->subscribe_lock); + } + EXPORT_SYMBOL_GPL(v4l2_fh_init); + +@@ -95,6 +96,7 @@ void v4l2_fh_exit(struct v4l2_fh *fh) + return; + v4l_disable_media_source(fh->vdev); + v4l2_event_unsubscribe_all(fh); ++ mutex_destroy(&fh->subscribe_lock); + fh->vdev = NULL; + } + EXPORT_SYMBOL_GPL(v4l2_fh_exit); +diff --git a/drivers/misc/tsl2550.c b/drivers/misc/tsl2550.c +index 87a13374fdc0..eb5761067310 100644 +--- a/drivers/misc/tsl2550.c ++++ b/drivers/misc/tsl2550.c +@@ -177,7 +177,7 @@ static int tsl2550_calculate_lux(u8 ch0, u8 ch1) + } else + lux = 0; + else +- return -EAGAIN; ++ return 0; + + /* LUX range check */ + return lux > TSL2550_MAX_LUX ? TSL2550_MAX_LUX : lux; +diff --git a/drivers/misc/vmw_vmci/vmci_queue_pair.c b/drivers/misc/vmw_vmci/vmci_queue_pair.c +index f735ab4ba84e..5927db046a87 100644 +--- a/drivers/misc/vmw_vmci/vmci_queue_pair.c ++++ b/drivers/misc/vmw_vmci/vmci_queue_pair.c +@@ -755,7 +755,7 @@ static int qp_host_get_user_memory(u64 produce_uva, + retval = get_user_pages_fast((uintptr_t) produce_uva, + produce_q->kernel_if->num_pages, 1, + produce_q->kernel_if->u.h.header_page); +- if (retval < produce_q->kernel_if->num_pages) { ++ if (retval < (int)produce_q->kernel_if->num_pages) { + pr_debug("get_user_pages_fast(produce) failed (retval=%d)", + retval); + qp_release_pages(produce_q->kernel_if->u.h.header_page, +@@ -767,7 +767,7 @@ static int qp_host_get_user_memory(u64 produce_uva, + retval = get_user_pages_fast((uintptr_t) consume_uva, + consume_q->kernel_if->num_pages, 1, + consume_q->kernel_if->u.h.header_page); +- if (retval < consume_q->kernel_if->num_pages) { ++ if (retval < (int)consume_q->kernel_if->num_pages) { + pr_debug("get_user_pages_fast(consume) failed (retval=%d)", + retval); + qp_release_pages(consume_q->kernel_if->u.h.header_page, +diff --git a/drivers/net/ethernet/hisilicon/hns/hnae.h b/drivers/net/ethernet/hisilicon/hns/hnae.h +index e093cbf26c8c..f9d68453c81d 100644 +--- a/drivers/net/ethernet/hisilicon/hns/hnae.h ++++ b/drivers/net/ethernet/hisilicon/hns/hnae.h +@@ -213,10 +213,10 @@ struct hnae_desc_cb { + + /* priv data for the desc, e.g. skb when use with ip stack*/ + void *priv; +- u16 page_offset; +- u16 reuse_flag; ++ u32 page_offset; ++ u32 length; /* length of the buffer */ + +- u16 length; /* length of the buffer */ ++ u16 reuse_flag; + + /* desc type, used by the ring user to mark the type of the priv data */ + u16 type; +diff --git a/drivers/net/ethernet/hisilicon/hns/hns_enet.c b/drivers/net/ethernet/hisilicon/hns/hns_enet.c +index 111e1aab7d83..8a2a07e21324 100644 +--- a/drivers/net/ethernet/hisilicon/hns/hns_enet.c ++++ b/drivers/net/ethernet/hisilicon/hns/hns_enet.c +@@ -529,7 +529,7 @@ static void hns_nic_reuse_page(struct sk_buff *skb, int i, + } + + skb_add_rx_frag(skb, i, desc_cb->priv, desc_cb->page_offset + pull_len, +- size - pull_len, truesize - pull_len); ++ size - pull_len, truesize); + + /* avoid re-using remote pages,flag default unreuse */ + if (unlikely(page_to_nid(desc_cb->priv) != numa_node_id())) +diff --git a/drivers/net/ethernet/intel/e1000/e1000_ethtool.c b/drivers/net/ethernet/intel/e1000/e1000_ethtool.c +index 975eeb885ca2..e84574b1eae7 100644 +--- a/drivers/net/ethernet/intel/e1000/e1000_ethtool.c ++++ b/drivers/net/ethernet/intel/e1000/e1000_ethtool.c +@@ -645,14 +645,14 @@ static int e1000_set_ringparam(struct net_device *netdev, + adapter->tx_ring = tx_old; + e1000_free_all_rx_resources(adapter); + e1000_free_all_tx_resources(adapter); +- kfree(tx_old); +- kfree(rx_old); + adapter->rx_ring = rxdr; + adapter->tx_ring = txdr; + err = e1000_up(adapter); + if (err) + goto err_setup; + } ++ kfree(tx_old); ++ kfree(rx_old); + + clear_bit(__E1000_RESETTING, &adapter->flags); + return 0; +@@ -665,7 +665,8 @@ err_setup_rx: + err_alloc_rx: + kfree(txdr); + err_alloc_tx: +- e1000_up(adapter); ++ if (netif_running(adapter->netdev)) ++ e1000_up(adapter); + err_setup: + clear_bit(__E1000_RESETTING, &adapter->flags); + return err; +diff --git a/drivers/net/ethernet/qlogic/qed/qed_mcp.c b/drivers/net/ethernet/qlogic/qed/qed_mcp.c +index eaa242df4131..e175fcd73739 100644 +--- a/drivers/net/ethernet/qlogic/qed/qed_mcp.c ++++ b/drivers/net/ethernet/qlogic/qed/qed_mcp.c +@@ -97,18 +97,57 @@ int qed_mcp_free(struct qed_hwfn *p_hwfn) + return 0; + } + ++/* Maximum of 1 sec to wait for the SHMEM ready indication */ ++#define QED_MCP_SHMEM_RDY_MAX_RETRIES 20 ++#define QED_MCP_SHMEM_RDY_ITER_MS 50 ++ + static int qed_load_mcp_offsets(struct qed_hwfn *p_hwfn, struct qed_ptt *p_ptt) + { + struct qed_mcp_info *p_info = p_hwfn->mcp_info; ++ u8 cnt = QED_MCP_SHMEM_RDY_MAX_RETRIES; ++ u8 msec = QED_MCP_SHMEM_RDY_ITER_MS; + u32 drv_mb_offsize, mfw_mb_offsize; + u32 mcp_pf_id = MCP_PF_ID(p_hwfn); + + p_info->public_base = qed_rd(p_hwfn, p_ptt, MISC_REG_SHARED_MEM_ADDR); +- if (!p_info->public_base) +- return 0; ++ if (!p_info->public_base) { ++ DP_NOTICE(p_hwfn, ++ "The address of the MCP scratch-pad is not configured\n"); ++ return -EINVAL; ++ } + + p_info->public_base |= GRCBASE_MCP; + ++ /* Get the MFW MB address and number of supported messages */ ++ mfw_mb_offsize = qed_rd(p_hwfn, p_ptt, ++ SECTION_OFFSIZE_ADDR(p_info->public_base, ++ PUBLIC_MFW_MB)); ++ p_info->mfw_mb_addr = SECTION_ADDR(mfw_mb_offsize, mcp_pf_id); ++ p_info->mfw_mb_length = (u16)qed_rd(p_hwfn, p_ptt, ++ p_info->mfw_mb_addr + ++ offsetof(struct public_mfw_mb, ++ sup_msgs)); ++ ++ /* The driver can notify that there was an MCP reset, and might read the ++ * SHMEM values before the MFW has completed initializing them. ++ * To avoid this, the "sup_msgs" field in the MFW mailbox is used as a ++ * data ready indication. ++ */ ++ while (!p_info->mfw_mb_length && --cnt) { ++ msleep(msec); ++ p_info->mfw_mb_length = ++ (u16)qed_rd(p_hwfn, p_ptt, ++ p_info->mfw_mb_addr + ++ offsetof(struct public_mfw_mb, sup_msgs)); ++ } ++ ++ if (!cnt) { ++ DP_NOTICE(p_hwfn, ++ "Failed to get the SHMEM ready notification after %d msec\n", ++ QED_MCP_SHMEM_RDY_MAX_RETRIES * msec); ++ return -EBUSY; ++ } ++ + /* Calculate the driver and MFW mailbox address */ + drv_mb_offsize = qed_rd(p_hwfn, p_ptt, + SECTION_OFFSIZE_ADDR(p_info->public_base, +@@ -118,13 +157,6 @@ static int qed_load_mcp_offsets(struct qed_hwfn *p_hwfn, struct qed_ptt *p_ptt) + "drv_mb_offsiz = 0x%x, drv_mb_addr = 0x%x mcp_pf_id = 0x%x\n", + drv_mb_offsize, p_info->drv_mb_addr, mcp_pf_id); + +- /* Set the MFW MB address */ +- mfw_mb_offsize = qed_rd(p_hwfn, p_ptt, +- SECTION_OFFSIZE_ADDR(p_info->public_base, +- PUBLIC_MFW_MB)); +- p_info->mfw_mb_addr = SECTION_ADDR(mfw_mb_offsize, mcp_pf_id); +- p_info->mfw_mb_length = (u16)qed_rd(p_hwfn, p_ptt, p_info->mfw_mb_addr); +- + /* Get the current driver mailbox sequence before sending + * the first command + */ +@@ -1198,31 +1230,61 @@ qed_mcp_send_drv_version(struct qed_hwfn *p_hwfn, + return rc; + } + ++/* A maximal 100 msec waiting time for the MCP to halt */ ++#define QED_MCP_HALT_SLEEP_MS 10 ++#define QED_MCP_HALT_MAX_RETRIES 10 ++ + int qed_mcp_halt(struct qed_hwfn *p_hwfn, struct qed_ptt *p_ptt) + { +- u32 resp = 0, param = 0; ++ u32 resp = 0, param = 0, cpu_state, cnt = 0; + int rc; + + rc = qed_mcp_cmd(p_hwfn, p_ptt, DRV_MSG_CODE_MCP_HALT, 0, &resp, + ¶m); +- if (rc) ++ if (rc) { + DP_ERR(p_hwfn, "MCP response failure, aborting\n"); ++ return rc; ++ } + +- return rc; ++ do { ++ msleep(QED_MCP_HALT_SLEEP_MS); ++ cpu_state = qed_rd(p_hwfn, p_ptt, MCP_REG_CPU_STATE); ++ if (cpu_state & MCP_REG_CPU_STATE_SOFT_HALTED) ++ break; ++ } while (++cnt < QED_MCP_HALT_MAX_RETRIES); ++ ++ if (cnt == QED_MCP_HALT_MAX_RETRIES) { ++ DP_NOTICE(p_hwfn, ++ "Failed to halt the MCP [CPU_MODE = 0x%08x, CPU_STATE = 0x%08x]\n", ++ qed_rd(p_hwfn, p_ptt, MCP_REG_CPU_MODE), cpu_state); ++ return -EBUSY; ++ } ++ ++ return 0; + } + ++#define QED_MCP_RESUME_SLEEP_MS 10 ++ + int qed_mcp_resume(struct qed_hwfn *p_hwfn, struct qed_ptt *p_ptt) + { +- u32 value, cpu_mode; ++ u32 cpu_mode, cpu_state; + + qed_wr(p_hwfn, p_ptt, MCP_REG_CPU_STATE, 0xffffffff); + +- value = qed_rd(p_hwfn, p_ptt, MCP_REG_CPU_MODE); +- value &= ~MCP_REG_CPU_MODE_SOFT_HALT; +- qed_wr(p_hwfn, p_ptt, MCP_REG_CPU_MODE, value); + cpu_mode = qed_rd(p_hwfn, p_ptt, MCP_REG_CPU_MODE); ++ cpu_mode &= ~MCP_REG_CPU_MODE_SOFT_HALT; ++ qed_wr(p_hwfn, p_ptt, MCP_REG_CPU_MODE, cpu_mode); ++ msleep(QED_MCP_RESUME_SLEEP_MS); ++ cpu_state = qed_rd(p_hwfn, p_ptt, MCP_REG_CPU_STATE); + +- return (cpu_mode & MCP_REG_CPU_MODE_SOFT_HALT) ? -EAGAIN : 0; ++ if (cpu_state & MCP_REG_CPU_STATE_SOFT_HALTED) { ++ DP_NOTICE(p_hwfn, ++ "Failed to resume the MCP [CPU_MODE = 0x%08x, CPU_STATE = 0x%08x]\n", ++ cpu_mode, cpu_state); ++ return -EBUSY; ++ } ++ ++ return 0; + } + + int qed_mcp_set_led(struct qed_hwfn *p_hwfn, +diff --git a/drivers/net/ethernet/qlogic/qed/qed_reg_addr.h b/drivers/net/ethernet/qlogic/qed/qed_reg_addr.h +index b414a0542177..56be1d6adfcc 100644 +--- a/drivers/net/ethernet/qlogic/qed/qed_reg_addr.h ++++ b/drivers/net/ethernet/qlogic/qed/qed_reg_addr.h +@@ -510,6 +510,7 @@ + 0 + #define MCP_REG_CPU_STATE \ + 0xe05004UL ++#define MCP_REG_CPU_STATE_SOFT_HALTED (0x1UL << 10) + #define MCP_REG_CPU_EVENT_MASK \ + 0xe05008UL + #define PGLUE_B_REG_PF_BAR0_SIZE \ +diff --git a/drivers/net/phy/xilinx_gmii2rgmii.c b/drivers/net/phy/xilinx_gmii2rgmii.c +index 2e5150b0b8d5..7a14e8170e82 100644 +--- a/drivers/net/phy/xilinx_gmii2rgmii.c ++++ b/drivers/net/phy/xilinx_gmii2rgmii.c +@@ -40,8 +40,11 @@ static int xgmiitorgmii_read_status(struct phy_device *phydev) + { + struct gmii2rgmii *priv = phydev->priv; + u16 val = 0; ++ int err; + +- priv->phy_drv->read_status(phydev); ++ err = priv->phy_drv->read_status(phydev); ++ if (err < 0) ++ return err; + + val = mdiobus_read(phydev->mdio.bus, priv->addr, XILINX_GMII2RGMII_REG); + val &= ~XILINX_GMII2RGMII_SPEED_MASK; +@@ -81,6 +84,11 @@ static int xgmiitorgmii_probe(struct mdio_device *mdiodev) + return -EPROBE_DEFER; + } + ++ if (!priv->phy_dev->drv) { ++ dev_info(dev, "Attached phy not ready\n"); ++ return -EPROBE_DEFER; ++ } ++ + priv->addr = mdiodev->addr; + priv->phy_drv = priv->phy_dev->drv; + memcpy(&priv->conv_phy_drv, priv->phy_dev->drv, +diff --git a/drivers/net/wireless/ath/ath10k/htt_rx.c b/drivers/net/wireless/ath/ath10k/htt_rx.c +index ba1fe61e6ea6..a3c218047597 100644 +--- a/drivers/net/wireless/ath/ath10k/htt_rx.c ++++ b/drivers/net/wireless/ath/ath10k/htt_rx.c +@@ -214,11 +214,12 @@ int ath10k_htt_rx_ring_refill(struct ath10k *ar) + spin_lock_bh(&htt->rx_ring.lock); + ret = ath10k_htt_rx_ring_fill_n(htt, (htt->rx_ring.fill_level - + htt->rx_ring.fill_cnt)); +- spin_unlock_bh(&htt->rx_ring.lock); + + if (ret) + ath10k_htt_rx_ring_free(htt); + ++ spin_unlock_bh(&htt->rx_ring.lock); ++ + return ret; + } + +@@ -230,7 +231,9 @@ void ath10k_htt_rx_free(struct ath10k_htt *htt) + skb_queue_purge(&htt->rx_in_ord_compl_q); + skb_queue_purge(&htt->tx_fetch_ind_q); + ++ spin_lock_bh(&htt->rx_ring.lock); + ath10k_htt_rx_ring_free(htt); ++ spin_unlock_bh(&htt->rx_ring.lock); + + dma_free_coherent(htt->ar->dev, + (htt->rx_ring.size * +diff --git a/drivers/net/wireless/rndis_wlan.c b/drivers/net/wireless/rndis_wlan.c +index 15b2350d9f45..c9f8847dc123 100644 +--- a/drivers/net/wireless/rndis_wlan.c ++++ b/drivers/net/wireless/rndis_wlan.c +@@ -2921,6 +2921,8 @@ static void rndis_wlan_auth_indication(struct usbnet *usbdev, + + while (buflen >= sizeof(*auth_req)) { + auth_req = (void *)buf; ++ if (buflen < le32_to_cpu(auth_req->length)) ++ return; + type = "unknown"; + flags = le32_to_cpu(auth_req->flags); + pairwise_error = false; +diff --git a/drivers/net/wireless/ti/wlcore/cmd.c b/drivers/net/wireless/ti/wlcore/cmd.c +index 7f4da727bb7b..96f83f09b8c5 100644 +--- a/drivers/net/wireless/ti/wlcore/cmd.c ++++ b/drivers/net/wireless/ti/wlcore/cmd.c +@@ -35,6 +35,7 @@ + #include "wl12xx_80211.h" + #include "cmd.h" + #include "event.h" ++#include "ps.h" + #include "tx.h" + #include "hw_ops.h" + +@@ -191,6 +192,10 @@ int wlcore_cmd_wait_for_event_or_timeout(struct wl1271 *wl, + + timeout_time = jiffies + msecs_to_jiffies(WL1271_EVENT_TIMEOUT); + ++ ret = wl1271_ps_elp_wakeup(wl); ++ if (ret < 0) ++ return ret; ++ + do { + if (time_after(jiffies, timeout_time)) { + wl1271_debug(DEBUG_CMD, "timeout waiting for event %d", +@@ -222,6 +227,7 @@ int wlcore_cmd_wait_for_event_or_timeout(struct wl1271 *wl, + } while (!event); + + out: ++ wl1271_ps_elp_sleep(wl); + kfree(events_vector); + return ret; + } +diff --git a/drivers/power/reset/vexpress-poweroff.c b/drivers/power/reset/vexpress-poweroff.c +index 102f95a09460..e9e749f87517 100644 +--- a/drivers/power/reset/vexpress-poweroff.c ++++ b/drivers/power/reset/vexpress-poweroff.c +@@ -35,6 +35,7 @@ static void vexpress_reset_do(struct device *dev, const char *what) + } + + static struct device *vexpress_power_off_device; ++static atomic_t vexpress_restart_nb_refcnt = ATOMIC_INIT(0); + + static void vexpress_power_off(void) + { +@@ -99,10 +100,13 @@ static int _vexpress_register_restart_handler(struct device *dev) + int err; + + vexpress_restart_device = dev; +- err = register_restart_handler(&vexpress_restart_nb); +- if (err) { +- dev_err(dev, "cannot register restart handler (err=%d)\n", err); +- return err; ++ if (atomic_inc_return(&vexpress_restart_nb_refcnt) == 1) { ++ err = register_restart_handler(&vexpress_restart_nb); ++ if (err) { ++ dev_err(dev, "cannot register restart handler (err=%d)\n", err); ++ atomic_dec(&vexpress_restart_nb_refcnt); ++ return err; ++ } + } + device_create_file(dev, &dev_attr_active); + +diff --git a/drivers/power/supply/power_supply_core.c b/drivers/power/supply/power_supply_core.c +index a74d8ca383a1..9e05ae0430a9 100644 +--- a/drivers/power/supply/power_supply_core.c ++++ b/drivers/power/supply/power_supply_core.c +@@ -14,6 +14,7 @@ + #include <linux/types.h> + #include <linux/init.h> + #include <linux/slab.h> ++#include <linux/delay.h> + #include <linux/device.h> + #include <linux/notifier.h> + #include <linux/err.h> +@@ -138,8 +139,13 @@ static void power_supply_deferred_register_work(struct work_struct *work) + struct power_supply *psy = container_of(work, struct power_supply, + deferred_register_work.work); + +- if (psy->dev.parent) +- mutex_lock(&psy->dev.parent->mutex); ++ if (psy->dev.parent) { ++ while (!mutex_trylock(&psy->dev.parent->mutex)) { ++ if (psy->removing) ++ return; ++ msleep(10); ++ } ++ } + + power_supply_changed(psy); + +@@ -944,6 +950,7 @@ EXPORT_SYMBOL_GPL(devm_power_supply_register_no_ws); + void power_supply_unregister(struct power_supply *psy) + { + WARN_ON(atomic_dec_return(&psy->use_cnt)); ++ psy->removing = true; + cancel_work_sync(&psy->changed_work); + cancel_delayed_work_sync(&psy->deferred_register_work); + sysfs_remove_link(&psy->dev.kobj, "powers"); +diff --git a/drivers/regulator/core.c b/drivers/regulator/core.c +index 178fcda12cec..18d57c0efe9f 100644 +--- a/drivers/regulator/core.c ++++ b/drivers/regulator/core.c +@@ -4054,13 +4054,13 @@ regulator_register(const struct regulator_desc *regulator_desc, + !rdev->desc->fixed_uV) + rdev->is_switch = true; + ++ dev_set_drvdata(&rdev->dev, rdev); + ret = device_register(&rdev->dev); + if (ret != 0) { + put_device(&rdev->dev); + goto unset_supplies; + } + +- dev_set_drvdata(&rdev->dev, rdev); + rdev_init_debugfs(rdev); + + /* try to resolve regulators supply since a new one was registered */ +diff --git a/drivers/scsi/bnx2i/bnx2i_hwi.c b/drivers/scsi/bnx2i/bnx2i_hwi.c +index 42921dbba927..4ca10501647b 100644 +--- a/drivers/scsi/bnx2i/bnx2i_hwi.c ++++ b/drivers/scsi/bnx2i/bnx2i_hwi.c +@@ -2742,6 +2742,8 @@ int bnx2i_map_ep_dbell_regs(struct bnx2i_endpoint *ep) + BNX2X_DOORBELL_PCI_BAR); + reg_off = (1 << BNX2X_DB_SHIFT) * (cid_num & 0x1FFFF); + ep->qp.ctx_base = ioremap_nocache(reg_base + reg_off, 4); ++ if (!ep->qp.ctx_base) ++ return -ENOMEM; + goto arm_cq; + } + +diff --git a/drivers/scsi/ibmvscsi/ibmvscsi.c b/drivers/scsi/ibmvscsi/ibmvscsi.c +index d9534ee6ef52..e1730227b448 100644 +--- a/drivers/scsi/ibmvscsi/ibmvscsi.c ++++ b/drivers/scsi/ibmvscsi/ibmvscsi.c +@@ -93,7 +93,7 @@ static int max_requests = IBMVSCSI_MAX_REQUESTS_DEFAULT; + static int max_events = IBMVSCSI_MAX_REQUESTS_DEFAULT + 2; + static int fast_fail = 1; + static int client_reserve = 1; +-static char partition_name[97] = "UNKNOWN"; ++static char partition_name[96] = "UNKNOWN"; + static unsigned int partition_number = -1; + + static struct scsi_transport_template *ibmvscsi_transport_template; +@@ -259,7 +259,7 @@ static void gather_partition_info(void) + + ppartition_name = of_get_property(of_root, "ibm,partition-name", NULL); + if (ppartition_name) +- strncpy(partition_name, ppartition_name, ++ strlcpy(partition_name, ppartition_name, + sizeof(partition_name)); + p_number_ptr = of_get_property(of_root, "ibm,partition-no", NULL); + if (p_number_ptr) +diff --git a/drivers/scsi/megaraid/megaraid_sas_base.c b/drivers/scsi/megaraid/megaraid_sas_base.c +index 35cbd36f8d3b..090fdcdd15c9 100644 +--- a/drivers/scsi/megaraid/megaraid_sas_base.c ++++ b/drivers/scsi/megaraid/megaraid_sas_base.c +@@ -6193,6 +6193,9 @@ megasas_resume(struct pci_dev *pdev) + goto fail_init_mfi; + } + ++ if (megasas_get_ctrl_info(instance) != DCMD_SUCCESS) ++ goto fail_init_mfi; ++ + tasklet_init(&instance->isr_tasklet, instance->instancet->tasklet, + (unsigned long)instance); + +diff --git a/drivers/spi/spi-rspi.c b/drivers/spi/spi-rspi.c +index a816f07e168e..093c9cf92bfd 100644 +--- a/drivers/spi/spi-rspi.c ++++ b/drivers/spi/spi-rspi.c +@@ -597,11 +597,13 @@ static int rspi_dma_transfer(struct rspi_data *rspi, struct sg_table *tx, + + ret = wait_event_interruptible_timeout(rspi->wait, + rspi->dma_callbacked, HZ); +- if (ret > 0 && rspi->dma_callbacked) ++ if (ret > 0 && rspi->dma_callbacked) { + ret = 0; +- else if (!ret) { +- dev_err(&rspi->master->dev, "DMA timeout\n"); +- ret = -ETIMEDOUT; ++ } else { ++ if (!ret) { ++ dev_err(&rspi->master->dev, "DMA timeout\n"); ++ ret = -ETIMEDOUT; ++ } + if (tx) + dmaengine_terminate_all(rspi->master->dma_tx); + if (rx) +@@ -1313,12 +1315,36 @@ static const struct platform_device_id