Get Gentoo!
gentoo.org sites
gentoo.org Wiki Bugs Forums Packages
Planet Archives Sources
Infra Status
summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorMike Pagano <mpagano@gentoo.org>2021-03-07 10:15:55 -0500
committerMike Pagano <mpagano@gentoo.org>2021-03-07 10:15:55 -0500
commitc5a6fc32afe24d782c29b6d3986626c53f7b6da4 (patch)
tree660c7899d3047d551c6442b3f2b901dbe66cbc3f
parentUpdate wireguard patch (diff)
downloadlinux-patches-c5a6fc32afe24d782c29b6d3986626c53f7b6da4.tar.gz
linux-patches-c5a6fc32afe24d782c29b6d3986626c53f7b6da4.tar.bz2
linux-patches-c5a6fc32afe24d782c29b6d3986626c53f7b6da4.zip
Linux patch 5.4.1035.4-106
Signed-off-by: Mike Pagano <mpagano@gentoo.org>
Diffstat
-rw-r--r--0000_README4
-rw-r--r--1102_linux-5.4.103.patch3388
2 files changed, 3392 insertions, 0 deletions
diff --git a/0000_README b/0000_README
index f881b7b2..396b6d9f 100644
--- a/0000_README
+++ b/0000_README
@@ -451,6 +451,10 @@ Patch: 1101_linux-5.4.102.patch
From: http://www.kernel.org
Desc: Linux 5.4.102
+Patch: 1102_linux-5.4.103.patch
+From: http://www.kernel.org
+Desc: Linux 5.4.103
+
Patch: 1500_XATTR_USER_PREFIX.patch
From: https://bugs.gentoo.org/show_bug.cgi?id=470644
Desc: Support for namespace user.pax.* on tmpfs.
diff --git a/1102_linux-5.4.103.patch b/1102_linux-5.4.103.patch
new file mode 100644
index 00000000..5bc570a7
--- /dev/null
+++ b/1102_linux-5.4.103.patch
@@ -0,0 +1,3388 @@
+diff --git a/Documentation/devicetree/bindings/net/btusb.txt b/Documentation/devicetree/bindings/net/btusb.txt
+index b1ad6ee68e909..c51dd99dc0d3c 100644
+--- a/Documentation/devicetree/bindings/net/btusb.txt
++++ b/Documentation/devicetree/bindings/net/btusb.txt
+@@ -38,7 +38,7 @@ Following example uses irq pin number 3 of gpio0 for out of band wake-on-bt:
+ compatible = "usb1286,204e";
+ reg = <1>;
+ interrupt-parent = <&gpio0>;
+- interrupt-name = "wakeup";
++ interrupt-names = "wakeup";
+ interrupts = <3 IRQ_TYPE_LEVEL_LOW>;
+ };
+ };
+diff --git a/Documentation/devicetree/bindings/net/ethernet-controller.yaml b/Documentation/devicetree/bindings/net/ethernet-controller.yaml
+index 0e7c31794ae6c..4f78e9a6da609 100644
+--- a/Documentation/devicetree/bindings/net/ethernet-controller.yaml
++++ b/Documentation/devicetree/bindings/net/ethernet-controller.yaml
+@@ -190,6 +190,11 @@ properties:
+ Indicates that full-duplex is used. When absent, half
+ duplex is assumed.
+
++ pause:
++ $ref: /schemas/types.yaml#definitions/flag
++ description:
++ Indicates that pause should be enabled.
++
+ asym-pause:
+ $ref: /schemas/types.yaml#definitions/flag
+ description:
+diff --git a/Documentation/filesystems/sysfs.txt b/Documentation/filesystems/sysfs.txt
+index ddf15b1b0d5a4..33ec0a01450dd 100644
+--- a/Documentation/filesystems/sysfs.txt
++++ b/Documentation/filesystems/sysfs.txt
+@@ -232,12 +232,10 @@ Other notes:
+ is 4096.
+
+ - show() methods should return the number of bytes printed into the
+- buffer. This is the return value of scnprintf().
++ buffer.
+
+-- show() must not use snprintf() when formatting the value to be
+- returned to user space. If you can guarantee that an overflow
+- will never happen you can use sprintf() otherwise you must use
+- scnprintf().
++- show() should only use sysfs_emit() or sysfs_emit_at() when formatting
++ the value to be returned to user space.
+
+ - store() should return the number of bytes used from the buffer. If the
+ entire buffer has been used, just return the count argument.
+diff --git a/Makefile b/Makefile
+index 80ff67e5f73a6..c95435d78fcbb 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,7 +1,7 @@
+ # SPDX-License-Identifier: GPL-2.0
+ VERSION = 5
+ PATCHLEVEL = 4
+-SUBLEVEL = 102
++SUBLEVEL = 103
+ EXTRAVERSION =
+ NAME = Kleptomaniac Octopus
+
+diff --git a/arch/arm/xen/p2m.c b/arch/arm/xen/p2m.c
+index fd6e3aafe2724..acb464547a54f 100644
+--- a/arch/arm/xen/p2m.c
++++ b/arch/arm/xen/p2m.c
+@@ -93,12 +93,39 @@ int set_foreign_p2m_mapping(struct gnttab_map_grant_ref *map_ops,
+ int i;
+
+ for (i = 0; i < count; i++) {
++ struct gnttab_unmap_grant_ref unmap;
++ int rc;
++
+ if (map_ops[i].status)
+ continue;
+- if (unlikely(!set_phys_to_machine(map_ops[i].host_addr >> XEN_PAGE_SHIFT,
+- map_ops[i].dev_bus_addr >> XEN_PAGE_SHIFT))) {
+- return -ENOMEM;
+- }
++ if (likely(set_phys_to_machine(map_ops[i].host_addr >> XEN_PAGE_SHIFT,
++ map_ops[i].dev_bus_addr >> XEN_PAGE_SHIFT)))
++ continue;
++
++ /*
++ * Signal an error for this slot. This in turn requires
++ * immediate unmapping.
++ */
++ map_ops[i].status = GNTST_general_error;
++ unmap.host_addr = map_ops[i].host_addr,
++ unmap.handle = map_ops[i].handle;
++ map_ops[i].handle = ~0;
++ if (map_ops[i].flags & GNTMAP_device_map)
++ unmap.dev_bus_addr = map_ops[i].dev_bus_addr;
++ else
++ unmap.dev_bus_addr = 0;
++
++ /*
++ * Pre-populate the status field, to be recognizable in
++ * the log message below.
++ */
++ unmap.status = 1;
++
++ rc = HYPERVISOR_grant_table_op(GNTTABOP_unmap_grant_ref,
++ &unmap, 1);
++ if (rc || unmap.status != GNTST_okay)
++ pr_err_once("gnttab unmap failed: rc=%d st=%d\n",
++ rc, unmap.status);
+ }
+
+ return 0;
+diff --git a/arch/arm64/kernel/module.lds b/arch/arm64/kernel/module.lds
+index 22e36a21c1134..09a0eef71d12b 100644
+--- a/arch/arm64/kernel/module.lds
++++ b/arch/arm64/kernel/module.lds
+@@ -1,5 +1,5 @@
+ SECTIONS {
+- .plt (NOLOAD) : { BYTE(0) }
+- .init.plt (NOLOAD) : { BYTE(0) }
+- .text.ftrace_trampoline (NOLOAD) : { BYTE(0) }
++ .plt 0 (NOLOAD) : { BYTE(0) }
++ .init.plt 0 (NOLOAD) : { BYTE(0) }
++ .text.ftrace_trampoline 0 (NOLOAD) : { BYTE(0) }
+ }
+diff --git a/arch/mips/include/asm/string.h b/arch/mips/include/asm/string.h
+index 29030cb398ee5..1de3bbce8e88a 100644
+--- a/arch/mips/include/asm/string.h
++++ b/arch/mips/include/asm/string.h
+@@ -10,127 +10,6 @@
+ #ifndef _ASM_STRING_H
+ #define _ASM_STRING_H
+
+-
+-/*
+- * Most of the inline functions are rather naive implementations so I just
+- * didn't bother updating them for 64-bit ...
+- */
+-#ifdef CONFIG_32BIT
+-
+-#ifndef IN_STRING_C
+-
+-#define __HAVE_ARCH_STRCPY
+-static __inline__ char *strcpy(char *__dest, __const__ char *__src)
+-{
+- char *__xdest = __dest;
+-
+- __asm__ __volatile__(
+- ".set\tnoreorder\n\t"
+- ".set\tnoat\n"
+- "1:\tlbu\t$1,(%1)\n\t"
+- "addiu\t%1,1\n\t"
+- "sb\t$1,(%0)\n\t"
+- "bnez\t$1,1b\n\t"
+- "addiu\t%0,1\n\t"
+- ".set\tat\n\t"
+- ".set\treorder"
+- : "=r" (__dest), "=r" (__src)
+- : "0" (__dest), "1" (__src)
+- : "memory");
+-
+- return __xdest;
+-}
+-
+-#define __HAVE_ARCH_STRNCPY
+-static __inline__ char *strncpy(char *__dest, __const__ char *__src, size_t __n)
+-{
+- char *__xdest = __dest;
+-
+- if (__n == 0)
+- return __xdest;
+-
+- __asm__ __volatile__(
+- ".set\tnoreorder\n\t"
+- ".set\tnoat\n"
+- "1:\tlbu\t$1,(%1)\n\t"
+- "subu\t%2,1\n\t"
+- "sb\t$1,(%0)\n\t"
+- "beqz\t$1,2f\n\t"
+- "addiu\t%0,1\n\t"
+- "bnez\t%2,1b\n\t"
+- "addiu\t%1,1\n"
+- "2:\n\t"
+- ".set\tat\n\t"
+- ".set\treorder"
+- : "=r" (__dest), "=r" (__src), "=r" (__n)
+- : "0" (__dest), "1" (__src), "2" (__n)
+- : "memory");
+-
+- return __xdest;
+-}
+-
+-#define __HAVE_ARCH_STRCMP
+-static __inline__ int strcmp(__const__ char *__cs, __const__ char *__ct)
+-{
+- int __res;
+-
+- __asm__ __volatile__(
+- ".set\tnoreorder\n\t"
+- ".set\tnoat\n\t"
+- "lbu\t%2,(%0)\n"
+- "1:\tlbu\t$1,(%1)\n\t"
+- "addiu\t%0,1\n\t"
+- "bne\t$1,%2,2f\n\t"
+- "addiu\t%1,1\n\t"
+- "bnez\t%2,1b\n\t"
+- "lbu\t%2,(%0)\n\t"
+-#if defined(CONFIG_CPU_R3000)
+- "nop\n\t"
+-#endif
+- "move\t%2,$1\n"
+- "2:\tsubu\t%2,$1\n"
+- "3:\t.set\tat\n\t"
+- ".set\treorder"
+- : "=r" (__cs), "=r" (__ct), "=r" (__res)
+- : "0" (__cs), "1" (__ct));
+-
+- return __res;
+-}
+-
+-#endif /* !defined(IN_STRING_C) */
+-
+-#define __HAVE_ARCH_STRNCMP
+-static __inline__ int
+-strncmp(__const__ char *__cs, __const__ char *__ct, size_t __count)
+-{
+- int __res;
+-
+- __asm__ __volatile__(
+- ".set\tnoreorder\n\t"
+- ".set\tnoat\n"
+- "1:\tlbu\t%3,(%0)\n\t"
+- "beqz\t%2,2f\n\t"
+- "lbu\t$1,(%1)\n\t"
+- "subu\t%2,1\n\t"
+- "bne\t$1,%3,3f\n\t"
+- "addiu\t%0,1\n\t"
+- "bnez\t%3,1b\n\t"
+- "addiu\t%1,1\n"
+- "2:\n\t"
+-#if defined(CONFIG_CPU_R3000)
+- "nop\n\t"
+-#endif
+- "move\t%3,$1\n"
+- "3:\tsubu\t%3,$1\n\t"
+- ".set\tat\n\t"
+- ".set\treorder"
+- : "=r" (__cs), "=r" (__ct), "=r" (__count), "=r" (__res)
+- : "0" (__cs), "1" (__ct), "2" (__count));
+-
+- return __res;
+-}
+-#endif /* CONFIG_32BIT */
+-
+ #define __HAVE_ARCH_MEMSET
+ extern void *memset(void *__s, int __c, size_t __count);
+
+diff --git a/arch/mips/vdso/Makefile b/arch/mips/vdso/Makefile
+index 996a934ece7d6..d3cd9c4cadc28 100644
+--- a/arch/mips/vdso/Makefile
++++ b/arch/mips/vdso/Makefile
+@@ -16,12 +16,9 @@ ccflags-vdso := \
+ $(filter -march=%,$(KBUILD_CFLAGS)) \
+ $(filter -m%-float,$(KBUILD_CFLAGS)) \
+ $(filter -mno-loongson-%,$(KBUILD_CFLAGS)) \
++ $(CLANG_FLAGS) \
+ -D__VDSO__
+
+-ifdef CONFIG_CC_IS_CLANG
+-ccflags-vdso += $(filter --target=%,$(KBUILD_CFLAGS))
+-endif
+-
+ #
+ # The -fno-jump-tables flag only prevents the compiler from generating
+ # jump tables but does not prevent the compiler from emitting absolute
+diff --git a/arch/parisc/kernel/irq.c b/arch/parisc/kernel/irq.c
+index e5fcfb70cc7c0..4d54aa70ea5f3 100644
+--- a/arch/parisc/kernel/irq.c
++++ b/arch/parisc/kernel/irq.c
+@@ -376,7 +376,11 @@ static inline int eirr_to_irq(unsigned long eirr)
+ /*
+ * IRQ STACK - used for irq handler
+ */
++#ifdef CONFIG_64BIT
++#define IRQ_STACK_SIZE (4096 << 4) /* 64k irq stack size */
++#else
+ #define IRQ_STACK_SIZE (4096 << 3) /* 32k irq stack size */
++#endif
+
+ union irq_stack_union {
+ unsigned long stack[IRQ_STACK_SIZE/sizeof(unsigned long)];
+diff --git a/arch/x86/events/intel/core.c b/arch/x86/events/intel/core.c
+index b24c38090dd99..90760393a9643 100644
+--- a/arch/x86/events/intel/core.c
++++ b/arch/x86/events/intel/core.c
+@@ -4002,6 +4002,9 @@ static const struct x86_cpu_desc isolation_ucodes[] = {
+ INTEL_CPU_DESC(INTEL_FAM6_BROADWELL_X, 2, 0x0b000014),
+ INTEL_CPU_DESC(INTEL_FAM6_SKYLAKE_X, 3, 0x00000021),
+ INTEL_CPU_DESC(INTEL_FAM6_SKYLAKE_X, 4, 0x00000000),
++ INTEL_CPU_DESC(INTEL_FAM6_SKYLAKE_X, 5, 0x00000000),
++ INTEL_CPU_DESC(INTEL_FAM6_SKYLAKE_X, 6, 0x00000000),
++ INTEL_CPU_DESC(INTEL_FAM6_SKYLAKE_X, 7, 0x00000000),
+ INTEL_CPU_DESC(INTEL_FAM6_SKYLAKE_L, 3, 0x0000007c),
+ INTEL_CPU_DESC(INTEL_FAM6_SKYLAKE, 3, 0x0000007c),
+ INTEL_CPU_DESC(INTEL_FAM6_KABYLAKE, 9, 0x0000004e),
+diff --git a/arch/x86/kernel/module.c b/arch/x86/kernel/module.c
+index d5c72cb877b31..77dabedaa9d12 100644
+--- a/arch/x86/kernel/module.c
++++ b/arch/x86/kernel/module.c
+@@ -114,6 +114,7 @@ int apply_relocate(Elf32_Shdr *sechdrs,
+ *location += sym->st_value;
+ break;
+ case R_386_PC32:
++ case R_386_PLT32:
+ /* Add the value, subtract its position */
+ *location += sym->st_value - (uint32_t)location;
+ break;
+diff --git a/arch/x86/kernel/reboot.c b/arch/x86/kernel/reboot.c
+index 835b6fc0c1bbf..b1b96d461bc76 100644
+--- a/arch/x86/kernel/reboot.c
++++ b/arch/x86/kernel/reboot.c
+@@ -477,6 +477,15 @@ static const struct dmi_system_id reboot_dmi_table[] __initconst = {
+ },
+ },
+
++ { /* PCIe Wifi card isn't detected after reboot otherwise */
++ .callback = set_pci_reboot,
++ .ident = "Zotac ZBOX CI327 nano",
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "NA"),
++ DMI_MATCH(DMI_PRODUCT_NAME, "ZBOX-CI327NANO-GS-01"),
++ },
++ },
++
+ /* Sony */
+ { /* Handle problems with rebooting on Sony VGN-Z540N */
+ .callback = set_bios_reboot,
+diff --git a/arch/x86/tools/relocs.c b/arch/x86/tools/relocs.c
+index ce7188cbdae58..1c3a1962cade6 100644
+--- a/arch/x86/tools/relocs.c
++++ b/arch/x86/tools/relocs.c
+@@ -867,9 +867,11 @@ static int do_reloc32(struct section *sec, Elf_Rel *rel, Elf_Sym *sym,
+ case R_386_PC32:
+ case R_386_PC16:
+ case R_386_PC8:
++ case R_386_PLT32:
+ /*
+- * NONE can be ignored and PC relative relocations don't
+- * need to be adjusted.
++ * NONE can be ignored and PC relative relocations don't need
++ * to be adjusted. Because sym must be defined, R_386_PLT32 can
++ * be treated the same way as R_386_PC32.
+ */
+ break;
+
+@@ -910,9 +912,11 @@ static int do_reloc_real(struct section *sec, Elf_Rel *rel, Elf_Sym *sym,
+ case R_386_PC32:
+ case R_386_PC16:
+ case R_386_PC8:
++ case R_386_PLT32:
+ /*
+- * NONE can be ignored and PC relative relocations don't
+- * need to be adjusted.
++ * NONE can be ignored and PC relative relocations don't need
++ * to be adjusted. Because sym must be defined, R_386_PLT32 can
++ * be treated the same way as R_386_PC32.
+ */
+ break;
+
+diff --git a/arch/x86/xen/p2m.c b/arch/x86/xen/p2m.c
+index 7fe5be8e6d3db..12fcb3858303a 100644
+--- a/arch/x86/xen/p2m.c
++++ b/arch/x86/xen/p2m.c
+@@ -714,6 +714,8 @@ int set_foreign_p2m_mapping(struct gnttab_map_grant_ref *map_ops,
+
+ for (i = 0; i < count; i++) {
+ unsigned long mfn, pfn;
++ struct gnttab_unmap_grant_ref unmap[2];
++ int rc;
+
+ /* Do not add to override if the map failed. */
+ if (map_ops[i].status != GNTST_okay ||
+@@ -731,10 +733,46 @@ int set_foreign_p2m_mapping(struct gnttab_map_grant_ref *map_ops,
+
+ WARN(pfn_to_mfn(pfn) != INVALID_P2M_ENTRY, "page must be ballooned");
+
+- if (unlikely(!set_phys_to_machine(pfn, FOREIGN_FRAME(mfn)))) {
+- ret = -ENOMEM;
+- goto out;
++ if (likely(set_phys_to_machine(pfn, FOREIGN_FRAME(mfn))))
++ continue;
++
++ /*
++ * Signal an error for this slot. This in turn requires
++ * immediate unmapping.
++ */
++ map_ops[i].status = GNTST_general_error;
++ unmap[0].host_addr = map_ops[i].host_addr,
++ unmap[0].handle = map_ops[i].handle;
++ map_ops[i].handle = ~0;
++ if (map_ops[i].flags & GNTMAP_device_map)
++ unmap[0].dev_bus_addr = map_ops[i].dev_bus_addr;
++ else
++ unmap[0].dev_bus_addr = 0;
++
++ if (kmap_ops) {
++ kmap_ops[i].status = GNTST_general_error;
++ unmap[1].host_addr = kmap_ops[i].host_addr,
++ unmap[1].handle = kmap_ops[i].handle;
++ kmap_ops[i].handle = ~0;
++ if (kmap_ops[i].flags & GNTMAP_device_map)
++ unmap[1].dev_bus_addr = kmap_ops[i].dev_bus_addr;
++ else
++ unmap[1].dev_bus_addr = 0;
+ }
++
++ /*
++ * Pre-populate both status fields, to be recognizable in
++ * the log message below.
++ */
++ unmap[0].status = 1;
++ unmap[1].status = 1;
++
++ rc = HYPERVISOR_grant_table_op(GNTTABOP_unmap_grant_ref,
++ unmap, 1 + !!kmap_ops);
++ if (rc || unmap[0].status != GNTST_okay ||
++ unmap[1].status != GNTST_okay)
++ pr_err_once("gnttab unmap failed: rc=%d st0=%d st1=%d\n",
++ rc, unmap[0].status, unmap[1].status);
+ }
+
+ out:
+diff --git a/crypto/tcrypt.c b/crypto/tcrypt.c
+index 83ad0b1fab30a..0cece1f883ebe 100644
+--- a/crypto/tcrypt.c
++++ b/crypto/tcrypt.c
+@@ -198,8 +198,8 @@ static int test_mb_aead_jiffies(struct test_mb_aead_data *data, int enc,
+ goto out;
+ }
+
+- pr_cont("%d operations in %d seconds (%ld bytes)\n",
+- bcount * num_mb, secs, (long)bcount * blen * num_mb);
++ pr_cont("%d operations in %d seconds (%llu bytes)\n",
++ bcount * num_mb, secs, (u64)bcount * blen * num_mb);
+
+ out:
+ kfree(rc);
+@@ -468,8 +468,8 @@ static int test_aead_jiffies(struct aead_request *req, int enc,
+ return ret;
+ }
+
+- printk("%d operations in %d seconds (%ld bytes)\n",
+- bcount, secs, (long)bcount * blen);
++ pr_cont("%d operations in %d seconds (%llu bytes)\n",
++ bcount, secs, (u64)bcount * blen);
+ return 0;
+ }
+
+@@ -759,8 +759,8 @@ static int test_mb_ahash_jiffies(struct test_mb_ahash_data *data, int blen,
+ goto out;
+ }
+
+- pr_cont("%d operations in %d seconds (%ld bytes)\n",
+- bcount * num_mb, secs, (long)bcount * blen * num_mb);
++ pr_cont("%d operations in %d seconds (%llu bytes)\n",
++ bcount * num_mb, secs, (u64)bcount * blen * num_mb);
+
+ out:
+ kfree(rc);
+@@ -1196,8 +1196,8 @@ static int test_mb_acipher_jiffies(struct test_mb_skcipher_data *data, int enc,
+ goto out;
+ }
+
+- pr_cont("%d operations in %d seconds (%ld bytes)\n",
+- bcount * num_mb, secs, (long)bcount * blen * num_mb);
++ pr_cont("%d operations in %d seconds (%llu bytes)\n",
++ bcount * num_mb, secs, (u64)bcount * blen * num_mb);
+
+ out:
+ kfree(rc);
+@@ -1434,8 +1434,8 @@ static int test_acipher_jiffies(struct skcipher_request *req, int enc,
+ return ret;
+ }
+
+- pr_cont("%d operations in %d seconds (%ld bytes)\n",
+- bcount, secs, (long)bcount * blen);
++ pr_cont("%d operations in %d seconds (%llu bytes)\n",
++ bcount, secs, (u64)bcount * blen);
+ return 0;
+ }
+
+diff --git a/drivers/block/nbd.c b/drivers/block/nbd.c
+index f068bb5d650eb..e11fddcb73b98 100644
+--- a/drivers/block/nbd.c
++++ b/drivers/block/nbd.c
+@@ -78,8 +78,7 @@ struct link_dead_args {
+ #define NBD_RT_HAS_PID_FILE 3
+ #define NBD_RT_HAS_CONFIG_REF 4
+ #define NBD_RT_BOUND 5
+-#define NBD_RT_DESTROY_ON_DISCONNECT 6
+-#define NBD_RT_DISCONNECT_ON_CLOSE 7
++#define NBD_RT_DISCONNECT_ON_CLOSE 6
+
+ #define NBD_DESTROY_ON_DISCONNECT 0
+ #define NBD_DISCONNECT_REQUESTED 1
+@@ -1940,12 +1939,21 @@ again:
+ if (info->attrs[NBD_ATTR_CLIENT_FLAGS]) {
+ u64 flags = nla_get_u64(info->attrs[NBD_ATTR_CLIENT_FLAGS]);
+ if (flags & NBD_CFLAG_DESTROY_ON_DISCONNECT) {
+- set_bit(NBD_RT_DESTROY_ON_DISCONNECT,
+- &config->runtime_flags);
+- set_bit(NBD_DESTROY_ON_DISCONNECT, &nbd->flags);
+- put_dev = true;
++ /*
++ * We have 1 ref to keep the device around, and then 1
++ * ref for our current operation here, which will be
++ * inherited by the config. If we already have
++ * DESTROY_ON_DISCONNECT set then we know we don't have
++ * that extra ref already held so we don't need the
++ * put_dev.
++ */
++ if (!test_and_set_bit(NBD_DESTROY_ON_DISCONNECT,
++ &nbd->flags))
++ put_dev = true;
+ } else {
+- clear_bit(NBD_DESTROY_ON_DISCONNECT, &nbd->flags);
++ if (test_and_clear_bit(NBD_DESTROY_ON_DISCONNECT,
++ &nbd->flags))
++ refcount_inc(&nbd->refs);
+ }
+ if (flags & NBD_CFLAG_DISCONNECT_ON_CLOSE) {
+ set_bit(NBD_RT_DISCONNECT_ON_CLOSE,
+@@ -2116,15 +2124,13 @@ static int nbd_genl_reconfigure(struct sk_buff *skb, struct genl_info *info)
+ if (info->attrs[NBD_ATTR_CLIENT_FLAGS]) {
+ u64 flags = nla_get_u64(info->attrs[NBD_ATTR_CLIENT_FLAGS]);
+ if (flags & NBD_CFLAG_DESTROY_ON_DISCONNECT) {
+- if (!test_and_set_bit(NBD_RT_DESTROY_ON_DISCONNECT,
+- &config->runtime_flags))
++ if (!test_and_set_bit(NBD_DESTROY_ON_DISCONNECT,
++ &nbd->flags))
+ put_dev = true;
+- set_bit(NBD_DESTROY_ON_DISCONNECT, &nbd->flags);
+ } else {
+- if (test_and_clear_bit(NBD_RT_DESTROY_ON_DISCONNECT,
+- &config->runtime_flags))
++ if (test_and_clear_bit(NBD_DESTROY_ON_DISCONNECT,
++ &nbd->flags))
+ refcount_inc(&nbd->refs);
+- clear_bit(NBD_DESTROY_ON_DISCONNECT, &nbd->flags);
+ }
+
+ if (flags & NBD_CFLAG_DISCONNECT_ON_CLOSE) {
+diff --git a/drivers/block/zram/zram_drv.c b/drivers/block/zram/zram_drv.c
+index 36d49159140f4..22aa432a68bf9 100644
+--- a/drivers/block/zram/zram_drv.c
++++ b/drivers/block/zram/zram_drv.c
+@@ -1072,7 +1072,7 @@ static ssize_t mm_stat_show(struct device *dev,
+ zram->limit_pages << PAGE_SHIFT,
+ max_used << PAGE_SHIFT,
+ (u64)atomic64_read(&zram->stats.same_pages),
+- pool_stats.pages_compacted,
++ atomic_long_read(&pool_stats.pages_compacted),
+ (u64)atomic64_read(&zram->stats.huge_pages));
+ up_read(&zram->init_lock);
+
+diff --git a/drivers/bluetooth/hci_h5.c b/drivers/bluetooth/hci_h5.c
+index e11af747395dd..bf3e23104194a 100644
+--- a/drivers/bluetooth/hci_h5.c
++++ b/drivers/bluetooth/hci_h5.c
+@@ -894,6 +894,11 @@ static int h5_btrtl_setup(struct h5 *h5)
+ /* Give the device some time before the hci-core sends it a reset */
+ usleep_range(10000, 20000);
+
++ /* Enable controller to do both LE scan and BR/EDR inquiry
++ * simultaneously.
++ */
++ set_bit(HCI_QUIRK_SIMULTANEOUS_DISCOVERY, &h5->hu->hdev->quirks);
++
+ out_free:
+ btrtl_free(btrtl_dev);
+
+diff --git a/drivers/gpu/drm/amd/amdgpu/cz_ih.c b/drivers/gpu/drm/amd/amdgpu/cz_ih.c
+index 1dca0cabc326a..13520d173296f 100644
+--- a/drivers/gpu/drm/amd/amdgpu/cz_ih.c
++++ b/drivers/gpu/drm/amd/amdgpu/cz_ih.c
+@@ -193,19 +193,30 @@ static u32 cz_ih_get_wptr(struct amdgpu_device *adev,
+
+ wptr = le32_to_cpu(*ih->wptr_cpu);
+
+- if (REG_GET_FIELD(wptr, IH_RB_WPTR, RB_OVERFLOW)) {
+- wptr = REG_SET_FIELD(wptr, IH_RB_WPTR, RB_OVERFLOW, 0);
+- /* When a ring buffer overflow happen start parsing interrupt
+- * from the last not overwritten vector (wptr + 16). Hopefully
+- * this should allow us to catchup.
+- */
+- dev_warn(adev->dev, "IH ring buffer overflow (0x%08X, 0x%08X, 0x%08X)\n",
+- wptr, ih->rptr, (wptr + 16) & ih->ptr_mask);
+- ih->rptr = (wptr + 16) & ih->ptr_mask;
+- tmp = RREG32(mmIH_RB_CNTL);
+- tmp = REG_SET_FIELD(tmp, IH_RB_CNTL, WPTR_OVERFLOW_CLEAR, 1);
+- WREG32(mmIH_RB_CNTL, tmp);
+- }
++ if (!REG_GET_FIELD(wptr, IH_RB_WPTR, RB_OVERFLOW))
++ goto out;
++
++ /* Double check that the overflow wasn't already cleared. */
++ wptr = RREG32(mmIH_RB_WPTR);
++
++ if (!REG_GET_FIELD(wptr, IH_RB_WPTR, RB_OVERFLOW))
++ goto out;
++
++ wptr = REG_SET_FIELD(wptr, IH_RB_WPTR, RB_OVERFLOW, 0);
++
++ /* When a ring buffer overflow happen start parsing interrupt
++ * from the last not overwritten vector (wptr + 16). Hopefully
++ * this should allow us to catchup.
++ */
++ dev_warn(adev->dev, "IH ring buffer overflow (0x%08X, 0x%08X, 0x%08X)\n",
++ wptr, ih->rptr, (wptr + 16) & ih->ptr_mask);
++ ih->rptr = (wptr + 16) & ih->ptr_mask;
++ tmp = RREG32(mmIH_RB_CNTL);
++ tmp = REG_SET_FIELD(tmp, IH_RB_CNTL, WPTR_OVERFLOW_CLEAR, 1);
++ WREG32(mmIH_RB_CNTL, tmp);
++
++
++out:
+ return (wptr & ih->ptr_mask);
+ }
+
+diff --git a/drivers/gpu/drm/amd/amdgpu/iceland_ih.c b/drivers/gpu/drm/amd/amdgpu/iceland_ih.c
+index a13dd9a51149a..7d165f024f072 100644
+--- a/drivers/gpu/drm/amd/amdgpu/iceland_ih.c
++++ b/drivers/gpu/drm/amd/amdgpu/iceland_ih.c
+@@ -193,19 +193,29 @@ static u32 iceland_ih_get_wptr(struct amdgpu_device *adev,
+
+ wptr = le32_to_cpu(*ih->wptr_cpu);
+
+- if (REG_GET_FIELD(wptr, IH_RB_WPTR, RB_OVERFLOW)) {
+- wptr = REG_SET_FIELD(wptr, IH_RB_WPTR, RB_OVERFLOW, 0);
+- /* When a ring buffer overflow happen start parsing interrupt
+- * from the last not overwritten vector (wptr + 16). Hopefully
+- * this should allow us to catchup.
+- */
+- dev_warn(adev->dev, "IH ring buffer overflow (0x%08X, 0x%08X, 0x%08X)\n",
+- wptr, ih->rptr, (wptr + 16) & ih->ptr_mask);
+- ih->rptr = (wptr + 16) & ih->ptr_mask;
+- tmp = RREG32(mmIH_RB_CNTL);
+- tmp = REG_SET_FIELD(tmp, IH_RB_CNTL, WPTR_OVERFLOW_CLEAR, 1);
+- WREG32(mmIH_RB_CNTL, tmp);
+- }
++ if (!REG_GET_FIELD(wptr, IH_RB_WPTR, RB_OVERFLOW))
++ goto out;
++
++ /* Double check that the overflow wasn't already cleared. */
++ wptr = RREG32(mmIH_RB_WPTR);
++
++ if (!REG_GET_FIELD(wptr, IH_RB_WPTR, RB_OVERFLOW))
++ goto out;
++
++ wptr = REG_SET_FIELD(wptr, IH_RB_WPTR, RB_OVERFLOW, 0);
++ /* When a ring buffer overflow happen start parsing interrupt
++ * from the last not overwritten vector (wptr + 16). Hopefully
++ * this should allow us to catchup.
++ */
++ dev_warn(adev->dev, "IH ring buffer overflow (0x%08X, 0x%08X, 0x%08X)\n",
++ wptr, ih->rptr, (wptr + 16) & ih->ptr_mask);
++ ih->rptr = (wptr + 16) & ih->ptr_mask;
++ tmp = RREG32(mmIH_RB_CNTL);
++ tmp = REG_SET_FIELD(tmp, IH_RB_CNTL, WPTR_OVERFLOW_CLEAR, 1);
++ WREG32(mmIH_RB_CNTL, tmp);
++
++
++out:
+ return (wptr & ih->ptr_mask);
+ }
+
+diff --git a/drivers/gpu/drm/amd/amdgpu/tonga_ih.c b/drivers/gpu/drm/amd/amdgpu/tonga_ih.c
+index e40140bf6699c..db0a3bda13fbe 100644
+--- a/drivers/gpu/drm/amd/amdgpu/tonga_ih.c
++++ b/drivers/gpu/drm/amd/amdgpu/tonga_ih.c
+@@ -195,19 +195,30 @@ static u32 tonga_ih_get_wptr(struct amdgpu_device *adev,
+
+ wptr = le32_to_cpu(*ih->wptr_cpu);
+
+- if (REG_GET_FIELD(wptr, IH_RB_WPTR, RB_OVERFLOW)) {
+- wptr = REG_SET_FIELD(wptr, IH_RB_WPTR, RB_OVERFLOW, 0);
+- /* When a ring buffer overflow happen start parsing interrupt
+- * from the last not overwritten vector (wptr + 16). Hopefully
+- * this should allow us to catchup.
+- */
+- dev_warn(adev->dev, "IH ring buffer overflow (0x%08X, 0x%08X, 0x%08X)\n",
+- wptr, ih->rptr, (wptr + 16) & ih->ptr_mask);
+- ih->rptr = (wptr + 16) & ih->ptr_mask;
+- tmp = RREG32(mmIH_RB_CNTL);
+- tmp = REG_SET_FIELD(tmp, IH_RB_CNTL, WPTR_OVERFLOW_CLEAR, 1);
+- WREG32(mmIH_RB_CNTL, tmp);
+- }
++ if (!REG_GET_FIELD(wptr, IH_RB_WPTR, RB_OVERFLOW))
++ goto out;
++
++ /* Double check that the overflow wasn't already cleared. */
++ wptr = RREG32(mmIH_RB_WPTR);
++
++ if (!REG_GET_FIELD(wptr, IH_RB_WPTR, RB_OVERFLOW))
++ goto out;
++
++ wptr = REG_SET_FIELD(wptr, IH_RB_WPTR, RB_OVERFLOW, 0);
++
++ /* When a ring buffer overflow happen start parsing interrupt
++ * from the last not overwritten vector (wptr + 16). Hopefully
++ * this should allow us to catchup.