spi_driver_ids[] = { + + MODULE_DEVICE_TABLE(platform, spi_driver_ids); + ++#ifdef CONFIG_PM_SLEEP ++static int rspi_suspend(struct device *dev) ++{ ++ struct platform_device *pdev = to_platform_device(dev); ++ struct rspi_data *rspi = platform_get_drvdata(pdev); ++ ++ return spi_master_suspend(rspi->master); ++} ++ ++static int rspi_resume(struct device *dev) ++{ ++ struct platform_device *pdev = to_platform_device(dev); ++ struct rspi_data *rspi = platform_get_drvdata(pdev); ++ ++ return spi_master_resume(rspi->master); ++} ++ ++static SIMPLE_DEV_PM_OPS(rspi_pm_ops, rspi_suspend, rspi_resume); ++#define DEV_PM_OPS &rspi_pm_ops ++#else ++#define DEV_PM_OPS NULL ++#endif /* CONFIG_PM_SLEEP */ ++ + static struct platform_driver rspi_driver = { + .probe = rspi_probe, + .remove = rspi_remove, + .id_table = spi_driver_ids, + .driver = { + .name = "renesas_spi", ++ .pm = DEV_PM_OPS, + .of_match_table = of_match_ptr(rspi_of_match), + }, + }; +diff --git a/drivers/spi/spi-sh-msiof.c b/drivers/spi/spi-sh-msiof.c +index cbf02ebb30a2..711ea523b325 100644 +--- a/drivers/spi/spi-sh-msiof.c ++++ b/drivers/spi/spi-sh-msiof.c +@@ -373,7 +373,8 @@ static void sh_msiof_spi_set_mode_regs(struct sh_msiof_spi_priv *p, + + static void sh_msiof_reset_str(struct sh_msiof_spi_priv *p) + { +- sh_msiof_write(p, STR, sh_msiof_read(p, STR)); ++ sh_msiof_write(p, STR, ++ sh_msiof_read(p, STR) & ~(STR_TDREQ | STR_RDREQ)); + } + + static void sh_msiof_spi_write_fifo_8(struct sh_msiof_spi_priv *p, +@@ -1275,12 +1276,37 @@ static const struct platform_device_id spi_driver_ids[] = { + }; + MODULE_DEVICE_TABLE(platform, spi_driver_ids); + ++#ifdef CONFIG_PM_SLEEP ++static int sh_msiof_spi_suspend(struct device *dev) ++{ ++ struct platform_device *pdev = to_platform_device(dev); ++ struct sh_msiof_spi_priv *p = platform_get_drvdata(pdev); ++ ++ return spi_master_suspend(p->master); ++} ++ ++static int sh_msiof_spi_resume(struct device *dev) ++{ ++ struct platform_device *pdev = to_platform_device(dev); ++ struct sh_msiof_spi_priv *p = platform_get_drvdata(pdev); ++ ++ return spi_master_resume(p->master); ++} ++ ++static SIMPLE_DEV_PM_OPS(sh_msiof_spi_pm_ops, sh_msiof_spi_suspend, ++ sh_msiof_spi_resume); ++#define DEV_PM_OPS &sh_msiof_spi_pm_ops ++#else ++#define DEV_PM_OPS NULL ++#endif /* CONFIG_PM_SLEEP */ ++ + static struct platform_driver sh_msiof_spi_drv = { + .probe = sh_msiof_spi_probe, + .remove = sh_msiof_spi_remove, + .id_table = spi_driver_ids, + .driver = { + .name = "spi_sh_msiof", ++ .pm = DEV_PM_OPS, + .of_match_table = of_match_ptr(sh_msiof_match), + }, + }; +diff --git a/drivers/spi/spi-tegra20-slink.c b/drivers/spi/spi-tegra20-slink.c +index 85c91f58b42f..af2880d0c112 100644 +--- a/drivers/spi/spi-tegra20-slink.c ++++ b/drivers/spi/spi-tegra20-slink.c +@@ -1063,6 +1063,24 @@ static int tegra_slink_probe(struct platform_device *pdev) + goto exit_free_master; + } + ++ /* disabled clock may cause interrupt storm upon request */ ++ tspi->clk = devm_clk_get(&pdev->dev, NULL); ++ if (IS_ERR(tspi->clk)) { ++ ret = PTR_ERR(tspi->clk); ++ dev_err(&pdev->dev, "Can not get clock %d\n", ret); ++ goto exit_free_master; ++ } ++ ret = clk_prepare(tspi->clk); ++ if (ret < 0) { ++ dev_err(&pdev->dev, "Clock prepare failed %d\n", ret); ++ goto exit_free_master; ++ } ++ ret = clk_enable(tspi->clk); ++ if (ret < 0) { ++ dev_err(&pdev->dev, "Clock enable failed %d\n", ret); ++ goto exit_free_master; ++ } ++ + spi_irq = platform_get_irq(pdev, 0); + tspi->irq = spi_irq; + ret = request_threaded_irq(tspi->irq, tegra_slink_isr, +@@ -1071,14 +1089,7 @@ static int tegra_slink_probe(struct platform_device *pdev) + if (ret < 0) { + dev_err(&pdev->dev, "Failed to register ISR for IRQ %d\n", + tspi->irq); +- goto exit_free_master; +- } +- +- tspi->clk = devm_clk_get(&pdev->dev, NULL); +- if (IS_ERR(tspi->clk)) { +- dev_err(&pdev->dev, "can not get clock\n"); +- ret = PTR_ERR(tspi->clk); +- goto exit_free_irq; ++ goto exit_clk_disable; + } + + tspi->rst = devm_reset_control_get(&pdev->dev, "spi"); +@@ -1138,6 +1149,8 @@ exit_rx_dma_free: + tegra_slink_deinit_dma_param(tspi, true); + exit_free_irq: + free_irq(spi_irq, tspi); ++exit_clk_disable: ++ clk_disable(tspi->clk); + exit_free_master: + spi_master_put(master); + return ret; +@@ -1150,6 +1163,8 @@ static int tegra_slink_remove(struct platform_device *pdev) + + free_irq(tspi->irq, tspi); + ++ clk_disable(tspi->clk); ++ + if (tspi->tx_dma_chan) + tegra_slink_deinit_dma_param(tspi, false); + +diff --git a/drivers/staging/android/ashmem.c b/drivers/staging/android/ashmem.c +index 6d690e5fa9bb..c6314d1552ea 100644 +--- a/drivers/staging/android/ashmem.c ++++ b/drivers/staging/android/ashmem.c +@@ -383,6 +383,12 @@ static int ashmem_mmap(struct file *file, struct vm_area_struct *vma) + goto out; + } + ++ /* requested mapping size larger than object size */ ++ if (vma->vm_end - vma->vm_start > PAGE_ALIGN(asma->size)) { ++ ret = -EINVAL; ++ goto out; ++ } ++ + /* requested protection bits must match our allowed protection mask */ + if (unlikely((vma->vm_flags & ~calc_vm_prot_bits(asma->prot_mask, 0)) & + calc_vm_prot_bits(PROT_MASK, 0))) { +diff --git a/drivers/staging/rts5208/sd.c b/drivers/staging/rts5208/sd.c +index b0bbb36f8988..9e63bdf2afe7 100644 +--- a/drivers/staging/rts5208/sd.c ++++ b/drivers/staging/rts5208/sd.c +@@ -4976,7 +4976,7 @@ int sd_execute_write_data(struct scsi_cmnd *srb, struct rtsx_chip *chip) + goto SD_Execute_Write_Cmd_Failed; + } + +- rtsx_write_register(chip, SD_BYTE_CNT_L, 0xFF, 0x00); ++ retval = rtsx_write_register(chip, SD_BYTE_CNT_L, 0xFF, 0x00); + if (retval != STATUS_SUCCESS) { + rtsx_trace(chip); + goto SD_Execute_Write_Cmd_Failed; +diff --git a/drivers/target/iscsi/iscsi_target_auth.c b/drivers/target/iscsi/iscsi_target_auth.c +index f06e74ea10d3..f0d97305575d 100644 +--- a/drivers/target/iscsi/iscsi_target_auth.c ++++ b/drivers/target/iscsi/iscsi_target_auth.c +@@ -26,15 +26,6 @@ + #include "iscsi_target_nego.h" + #include "iscsi_target_auth.h" + +-static void chap_binaryhex_to_asciihex(char *dst, char *src, int src_len) +-{ +- int i; +- +- for (i = 0; i < src_len; i++) { +- sprintf(&dst[i*2], "%02x", (int) src[i] & 0xff); +- } +-} +- + static void chap_gen_challenge( + struct iscsi_conn *conn, + int caller, +@@ -47,7 +38,7 @@ static void chap_gen_challenge( + memset(challenge_asciihex, 0, CHAP_CHALLENGE_LENGTH * 2 + 1); + + get_random_bytes(chap->challenge, CHAP_CHALLENGE_LENGTH); +- chap_binaryhex_to_asciihex(challenge_asciihex, chap->challenge, ++ bin2hex(challenge_asciihex, chap->challenge, + CHAP_CHALLENGE_LENGTH); + /* + * Set CHAP_C, and copy the generated challenge into c_str. +@@ -281,7 +272,7 @@ static int chap_server_compute_md5( + goto out; + } + +- chap_binaryhex_to_asciihex(response, server_digest, MD5_SIGNATURE_SIZE); ++ bin2hex(response, server_digest, MD5_SIGNATURE_SIZE); + pr_debug("[server] MD5 Server Digest: %s\n", response); + + if (memcmp(server_digest, client_digest, MD5_SIGNATURE_SIZE) != 0) { +@@ -403,7 +394,7 @@ static int chap_server_compute_md5( + /* + * Convert response from binary hex to ascii hext. + */ +- chap_binaryhex_to_asciihex(response, digest, MD5_SIGNATURE_SIZE); ++ bin2hex(response, digest, MD5_SIGNATURE_SIZE); + *nr_out_len += sprintf(nr_out_ptr + *nr_out_len, "CHAP_R=0x%s", + response); + *nr_out_len += 1; +diff --git a/drivers/target/iscsi/iscsi_target_tpg.c b/drivers/target/iscsi/iscsi_target_tpg.c +index 63e1dcc5914d..761b065a40bb 100644 +--- a/drivers/target/iscsi/iscsi_target_tpg.c ++++ b/drivers/target/iscsi/iscsi_target_tpg.c +@@ -637,8 +637,7 @@ int iscsit_ta_authentication(struct iscsi_portal_group *tpg, u32 authentication) + none = strstr(buf1, NONE); + if (none) + goto out; +- strncat(buf1, ",", strlen(",")); +- strncat(buf1, NONE, strlen(NONE)); ++ strlcat(buf1, "," NONE, sizeof(buf1)); + if (iscsi_update_param_value(param, buf1) < 0) + return -EINVAL; + } +diff --git a/drivers/thermal/of-thermal.c b/drivers/thermal/of-thermal.c +index d04ec3b9e5ff..8a70b57d129c 100644 +--- a/drivers/thermal/of-thermal.c ++++ b/drivers/thermal/of-thermal.c +@@ -278,10 +278,13 @@ static int of_thermal_set_mode(struct thermal_zone_device *tz, + + mutex_lock(&tz->lock); + +- if (mode == THERMAL_DEVICE_ENABLED) ++ if (mode == THERMAL_DEVICE_ENABLED) { + tz->polling_delay = data->polling_delay; +- else ++ tz->passive_delay = data->passive_delay; ++ } else { + tz->polling_delay = 0; ++ tz->passive_delay = 0; ++ } + + mutex_unlock(&tz->lock); + +diff --git a/drivers/tty/serial/8250/serial_cs.c b/drivers/tty/serial/8250/serial_cs.c +index 933c2688dd7e..8106353ce7aa 100644 +--- a/drivers/tty/serial/8250/serial_cs.c ++++ b/drivers/tty/serial/8250/serial_cs.c +@@ -637,8 +637,10 @@ static int serial_config(struct pcmcia_device *link) + (link->has_func_id) && + (link->socket->pcmcia_pfc == 0) && + ((link->func_id == CISTPL_FUNCID_MULTI) || +- (link->func_id == CISTPL_FUNCID_SERIAL))) +- pcmcia_loop_config(link, serial_check_for_multi, info); ++ (link->func_id == CISTPL_FUNCID_SERIAL))) { ++ if (pcmcia_loop_config(link, serial_check_for_multi, info)) ++ goto failed; ++ } + + /* + * Apply any multi-port quirk. +diff --git a/drivers/tty/serial/cpm_uart/cpm_uart_core.c b/drivers/tty/serial/cpm_uart/cpm_uart_core.c +index d3e3d42c0c12..0040c29f651a 100644 +--- a/drivers/tty/serial/cpm_uart/cpm_uart_core.c ++++ b/drivers/tty/serial/cpm_uart/cpm_uart_core.c +@@ -1068,8 +1068,8 @@ static int poll_wait_key(char *obuf, struct uart_cpm_port *pinfo) + /* Get the address of the host memory buffer. + */ + bdp = pinfo->rx_cur; +- while (bdp->cbd_sc & BD_SC_EMPTY) +- ; ++ if (bdp->cbd_sc & BD_SC_EMPTY) ++ return NO_POLL_CHAR; + + /* If the buffer address is in the CPM DPRAM, don't + * convert it. +@@ -1104,7 +1104,11 @@ static int cpm_get_poll_char(struct uart_port *port) + poll_chars = 0; + } + if (poll_chars <= 0) { +- poll_chars = poll_wait_key(poll_buf, pinfo); ++ int ret = poll_wait_key(poll_buf, pinfo); ++ ++ if (ret == NO_POLL_CHAR) ++ return ret; ++ poll_chars = ret; + pollp = poll_buf; + } + poll_chars--; +diff --git a/drivers/tty/serial/fsl_lpuart.c b/drivers/tty/serial/fsl_lpuart.c +index 937f5e10f165..e2ec04904f54 100644 +--- a/drivers/tty/serial/fsl_lpuart.c ++++ b/drivers/tty/serial/fsl_lpuart.c +@@ -833,7 +833,8 @@ static inline int lpuart_start_rx_dma(struct lpuart_port *sport) + struct circ_buf *ring = &sport->rx_ring; + int ret, nent; + int bits, baud; +- struct tty_struct *tty = tty_port_tty_get(&sport->port.state->port); ++ struct tty_port *port = &sport->port.state->port; ++ struct tty_struct *tty = port->tty; + struct ktermios *termios = &tty->termios; + + baud = tty_get_baud_rate(tty); +diff --git a/drivers/tty/serial/imx.c b/drivers/tty/serial/imx.c +index b24edf634985..0d82be145c68 100644 +--- a/drivers/tty/serial/imx.c ++++ b/drivers/tty/serial/imx.c +@@ -2197,6 +2197,14 @@ static int serial_imx_probe(struct platform_device *pdev) + ret); + return ret; + } ++ ++ ret = devm_request_irq(&pdev->dev, rtsirq, imx_rtsint, 0, ++ dev_name(&pdev->dev), sport); ++ if (ret) { ++ dev_err(&pdev->dev, "failed to request rts irq: %d\n", ++ ret); ++ return ret; ++ } + } else { + ret = devm_request_irq(&pdev->dev, rxirq, imx_int, 0, + dev_name(&pdev->dev), sport); +diff --git a/drivers/usb/class/cdc-wdm.c b/drivers/usb/class/cdc-wdm.c +index adc0f78dc54d..9f001659807a 100644 +--- a/drivers/usb/class/cdc-wdm.c ++++ b/drivers/usb/class/cdc-wdm.c +@@ -470,7 +470,7 @@ static int service_outstanding_interrupt(struct wdm_device *desc) + + set_bit(WDM_RESPONDING, &desc->flags); + spin_unlock_irq(&desc->iuspin); +- rv = usb_submit_urb(desc->response, GFP_ATOMIC); ++ rv = usb_submit_urb(desc->response, GFP_KERNEL); + spin_lock_irq(&desc->iuspin); + if (rv) { + dev_err(&desc->intf->dev, +diff --git a/drivers/usb/core/devio.c b/drivers/usb/core/devio.c +index 893ebae51029..988240e3cb58 100644 +--- a/drivers/usb/core/devio.c ++++ b/drivers/usb/core/devio.c +@@ -1450,10 +1450,13 @@ static int proc_do_submiturb(struct usb_dev_state *ps, struct usbdevfs_urb *uurb + struct async *as = NULL; + struct usb_ctrlrequest *dr = NULL; + unsigned int u, totlen, isofrmlen; +- int i, ret, is_in, num_sgs = 0, ifnum = -1; ++ int i, ret, num_sgs = 0, ifnum = -1; + int number_of_packets = 0; + unsigned int stream_id = 0; + void *buf; ++ bool is_in; ++ bool allow_short = false; ++ bool allow_zero = false; + unsigned long mask = USBDEVFS_URB_SHORT_NOT_OK | + USBDEVFS_URB_BULK_CONTINUATION | + USBDEVFS_URB_NO_FSBR | +@@ -1487,6 +1490,8 @@ static int proc_do_submiturb(struct usb_dev_state *ps, struct usbdevfs_urb *uurb + u = 0; + switch (uurb->type) { + case USBDEVFS_URB_TYPE_CONTROL: ++ if (is_in) ++ allow_short = true; + if (!usb_endpoint_xfer_control(&ep->desc)) + return -EINVAL; + /* min 8 byte setup packet */ +@@ -1527,6 +1532,10 @@ static int proc_do_submiturb(struct usb_dev_state *ps, struct usbdevfs_urb *uurb + break; + + case USBDEVFS_URB_TYPE_BULK: ++ if (!is_in) ++ allow_zero = true; ++ else ++ allow_short = true; + switch (usb_endpoint_type(&ep->desc)) { + case USB_ENDPOINT_XFER_CONTROL: + case USB_ENDPOINT_XFER_ISOC: +@@ -1547,6 +1556,10 @@ static int proc_do_submiturb(struct usb_dev_state *ps, struct usbdevfs_urb *uurb + if (!usb_endpoint_xfer_int(&ep->desc)) + return -EINVAL; + interrupt_urb: ++ if (!is_in) ++ allow_zero = true; ++ else ++ allow_short = true; + break; + + case USBDEVFS_URB_TYPE_ISO: +@@ -1691,16 +1704,21 @@ static int proc_do_submiturb(struct usb_dev_state *ps, struct usbdevfs_urb *uurb + u = (is_in ? URB_DIR_IN : URB_DIR_OUT); + if (uurb->flags & USBDEVFS_URB_ISO_ASAP) + u |= URB_ISO_ASAP; +- if (uurb->flags & USBDEVFS_URB_SHORT_NOT_OK && is_in) ++ if (allow_short && uurb->flags & USBDEVFS_URB_SHORT_NOT_OK) + u |= URB_SHORT_NOT_OK; + if (uurb->flags & USBDEVFS_URB_NO_FSBR) + u |= URB_NO_FSBR; +- if (uurb->flags & USBDEVFS_URB_ZERO_PACKET) ++ if (allow_zero && uurb->flags & USBDEVFS_URB_ZERO_PACKET) + u |= URB_ZERO_PACKET; + if (uurb->flags & USBDEVFS_URB_NO_INTERRUPT) + u |= URB_NO_INTERRUPT; + as->urb->transfer_flags = u; + ++ if (!allow_short && uurb->flags & USBDEVFS_URB_SHORT_NOT_OK) ++ dev_warn(&ps->dev->dev, "Requested nonsensical USBDEVFS_URB_SHORT_NOT_OK.\n"); ++ if (!allow_zero && uurb->flags & USBDEVFS_URB_ZERO_PACKET) ++ dev_warn(&ps->dev->dev, "Requested nonsensical USBDEVFS_URB_ZERO_PACKET.\n"); ++ + as->urb->transfer_buffer_length = uurb->buffer_length; + as->urb->setup_packet = (unsigned char *)dr; + dr = NULL; +diff --git a/drivers/usb/core/driver.c b/drivers/usb/core/driver.c +index 0bb380a9fcf7..e9d6cf146fcc 100644 +--- a/drivers/usb/core/driver.c ++++ b/drivers/usb/core/driver.c +@@ -509,7 +509,6 @@ int usb_driver_claim_interface(struct usb_driver *driver, + struct device *dev; + struct usb_device *udev; + int retval = 0; +- int lpm_disable_error = -ENODEV; + + if (!iface) + return -ENODEV; +@@ -530,16 +529,6 @@ int usb_driver_claim_interface(struct usb_driver *driver, + + iface->condition = USB_INTERFACE_BOUND; + +- /* See the comment about disabling LPM in usb_probe_interface(). */ +- if (driver->disable_hub_initiated_lpm) { +- lpm_disable_error = usb_unlocked_disable_lpm(udev); +- if (lpm_disable_error) { +- dev_err(&iface->dev, "%s Failed to disable LPM for driver %s\n.", +- __func__, driver->name); +- return -ENOMEM; +- } +- } +- + /* Claimed interfaces are initially inactive (suspended) and + * runtime-PM-enabled, but only if the driver has autosuspend + * support. Otherwise they are marked active, to prevent the +@@ -558,9 +547,20 @@ int usb_driver_claim_interface(struct usb_driver *driver, + if (device_is_registered(dev)) + retval = device_bind_driver(dev); + +- /* Attempt to re-enable USB3 LPM, if the disable was successful. */ +- if (!lpm_disable_error) +- usb_unlocked_enable_lpm(udev); ++ if (retval) { ++ dev->driver = NULL; ++ usb_set_intfdata(iface, NULL); ++ iface->needs_remote_wakeup = 0; ++ iface->condition = USB_INTERFACE_UNBOUND; ++ ++ /* ++ * Unbound interfaces are always runtime-PM-disabled ++ * and runtime-PM-suspended ++ */ ++ if (driver->supports_autosuspend) ++ pm_runtime_disable(dev); ++ pm_runtime_set_suspended(dev); ++ } + + return retval; + } +diff --git a/drivers/usb/core/usb.c b/drivers/usb/core/usb.c +index eaf1c3b06f02..891261b43c67 100644 +--- a/drivers/usb/core/usb.c ++++ b/drivers/usb/core/usb.c +@@ -91,6 +91,8 @@ struct usb_host_interface *usb_find_alt_setting( + struct usb_interface_cache *intf_cache = NULL; + int i; + ++ if (!config) ++ return NULL; + for (i = 0; i < config->desc.bNumInterfaces; i++) { + if (config->intf_cache[i]->altsetting[0].desc.bInterfaceNumber + == iface_num) { +diff --git a/drivers/usb/serial/kobil_sct.c b/drivers/usb/serial/kobil_sct.c +index 813035f51fe7..7d252678c55a 100644 +--- a/drivers/usb/serial/kobil_sct.c ++++ b/drivers/usb/serial/kobil_sct.c +@@ -408,12 +408,20 @@ static int kobil_tiocmget(struct tty_struct *tty) + transfer_buffer_length, + KOBIL_TIMEOUT); + +- dev_dbg(&port->dev, "%s - Send get_status_line_state URB returns: %i. Statusline: %02x\n", +- __func__, result, transfer_buffer[0]); ++ dev_dbg(&port->dev, "Send get_status_line_state URB returns: %i\n", ++ result); ++ if (result < 1) { ++ if (result >= 0) ++ result = -EIO; ++ goto out_free; ++ } ++ ++ dev_dbg(&port->dev, "Statusline: %02x\n", transfer_buffer[0]); + + result = 0; + if ((transfer_buffer[0] & SUSBCR_GSL_DSR) != 0) + result = TIOCM_DSR; ++out_free: + kfree(transfer_buffer); + return result; + } +diff --git a/drivers/usb/wusbcore/security.c b/drivers/usb/wusbcore/security.c +index 8c9421b69da0..6bf86ca950b3 100644 +--- a/drivers/usb/wusbcore/security.c ++++ b/drivers/usb/wusbcore/security.c +@@ -230,7 +230,7 @@ int wusb_dev_sec_add(struct wusbhc *wusbhc, + + result = usb_get_descriptor(usb_dev, USB_DT_SECURITY, + 0, secd, sizeof(*secd)); +- if (result < sizeof(*secd)) { ++ if (result < (int)sizeof(*secd)) { + dev_err(dev, "Can't read security descriptor or " + "not enough data: %d\n", result); + goto out; +diff --git a/drivers/uwb/hwa-rc.c b/drivers/uwb/hwa-rc.c +index 9a53912bdfe9..5d3ba747ae17 100644 +--- a/drivers/uwb/hwa-rc.c ++++ b/drivers/uwb/hwa-rc.c +@@ -873,6 +873,7 @@ error_get_version: + error_rc_add: + usb_put_intf(iface); + usb_put_dev(hwarc->usb_dev); ++ kfree(hwarc); + error_alloc: + uwb_rc_put(uwb_rc); + error_rc_alloc: +diff --git a/fs/ext4/xattr.c b/fs/ext4/xattr.c +index fdcbe0f2814f..c19c96840480 100644 +--- a/fs/ext4/xattr.c ++++ b/fs/ext4/xattr.c +@@ -1426,6 +1426,11 @@ static int ext4_xattr_make_inode_space(handle_t *handle, struct inode *inode, + last = IFIRST(header); + /* Find the entry best suited to be pushed into EA block */ + for (; !IS_LAST_ENTRY(last); last = EXT4_XATTR_NEXT(last)) { ++ /* never move system.data out of the inode */ ++ if ((last->e_name_len == 4) && ++ (last->e_name_index == EXT4_XATTR_INDEX_SYSTEM) && ++ !memcmp(last->e_name, "data", 4)) ++ continue; + total_size = + EXT4_XATTR_SIZE(le32_to_cpu(last->e_value_size)) + + EXT4_XATTR_LEN(last->e_name_len); +diff --git a/fs/nfsd/nfs4proc.c b/fs/nfsd/nfs4proc.c +index eef0caf6e67d..e9495516527d 100644 +--- a/fs/nfsd/nfs4proc.c ++++ b/fs/nfsd/nfs4proc.c +@@ -1725,6 +1725,7 @@ nfsd4_proc_compound(struct svc_rqst *rqstp, + if (status) { + op = &args->ops[0]; + op->status = status; ++ resp->opcnt = 1; + goto encode_op; + } + +diff --git a/include/linux/arm-smccc.h b/include/linux/arm-smccc.h +index ca1d2cc2cdfa..18863d56273c 100644 +--- a/include/linux/arm-smccc.h ++++ b/include/linux/arm-smccc.h +@@ -199,47 +199,57 @@ asmlinkage void __arm_smccc_hvc(unsigned long a0, unsigned long a1, + + #define __declare_arg_0(a0, res) \ + struct arm_smccc_res *___res = res; \ +- register u32 r0 asm("r0") = a0; \ ++ register unsigned long r0 asm("r0") = (u32)a0; \ + register unsigned long r1 asm("r1"); \ + register unsigned long r2 asm("r2"); \ + register unsigned long r3 asm("r3") + + #define __declare_arg_1(a0, a1, res) \ ++ typeof(a1) __a1 = a1; \ + struct arm_smccc_res *___res = res; \ +- register u32 r0 asm("r0") = a0; \ +- register typeof(a1) r1 asm("r1") = a1; \ ++ register unsigned long r0 asm("r0") = (u32)a0; \ ++ register unsigned long r1 asm("r1") = __a1; \ + register unsigned long r2 asm("r2"); \ + register unsigned long r3 asm("r3") + + #define __declare_arg_2(a0, a1, a2, res) \ ++ typeof(a1) __a1 = a1; \ ++ typeof(a2) __a2 = a2; \ + struct arm_smccc_res *___res = res; \ +- register u32 r0 asm("r0") = a0; \ +- register typeof(a1) r1 asm("r1") = a1; \ +- register typeof(a2) r2 asm("r2") = a2; \ ++ register unsigned long r0 asm("r0") = (u32)a0; \ ++ register unsigned long r1 asm("r1") = __a1; \ ++ register unsigned long r2 asm("r2") = __a2; \ + register unsigned long r3 asm("r3") + + #define __declare_arg_3(a0, a1, a2, a3, res) \ ++ typeof(a1) __a1 = a1; \ ++ typeof(a2) __a2 = a2; \ ++ typeof(a3) __a3 = a3; \ + struct arm_smccc_res *___res = res; \ +- register u32 r0 asm("r0") = a0; \ +- register typeof(a1) r1 asm("r1") = a1; \ +- register typeof(a2) r2 asm("r2") = a2; \ +- register typeof(a3) r3 asm("r3") = a3 ++ register unsigned long r0 asm("r0") = (u32)a0; \ ++ register unsigned long r1 asm("r1") = __a1; \ ++ register unsigned long r2 asm("r2") = __a2; \ ++ register unsigned long r3 asm("r3") = __a3 + + #define __declare_arg_4(a0, a1, a2, a3, a4, res) \ ++ typeof(a4) __a4 = a4; \ + __declare_arg_3(a0, a1, a2, a3, res); \ +- register typeof(a4) r4 asm("r4") = a4 ++ register unsigned long r4 asm("r4") = __a4 + + #define __declare_arg_5(a0, a1, a2, a3, a4, a5, res) \ ++ typeof(a5) __a5 = a5; \ + __declare_arg_4(a0, a1, a2, a3, a4, res); \ +- register typeof(a5) r5 asm("r5") = a5 ++ register unsigned long r5 asm("r5") = __a5 + + #define __declare_arg_6(a0, a1, a2, a3, a4, a5, a6, res) \ ++ typeof(a6) __a6 = a6; \ + __declare_arg_5(a0, a1, a2, a3, a4, a5, res); \ +- register typeof(a6) r6 asm("r6") = a6 ++ register unsigned long r6 asm("r6") = __a6 + + #define __declare_arg_7(a0, a1, a2, a3, a4, a5, a6, a7, res) \ ++ typeof(a7) __a7 = a7; \ + __declare_arg_6(a0, a1, a2, a3, a4, a5, a6, res); \ +- register typeof(a7) r7 asm("r7") = a7 ++ register unsigned long r7 asm("r7") = __a7 + + #define ___declare_args(count, ...) __declare_arg_ ## count(__VA_ARGS__) + #define __declare_args(count, ...) ___declare_args(count, __VA_ARGS__) +diff --git a/include/linux/platform_data/ina2xx.h b/include/linux/platform_data/ina2xx.h +index 9abc0ca7259b..9f0aa1b48c78 100644 +--- a/include/linux/platform_data/ina2xx.h ++++ b/include/linux/platform_data/ina2xx.h +@@ -1,7 +1,7 @@ + /* + * Driver for Texas Instruments INA219, INA226 power monitor chips + * +- * Copyright (C) 2012 Lothar Felten <l-felten@ti.com> ++ * Copyright (C) 2012 Lothar Felten <lothar.felten@gmail.com> + * + * This program is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License version 2 as +diff --git a/include/linux/power_supply.h b/include/linux/power_supply.h +index 3965503315ef..ad97baf7b8de 100644 +--- a/include/linux/power_supply.h ++++ b/include/linux/power_supply.h +@@ -249,6 +249,7 @@ struct power_supply { + spinlock_t changed_lock; + bool changed; + bool initialized; ++ bool removing; + atomic_t use_cnt; + #ifdef CONFIG_THERMAL + struct thermal_zone_device *tzd; +diff --git a/include/linux/slub_def.h b/include/linux/slub_def.h +index 75f56c2ef2d4..b6a59e8cd855 100644 +--- a/include/linux/slub_def.h ++++ b/include/linux/slub_def.h +@@ -67,7 +67,8 @@ struct kmem_cache { + int size; /* The size of an object including meta data */ + int object_size; /* The size of an object without meta data */ + int offset; /* Free pointer offset. */ +- int cpu_partial; /* Number of per cpu partial objects to keep around */ ++ /* Number of per cpu partial objects to keep around */ ++ unsigned int cpu_partial; + struct kmem_cache_order_objects oo; + + /* Allocation and freeing of slabs */ +diff --git a/include/media/v4l2-fh.h b/include/media/v4l2-fh.h +index e19e6246e21c..d2671606cb5d 100644 +--- a/include/media/v4l2-fh.h ++++ b/include/media/v4l2-fh.h +@@ -42,10 +42,13 @@ struct v4l2_ctrl_handler; + * @prio: priority of the file handler, as defined by &enum v4l2_priority + * + * @wait: event' s wait queue ++ * @subscribe_lock: serialise changes to the subscribed list; guarantee that ++ * the add and del event callbacks are orderly called + * @subscribed: list of subscribed events + * @available: list of events waiting to be dequeued + * @navailable: number of available events at @available list + * @sequence: event sequence number ++ * + * @m2m_ctx: pointer to &struct v4l2_m2m_ctx + */ + struct v4l2_fh { +@@ -56,6 +59,7 @@ struct v4l2_fh { + + /* Events */ + wait_queue_head_t wait; ++ struct mutex subscribe_lock; + struct list_head subscribed; + struct list_head available; + unsigned int navailable; +diff --git a/kernel/module.c b/kernel/module.c +index 0651f2d25fc9..2325c9821f2a 100644 +--- a/kernel/module.c ++++ b/kernel/module.c +@@ -4011,7 +4011,7 @@ static unsigned long mod_find_symname(struct module *mod, const char *name) + + for (i = 0; i < kallsyms->num_symtab; i++) + if (strcmp(name, symname(kallsyms, i)) == 0 && +- kallsyms->symtab[i].st_info != 'U') ++ kallsyms->symtab[i].st_shndx != SHN_UNDEF) + return kallsyms->symtab[i].st_value; + return 0; + } +@@ -4057,6 +4057,10 @@ int module_kallsyms_on_each_symbol(int (*fn)(void *, const char *, + if (mod->state == MODULE_STATE_UNFORMED) + continue; + for (i = 0; i < kallsyms->num_symtab; i++) { ++ ++ if (kallsyms->symtab[i].st_shndx == SHN_UNDEF) ++ continue; ++ + ret = fn(data, symname(kallsyms, i), + mod, kallsyms->symtab[i].st_value); + if (ret != 0) +diff --git a/kernel/time/alarmtimer.c b/kernel/time/alarmtimer.c +index d67ef56ca9bc..a0ee81f49a87 100644 +--- a/kernel/time/alarmtimer.c ++++ b/kernel/time/alarmtimer.c +@@ -786,7 +786,8 @@ static int alarm_timer_nsleep(const clockid_t which_clock, int flags, + /* Convert (if necessary) to absolute time */ + if (flags != TIMER_ABSTIME) { + ktime_t now = alarm_bases[type].gettime(); +- exp = ktime_add(now, exp); ++ ++ exp = ktime_add_safe(now, exp); + } + + if (alarmtimer_do_nsleep(&alarm, exp)) +diff --git a/lib/klist.c b/lib/klist.c +index 0507fa5d84c5..f6b547812fe3 100644 +--- a/lib/klist.c ++++ b/lib/klist.c +@@ -336,8 +336,9 @@ struct klist_node *klist_prev(struct klist_iter *i) + void (*put)(struct klist_node *) = i->i_klist->put; + struct klist_node *last = i->i_cur; + struct klist_node *prev; ++ unsigned long flags; + +- spin_lock(&i->i_klist->k_lock); ++ spin_lock_irqsave(&i->i_klist->k_lock, flags); + + if (last) { + prev = to_klist_node(last->n_node.prev); +@@ -356,7 +357,7 @@ struct klist_node *klist_prev(struct klist_iter *i) + prev = to_klist_node(prev->n_node.prev); + } + +- spin_unlock(&i->i_klist->k_lock); ++ spin_unlock_irqrestore(&i->i_klist->k_lock, flags); + + if (put && last) + put(last); +@@ -377,8 +378,9 @@ struct klist_node *klist_next(struct klist_iter *i) + void (*put)(struct klist_node *) = i->i_klist->put; + struct klist_node *last = i->i_cur; + struct klist_node *next; ++ unsigned long flags; + +- spin_lock(&i->i_klist->k_lock); ++ spin_lock_irqsave(&i->i_klist->k_lock, flags); + + if (last) { + next = to_klist_node(last->n_node.next); +@@ -397,7 +399,7 @@ struct klist_node *klist_next(struct klist_iter *i) + next = to_klist_node(next->n_node.next); + } + +- spin_unlock(&i->i_klist->k_lock); ++ spin_unlock_irqrestore(&i->i_klist->k_lock, flags); + + if (put && last) + put(last); +diff --git a/mm/slub.c b/mm/slub.c +index e0ce5dec84ba..131dee87a67c 100644 +--- a/mm/slub.c ++++ b/mm/slub.c +@@ -1793,7 +1793,7 @@ static void *get_partial_node(struct kmem_cache *s, struct kmem_cache_node *n, + { + struct page *page, *page2; + void *object = NULL; +- int available = 0; ++ unsigned int available = 0; + int objects; + + /* +@@ -4870,10 +4870,10 @@ static ssize_t cpu_partial_show(struct kmem_cache *s, char *buf) + static ssize_t cpu_partial_store(struct kmem_cache *s, const char *buf, + size_t length) + { +- unsigned long objects; ++ unsigned int objects; + int err; + +- err = kstrtoul(buf, 10, &objects); ++ err = kstrtouint(buf, 10, &objects); + if (err) + return err; + if (objects && !kmem_cache_has_cpu_partial(s)) +diff --git a/net/6lowpan/iphc.c b/net/6lowpan/iphc.c +index 79f1fa22509a..23654f1902f3 100644 +--- a/net/6lowpan/iphc.c ++++ b/net/6lowpan/iphc.c +@@ -745,6 +745,7 @@ int lowpan_header_decompress(struct sk_buff *skb, const struct net_device *dev, + hdr.hop_limit, &hdr.daddr); + + skb_push(skb, sizeof(hdr)); ++ skb_reset_mac_header(skb); + skb_reset_network_header(skb); + skb_copy_to_linear_data(skb, &hdr, sizeof(hdr)); + +diff --git a/sound/aoa/core/gpio-feature.c b/sound/aoa/core/gpio-feature.c +index 71960089e207..65557421fe0b 100644 +--- a/sound/aoa/core/gpio-feature.c ++++ b/sound/aoa/core/gpio-feature.c +@@ -88,8 +88,10 @@ static struct device_node *get_gpio(char *name, + } + + reg = of_get_property(np, "reg", NULL); +- if (!reg) ++ if (!reg) { ++ of_node_put(np); + return NULL; ++ } + + *gpioptr = *reg; + +diff --git a/sound/pci/hda/hda_intel.c b/sound/pci/hda/hda_intel.c +index 4e331dd5ff47..f913809a7de3 100644 +--- a/sound/pci/hda/hda_intel.c ++++ b/sound/pci/hda/hda_intel.c +@@ -2349,7 +2349,8 @@ static const struct pci_device_id azx_ids[] = { + .driver_data = AZX_DRIVER_GENERIC | AZX_DCAPS_PRESET_ATI_SB }, + /* AMD Raven */ + { PCI_DEVICE(0x1022, 0x15e3), +- .driver_data = AZX_DRIVER_GENERIC | AZX_DCAPS_PRESET_ATI_SB }, ++ .driver_data = AZX_DRIVER_GENERIC | AZX_DCAPS_PRESET_ATI_SB | ++ AZX_DCAPS_PM_RUNTIME }, + /* ATI HDMI */ + { PCI_DEVICE(0x1002, 0x0002), + .driver_data = AZX_DRIVER_ATIHDMI_NS | AZX_DCAPS_PRESET_ATI_HDMI_NS }, +diff --git a/sound/soc/soc-dapm.c b/sound/soc/soc-dapm.c +index 0b5d132bc3dd..8bfc534e3b34 100644 +--- a/sound/soc/soc-dapm.c ++++ b/sound/soc/soc-dapm.c +@@ -3913,6 +3913,13 @@ int snd_soc_dapm_link_dai_widgets(struct snd_soc_card *card) + continue; + } + ++ /* let users know there is no DAI to link */ ++ if (!dai_w->priv) { ++ dev_dbg(card->dev, "dai widget %s has no DAI\n", ++ dai_w->name); ++ continue; ++ } ++ + dai = dai_w->priv; + + /* ...find all widgets with the same stream and link them */ |