++ */
++
++ dev_warn(adev->dev, "IH ring buffer overflow (0x%08X, 0x%08X, 0x%08X)\n",
++ wptr, ih->rptr, (wptr + 16) & ih->ptr_mask);
++ ih->rptr = (wptr + 16) & ih->ptr_mask;
++ tmp = RREG32(mmIH_RB_CNTL);
++ tmp = REG_SET_FIELD(tmp, IH_RB_CNTL, WPTR_OVERFLOW_CLEAR, 1);
++ WREG32(mmIH_RB_CNTL, tmp);
++
++out:
+ return (wptr & ih->ptr_mask);
+ }
+
+diff --git a/drivers/gpu/drm/amd/display/dc/core/dc_link.c b/drivers/gpu/drm/amd/display/dc/core/dc_link.c
+index fa92b88bc5a13..40041c61a100e 100644
+--- a/drivers/gpu/drm/amd/display/dc/core/dc_link.c
++++ b/drivers/gpu/drm/amd/display/dc/core/dc_link.c
+@@ -1303,6 +1303,11 @@ static bool construct(
+ goto ddc_create_fail;
+ }
+
++ if (!link->ddc->ddc_pin) {
++ DC_ERROR("Failed to get I2C info for connector!\n");
++ goto ddc_create_fail;
++ }
++
+ link->ddc_hw_inst =
+ dal_ddc_get_line(
+ dal_ddc_service_get_ddc_pin(link->ddc));
+diff --git a/drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_drv.c b/drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_drv.c
+index c103005b0a33e..a34ef5ec7d429 100644
+--- a/drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_drv.c
++++ b/drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_drv.c
+@@ -376,7 +376,6 @@ static void hibmc_pci_remove(struct pci_dev *pdev)
+
+ drm_dev_unregister(dev);
+ hibmc_unload(dev);
+- drm_dev_put(dev);
+ }
+
+ static struct pci_device_id hibmc_pci_table[] = {
+diff --git a/drivers/gpu/drm/virtio/virtgpu_vq.c b/drivers/gpu/drm/virtio/virtgpu_vq.c
+index 92022a83bbd5e..bb46e7a0f1b5d 100644
+--- a/drivers/gpu/drm/virtio/virtgpu_vq.c
++++ b/drivers/gpu/drm/virtio/virtgpu_vq.c
+@@ -992,8 +992,9 @@ int virtio_gpu_object_attach(struct virtio_gpu_device *vgdev,
+ }
+
+ /* gets freed when the ring has consumed it */
+- ents = kmalloc_array(nents, sizeof(struct virtio_gpu_mem_entry),
+- GFP_KERNEL);
++ ents = kvmalloc_array(nents,
++ sizeof(struct virtio_gpu_mem_entry),
++ GFP_KERNEL);
+ if (!ents) {
+ DRM_ERROR("failed to allocate ent list\n");
+ return -ENOMEM;
+diff --git a/drivers/input/mouse/elantech.c b/drivers/input/mouse/elantech.c
+index 2d8434b7b6238..053fe2da1e08f 100644
+--- a/drivers/input/mouse/elantech.c
++++ b/drivers/input/mouse/elantech.c
+@@ -89,6 +89,47 @@ static int elantech_ps2_command(struct psmouse *psmouse,
+ return rc;
+ }
+
++/*
++ * Send an Elantech style special command to read 3 bytes from a register
++ */
++static int elantech_read_reg_params(struct psmouse *psmouse, u8 reg, u8 *param)
++{
++ if (elantech_ps2_command(psmouse, NULL, ETP_PS2_CUSTOM_COMMAND) ||
++ elantech_ps2_command(psmouse, NULL, ETP_REGISTER_READWRITE) ||
++ elantech_ps2_command(psmouse, NULL, ETP_PS2_CUSTOM_COMMAND) ||
++ elantech_ps2_command(psmouse, NULL, reg) ||
++ elantech_ps2_command(psmouse, param, PSMOUSE_CMD_GETINFO)) {
++ psmouse_err(psmouse,
++ "failed to read register %#02x\n", reg);
++ return -EIO;
++ }
++
++ return 0;
++}
++
++/*
++ * Send an Elantech style special command to write a register with a parameter
++ */
++static int elantech_write_reg_params(struct psmouse *psmouse, u8 reg, u8 *param)
++{
++ if (elantech_ps2_command(psmouse, NULL, ETP_PS2_CUSTOM_COMMAND) ||
++ elantech_ps2_command(psmouse, NULL, ETP_REGISTER_READWRITE) ||
++ elantech_ps2_command(psmouse, NULL, ETP_PS2_CUSTOM_COMMAND) ||
++ elantech_ps2_command(psmouse, NULL, reg) ||
++ elantech_ps2_command(psmouse, NULL, ETP_PS2_CUSTOM_COMMAND) ||
++ elantech_ps2_command(psmouse, NULL, param[0]) ||
++ elantech_ps2_command(psmouse, NULL, ETP_PS2_CUSTOM_COMMAND) ||
++ elantech_ps2_command(psmouse, NULL, param[1]) ||
++ elantech_ps2_command(psmouse, NULL, PSMOUSE_CMD_SETSCALE11)) {
++ psmouse_err(psmouse,
++ "failed to write register %#02x with value %#02x%#02x\n",
++ reg, param[0], param[1]);
++ return -EIO;
++ }
++
++ return 0;
++}
++
+ /*
+ * Send an Elantech style special command to read a value from a register
+ */
+@@ -1529,19 +1570,35 @@ static const struct dmi_system_id no_hw_res_dmi_table[] = {
+ { }
+ };
+
++/*
++ * Change Report id 0x5E to 0x5F.
++ */
++static int elantech_change_report_id(struct psmouse *psmouse)
++{
++ unsigned char param[2] = { 0x10, 0x03 };
++
++ if (elantech_write_reg_params(psmouse, 0x7, param) ||
++ elantech_read_reg_params(psmouse, 0x7, param) ||
++ param[0] != 0x10 || param[1] != 0x03) {
++ psmouse_err(psmouse, "Unable to change report ID to 0x5f.\n");
++ return -EIO;
++ }
++
++ return 0;
++}
+ /*
+ * determine hardware version and set some properties according to it.
+ */
+ static int elantech_set_properties(struct elantech_device_info *info)
+ {
+ /* This represents the version of IC body. */
+- int ver = (info->fw_version & 0x0f0000) >> 16;
++ info->ic_version = (info->fw_version & 0x0f0000) >> 16;
+
+ /* Early version of Elan touchpads doesn't obey the rule. */
+ if (info->fw_version < 0x020030 || info->fw_version == 0x020600)
+ info->hw_version = 1;
+ else {
+- switch (ver) {
++ switch (info->ic_version) {
+ case 2:
+ case 4:
+ info->hw_version = 2;
+@@ -1557,6 +1614,11 @@ static int elantech_set_properties(struct elantech_device_info *info)
+ }
+ }
+
++ /* Get information pattern for hw_version 4 */
++ info->pattern = 0x00;
++ if (info->ic_version == 0x0f && (info->fw_version & 0xff) <= 0x02)
++ info->pattern = info->fw_version & 0xff;
++
+ /* decide which send_cmd we're gonna use early */
+ info->send_cmd = info->hw_version >= 3 ? elantech_send_cmd :
+ synaptics_send_cmd;
+@@ -1598,6 +1660,7 @@ static int elantech_query_info(struct psmouse *psmouse,
+ {
+ unsigned char param[3];
+ unsigned char traces;
++ unsigned char ic_body[3];
+
+ memset(info, 0, sizeof(*info));
+
+@@ -1640,6 +1703,21 @@ static int elantech_query_info(struct psmouse *psmouse,
+ info->samples[2]);
+ }
+
++ if (info->pattern > 0x00 && info->ic_version == 0xf) {
++ if (info->send_cmd(psmouse, ETP_ICBODY_QUERY, ic_body)) {
++ psmouse_err(psmouse, "failed to query ic body\n");
++ return -EINVAL;
++ }
++ info->ic_version = be16_to_cpup((__be16 *)ic_body);
++ psmouse_info(psmouse,
++ "Elan ic body: %#04x, current fw version: %#02x\n",
++ info->ic_version, ic_body[2]);
++ }
++
++ info->product_id = be16_to_cpup((__be16 *)info->samples);
++ if (info->pattern == 0x00)
++ info->product_id &= 0xff;
++
+ if (info->samples[1] == 0x74 && info->hw_version == 0x03) {
+ /*
+ * This module has a bug which makes absolute mode
+@@ -1654,6 +1732,23 @@ static int elantech_query_info(struct psmouse *psmouse,
+ /* The MSB indicates the presence of the trackpoint */
+ info->has_trackpoint = (info->capabilities[0] & 0x80) == 0x80;
+
++ if (info->has_trackpoint && info->ic_version == 0x0011 &&
++ (info->product_id == 0x08 || info->product_id == 0x09 ||
++ info->product_id == 0x0d || info->product_id == 0x0e)) {
++ /*
++ * This module has a bug which makes trackpoint in SMBus
++ * mode return invalid data unless trackpoint is switched
++ * from using 0x5e reports to 0x5f. If we are not able to
++ * make the switch, let's abort initialization so we'll be
++ * using standard PS/2 protocol.
++ */
++ if (elantech_change_report_id(psmouse)) {
++ psmouse_info(psmouse,
++ "Trackpoint report is broken, forcing standard PS/2 protocol\n");
++ return -ENODEV;
++ }
++ }
++
+ info->x_res = 31;
+ info->y_res = 31;
+ if (info->hw_version == 4) {
+diff --git a/drivers/input/mouse/elantech.h b/drivers/input/mouse/elantech.h
+index e0a3e59d4f1bb..571e6ca11d33b 100644
+--- a/drivers/input/mouse/elantech.h
++++ b/drivers/input/mouse/elantech.h
+@@ -18,6 +18,7 @@
+ #define ETP_CAPABILITIES_QUERY 0x02
+ #define ETP_SAMPLE_QUERY 0x03
+ #define ETP_RESOLUTION_QUERY 0x04
++#define ETP_ICBODY_QUERY 0x05
+
+ /*
+ * Command values for register reading or writing
+@@ -140,7 +141,10 @@ struct elantech_device_info {
+ unsigned char samples[3];
+ unsigned char debug;
+ unsigned char hw_version;
++ unsigned char pattern;
+ unsigned int fw_version;
++ unsigned int ic_version;
++ unsigned int product_id;
+ unsigned int x_min;
+ unsigned int y_min;
+ unsigned int x_max;
+diff --git a/drivers/media/rc/mceusb.c b/drivers/media/rc/mceusb.c
+index 867f5fb6fbe11..c68e52c17ae13 100644
+--- a/drivers/media/rc/mceusb.c
++++ b/drivers/media/rc/mceusb.c
+@@ -701,11 +701,18 @@ static void mceusb_dev_printdata(struct mceusb_dev *ir, u8 *buf, int buf_len,
+ data[0], data[1]);
+ break;
+ case MCE_RSP_EQIRCFS:
++ if (!data[0] && !data[1]) {
++ dev_dbg(dev, "%s: no carrier", inout);
++ break;
++ }
++ // prescaler should make sense
++ if (data[0] > 8)
++ break;
+ period = DIV_ROUND_CLOSEST((1U << data[0] * 2) *
+ (data[1] + 1), 10);
+ if (!period)
+ break;
+- carrier = (1000 * 1000) / period;
++ carrier = USEC_PER_SEC / period;
+ dev_dbg(dev, "%s carrier of %u Hz (period %uus)",
+ inout, carrier, period);
+ break;
+diff --git a/drivers/media/usb/uvc/uvc_driver.c b/drivers/media/usb/uvc/uvc_driver.c
+index 99883550375e9..40ca1d4e03483 100644
+--- a/drivers/media/usb/uvc/uvc_driver.c
++++ b/drivers/media/usb/uvc/uvc_driver.c
+@@ -967,7 +967,10 @@ static struct uvc_entity *uvc_alloc_entity(u16 type, u8 id,
+ unsigned int i;
+
+ extra_size = roundup(extra_size, sizeof(*entity->pads));
+- num_inputs = (type & UVC_TERM_OUTPUT) ? num_pads : num_pads - 1;
++ if (num_pads)
++ num_inputs = type & UVC_TERM_OUTPUT ? num_pads : num_pads - 1;
++ else
++ num_inputs = 0;
+ size = sizeof(*entity) + extra_size + sizeof(*entity->pads) * num_pads
+ + num_inputs;
+ entity = kzalloc(size, GFP_KERNEL);
+@@ -983,7 +986,7 @@ static struct uvc_entity *uvc_alloc_entity(u16 type, u8 id,
+
+ for (i = 0; i < num_inputs; ++i)
+ entity->pads[i].flags = MEDIA_PAD_FL_SINK;
+- if (!UVC_ENTITY_IS_OTERM(entity))
++ if (!UVC_ENTITY_IS_OTERM(entity) && num_pads)
+ entity->pads[num_pads-1].flags = MEDIA_PAD_FL_SOURCE;
+
+ entity->bNrInPins = num_inputs;
+diff --git a/drivers/media/v4l2-core/v4l2-ctrls.c b/drivers/media/v4l2-core/v4l2-ctrls.c
+index cd84dbbf6a890..3fe99519fedfb 100644
+--- a/drivers/media/v4l2-core/v4l2-ctrls.c
++++ b/drivers/media/v4l2-core/v4l2-ctrls.c
+@@ -1795,7 +1795,8 @@ static int std_validate(const struct v4l2_ctrl *ctrl, u32 idx,
+ case V4L2_CTRL_TYPE_INTEGER_MENU:
+ if (ptr.p_s32[idx] < ctrl->minimum || ptr.p_s32[idx] > ctrl->maximum)
+ return -ERANGE;
+- if (ctrl->menu_skip_mask & (1ULL << ptr.p_s32[idx]))
++ if (ptr.p_s32[idx] < BITS_PER_LONG_LONG &&
++ (ctrl->menu_skip_mask & BIT_ULL(ptr.p_s32[idx])))
+ return -EINVAL;
+ if (ctrl->type == V4L2_CTRL_TYPE_MENU &&
+ ctrl->qmenu[ptr.p_s32[idx]][0] == '\0')
+diff --git a/drivers/media/v4l2-core/v4l2-ioctl.c b/drivers/media/v4l2-core/v4l2-ioctl.c
+index 58868d7129ebd..24db33f803c06 100644
+--- a/drivers/media/v4l2-core/v4l2-ioctl.c
++++ b/drivers/media/v4l2-core/v4l2-ioctl.c
+@@ -3016,7 +3016,7 @@ video_usercopy(struct file *file, unsigned int cmd, unsigned long arg,
+ v4l2_kioctl func)
+ {
+ char sbuf[128];
+- void *mbuf = NULL;
++ void *mbuf = NULL, *array_buf = NULL;
+ void *parg = (void *)arg;
+ long err = -EINVAL;
+ bool has_array_args;
+@@ -3075,20 +3075,14 @@ video_usercopy(struct file *file, unsigned int cmd, unsigned long arg,
+ has_array_args = err;
+
+ if (has_array_args) {
+- /*
+- * When adding new types of array args, make sure that the
+- * parent argument to ioctl (which contains the pointer to the
+- * array) fits into sbuf (so that mbuf will still remain
+- * unused up to here).
+- */
+- mbuf = kvmalloc(array_size, GFP_KERNEL);
++ array_buf = kvmalloc(array_size, GFP_KERNEL);
+ err = -ENOMEM;
+- if (NULL == mbuf)
++ if (array_buf == NULL)
+ goto out_array_args;
+ err = -EFAULT;
+- if (copy_from_user(mbuf, user_ptr, array_size))
++ if (copy_from_user(array_buf, user_ptr, array_size))
+ goto out_array_args;
+- *kernel_ptr = mbuf;
++ *kernel_ptr = array_buf;
+ }
+
+ /* Handles IOCTL */
+@@ -3107,7 +3101,7 @@ video_usercopy(struct file *file, unsigned int cmd, unsigned long arg,
+
+ if (has_array_args) {
+ *kernel_ptr = (void __force *)user_ptr;
+- if (copy_to_user(user_ptr, mbuf, array_size))
++ if (copy_to_user(user_ptr, array_buf, array_size))
+ err = -EFAULT;
+ goto out_array_args;
+ }
+@@ -3129,6 +3123,7 @@ out_array_args:
+ }
+
+ out:
++ kvfree(array_buf);
+ kvfree(mbuf);
+ return err;
+ }
+diff --git a/drivers/net/ethernet/atheros/ag71xx.c b/drivers/net/ethernet/atheros/ag71xx.c
+index 78e20f53677d5..58a002dd758cd 100644
+--- a/drivers/net/ethernet/atheros/ag71xx.c
++++ b/drivers/net/ethernet/atheros/ag71xx.c
+@@ -222,8 +222,6 @@
+ #define AG71XX_REG_RX_SM 0x01b0
+ #define AG71XX_REG_TX_SM 0x01b4
+
+-#define ETH_SWITCH_HEADER_LEN 2
+-
+ #define AG71XX_DEFAULT_MSG_ENABLE \
+ (NETIF_MSG_DRV \
+ | NETIF_MSG_PROBE \
+@@ -784,7 +782,7 @@ static void ag71xx_hw_setup(struct ag71xx *ag)
+
+ static unsigned int ag71xx_max_frame_len(unsigned int mtu)
+ {
+- return ETH_SWITCH_HEADER_LEN + ETH_HLEN + VLAN_HLEN + mtu + ETH_FCS_LEN;
++ return ETH_HLEN + VLAN_HLEN + mtu + ETH_FCS_LEN;
+ }
+
+ static void ag71xx_hw_set_macaddr(struct ag71xx *ag, unsigned char *mac)
+diff --git a/drivers/net/tap.c b/drivers/net/tap.c
+index 3ae70c7e6860c..f285422a80717 100644
+--- a/drivers/net/tap.c
++++ b/drivers/net/tap.c
+@@ -1095,10 +1095,9 @@ static long tap_ioctl(struct file *file, unsigned int cmd,
+ return -ENOLINK;
+ }
+ ret = 0;
+- u = tap->dev->type;
++ dev_get_mac_address(&sa, dev_net(tap->dev), tap->dev->name);
+ if (copy_to_user(&ifr->ifr_name, tap->dev->name, IFNAMSIZ) ||
+- copy_to_user(&ifr->ifr_hwaddr.sa_data, tap->dev->dev_addr, ETH_ALEN) ||
+- put_user(u, &ifr->ifr_hwaddr.sa_family))
++ copy_to_user(&ifr->ifr_hwaddr, &sa, sizeof(sa)))
+ ret = -EFAULT;
+ tap_put_tap_dev(tap);
+ rtnl_unlock();
+@@ -1113,7 +1112,7 @@ static long tap_ioctl(struct file *file, unsigned int cmd,
+ rtnl_unlock();
+ return -ENOLINK;
+ }
+- ret = dev_set_mac_address(tap->dev, &sa, NULL);
++ ret = dev_set_mac_address_user(tap->dev, &sa, NULL);
+ tap_put_tap_dev(tap);
+ rtnl_unlock();
+ return ret;
+diff --git a/drivers/net/tun.c b/drivers/net/tun.c
+index 84e779f93f0a4..fe6ec22bf3d51 100644
+--- a/drivers/net/tun.c
++++ b/drivers/net/tun.c
+@@ -3224,7 +3224,7 @@ static long __tun_chr_ioctl(struct file *file, unsigned int cmd,
+ case SIOCGIFHWADDR:
+ /* Get hw address */
+ memcpy(ifr.ifr_hwaddr.sa_data, tun->dev->dev_addr, ETH_ALEN);
+- ifr.ifr_hwaddr.sa_family = tun->dev->type;
++ dev_get_mac_address(&ifr.ifr_hwaddr, net, tun->dev->name);
+ if (copy_to_user(argp, &ifr, ifreq_len))
+ ret = -EFAULT;
+ break;
+@@ -3234,7 +3234,7 @@ static long __tun_chr_ioctl(struct file *file, unsigned int cmd,
+ tun_debug(KERN_DEBUG, tun, "set hw address: %pM\n",
+ ifr.ifr_hwaddr.sa_data);
+
+- ret = dev_set_mac_address(tun->dev, &ifr.ifr_hwaddr, NULL);
++ ret = dev_set_mac_address_user(tun->dev, &ifr.ifr_hwaddr, NULL);
+ break;
+
+ case TUNGETSNDBUF:
+diff --git a/drivers/net/usb/qmi_wwan.c b/drivers/net/usb/qmi_wwan.c
+index 5a1d21aae2a9e..05b85b94d9518 100644
+--- a/drivers/net/usb/qmi_wwan.c
++++ b/drivers/net/usb/qmi_wwan.c
+@@ -1280,6 +1280,7 @@ static const struct usb_device_id products[] = {
+ {QMI_FIXED_INTF(0x19d2, 0x1255, 4)},
+ {QMI_FIXED_INTF(0x19d2, 0x1256, 4)},
+ {QMI_FIXED_INTF(0x19d2, 0x1270, 5)}, /* ZTE MF667 */
++ {QMI_FIXED_INTF(0x19d2, 0x1275, 3)}, /* ZTE P685M */
+ {QMI_FIXED_INTF(0x19d2, 0x1401, 2)},
+ {QMI_FIXED_INTF(0x19d2, 0x1402, 2)}, /* ZTE MF60 */
+ {QMI_FIXED_INTF(0x19d2, 0x1424, 2)},
+diff --git a/drivers/net/wireless/ath/ath10k/mac.c b/drivers/net/wireless/ath/ath10k/mac.c
+index 915ba2a7f7448..47b733fdf4fcb 100644
+--- a/drivers/net/wireless/ath/ath10k/mac.c
++++ b/drivers/net/wireless/ath/ath10k/mac.c
+@@ -3624,23 +3624,16 @@ bool ath10k_mac_tx_frm_has_freq(struct ath10k *ar)
+ static int ath10k_mac_tx_wmi_mgmt(struct ath10k *ar, struct sk_buff *skb)
+ {
+ struct sk_buff_head *q = &ar->wmi_mgmt_tx_queue;
+- int ret = 0;
+-
+- spin_lock_bh(&ar->data_lock);
+
+- if (skb_queue_len(q) == ATH10K_MAX_NUM_MGMT_PENDING) {
++ if (skb_queue_len_lockless(q) >= ATH10K_MAX_NUM_MGMT_PENDING) {
+ ath10k_warn(ar, "wmi mgmt tx queue is full\n");
+- ret = -ENOSPC;
+- goto unlock;
++ return -ENOSPC;
+ }
+
+- __skb_queue_tail(q, skb);
++ skb_queue_tail(q, skb);
+ ieee80211_queue_work(ar->hw, &ar->wmi_mgmt_tx_work);
+
+-unlock:
+- spin_unlock_bh(&ar->data_lock);
+-
+- return ret;
++ return 0;
+ }
+
+ static enum ath10k_mac_tx_path
+diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/dmi.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/dmi.c
+index 4aa2561934d77..6d5188b78f2de 100644
+--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/dmi.c
++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/dmi.c
+@@ -40,6 +40,18 @@ static const struct brcmf_dmi_data pov_tab_p1006w_data = {
+ BRCM_CC_43340_CHIP_ID, 2, "pov-tab-p1006w-data"
+ };
+
++static const struct brcmf_dmi_data predia_basic_data = {
++ BRCM_CC_43341_CHIP_ID, 2, "predia-basic"
++};
++
++/* Note the Voyo winpad A15 tablet uses the same Ampak AP6330 module, with the
++ * exact same nvram file as the Prowise-PT301 tablet. Since the nvram for the
++ * Prowise-PT301 is already in linux-firmware we just point to that here.
++ */
++static const struct brcmf_dmi_data voyo_winpad_a15_data = {
++ BRCM_CC_4330_CHIP_ID, 4, "Prowise-PT301"
++};
++
+ static const struct dmi_system_id dmi_platform_data[] = {
+ {
+ /* ACEPC T8 Cherry Trail Z8350 mini PC */
+@@ -111,6 +123,26 @@ static const struct dmi_system_id dmi_platform_data[] = {
+ },
+ .driver_data = (void *)&pov_tab_p1006w_data,
+ },
++ {
++ /* Predia Basic tablet (+ with keyboard dock) */
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "Insyde"),
++ DMI_MATCH(DMI_PRODUCT_NAME, "CherryTrail"),
++ /* Mx.WT107.KUBNGEA02 with the version-nr dropped */
++ DMI_MATCH(DMI_BIOS_VERSION, "Mx.WT107.KUBNGEA"),
++ },
++ .driver_data = (void *)&predia_basic_data,
++ },
++ {
++ /* Voyo winpad A15 tablet */
++ .matches = {
++ DMI_MATCH(DMI_BOARD_VENDOR, "AMI Corporation"),
++ DMI_MATCH(DMI_BOARD_NAME, "Aptio CRB"),
++ /* Above strings are too generic, also match on BIOS date */
++ DMI_MATCH(DMI_BIOS_DATE, "11/20/2014"),
++ },
++ .driver_data = (void *)&voyo_winpad_a15_data,
++ },
+ {}
+ };
+
+diff --git a/drivers/net/wireless/rsi/rsi_91x_hal.c b/drivers/net/wireless/rsi/rsi_91x_hal.c
+index 6f8d5f9a9f7e6..a07304405b2cc 100644
+--- a/drivers/net/wireless/rsi/rsi_91x_hal.c
++++ b/drivers/net/wireless/rsi/rsi_91x_hal.c
+@@ -248,7 +248,8 @@ int rsi_prepare_data_desc(struct rsi_common *common, struct sk_buff *skb)
+ rsi_set_len_qno(&data_desc->len_qno,
+ (skb->len - FRAME_DESC_SZ),
+ RSI_WIFI_MGMT_Q);
+- if ((skb->len - header_size) == EAPOL4_PACKET_LEN) {
++ if (((skb->len - header_size) == EAPOL4_PACKET_LEN) ||
++ ((skb->len - header_size) == EAPOL4_PACKET_LEN - 2)) {
+ data_desc->misc_flags |=
+ RSI_DESC_REQUIRE_CFM_TO_HOST;
+ xtend_desc->confirm_frame_type = EAPOL4_CONFIRM;
+diff --git a/drivers/net/wireless/rsi/rsi_91x_sdio.c b/drivers/net/wireless/rsi/rsi_91x_sdio.c
+index 1bebba4e85273..d1e8c6593ef51 100644
+--- a/drivers/net/wireless/rsi/rsi_91x_sdio.c
++++ b/drivers/net/wireless/rsi/rsi_91x_sdio.c
+@@ -153,9 +153,7 @@ static void rsi_handle_interrupt(struct sdio_func *function)
+ if (adapter->priv->fsm_state == FSM_FW_NOT_LOADED)
+ return;
+
+- dev->sdio_irq_task = current;
+- rsi_interrupt_handler(adapter);
+- dev->sdio_irq_task = NULL;
++ rsi_set_event(&dev->rx_thread.event);
+ }
+
+ /**
+@@ -1059,8 +1057,6 @@ static int rsi_probe(struct sdio_func *pfunction,
+ rsi_dbg(ERR_ZONE, "%s: Unable to init rx thrd\n", __func__);
+ goto fail_kill_thread;
+ }
+- skb_queue_head_init(&sdev->rx_q.head);
+- sdev->rx_q.num_rx_pkts = 0;
+
+ sdio_claim_host(pfunction);
+ if (sdio_claim_irq(pfunction, rsi_handle_interrupt)) {
+diff --git a/drivers/net/wireless/rsi/rsi_91x_sdio_ops.c b/drivers/net/wireless/rsi/rsi_91x_sdio_ops.c
+index 449f6d23c5e36..7c77b09240da2 100644
+--- a/drivers/net/wireless/rsi/rsi_91x_sdio_ops.c
++++ b/drivers/net/wireless/rsi/rsi_91x_sdio_ops.c
+@@ -60,39 +60,20 @@ int rsi_sdio_master_access_msword(struct rsi_hw *adapter, u16 ms_word)
+ return status;
+ }
+
++static void rsi_rx_handler(struct rsi_hw *adapter);
++
+ void rsi_sdio_rx_thread(struct rsi_common *common)
+ {
+ struct rsi_hw *adapter = common->priv;
+ struct rsi_91x_sdiodev *sdev = adapter->rsi_dev;
+- struct sk_buff *skb;
+- int status;
+
+ do {
+ rsi_wait_event(&sdev->rx_thread.event, EVENT_WAIT_FOREVER);
+ rsi_reset_event(&sdev->rx_thread.event);
++ rsi_rx_handler(adapter);
++ } while (!atomic_read(&sdev->rx_thread.thread_done));
+
+- while (true) {
+- if (atomic_read(&sdev->rx_thread.thread_done))
+- goto out;
+-
+- skb = skb_dequeue(&sdev->rx_q.head);
+- if (!skb)
+- break;
+- if (sdev->rx_q.num_rx_pkts > 0)
+- sdev->rx_q.num_rx_pkts--;
+- status = rsi_read_pkt(common, skb->data, skb->len);
+- if (status) {
+- rsi_dbg(ERR_ZONE, "Failed to read the packet\n");
+- dev_kfree_skb(skb);
+- break;
+- }
+- dev_kfree_skb(skb);
+- }
+- } while (1);
+-
+-out:
+ rsi_dbg(INFO_ZONE, "%s: Terminated SDIO RX thread\n", __func__);
+- skb_queue_purge(&sdev->rx_q.head);
+ atomic_inc(&sdev->rx_thread.thread_done);
+ complete_and_exit(&sdev->rx_thread.completion, 0);
+ }
+@@ -113,10 +94,6 @@ static int rsi_process_pkt(struct rsi_common *common)
+ u32 rcv_pkt_len = 0;
+ int status = 0;
+ u8 value = 0;
+- struct sk_buff *skb;
+-
+- if (dev->rx_q.num_rx_pkts >= RSI_MAX_RX_PKTS)
+- return 0;
+
+ num_blks = ((adapter->interrupt_status & 1) |
+ ((adapter->interrupt_status >> RECV_NUM_BLOCKS) << 1));
+@@ -144,22 +121,19 @@ static int rsi_process_pkt(struct rsi_common *common)
+
+ rcv_pkt_len = (num_blks * 256);
+
+- skb = dev_alloc_skb(rcv_pkt_len);
+- if (!skb)
+- return -ENOMEM;
+-
+- status = rsi_sdio_host_intf_read_pkt(adapter, skb->data, rcv_pkt_len);
++ status = rsi_sdio_host_intf_read_pkt(adapter, dev->pktbuffer,
++ rcv_pkt_len);
+ if (status) {
+ rsi_dbg(ERR_ZONE, "%s: Failed to read packet from card\n",
+ __func__);
+- dev_kfree_skb(skb);
+ return status;
+ }
+- skb_put(skb, rcv_pkt_len);
+- skb_queue_tail(&dev->rx_q.head, skb);
+- dev->rx_q.num_rx_pkts++;
+
+- rsi_set_event(&dev->rx_thread.event);
++ status = rsi_read_pkt(common, dev->pktbuffer, rcv_pkt_len);
++ if (status) {
++ rsi_dbg(ERR_ZONE, "Failed to read the packet\n");
++ return status;
++ }
+
+ return 0;
+ }
+@@ -251,12 +225,12 @@ int rsi_init_sdio_slave_regs(struct rsi_hw *adapter)
+ }
+
+ /**
+- * rsi_interrupt_handler() - This function read and process SDIO interrupts.
++ * rsi_rx_handler() - Read and process SDIO interrupts.
+ * @adapter: Pointer to the adapter structure.
+ *
+ * Return: None.
+ */
+-void rsi_interrupt_handler(struct rsi_hw *adapter)
++static void rsi_rx_handler(struct rsi_hw *adapter)
+ {
+ struct rsi_common *common = adapter->priv;
+ struct rsi_91x_sdiodev *dev =
+diff --git a/drivers/net/wireless/rsi/rsi_sdio.h b/drivers/net/wireless/rsi/rsi_sdio.h
+index c5cfb6238f737..ce6cf65a577a4 100644
+--- a/drivers/net/wireless/rsi/rsi_sdio.h
++++ b/drivers/net/wireless/rsi/rsi_sdio.h
+@@ -111,11 +111,6 @@ struct receive_info {
+ u32 buf_available_counter;
+ };
+
+-struct rsi_sdio_rx_q {
+- u8 num_rx_pkts;
+- struct sk_buff_head head;
+-};
+-
+ struct rsi_91x_sdiodev {
+ struct sdio_func *pfunction;
+ struct task_struct *sdio_irq_task;
+@@ -128,11 +123,10 @@ struct rsi_91x_sdiodev {
+ u16 tx_blk_size;
+ u8 write_fail;
+ bool buff_status_updated;
+- struct rsi_sdio_rx_q rx_q;
+ struct rsi_thread rx_thread;
++ u8 pktbuffer[8192] __aligned(4);
+ };
+
+-void rsi_interrupt_handler(struct rsi_hw *adapter);
+ int rsi_init_sdio_slave_regs(struct rsi_hw *adapter);
+ int rsi_sdio_read_register(struct rsi_hw *adapter, u32 addr, u8 *data);
+ int rsi_sdio_host_intf_read_pkt(struct rsi_hw *adapter, u8 *pkt, u32 length);
+diff --git a/drivers/net/wireless/ti/wl12xx/main.c b/drivers/net/wireless/ti/wl12xx/main.c
+index 3c9c623bb4283..9d7dbfe7fe0c3 100644
+--- a/drivers/net/wireless/ti/wl12xx/main.c
++++ b/drivers/net/wireless/ti/wl12xx/main.c
+@@ -635,7 +635,6 @@ static int wl12xx_identify_chip(struct wl1271 *wl)
+ wl->quirks |= WLCORE_QUIRK_LEGACY_NVS |
+ WLCORE_QUIRK_DUAL_PROBE_TMPL |
+ WLCORE_QUIRK_TKIP_HEADER_SPACE |
+- WLCORE_QUIRK_START_STA_FAILS |
+ WLCORE_QUIRK_AP_ZERO_SESSION_ID;
+ wl->sr_fw_name = WL127X_FW_NAME_SINGLE;
+ wl->mr_fw_name = WL127X_FW_NAME_MULTI;
+@@ -659,7 +658,6 @@ static int wl12xx_identify_chip(struct wl1271 *wl)
+ wl->quirks |= WLCORE_QUIRK_LEGACY_NVS |
+ WLCORE_QUIRK_DUAL_PROBE_TMPL |
+ WLCORE_QUIRK_TKIP_HEADER_SPACE |
+- WLCORE_QUIRK_START_STA_FAILS |
+ WLCORE_QUIRK_AP_ZERO_SESSION_ID;
+ wl->plt_fw_name = WL127X_PLT_FW_NAME;
+ wl->sr_fw_name = WL127X_FW_NAME_SINGLE;
+@@ -688,7 +686,6 @@ static int wl12xx_identify_chip(struct wl1271 *wl)
+ wl->quirks |= WLCORE_QUIRK_TX_BLOCKSIZE_ALIGN |
+ WLCORE_QUIRK_DUAL_PROBE_TMPL |
+ WLCORE_QUIRK_TKIP_HEADER_SPACE |
+- WLCORE_QUIRK_START_STA_FAILS |
+ WLCORE_QUIRK_AP_ZERO_SESSION_ID;
+
+ wlcore_set_min_fw_ver(wl, WL128X_CHIP_VER,
+diff --git a/drivers/net/wireless/ti/wlcore/main.c b/drivers/net/wireless/ti/wlcore/main.c
+index 5f74cf821068d..be0ed19f93569 100644
+--- a/drivers/net/wireless/ti/wlcore/main.c
++++ b/drivers/net/wireless/ti/wlcore/main.c
+@@ -2862,21 +2862,8 @@ static int wlcore_join(struct wl1271 *wl, struct wl12xx_vif *wlvif)
+
+ if (is_ibss)
+ ret = wl12xx_cmd_role_start_ibss(wl, wlvif);
+- else {
+- if (wl->quirks & WLCORE_QUIRK_START_STA_FAILS) {
+- /*
+- * TODO: this is an ugly workaround for wl12xx fw
+- * bug - we are not able to tx/rx after the first
+- * start_sta, so make dummy start+stop calls,
+- * and then call start_sta again.
+- * this should be fixed in the fw.
+- */
+- wl12xx_cmd_role_start_sta(wl, wlvif);
+- wl12xx_cmd_role_stop_sta(wl, wlvif);
+- }
+-
++ else
+ ret = wl12xx_cmd_role_start_sta(wl, wlvif);
+- }
+
+ return ret;
+ }
+diff --git a/drivers/net/wireless/ti/wlcore/wlcore.h b/drivers/net/wireless/ti/wlcore/wlcore.h
+index b7821311ac75b..81c94d390623b 100644
+--- a/drivers/net/wireless/ti/wlcore/wlcore.h
++++ b/drivers/net/wireless/ti/wlcore/wlcore.h
+@@ -547,9 +547,6 @@ wlcore_set_min_fw_ver(struct wl1271 *wl, unsigned int chip,
+ /* Each RX/TX transaction requires an end-of-transaction transfer */
+ #define WLCORE_QUIRK_END_OF_TRANSACTION BIT(0)
+
+-/* the first start_role(sta) sometimes doesn't work on wl12xx */
+-#define WLCORE_QUIRK_START_STA_FAILS BIT(1)
+-
+ /* wl127x and SPI don't support SDIO block size alignment */
+ #define WLCORE_QUIRK_TX_BLOCKSIZE_ALIGN BIT(2)
+
+diff --git a/drivers/net/xen-netback/netback.c b/drivers/net/xen-netback/netback.c
+index 4bfafcd6317f4..c213f2b812691 100644
+--- a/drivers/net/xen-netback/netback.c
++++ b/drivers/net/xen-netback/netback.c
+@@ -1335,11 +1335,21 @@ int xenvif_tx_action(struct xenvif_queue *queue, int budget)
+ return 0;
+
+ gnttab_batch_copy(queue->tx_copy_ops, nr_cops);
+- if (nr_mops != 0)
++ if (nr_mops != 0) {
+ ret = gnttab_map_refs(queue->tx_map_ops,
+ NULL,
+ queue->pages_to_map,
+ nr_mops);
++ if (ret) {
++ unsigned int i;
++
++ netdev_err(queue->vif->dev, "Map fail: nr %u ret %d\n",
++ nr_mops, ret);
++ for (i = 0; i < nr_mops; ++i)
++ WARN_ON_ONCE(queue->tx_map_ops[i].status ==
++ GNTST_okay);
++ }
++ }
+
+ work_done = xenvif_tx_submit(queue);
+
+diff --git a/drivers/nvme/host/core.c b/drivers/nvme/host/core.c
+index c2cabd77884bf..95d77a17375e1 100644
+--- a/drivers/nvme/host/core.c
++++ b/drivers/nvme/host/core.c
+@@ -317,6 +317,26 @@ bool nvme_cancel_request(struct request *req, void *data, bool reserved)
+ }
+ EXPORT_SYMBOL_GPL(nvme_cancel_request);
+
++void nvme_cancel_tagset(struct nvme_ctrl *ctrl)
++{
++ if (ctrl->tagset) {
++ blk_mq_tagset_busy_iter(ctrl->tagset,
++ nvme_cancel_request, ctrl);
++ blk_mq_tagset_wait_completed_request(ctrl->tagset);
++ }
++}
++EXPORT_SYMBOL_GPL(nvme_cancel_tagset);
++
++void nvme_cancel_admin_tagset(struct nvme_ctrl *ctrl)
++{
++ if (ctrl->admin_tagset) {
++ blk_mq_tagset_busy_iter(ctrl->admin_tagset,
++ nvme_cancel_request, ctrl);
++ blk_mq_tagset_wait_completed_request(ctrl->admin_tagset);
++ }
++}
++EXPORT_SYMBOL_GPL(nvme_cancel_admin_tagset);
++
+ bool nvme_change_ctrl_state(struct nvme_ctrl *ctrl,
+ enum nvme_ctrl_state new_state)
+ {
+diff --git a/drivers/nvme/host/nvme.h b/drivers/nvme/host/nvme.h
+index e392d6cd92ced..62e5401865fee 100644
+--- a/drivers/nvme/host/nvme.h
++++ b/drivers/nvme/host/nvme.h
+@@ -468,6 +468,8 @@ static inline void nvme_put_ctrl(struct nvme_ctrl *ctrl)
+
+ void nvme_complete_rq(struct request *req);
+ bool nvme_cancel_request(struct request *req, void *data, bool reserved);
++void nvme_cancel_tagset(struct nvme_ctrl *ctrl);
++void nvme_cancel_admin_tagset(struct nvme_ctrl *ctrl);
+ bool nvme_change_ctrl_state(struct nvme_ctrl *ctrl,
+ enum nvme_ctrl_state new_state);
+ bool nvme_wait_reset(struct nvme_ctrl *ctrl);
+diff --git a/drivers/nvme/host/pci.c b/drivers/nvme/host/pci.c
+index 19e375b59f407..abc342db3b337 100644
+--- a/drivers/nvme/host/pci.c
++++ b/drivers/nvme/host/pci.c
+@@ -528,50 +528,71 @@ static inline bool nvme_pci_use_sgls(struct nvme_dev *dev, struct request *req)
+ return true;
+ }
+
+-static void nvme_unmap_data(struct nvme_dev *dev, struct request *req)
++static void nvme_free_prps(struct nvme_dev *dev, struct request *req)
+ {
+- struct nvme_iod *iod = blk_mq_rq_to_pdu(req);
+ const int last_prp = dev->ctrl.page_size / sizeof(__le64) - 1;
+- dma_addr_t dma_addr = iod->first_dma, next_dma_addr;
++ struct nvme_iod *iod = blk_mq_rq_to_pdu(req);
++ dma_addr_t dma_addr = iod->first_dma;
+ int i;
+
+- if (iod->dma_len) {
+- dma_unmap_page(dev->dev, dma_addr, iod->dma_len,
+- rq_dma_dir(req));
+- return;
++ for (i = 0; i < iod->npages; i++) {
++ __le64 *prp_list = nvme_pci_iod_list(req)[i];
++ dma_addr_t next_dma_addr = le64_to_cpu(prp_list[last_prp]);
++
++ dma_pool_free(dev->prp_page_pool, prp_list, dma_addr);
++ dma_addr = next_dma_addr;
+ }
+
+- WARN_ON_ONCE(!iod->nents);
++}
+
+- if (is_pci_p2pdma_page(sg_page(iod->sg)))
+- pci_p2pdma_unmap_sg(dev->dev, iod->sg, iod->nents,
+- rq_dma_dir(req));
+- else
+- dma_unmap_sg(dev->dev, iod->sg, iod->nents, rq_dma_dir(req));
++static void nvme_free_sgls(struct nvme_dev *dev, struct request *req)
++{
++ const int last_sg = SGES_PER_PAGE - 1;
++ struct nvme_iod *iod = blk_mq_rq_to_pdu(req);
++ dma_addr_t dma_addr = iod->first_dma;
++ int i;
+
++ for (i = 0; i < iod->npages; i++) {
++ struct nvme_sgl_desc *sg_list = nvme_pci_iod_list(req)[i];
++ dma_addr_t next_dma_addr = le64_to_cpu((sg_list[last_sg]).addr);
+
+- if (iod->npages == 0)
+- dma_pool_free(dev->prp_small_pool, nvme_pci_iod_list(req)[0],
+- dma_addr);
++ dma_pool_free(dev->prp_page_pool, sg_list, dma_addr);
++ dma_addr = next_dma_addr;
++ }
+
+- for (i = 0; i < iod->npages; i++) {
+- void *addr = nvme_pci_iod_list(req)[i];
++}
+
+- if (iod->use_sgl) {
+- struct nvme_sgl_desc *sg_list = addr;
++static void nvme_unmap_sg(struct nvme_dev *dev, struct request *req)
++{
++ struct nvme_iod *iod = blk_mq_rq_to_pdu(req);
+
+- next_dma_addr =
+- le64_to_cpu((sg_list[SGES_PER_PAGE - 1]).addr);
+- } else {
+- __le64 *prp_list = addr;
++ if (is_pci_p2pdma_page(sg_page(iod->sg)))
++ pci_p2pdma_unmap_sg(dev->dev, iod->sg, iod->nents,
++ rq_dma_dir(req));
++ else
++ dma_unmap_sg(dev->dev, iod->sg, iod->nents, rq_dma_dir(req));
++}
+
+- next_dma_addr = le64_to_cpu(prp_list[last_prp]);
+- }
++static void nvme_unmap_data(struct nvme_dev *dev, struct request *req)
++{
++ struct nvme_iod *iod = blk_mq_rq_to_pdu(req);
+
+- dma_pool_free(dev->prp_page_pool, addr, dma_addr);
+- dma_addr = next_dma_addr;
++ if (iod->dma_len) {
++ dma_unmap_page(dev->dev, iod->first_dma, iod->dma_len,
++ rq_dma_dir(req));
++ return;
+ }
+
++ WARN_ON_ONCE(!iod->nents);
++
++ nvme_unmap_sg(dev, req);
++ if (iod->npages == 0)
++ dma_pool_free(dev->prp_small_pool, nvme_pci_iod_list(req)[0],
++ iod->first_dma);
++ else if (iod->use_sgl)
++ nvme_free_sgls(dev, req);
++ else
++ nvme_free_prps(dev, req);
+ mempool_free(iod->sg, dev->iod_mempool);
+ }
+
+@@ -648,7 +669,7 @@ static blk_status_t nvme_pci_setup_prps(struct nvme_dev *dev,
+ __le64 *old_prp_list = prp_list;
+ prp_list = dma_pool_alloc(pool, GFP_ATOMIC, &prp_dma);
+ if (!prp_list)
+- return BLK_STS_RESOURCE;
++ goto free_prps;
+ list[iod->npages++] = prp_list;
+ prp_list[0] = old_prp_list[i - 1];
+ old_prp_list[i - 1] = cpu_to_le64(prp_dma);
+@@ -668,14 +689,14 @@ static blk_status_t nvme_pci_setup_prps(struct nvme_dev *dev,
+ dma_addr = sg_dma_address(sg);
+ dma_len = sg_dma_len(sg);
+ }
+-
+ done:
+ cmnd->dptr.prp1 = cpu_to_le64(sg_dma_address(iod->sg));
+ cmnd->dptr.prp2 = cpu_to_le64(iod->first_dma);
+-
+ return BLK_STS_OK;
+-
+- bad_sgl:
++free_prps:
++ nvme_free_prps(dev, req);
++ return BLK_STS_RESOURCE;
++bad_sgl:
+ WARN(DO_ONCE(nvme_print_sgl, iod->sg, iod->nents),
+ "Invalid SGL for payload:%d nents:%d\n",
+ blk_rq_payload_bytes(req), iod->nents);
+@@ -747,7 +768,7 @@ static blk_status_t nvme_pci_setup_sgls(struct nvme_dev *dev,
+
+ sg_list = dma_pool_alloc(pool, GFP_ATOMIC, &sgl_dma);
+ if (!sg_list)
+- return BLK_STS_RESOURCE;
++ goto free_sgls;
+
+ i = 0;
+ nvme_pci_iod_list(req)[iod->npages++] = sg_list;
+@@ -760,6 +781,9 @@ static blk_status_t nvme_pci_setup_sgls(struct nvme_dev *dev,
+ } while (--entries > 0);
+
+ return BLK_STS_OK;
++free_sgls:
++ nvme_free_sgls(dev, req);
++ return BLK_STS_RESOURCE;
+ }
+
+ static blk_status_t nvme_setup_prp_simple(struct nvme_dev *dev,
+@@ -828,7 +852,7 @@ static blk_status_t nvme_map_data(struct nvme_dev *dev, struct request *req,
+ sg_init_table(iod->sg, blk_rq_nr_phys_segments(req));
+ iod->nents = blk_rq_map_sg(req->q, req, iod->sg);
+ if (!iod->nents)
+- goto out;
++ goto out_free_sg;
+
+ if (is_pci_p2pdma_page(sg_page(iod->sg)))
+ nr_mapped = pci_p2pdma_map_sg_attrs(dev->dev, iod->sg,
+@@ -837,16 +861,21 @@ static blk_status_t nvme_map_data(struct nvme_dev *dev, struct request *req,
+ nr_mapped = dma_map_sg_attrs(dev->dev, iod->sg, iod->nents,
+ rq_dma_dir(req), DMA_ATTR_NO_WARN);
+ if (!nr_mapped)
+- goto out;
++ goto out_free_sg;
+
+ iod->use_sgl = nvme_pci_use_sgls(dev, req);
+ if (iod->use_sgl)
+ ret = nvme_pci_setup_sgls(dev, req, &cmnd->rw, nr_mapped);
+ else
+ ret = nvme_pci_setup_prps(dev, req, &cmnd->rw);
+-out:
+ if (ret != BLK_STS_OK)
+- nvme_unmap_data(dev, req);
++ goto out_unmap_sg;
++ return BLK_STS_OK;
++
++out_unmap_sg:
++ nvme_unmap_sg(dev, req);
++out_free_sg:
++ mempool_free(iod->sg, dev->iod_mempool);
+ return ret;
+ }
+
+diff --git a/drivers/nvme/host/rdma.c b/drivers/nvme/host/rdma.c
+index 8a62c2fe5a5ec..da60300104322 100644
+--- a/drivers/nvme/host/rdma.c
++++ b/drivers/nvme/host/rdma.c
+@@ -835,12 +835,16 @@ static int nvme_rdma_configure_admin_queue(struct nvme_rdma_ctrl *ctrl,
+
+ error = nvme_init_identify(&ctrl->ctrl);
+ if (error)
+- goto out_stop_queue;
++ goto out_quiesce_queue;
+
+ return 0;
+
++out_quiesce_queue:
++ blk_mq_quiesce_queue(ctrl->ctrl.admin_q);
++ blk_sync_queue(ctrl->ctrl.admin_q);
+ out_stop_queue:
+ nvme_rdma_stop_queue(&ctrl->queues[0]);
++ nvme_cancel_admin_tagset(&ctrl->ctrl);
+ out_cleanup_queue:
+ if (new)
+ blk_cleanup_queue(ctrl->ctrl.admin_q);
+@@ -917,8 +921,10 @@ static int nvme_rdma_configure_io_queues(struct nvme_rdma_ctrl *ctrl, bool new)
+
+ out_wait_freeze_timed_out:
+ nvme_stop_queues(&ctrl->ctrl);
++ nvme_sync_io_queues(&ctrl->ctrl);
+ nvme_rdma_stop_io_queues(ctrl);
+ out_cleanup_connect_q:
++ nvme_cancel_tagset(&ctrl->ctrl);
+ if (new)
+ blk_cleanup_queue(ctrl->ctrl.connect_q);
+ out_free_tag_set:
+@@ -1054,10 +1060,18 @@ static int nvme_rdma_setup_ctrl(struct nvme_rdma_ctrl *ctrl, bool new)
+ return 0;
+
+ destroy_io:
+- if (ctrl->ctrl.queue_count > 1)
++ if (ctrl->ctrl.queue_count > 1) {
++ nvme_stop_queues(&ctrl->ctrl);
++ nvme_sync_io_queues(&ctrl->ctrl);
++ nvme_rdma_stop_io_queues(ctrl);
++ nvme_cancel_tagset(&ctrl->ctrl);
+ nvme_rdma_destroy_io_queues(ctrl, new);
++ }
+ destroy_admin:
++ blk_mq_quiesce_queue(ctrl->ctrl.admin_q);
++ blk_sync_queue(ctrl->ctrl.admin_q);
+ nvme_rdma_stop_queue(&ctrl->queues[0]);
++ nvme_cancel_admin_tagset(&ctrl->ctrl);
+ nvme_rdma_destroy_admin_queue(ctrl, new);
+ return ret;
+ }
+diff --git a/drivers/nvme/host/tcp.c b/drivers/nvme/host/tcp.c
+index a554021e1ab92..77a3c488ec120 100644
+--- a/drivers/nvme/host/tcp.c
++++ b/drivers/nvme/host/tcp.c
+@@ -1710,8 +1710,10 @@ static int nvme_tcp_configure_io_queues(struct nvme_ctrl *ctrl, bool new)
+
+ out_wait_freeze_timed_out:
+ nvme_stop_queues(ctrl);
++ nvme_sync_io_queues(ctrl);
+ nvme_tcp_stop_io_queues(ctrl);
+ out_cleanup_connect_q:
++ nvme_cancel_tagset(ctrl);
+ if (new)
+ blk_cleanup_queue(ctrl->connect_q);
+ out_free_tag_set:
+@@ -1773,12 +1775,16 @@ static int nvme_tcp_configure_admin_queue(struct nvme_ctrl *ctrl, bool new)
+
+ error = nvme_init_identify(ctrl);
+ if (error)
+- goto out_stop_queue;
++ goto out_quiesce_queue;
+
+ return 0;
+
++out_quiesce_queue:
++ blk_mq_quiesce_queue(ctrl->admin_q);
++ blk_sync_queue(ctrl->admin_q);
+ out_stop_queue:
+ nvme_tcp_stop_queue(ctrl, 0);
++ nvme_cancel_admin_tagset(ctrl);
+ out_cleanup_queue:
+ if (new)
+ blk_cleanup_queue(ctrl->admin_q);
+@@ -1892,10 +1898,18 @@ static int nvme_tcp_setup_ctrl(struct nvme_ctrl *ctrl, bool new)
+ return 0;
+
+ destroy_io:
+- if (ctrl->queue_count > 1)
++ if (ctrl->queue_count > 1) {
++ nvme_stop_queues(ctrl);
++ nvme_sync_io_queues(ctrl);
++ nvme_tcp_stop_io_queues(ctrl);
++ nvme_cancel_tagset(ctrl);
+ nvme_tcp_destroy_io_queues(ctrl, new);
++ }
+ destroy_admin:
++ blk_mq_quiesce_queue(ctrl->admin_q);
++ blk_sync_queue(ctrl->admin_q);
+ nvme_tcp_stop_queue(ctrl, 0);
++ nvme_cancel_admin_tagset(ctrl);
+ nvme_tcp_destroy_admin_queue(ctrl, new);
+ return ret;
+ }
+diff --git a/drivers/pci/pci.c b/drivers/pci/pci.c
+index 89dece8a41321..9add26438be50 100644
+--- a/drivers/pci/pci.c
++++ b/drivers/pci/pci.c
+@@ -3471,7 +3471,14 @@ u32 pci_rebar_get_possible_sizes(struct pci_dev *pdev, int bar)
+ return 0;
+
+ pci_read_config_dword(pdev, pos + PCI_REBAR_CAP, &cap);
+- return (cap & PCI_REBAR_CAP_SIZES) >> 4;
++ cap &= PCI_REBAR_CAP_SIZES;
++
++ /* Sapphire RX 5600 XT Pulse has an invalid cap dword for BAR 0 */
++ if (pdev->vendor == PCI_VENDOR_ID_ATI && pdev->device == 0x731f &&
++ bar == 0 && cap == 0x7000)
++ cap = 0x3f000;
++
++ return cap >> 4;
+ }
+
+ /**
+diff --git a/drivers/scsi/libiscsi.c b/drivers/scsi/libiscsi.c
+index f954be3d5ee22..a14057c67a12a 100644
+--- a/drivers/scsi/libiscsi.c
++++ b/drivers/scsi/libiscsi.c
+@@ -3331,125 +3331,125 @@ int iscsi_session_get_param(struct iscsi_cls_session *cls_session,
+
+ switch(param) {
+ case ISCSI_PARAM_FAST_ABORT:
+- len = sprintf(buf, "%d\n", session->fast_abort);
++ len = sysfs_emit(buf, "%d\n", session->fast_abort);
+ break;
+ case ISCSI_PARAM_ABORT_TMO:
+- len = sprintf(buf, "%d\n", session->abort_timeout);
++ len = sysfs_emit(buf, "%d\n", session->abort_timeout);
+ break;
+ case ISCSI_PARAM_LU_RESET_TMO:
+- len = sprintf(buf, "%d\n", session->lu_reset_timeout);
++ len = sysfs_emit(buf, "%d\n", session->lu_reset_timeout);
+ break;
+ case ISCSI_PARAM_TGT_RESET_TMO:
+- len = sprintf(buf, "%d\n", session->tgt_reset_timeout);
++ len = sysfs_emit(buf, "%d\n", session->tgt_reset_timeout);
+ break;
+ case ISCSI_PARAM_INITIAL_R2T_EN:
+- len = sprintf(buf, "%d\n", session->initial_r2t_en);
++ len = sysfs_emit(buf, "%d\n", session->initial_r2t_en);
+ break;
+ case ISCSI_PARAM_MAX_R2T:
+- len = sprintf(buf, "%hu\n", session->max_r2t);
++ len = sysfs_emit(buf, "%hu\n", session->max_r2t);
+ break;
+ case ISCSI_PARAM_IMM_DATA_EN:
+- len = sprintf(buf, "%d\n", session->imm_data_en);
++ len = sysfs_emit(buf, "%d\n", session->imm_data_en);
+ break;
+ case ISCSI_PARAM_FIRST_BURST:
+- len = sprintf(buf, "%u\n", session->first_burst);
++ len = sysfs_emit(buf, "%u\n", session->first_burst);
+ break;
+ case ISCSI_PARAM_MAX_BURST:
+- len = sprintf(buf, "%u\n", session->max_burst);
++ len = sysfs_emit(buf, "%u\n", session->max_burst);
+ break;
+ case ISCSI_PARAM_PDU_INORDER_EN:
+- len = sprintf(buf, "%d\n", session->pdu_inorder_en);
++ len = sysfs_emit(buf, "%d\n", session->pdu_inorder_en);
+ break;
+ case ISCSI_PARAM_DATASEQ_INORDER_EN:
+- len = sprintf(buf, "%d\n", session->dataseq_inorder_en);
++ len = sysfs_emit(buf, "%d\n", session->dataseq_inorder_en);
+ break;
+ case ISCSI_PARAM_DEF_TASKMGMT_TMO:
+- len = sprintf(buf, "%d\n", session->def_taskmgmt_tmo);
++ len = sysfs_emit(buf, "%d\n", session->def_taskmgmt_tmo);
+ break;
+ case ISCSI_PARAM_ERL:
+- len = sprintf(buf, "%d\n", session->erl);
++ len = sysfs_emit(buf, "%d\n", session->erl);
+ break;
+ case ISCSI_PARAM_TARGET_NAME:
+- len = sprintf(buf, "%s\n", session->targetname);
++ len = sysfs_emit(buf, "%s\n", session->targetname);
+ break;
+ case ISCSI_PARAM_TARGET_ALIAS:
+- len = sprintf(buf, "%s\n", session->targetalias);
++ len = sysfs_emit(buf, "%s\n", session->targetalias);
+ break;
+ case ISCSI_PARAM_TPGT:
+- len = sprintf(buf, "%d\n", session->tpgt);
++ len = sysfs_emit(buf, "%d\n", session->tpgt);
+ break;
+ case ISCSI_PARAM_USERNAME:
+- len = sprintf(buf, "%s\n", session->username);
++ len = sysfs_emit(buf, "%s\n", session->username);
+ break;
+ case ISCSI_PARAM_USERNAME_IN:
+- len = sprintf(buf, "%s\n", session->username_in);
++ len = sysfs_emit(buf, "%s\n", session->username_in);
+ break;
+ case ISCSI_PARAM_PASSWORD:
+- len = sprintf(buf, "%s\n", session->password);
++ len = sysfs_emit(buf, "%s\n", session->password);
+ break;
+ case ISCSI_PARAM_PASSWORD_IN:
+- len = sprintf(buf, "%s\n", session->password_in);
++ len = sysfs_emit(buf, "%s\n", session->password_in);
+ break;
+ case ISCSI_PARAM_IFACE_NAME:
+- len = sprintf(buf, "%s\n", session->ifacename);
++ len = sysfs_emit(buf, "%s\n", session->ifacename);
+ break;
+ case ISCSI_PARAM_INITIATOR_NAME:
+- len = sprintf(buf, "%s\n", session->initiatorname);
++ len = sysfs_emit(buf, "%s\n", session->initiatorname);
+ break;
+ case ISCSI_PARAM_BOOT_ROOT:
+- len = sprintf(buf, "%s\n", session->boot_root);
++ len = sysfs_emit(buf, "%s\n", session->boot_root);
+ break;
+ case ISCSI_PARAM_BOOT_NIC:
+- len = sprintf(buf, "%s\n", session->boot_nic);
++ len = sysfs_emit(buf, "%s\n", session->boot_nic);
+ break;
+ case ISCSI_PARAM_BOOT_TARGET:
+- len = sprintf(buf, "%s\n", session->boot_target);
++ len = sysfs_emit(buf, "%s\n", session->boot_target);
+ break;
+ case ISCSI_PARAM_AUTO_SND_TGT_DISABLE:
+- len = sprintf(buf, "%u\n", session->auto_snd_tgt_disable);
++ len = sysfs_emit(buf, "%u\n", session->auto_snd_tgt_disable);
+ break;
+ case ISCSI_PARAM_DISCOVERY_SESS:
+- len = sprintf(buf, "%u\n", session->discovery_sess);
++ len = sysfs_emit(buf, "%u\n", session->discovery_sess);
+ break;
+ case ISCSI_PARAM_PORTAL_TYPE:
+- len = sprintf(buf, "%s\n", session->portal_type);
++ len = sysfs_emit(buf, "%s\n", session->portal_type);
+ break;
+ case ISCSI_PARAM_CHAP_AUTH_EN:
+- len = sprintf(buf, "%u\n", session->chap_auth_en);
++ len = sysfs_emit(buf, "%u\n", session->chap_auth_en);
+ break;
+ case ISCSI_PARAM_DISCOVERY_LOGOUT_EN:
+- len = sprintf(buf, "%u\n", session->discovery_logout_en);
++ len = sysfs_emit(buf, "%u\n", session->discovery_logout_en);
+ break;
+ case ISCSI_PARAM_BIDI_CHAP_EN:
+- len = sprintf(buf, "%u\n", session->bidi_chap_en);
++ len = sysfs_emit(buf, "%u\n", session->bidi_chap_en);
+ break;
+ case ISCSI_PARAM_DISCOVERY_AUTH_OPTIONAL:
+- len = sprintf(buf, "%u\n", session->discovery_auth_optional);
++ len = sysfs_emit(buf, "%u\n", session->discovery_auth_optional);
+ break;
+ case ISCSI_PARAM_DEF_TIME2WAIT:
+- len = sprintf(buf, "%d\n", session->time2wait);
++ len = sysfs_emit(buf, "%d\n", session->time2wait);
+ break;
+ case ISCSI_PARAM_DEF_TIME2RETAIN:
+- len = sprintf(buf, "%d\n", session->time2retain);
++ len = sysfs_emit(buf, "%d\n", session->time2retain);
+ break;
+ case ISCSI_PARAM_TSID:
+- len = sprintf(buf, "%u\n", session->tsid);
++ len = sysfs_emit(buf, "%u\n", session->tsid);
+ break;
+ case ISCSI_PARAM_ISID:
+- len = sprintf(buf, "%02x%02x%02x%02x%02x%02x\n",
++ len = sysfs_emit(buf, "%02x%02x%02x%02x%02x%02x\n",
+ session->isid[0], session->isid[1],
+ session->isid[2], session->isid[3],
+ session->isid[4], session->isid[5]);
+ break;
+ case ISCSI_PARAM_DISCOVERY_PARENT_IDX:
+- len = sprintf(buf, "%u\n", session->discovery_parent_idx);
++ len = sysfs_emit(buf, "%u\n", session->discovery_parent_idx);
+ break;
+ case ISCSI_PARAM_DISCOVERY_PARENT_TYPE:
+ if (session->discovery_parent_type)
+- len = sprintf(buf, "%s\n",
++ len = sysfs_emit(buf, "%s\n",
+ session->discovery_parent_type);
+ else
+- len = sprintf(buf, "\n");
++ len = sysfs_emit(buf, "\n");
+ break;
+ default:
+ return -ENOSYS;
+@@ -3481,16 +3481,16 @@ int iscsi_conn_get_addr_param(struct sockaddr_storage *addr,
+ case ISCSI_PARAM_CONN_ADDRESS:
+ case ISCSI_HOST_PARAM_IPADDRESS:
+ if (sin)
+- len = sprintf(buf, "%pI4\n", &sin->sin_addr.s_addr);
++ len = sysfs_emit(buf, "%pI4\n", &sin->sin_addr.s_addr);
+ else
+- len = sprintf(buf, "%pI6\n", &sin6->sin6_addr);
++ len = sysfs_emit(buf, "%pI6\n", &sin6->sin6_addr);
+ break;
+ case ISCSI_PARAM_CONN_PORT:
+ case ISCSI_PARAM_LOCAL_PORT:
+ if (sin)
+- len = sprintf(buf, "%hu\n", be16_to_cpu(sin->sin_port));
++ len = sysfs_emit(buf, "%hu\n", be16_to_cpu(sin->sin_port));
+ else
+- len = sprintf(buf, "%hu\n",
++ len = sysfs_emit(buf, "%hu\n",
+ be16_to_cpu(sin6->sin6_port));
+ break;
+ default:
+@@ -3509,88 +3509,88 @@ int iscsi_conn_get_param(struct iscsi_cls_conn *cls_conn,
+
+ switch(param) {
+ case ISCSI_PARAM_PING_TMO:
+- len = sprintf(buf, "%u\n", conn->ping_timeout);
++ len = sysfs_emit(buf, "%u\n", conn->ping_timeout);
+ break;
+ case ISCSI_PARAM_RECV_TMO:
+- len = sprintf(buf, "%u\n", conn->recv_timeout);
++ len = sysfs_emit(buf, "%u\n", conn->recv_timeout);
+ break;
+ case ISCSI_PARAM_MAX_RECV_DLENGTH:
+- len = sprintf(buf, "%u\n", conn->max_recv_dlength);
++ len = sysfs_emit(buf, "%u\n", conn->max_recv_dlength);
+ break;
+ case ISCSI_PARAM_MAX_XMIT_DLENGTH:
+- len = sprintf(buf, "%u\n", conn->max_xmit_dlength);
++ len = sysfs_emit(buf, "%u\n", conn->max_xmit_dlength);
+ break;
+ case ISCSI_PARAM_HDRDGST_EN:
+- len = sprintf(buf, "%d\n", conn->hdrdgst_en);
++ len = sysfs_emit(buf, "%d\n", conn->hdrdgst_en);
+ break;
+ case ISCSI_PARAM_DATADGST_EN:
+- len = sprintf(buf, "%d\n", conn->datadgst_en);
++ len = sysfs_emit(buf, "%d\n", conn->datadgst_en);
+ break;
+ case ISCSI_PARAM_IFMARKER_EN:
+- len = sprintf(buf, "%d\n", conn->ifmarker_en);
++ len = sysfs_emit(buf, "%d\n", conn->ifmarker_en);
+ break;
+ case ISCSI_PARAM_OFMARKER_EN:
+- len = sprintf(buf, "%d\n", conn->ofmarker_en);
++ len = sysfs_emit(buf, "%d\n", conn->ofmarker_en);
+ break;
+ case ISCSI_PARAM_EXP_STATSN:
+- len = sprintf(buf, "%u\n", conn->exp_statsn);
++ len = sysfs_emit(buf, "%u\n", conn->exp_statsn);
+ break;
+ case ISCSI_PARAM_PERSISTENT_PORT:
+- len = sprintf(buf, "%d\n", conn->persistent_port);
++ len = sysfs_emit(buf, "%d\n", conn->persistent_port);
+ break;
+ case ISCSI_PARAM_PERSISTENT_ADDRESS:
+- len = sprintf(buf, "%s\n", conn->persistent_address);
++ len = sysfs_emit(buf, "%s\n", conn->persistent_address);
+ break;
+ case ISCSI_PARAM_STATSN:
+- len = sprintf(buf, "%u\n", conn->statsn);
++ len = sysfs_emit(buf, "%u\n", conn->statsn);
+ break;
+ case ISCSI_PARAM_MAX_SEGMENT_SIZE:
+- len = sprintf(buf, "%u\n", conn->max_segment_size);
++ len = sysfs_emit(buf, "%u\n", conn->max_segment_size);
+ break;
+ case ISCSI_PARAM_KEEPALIVE_TMO:
+- len = sprintf(buf, "%u\n", conn->keepalive_tmo);
++ len = sysfs_emit(buf, "%u\n", conn->keepalive_tmo);
+ break;
+ case ISCSI_PARAM_LOCAL_PORT:
+- len = sprintf(buf, "%u\n", conn->local_port);
++ len = sysfs_emit(buf, "%u\n", conn->local_port);
+ break;
+ case ISCSI_PARAM_TCP_TIMESTAMP_STAT:
+- len = sprintf(buf, "%u\n", conn->tcp_timestamp_stat);
++ len = sysfs_emit(buf, "%u\n", conn->tcp_timestamp_stat);
+ break;
+ case ISCSI_PARAM_TCP_NAGLE_DISABLE:
+- len = sprintf(buf, "%u\n", conn->tcp_nagle_disable);
++ len = sysfs_emit(buf, "%u\n", conn->tcp_nagle_disable);
+ break;
+ case ISCSI_PARAM_TCP_WSF_DISABLE:
+- len = sprintf(buf, "%u\n", conn->tcp_wsf_disable);
++ len = sysfs_emit(buf, "%u\n", conn->tcp_wsf_disable);
+ break;
+ case ISCSI_PARAM_TCP_TIMER_SCALE:
+- len = sprintf(buf, "%u\n", conn->tcp_timer_scale);
++ len = sysfs_emit(buf, "%u\n", conn->tcp_timer_scale);
+ break;
+ case ISCSI_PARAM_TCP_TIMESTAMP_EN:
+- len = sprintf(buf, "%u\n", conn->tcp_timestamp_en);
++ len = sysfs_emit(buf, "%u\n", conn->tcp_timestamp_en);
+ break;
+ case ISCSI_PARAM_IP_FRAGMENT_DISABLE:
+- len = sprintf(buf, "%u\n", conn->fragment_disable);
++ len = sysfs_emit(buf, "%u\n", conn->fragment_disable);
+ break;
+ case ISCSI_PARAM_IPV4_TOS:
+- len = sprintf(buf, "%u\n", conn->ipv4_tos);
++ len = sysfs_emit(buf, "%u\n", conn->ipv4_tos);
+ break;
+ case ISCSI_PARAM_IPV6_TC:
+- len = sprintf(buf, "%u\n", conn->ipv6_traffic_class);
++ len = sysfs_emit(buf, "%u\n", conn->ipv6_traffic_class);
+ break;
+ case ISCSI_PARAM_IPV6_FLOW_LABEL:
+- len = sprintf(buf, "%u\n", conn->ipv6_flow_label);
++ len = sysfs_emit(buf, "%u\n", conn->ipv6_flow_label);
+ break;
+ case ISCSI_PARAM_IS_FW_ASSIGNED_IPV6:
+- len = sprintf(buf, "%u\n", conn->is_fw_assigned_ipv6);
++ len = sysfs_emit(buf, "%u\n", conn->is_fw_assigned_ipv6);
+ break;
+ case ISCSI_PARAM_TCP_XMIT_WSF:
+- len = sprintf(buf, "%u\n", conn->tcp_xmit_wsf);
++ len = sysfs_emit(buf, "%u\n", conn->tcp_xmit_wsf);
+ break;
+ case ISCSI_PARAM_TCP_RECV_WSF:
+- len = sprintf(buf, "%u\n", conn->tcp_recv_wsf);
++ len = sysfs_emit(buf, "%u\n", conn->tcp_recv_wsf);
+ break;
+ case ISCSI_PARAM_LOCAL_IPADDR:
+- len = sprintf(buf, "%s\n", conn->local_ipaddr);
++ len = sysfs_emit(buf, "%s\n", conn->local_ipaddr);
+ break;
+ default:
+ return -ENOSYS;
+@@ -3608,13 +3608,13 @@ int iscsi_host_get_param(struct Scsi_Host *shost, enum iscsi_host_param param,
+
+ switch (param) {
+ case ISCSI_HOST_PARAM_NETDEV_NAME:
+- len = sprintf(buf, "%s\n", ihost->netdev);
++ len = sysfs_emit(buf, "%s\n", ihost->netdev);
+ break;
+ case ISCSI_HOST_PARAM_HWADDRESS:
+- len = sprintf(buf, "%s\n", ihost->hwaddress);
++ len = sysfs_emit(buf, "%s\n", ihost->hwaddress);
+ break;
+ case ISCSI_HOST_PARAM_INITIATOR_NAME:
+- len = sprintf(buf, "%s\n", ihost->initiatorname);
++ len = sysfs_emit(buf, "%s\n", ihost->initiatorname);
+ break;
+ default:
+ return -ENOSYS;
+diff --git a/drivers/scsi/scsi_transport_iscsi.c b/drivers/scsi/scsi_transport_iscsi.c
+index dbad926e8f87f..a26df7d6d5d18 100644
+--- a/drivers/scsi/scsi_transport_iscsi.c
++++ b/drivers/scsi/scsi_transport_iscsi.c
+@@ -124,7 +124,11 @@ show_transport_handle(struct device *dev, struct device_attribute *attr,
+ char *buf)
+ {
+ struct iscsi_internal *priv = dev_to_iscsi_internal(dev);
+- return sprintf(buf, "%llu\n", (unsigned long long)iscsi_handle(priv->iscsi_transport));
++
++ if (!capable(CAP_SYS_ADMIN))
++ return -EACCES;
++ return sysfs_emit(buf, "%llu\n",
++ (unsigned long long)iscsi_handle(priv->iscsi_transport));
+ }
+ static DEVICE_ATTR(handle, S_IRUGO, show_transport_handle, NULL);
+
+@@ -134,7 +138,7 @@ show_transport_##name(struct device *dev, \
+ struct device_attribute *attr,char *buf) \
+ { \
+ struct iscsi_internal *priv = dev_to_iscsi_internal(dev); \
+- return sprintf(buf, format"\n", priv->iscsi_transport->name); \
++ return sysfs_emit(buf, format"\n", priv->iscsi_transport->name);\
+ } \
+ static DEVICE_ATTR(name, S_IRUGO, show_transport_##name, NULL);
+
+@@ -175,7 +179,7 @@ static ssize_t
+ show_ep_handle(struct device *dev, struct device_attribute *attr, char *buf)
+ {
+ struct iscsi_endpoint *ep = iscsi_dev_to_endpoint(dev);
+- return sprintf(buf, "%llu\n", (unsigned long long) ep->id);
++ return sysfs_emit(buf, "%llu\n", (unsigned long long) ep->id);
+ }
+ static ISCSI_ATTR(ep, handle, S_IRUGO, show_ep_handle, NULL);
+
+@@ -2765,6 +2769,9 @@ iscsi_set_param(struct iscsi_transport *transport, struct iscsi_uevent *ev)
+ struct iscsi_cls_session *session;
+ int err = 0, value = 0;
+
++ if (ev->u.set_param.len > PAGE_SIZE)
++ return -EINVAL;
++
+ session = iscsi_session_lookup(ev->u.set_param.sid);
+ conn = iscsi_conn_lookup(ev->u.set_param.sid, ev->u.set_param.cid);
+ if (!conn || !session)
+@@ -2912,6 +2919,9 @@ iscsi_set_host_param(struct iscsi_transport *transport,
+ if (!transport->set_host_param)
+ return -ENOSYS;
+
++ if (ev->u.set_host_param.len > PAGE_SIZE)
++ return -EINVAL;
++
+ shost = scsi_host_lookup(ev->u.set_host_param.host_no);
+ if (!shost) {
+ printk(KERN_ERR "set_host_param could not find host no %u\n",
+@@ -3499,6 +3509,7 @@ iscsi_if_recv_msg(struct sk_buff *skb, struct nlmsghdr *nlh, uint32_t *group)
+ {
+ int err = 0;
+ u32 portid;
++ u32 pdu_len;
+ struct iscsi_uevent *ev = nlmsg_data(nlh);
+ struct iscsi_transport *transport = NULL;
+ struct iscsi_internal *priv;
+@@ -3506,6 +3517,9 @@ iscsi_if_recv_msg(struct sk_buff *skb, struct nlmsghdr *nlh, uint32_t *group)
+ struct iscsi_cls_conn *conn;
+ struct iscsi_endpoint *ep = NULL;
+
++ if (!netlink_capable(skb, CAP_SYS_ADMIN))
++ return -EPERM;
++
+ if (nlh->nlmsg_type == ISCSI_UEVENT_PATH_UPDATE)
+ *group = ISCSI_NL_GRP_UIP;
+ else
+@@ -3613,6 +3627,14 @@ iscsi_if_recv_msg(struct sk_buff *skb, struct nlmsghdr *nlh, uint32_t *group)
+ err = -EINVAL;
+ break;
+ case ISCSI_UEVENT_SEND_PDU:
++ pdu_len = nlh->nlmsg_len - sizeof(*nlh) - sizeof(*ev);
++
++ if ((ev->u.send_pdu.hdr_size > pdu_len) ||
++ (ev->u.send_pdu.data_size > (pdu_len - ev->u.send_pdu.hdr_size))) {
++ err = -EINVAL;
++ break;
++ }
++
+ conn = iscsi_conn_lookup(ev->u.send_pdu.sid, ev->u.send_pdu.cid);
+ if (conn)
+ ev->r.retcode = transport->send_pdu(conn,
+@@ -4019,7 +4041,7 @@ show_priv_session_state(struct device *dev, struct device_attribute *attr,
+ char *buf)
+ {
+ struct iscsi_cls_session *session = iscsi_dev_to_session(dev->parent);
+- return sprintf(buf, "%s\n", iscsi_session_state_name(session->state));
++ return sysfs_emit(buf, "%s\n", iscsi_session_state_name(session->state));
+ }
+ static ISCSI_CLASS_ATTR(priv_sess, state, S_IRUGO, show_priv_session_state,
+ NULL);
+@@ -4028,7 +4050,7 @@ show_priv_session_creator(struct device *dev, struct device_attribute *attr,
+ char *buf)
+ {
+ struct iscsi_cls_session *session = iscsi_dev_to_session(dev->parent);
+- return sprintf(buf, "%d\n", session->creator);
++ return sysfs_emit(buf, "%d\n", session->creator);
+ }
+ static ISCSI_CLASS_ATTR(priv_sess, creator, S_IRUGO, show_priv_session_creator,
+ NULL);
+@@ -4037,7 +4059,7 @@ show_priv_session_target_id(struct device *dev, struct device_attribute *attr,
+ char *buf)
+ {
+ struct iscsi_cls_session *session = iscsi_dev_to_session(dev->parent);
+- return sprintf(buf, "%d\n", session->target_id);
++ return sysfs_emit(buf, "%d\n", session->target_id);
+ }
+ static ISCSI_CLASS_ATTR(priv_sess, target_id, S_IRUGO,
+ show_priv_session_target_id, NULL);
+@@ -4050,8 +4072,8 @@ show_priv_session_##field(struct device *dev, \
+ struct iscsi_cls_session *session = \
+ iscsi_dev_to_session(dev->parent); \
+ if (session->field == -1) \
+- return sprintf(buf, "off\n"); \
+- return sprintf(buf, format"\n", session->field); \
++ return sysfs_emit(buf, "off\n"); \
++ return sysfs_emit(buf, format"\n", session->field); \
+ }
+
+ #define iscsi_priv_session_attr_store(field) \
+diff --git a/drivers/staging/fwserial/fwserial.c b/drivers/staging/fwserial/fwserial.c
+index aec0f19597a94..4df6e3c1ea96c 100644
+--- a/drivers/staging/fwserial/fwserial.c
++++ b/drivers/staging/fwserial/fwserial.c
+@@ -2189,6 +2189,7 @@ static int fwserial_create(struct fw_unit *unit)
+ err = fw_core_add_address_handler(&port->rx_handler,
+ &fw_high_memory_region);
+ if (err) {
++ tty_port_destroy(&port->port);
+ kfree(port);
+ goto free_ports;
+ }
+@@ -2271,6 +2272,7 @@ unregister_ttys:
+
+ free_ports:
+ for (--i; i >= 0; --i) {
++ fw_core_remove_address_handler(&serial->ports[i]->rx_handler);
+ tty_port_destroy(&serial->ports[i]->port);
+ kfree(serial->ports[i]);
+ }
+diff --git a/drivers/staging/most/sound/sound.c b/drivers/staging/most/sound/sound.c
+index 79817061fcfa4..4225ee9fcf7bf 100644
+--- a/drivers/staging/most/sound/sound.c
++++ b/drivers/staging/most/sound/sound.c
+@@ -98,6 +98,8 @@ static void swap_copy24(u8 *dest, const u8 *source, unsigned int bytes)
+ {
+ unsigned int i = 0;
+
++ if (bytes < 2)
++ return;
+ while (i < bytes - 2) {
+ dest[i] = source[i + 2];
+ dest[i + 1] = source[i + 1];
+diff --git a/drivers/staging/vc04_services/bcm2835-audio/bcm2835-ctl.c b/drivers/staging/vc04_services/bcm2835-audio/bcm2835-ctl.c
+index 4c2cae99776b9..3703409715dab 100644
+--- a/drivers/staging/vc04_services/bcm2835-audio/bcm2835-ctl.c
++++ b/drivers/staging/vc04_services/bcm2835-audio/bcm2835-ctl.c
+@@ -224,7 +224,7 @@ int snd_bcm2835_new_ctl(struct bcm2835_chip *chip)
+ {
+ int err;
+
+- strcpy(chip->card->mixername, "Broadcom Mixer");
++ strscpy(chip->card->mixername, "Broadcom Mixer", sizeof(chip->card->mixername));
+ err = create_ctls(chip, ARRAY_SIZE(snd_bcm2835_ctl), snd_bcm2835_ctl);
+ if (err < 0)
+ return err;
+@@ -261,7 +261,7 @@ static const struct snd_kcontrol_new snd_bcm2835_headphones_ctl[] = {
+
+ int snd_bcm2835_new_headphones_ctl(struct bcm2835_chip *chip)
+ {
+- strcpy(chip->card->mixername, "Broadcom Mixer");
++ strscpy(chip->card->mixername, "Broadcom Mixer", sizeof(chip->card->mixername));
+ return create_ctls(chip, ARRAY_SIZE(snd_bcm2835_headphones_ctl),
+ snd_bcm2835_headphones_ctl);
+ }
+@@ -295,7 +295,7 @@ static const struct snd_kcontrol_new snd_bcm2835_hdmi[] = {
+
+ int snd_bcm2835_new_hdmi_ctl(struct bcm2835_chip *chip)
+ {
+- strcpy(chip->card->mixername, "Broadcom Mixer");
++ strscpy(chip->card->mixername, "Broadcom Mixer", sizeof(chip->card->mixername));
+ return create_ctls(chip, ARRAY_SIZE(snd_bcm2835_hdmi),
+ snd_bcm2835_hdmi);
+ }
+diff --git a/drivers/staging/vc04_services/bcm2835-audio/bcm2835-pcm.c b/drivers/staging/vc04_services/bcm2835-audio/bcm2835-pcm.c
+index 826016c3431a1..8708f97b46f3a 100644
+--- a/drivers/staging/vc04_services/bcm2835-audio/bcm2835-pcm.c
++++ b/drivers/staging/vc04_services/bcm2835-audio/bcm2835-pcm.c
+@@ -351,7 +351,7 @@ int snd_bcm2835_new_pcm(struct bcm2835_chip *chip, const char *name,
+
+ pcm->private_data = chip;
+ pcm->nonatomic = true;
+- strcpy(pcm->name, name);
++ strscpy(pcm->name, name, sizeof(pcm->name));
+ if (!spdif) {
+ chip->dest = route;
+ chip->volume = 0;
+diff --git a/drivers/staging/vc04_services/bcm2835-audio/bcm2835.c b/drivers/staging/vc04_services/bcm2835-audio/bcm2835.c
+index cf5f80f5ca6b0..c250fbef2fa3d 100644
+--- a/drivers/staging/vc04_services/bcm2835-audio/bcm2835.c
++++ b/drivers/staging/vc04_services/bcm2835-audio/bcm2835.c
+@@ -185,9 +185,9 @@ static int snd_add_child_device(struct device *dev,
+ goto error;
+ }
+
+- strcpy(card->driver, audio_driver->driver.name);
+- strcpy(card->shortname, audio_driver->shortname);
+- strcpy(card->longname, audio_driver->longname);
++ strscpy(card->driver, audio_driver->driver.name, sizeof(card->driver));
++ strscpy(card->shortname, audio_driver->shortname, sizeof(card->shortname));
++ strscpy(card->longname, audio_driver->longname, sizeof(card->longname));
+
+ err = audio_driver->newpcm(chip, audio_driver->shortname,
+ audio_driver->route,
+diff --git a/drivers/tty/vt/consolemap.c b/drivers/tty/vt/consolemap.c
+index b28aa0d289f89..251c02af1fc3e 100644
+--- a/drivers/tty/vt/consolemap.c
++++ b/drivers/tty/vt/consolemap.c
+@@ -495,7 +495,7 @@ con_insert_unipair(struct uni_pagedir *p, u_short unicode, u_short fontpos)
+
+ p2[unicode & 0x3f] = fontpos;
+
+- p->sum += (fontpos << 20) + unicode;
++ p->sum += (fontpos << 20U) + unicode;
+
+ return 0;
+ }
+diff --git a/drivers/video/fbdev/udlfb.c b/drivers/video/fbdev/udlfb.c
+index fe373b63ddd6d..ecbfbbf1c1a79 100644
+--- a/drivers/video/fbdev/udlfb.c
++++ b/drivers/video/fbdev/udlfb.c
+@@ -1017,6 +1017,7 @@ static void dlfb_ops_destroy(struct fb_info *info)
+ }
+ vfree(dlfb->backing_buffer);
+ kfree(dlfb->edid);
++ dlfb_free_urb_list(dlfb);
+ usb_put_dev(dlfb->udev);
+ kfree(dlfb);
+
+diff --git a/fs/btrfs/transaction.c b/fs/btrfs/transaction.c
+index c346ee7ec18d4..aca6c467d7761 100644
+--- a/fs/btrfs/transaction.c
++++ b/fs/btrfs/transaction.c
+@@ -1212,7 +1212,6 @@ static noinline int commit_fs_roots(struct btrfs_trans_handle *trans)
+ struct btrfs_root *gang[8];
+ int i;
+ int ret;
+- int err = 0;
+
+ spin_lock(&fs_info->fs_roots_radix_lock);
+ while (1) {
+@@ -1224,6 +1223,8 @@ static noinline int commit_fs_roots(struct btrfs_trans_handle *trans)
+ break;
+ for (i = 0; i < ret; i++) {
+ struct btrfs_root *root = gang[i];
++ int ret2;
++
+ radix_tree_tag_clear(&fs_info->fs_roots_radix,
+ (unsigned long)root->root_key.objectid,
+ BTRFS_ROOT_TRANS_TAG);
+@@ -1245,17 +1246,17 @@ static noinline int commit_fs_roots(struct btrfs_trans_handle *trans)
+ root->node);
+ }
+
+- err = btrfs_update_root(trans, fs_info->tree_root,
++ ret2 = btrfs_update_root(trans, fs_info->tree_root,
+ &root->root_key,
+ &root->root_item);
++ if (ret2)
++ return ret2;
+ spin_lock(&fs_info->fs_roots_radix_lock);
+- if (err)
+- break;
+ btrfs_qgroup_free_meta_all_pertrans(root);
+ }
+ }
+ spin_unlock(&fs_info->fs_roots_radix_lock);
+- return err;
++ return 0;
+ }
+
+ /*
+diff --git a/fs/erofs/super.c b/fs/erofs/super.c
+index 0e369494f2f2c..22e059b4f745c 100644
+--- a/fs/erofs/super.c
++++ b/fs/erofs/super.c
+@@ -124,8 +124,8 @@ static int erofs_read_superblock(struct super_block *sb)
+ blkszbits = dsb->blkszbits;
+ /* 9(512 bytes) + LOG_SECTORS_PER_BLOCK == LOG_BLOCK_SIZE */
+ if (blkszbits != LOG_BLOCK_SIZE) {
+- erofs_err(sb, "blksize %u isn't supported on this platform",
+- 1 << blkszbits);
++ erofs_err(sb, "blkszbits %u isn't supported on this platform",
++ blkszbits);
+ goto out;
+ }
+
+diff --git a/fs/f2fs/namei.c b/fs/f2fs/namei.c
+index 5d9584281935f..3a97ac56821ba 100644
+--- a/fs/f2fs/namei.c
++++ b/fs/f2fs/namei.c
+@@ -797,7 +797,11 @@ static int __f2fs_tmpfile(struct inode *dir, struct dentry *dentry,
+
+ if (whiteout) {
+ f2fs_i_links_write(inode, false);
++
++ spin_lock(&inode->i_lock);
+ inode->i_state |= I_LINKABLE;
++ spin_unlock(&inode->i_lock);
++
+ *whiteout = inode;
+ } else {
+ d_tmpfile(dentry, inode);
+@@ -996,7 +1000,11 @@ static int f2fs_rename(struct inode *old_dir, struct dentry *old_dentry,
+ err = f2fs_add_link(old_dentry, whiteout);
+ if (err)
+ goto put_out_dir;
++
++ spin_lock(&whiteout->i_lock);
+ whiteout->i_state &= ~I_LINKABLE;
++ spin_unlock(&whiteout->i_lock);
++
+ iput(whiteout);
+ }
+
+diff --git a/fs/f2fs/segment.h b/fs/f2fs/segment.h
+index 325781a1ae4d6..2034b9a07d632 100644
+--- a/fs/f2fs/segment.h
++++ b/fs/f2fs/segment.h
+@@ -88,11 +88,11 @@
+ #define BLKS_PER_SEC(sbi) \
+ ((sbi)->segs_per_sec * (sbi)->blocks_per_seg)
+ #define GET_SEC_FROM_SEG(sbi, segno) \
+- ((segno) / (sbi)->segs_per_sec)
++ (((segno) == -1) ? -1: (segno) / (sbi)->segs_per_sec)
+ #define GET_SEG_FROM_SEC(sbi, secno) \
+ ((secno) * (sbi)->segs_per_sec)
+ #define GET_ZONE_FROM_SEC(sbi, secno) \
+- ((secno) / (sbi)->secs_per_zone)
++ (((secno) == -1) ? -1: (secno) / (sbi)->secs_per_zone)
+ #define GET_ZONE_FROM_SEG(sbi, segno) \
+ GET_ZONE_FROM_SEC(sbi, GET_SEC_FROM_SEG(sbi, segno))
+
+diff --git a/fs/jfs/jfs_filsys.h b/fs/jfs/jfs_filsys.h
+index 1e899298f7f00..b5d702df7111a 100644
+--- a/fs/jfs/jfs_filsys.h
++++ b/fs/jfs/jfs_filsys.h
+@@ -268,5 +268,6 @@
+ * fsck() must be run to repair
+ */
+ #define FM_EXTENDFS 0x00000008 /* file system extendfs() in progress */
++#define FM_STATE_MAX 0x0000000f /* max value of s_state */
+
+ #endif /* _H_JFS_FILSYS */
+diff --git a/fs/jfs/jfs_mount.c b/fs/jfs/jfs_mount.c
+index eb8b9e233d73d..616de103dccc5 100644
+--- a/fs/jfs/jfs_mount.c
++++ b/fs/jfs/jfs_mount.c
+@@ -36,6 +36,7 @@
+
+ #include <linux/fs.h>
+ #include <linux/buffer_head.h>
++#include <linux/log2.h>
+
+ #include "jfs_incore.h"
+ #include "jfs_filsys.h"
+@@ -365,6 +366,15 @@ static int chkSuper(struct super_block *sb)
+ sbi->bsize = bsize;
+ sbi->l2bsize = le16_to_cpu(j_sb->s_l2bsize);
+
++ /* check some fields for possible corruption */
++ if (sbi->l2bsize != ilog2((u32)bsize) ||
++ j_sb->pad != 0 ||
++ le32_to_cpu(j_sb->s_state) > FM_STATE_MAX) {
++ rc = -EINVAL;
++ jfs_err("jfs_mount: Mount Failure: superblock is corrupt!");
++ goto out;
++ }
++
+ /*
+ * For now, ignore s_pbsize, l2bfactor. All I/O going through buffer
+ * cache.
+diff --git a/fs/sysfs/file.c b/fs/sysfs/file.c
+index 130fc6fbcc038..4f7cf975b27c2 100644
+--- a/fs/sysfs/file.c
++++ b/fs/sysfs/file.c
+@@ -15,6 +15,7 @@
+ #include <linux/list.h>
+ #include <linux/mutex.h>
+ #include <linux/seq_file.h>
++#include <linux/mm.h>
+
+ #include "sysfs.h"
+
+@@ -558,3 +559,57 @@ void sysfs_remove_bin_file(struct kobject *kobj,
+ kernfs_remove_by_name(kobj->sd, attr->attr.name);
+ }
+ EXPORT_SYMBOL_GPL(sysfs_remove_bin_file);
++
++/**
++ * sysfs_emit - scnprintf equivalent, aware of PAGE_SIZE buffer.
++ * @buf: start of PAGE_SIZE buffer.
++ * @fmt: format
++ * @...: optional arguments to @format
++ *
++ *
++ * Returns number of characters written to @buf.
++ */
++int sysfs_emit(char *buf, const char *fmt, ...)
++{
++ va_list args;
++ int len;
++
++ if (WARN(!buf || offset_in_page(buf),
++ "invalid sysfs_emit: buf:%p\n", buf))
++ return 0;
++
++ va_start(args, fmt);
++ len = vscnprintf(buf, PAGE_SIZE, fmt, args);
++ va_end(args);
++
++ return len;
++}
++EXPORT_SYMBOL_GPL(sysfs_emit);
++
++/**
++ * sysfs_emit_at - scnprintf equivalent, aware of PAGE_SIZE buffer.
++ * @buf: start of PAGE_SIZE buffer.
++ * @at: offset in @buf to start write in bytes
++ * @at must be >= 0 && < PAGE_SIZE
++ * @fmt: format
++ * @...: optional arguments to @fmt
++ *
++ *
++ * Returns number of characters written starting at &@buf[@at].
++ */
++int sysfs_emit_at(char *buf, int at, const char *fmt, ...)
++{
++ va_list args;
++ int len;
++
++ if (WARN(!buf || offset_in_page(buf) || at < 0 || at >= PAGE_SIZE,
++ "invalid sysfs_emit_at: buf:%p at:%d\n", buf, at))
++ return 0;
++
++ va_start(args, fmt);
++ len = vscnprintf(buf + at, PAGE_SIZE - at, fmt, args);
++ va_end(args);
++
++ return len;
++}
++EXPORT_SYMBOL_GPL(sysfs_emit_at);
+diff --git a/fs/xfs/xfs_iops.c b/fs/xfs/xfs_iops.c
+index dec511823fcbc..ca8c763902b96 100644
+--- a/fs/xfs/xfs_iops.c
++++ b/fs/xfs/xfs_iops.c
+@@ -839,7 +839,7 @@ xfs_setattr_size(
+ ASSERT(xfs_isilocked(ip, XFS_MMAPLOCK_EXCL));
+ ASSERT(S_ISREG(inode->i_mode));
+ ASSERT((iattr->ia_valid & (ATTR_UID|ATTR_GID|ATTR_ATIME|ATTR_ATIME_SET|
+- ATTR_MTIME_SET|ATTR_KILL_PRIV|ATTR_TIMES_SET)) == 0);
++ ATTR_MTIME_SET|ATTR_TIMES_SET)) == 0);
+
+ oldsize = inode->i_size;
+ newsize = iattr->ia_size;
+diff --git a/include/linux/netdevice.h b/include/linux/netdevice.h
+index 3e0692fd6282c..db1b9623977c8 100644
+--- a/include/linux/netdevice.h
++++ b/include/linux/netdevice.h
+@@ -3679,6 +3679,9 @@ int dev_pre_changeaddr_notify(struct net_device *dev, const char *addr,
+ struct netlink_ext_ack *extack);
+ int dev_set_mac_address(struct net_device *dev, struct sockaddr *sa,
+ struct netlink_ext_ack *extack);
++int dev_set_mac_address_user(struct net_device *dev, struct sockaddr *sa,
++ struct netlink_ext_ack *extack);
++int dev_get_mac_address(struct sockaddr *sa, struct net *net, char *dev_name);
+ int dev_change_carrier(struct net_device *, bool new_carrier);
+ int dev_get_phys_port_id(struct net_device *dev,
+ struct netdev_phys_item_id *ppid);
+diff --git a/include/linux/swap.h b/include/linux/swap.h
+index 063c0c1e112bd..136a929648ef4 100644
+--- a/include/linux/swap.h
++++ b/include/linux/swap.h
+@@ -473,6 +473,7 @@ struct backing_dev_info;
+ extern int init_swap_address_space(unsigned int type, unsigned long nr_pages);
+ extern void exit_swap_address_space(unsigned int type);
+ extern struct swap_info_struct *get_swap_device(swp_entry_t entry);
++sector_t swap_page_sector(struct page *page);
+
+ static inline void put_swap_device(struct swap_info_struct *si)
+ {
+diff --git a/include/linux/sysfs.h b/include/linux/sysfs.h
+index fa7ee503fb763..428707ac3c0bd 100644
+--- a/include/linux/sysfs.h
++++ b/include/linux/sysfs.h
+@@ -310,6 +310,11 @@ static inline void sysfs_enable_ns(struct kernfs_node *kn)
+ return kernfs_enable_ns(kn);
+ }
+
++__printf(2, 3)
++int sysfs_emit(char *buf, const char *fmt, ...);
++__printf(3, 4)
++int sysfs_emit_at(char *buf, int at, const char *fmt, ...);
++
+ #else /* CONFIG_SYSFS */
+
+ static inline int sysfs_create_dir_ns(struct kobject *kobj, const void *ns)
+@@ -522,6 +527,17 @@ static inline void sysfs_enable_ns(struct kernfs_node *kn)
+ {
+ }
+
++__printf(2, 3)
++static inline int sysfs_emit(char *buf, const char *fmt, ...)
++{
++ return 0;
++}
++
++__printf(3, 4)
++static inline int sysfs_emit_at(char *buf, int at, const char *fmt, ...)
++{
++ return 0;
++}
+ #endif /* CONFIG_SYSFS */
+
+ static inline int __must_check sysfs_create_file(struct kobject *kobj,
+diff --git a/include/linux/zsmalloc.h b/include/linux/zsmalloc.h
+index 4807ca4d52e03..2a430e713ce51 100644
+--- a/include/linux/zsmalloc.h
++++ b/include/linux/zsmalloc.h
+@@ -35,7 +35,7 @@ enum zs_mapmode {
+
+ struct zs_pool_stats {
+ /* How many pages were migrated (freed) */
+- unsigned long pages_compacted;
++ atomic_long_t pages_compacted;
+ };
+
+ struct zs_pool;
+diff --git a/kernel/sched/core.c b/kernel/sched/core.c
+index 7841e738e38f0..2ce61018e33b6 100644
+--- a/kernel/sched/core.c
++++ b/kernel/sched/core.c
+@@ -254,8 +254,9 @@ static enum hrtimer_restart hrtick(struct hrtimer *timer)
+ static void __hrtick_restart(struct rq *rq)
+ {
+ struct hrtimer *timer = &rq->hrtick_timer;
++ ktime_t time = rq->hrtick_time;
+
+- hrtimer_start_expires(timer, HRTIMER_MODE_ABS_PINNED_HARD);
++ hrtimer_start(timer, time, HRTIMER_MODE_ABS_PINNED_HARD);
+ }
+
+ /*
+@@ -280,7 +281,6 @@ static void __hrtick_start(void *arg)
+ void hrtick_start(struct rq *rq, u64 delay)
+ {
+ struct hrtimer *timer = &rq->hrtick_timer;
+- ktime_t time;
+ s64 delta;
+
+ /*
+@@ -288,9 +288,7 @@ void hrtick_start(struct rq *rq, u64 delay)
+ * doesn't make sense and can cause timer DoS.
+ */
+ delta = max_t(s64, delay, 10000LL);
+- time = ktime_add_ns(timer->base->get_time(), delta);
+-
+- hrtimer_set_expires(timer, time);
++ rq->hrtick_time = ktime_add_ns(timer->base->get_time(), delta);
+
+ if (rq == this_rq()) {
+ __hrtick_restart(rq);
+diff --git a/kernel/sched/sched.h b/kernel/sched/sched.h
+index e10fb9bf2988c..4e490e3db2f86 100644
+--- a/kernel/sched/sched.h
++++ b/kernel/sched/sched.h
+@@ -973,6 +973,7 @@ struct rq {
+ call_single_data_t hrtick_csd;
+ #endif
+ struct hrtimer hrtick_timer;
++ ktime_t hrtick_time;
+ #endif
+
+ #ifdef CONFIG_SCHEDSTATS
+diff --git a/mm/hugetlb.c b/mm/hugetlb.c
+index 2cd4c7f43dcd9..4033b6ce01c40 100644
+--- a/mm/hugetlb.c
++++ b/mm/hugetlb.c
+@@ -4902,21 +4902,23 @@ static bool vma_shareable(struct vm_area_struct *vma, unsigned long addr)
+ void adjust_range_if_pmd_sharing_possible(struct vm_area_struct *vma,
+ unsigned long *start, unsigned long *end)
+ {
+- unsigned long a_start, a_end;
++ unsigned long v_start = ALIGN(vma->vm_start, PUD_SIZE),
++ v_end = ALIGN_DOWN(vma->vm_end, PUD_SIZE);
+
+- if (!(vma->vm_flags & VM_MAYSHARE))
++ /*
++ * vma need span at least one aligned PUD size and the start,end range
++ * must at least partialy within it.
++ */
++ if (!(vma->vm_flags & VM_MAYSHARE) || !(v_end > v_start) ||
++ (*end <= v_start) || (*start >= v_end))
+ return;
+
+ /* Extend the range to be PUD aligned for a worst case scenario */
+- a_start = ALIGN_DOWN(*start, PUD_SIZE);
+- a_end = ALIGN(*end, PUD_SIZE);
++ if (*start > v_start)
++ *start = ALIGN_DOWN(*start, PUD_SIZE);
+
+- /*
+- * Intersect the range with the vma range, since pmd sharing won't be
+- * across vma after all
+- */
+- *start = max(vma->vm_start, a_start);
+- *end = min(vma->vm_end, a_end);
++ if (*end < v_end)
++ *end = ALIGN(*end, PUD_SIZE);
+ }
+
+ /*
+diff --git a/mm/page_io.c b/mm/page_io.c
+index 60a66a58b9bf9..bcf27d0572534 100644
+--- a/mm/page_io.c
++++ b/mm/page_io.c
+@@ -260,11 +260,6 @@ out:
+ return ret;
+ }
+
+-static sector_t swap_page_sector(struct page *page)
+-{
+- return (sector_t)__page_file_index(page) << (PAGE_SHIFT - 9);
+-}
+-
+ static inline void count_swpout_vm_event(struct page *page)
+ {
+ #ifdef CONFIG_TRANSPARENT_HUGEPAGE
+diff --git a/mm/swapfile.c b/mm/swapfile.c
+index 7947633d3cede..f6964212c6c8f 100644
+--- a/mm/swapfile.c
++++ b/mm/swapfile.c
+@@ -221,6 +221,19 @@ offset_to_swap_extent(struct swap_info_struct *sis, unsigned long offset)
+ BUG();
+ }
+
++sector_t swap_page_sector(struct page *page)
++{
++ struct swap_info_struct *sis = page_swap_info(page);
++ struct swap_extent *se;
++ sector_t sector;
++ pgoff_t offset;
++
++ offset = __page_file_index(page);
++ se = offset_to_swap_extent(sis, offset);
++ sector = se->start_block + (offset - se->start_page);
++ return sector << (PAGE_SHIFT - 9);
++}
++
+ /*
+ * swap allocation tell device that a cluster of swap can now be discarded,
+ * to allow the swap device to optimize its wear-levelling.
+diff --git a/mm/zsmalloc.c b/mm/zsmalloc.c
+index 8a72a3b3837b4..443b3b1c95818 100644
+--- a/mm/zsmalloc.c
++++ b/mm/zsmalloc.c
+@@ -2216,11 +2216,13 @@ static unsigned long zs_can_compact(struct size_class *class)
+ return obj_wasted * class->pages_per_zspage;
+ }
+
+-static void __zs_compact(struct zs_pool *pool, struct size_class *class)
++static unsigned long __zs_compact(struct zs_pool *pool,
++ struct size_class *class)
+ {
+ struct zs_compact_control cc;
+ struct zspage *src_zspage;
+ struct zspage *dst_zspage = NULL;
++ unsigned long pages_freed = 0;
+
+ spin_lock(&class->lock);
+ while ((src_zspage = isolate_zspage(class, true))) {
+@@ -2250,7 +2252,7 @@ static void __zs_compact(struct zs_pool *pool, struct size_class *class)
+ putback_zspage(class, dst_zspage);
+ if (putback_zspage(class, src_zspage) == ZS_EMPTY) {
+ free_zspage(pool, class, src_zspage);
+- pool->stats.pages_compacted += class->pages_per_zspage;
++ pages_freed += class->pages_per_zspage;
+ }
+ spin_unlock(&class->lock);
+ cond_resched();
+@@ -2261,12 +2263,15 @@ static void __zs_compact(struct zs_pool *pool, struct size_class *class)
+ putback_zspage(class, src_zspage);
+
+ spin_unlock(&class->lock);
++
++ return pages_freed;
+ }
+
+ unsigned long zs_compact(struct zs_pool *pool)
+ {
+ int i;
+ struct size_class *class;
++ unsigned long pages_freed = 0;
+
+ for (i = ZS_SIZE_CLASSES - 1; i >= 0; i--) {
+ class = pool->size_class[i];
+@@ -2274,10 +2279,11 @@ unsigned long zs_compact(struct zs_pool *pool)
+ continue;
+ if (class->index != i)
+ continue;
+- __zs_compact(pool, class);
++ pages_freed += __zs_compact(pool, class);
+ }
++ atomic_long_add(pages_freed, &pool->stats.pages_compacted);
+
+- return pool->stats.pages_compacted;
++ return pages_freed;
+ }
+ EXPORT_SYMBOL_GPL(zs_compact);
+
+@@ -2294,13 +2300,12 @@ static unsigned long zs_shrinker_scan(struct shrinker *shrinker,
+ struct zs_pool *pool = container_of(shrinker, struct zs_pool,
+ shrinker);
+
+- pages_freed = pool->stats.pages_compacted;
+ /*
+ * Compact classes and calculate compaction delta.
+ * Can run concurrently with a manually triggered
+ * (by user) compaction.
+ */
+- pages_freed = zs_compact(pool) - pages_freed;
++ pages_freed = zs_compact(pool);
+
+ return pages_freed ? pages_freed : SHRINK_STOP;
+ }
+diff --git a/net/bluetooth/amp.c b/net/bluetooth/amp.c
+index 9c711f0dfae35..be2d469d6369d 100644
+--- a/net/bluetooth/amp.c
++++ b/net/bluetooth/amp.c
+@@ -297,6 +297,9 @@ void amp_read_loc_assoc_final_data(struct hci_dev *hdev,
+ struct hci_request req;
+ int err;
+
++ if (!mgr)
++ return;
++
+ cp.phy_handle = hcon->handle;
+ cp.len_so_far = cpu_to_le16(0);
+ cp.max_len = cpu_to_le16(hdev->amp_assoc_size);
+diff --git a/net/bridge/br_sysfs_if.c b/net/bridge/br_sysfs_if.c
+index 7a59cdddd3ce3..5047e9c2333a2 100644
+--- a/net/bridge/br_sysfs_if.c
++++ b/net/bridge/br_sysfs_if.c
+@@ -55,9 +55,8 @@ static BRPORT_ATTR(_name, 0644, \
+ static int store_flag(struct net_bridge_port *p, unsigned long v,
+ unsigned long mask)
+ {
+- unsigned long flags;
+-
+- flags = p->flags;
++ unsigned long flags = p->flags;
++ int err;
+
+ if (v)
+ flags |= mask;
+@@ -65,6 +64,10 @@ static int store_flag(struct net_bridge_port *p, unsigned long v,
+ flags &= ~mask;
+
+ if (flags != p->flags) {
++ err = br_switchdev_set_port_flag(p, flags, mask);
++ if (err)
++ return err;
++
+ p->flags = flags;
+ br_port_flags_change(p, mask);
+ }
+diff --git a/net/core/dev.c b/net/core/dev.c
+index d90e8bd87df83..e732faade5dca 100644
+--- a/net/core/dev.c
++++ b/net/core/dev.c
+@@ -8144,6 +8144,48 @@ int dev_set_mac_address(struct net_device *dev, struct sockaddr *sa,
+ }
+ EXPORT_SYMBOL(dev_set_mac_address);
+
++static DECLARE_RWSEM(dev_addr_sem);
++
++int dev_set_mac_address_user(struct net_device *dev, struct sockaddr *sa,
++ struct netlink_ext_ack *extack)
++{
++ int ret;
++
++ down_write(&dev_addr_sem);
++ ret = dev_set_mac_address(dev, sa, extack);
++ up_write(&dev_addr_sem);
++ return ret;
++}
++EXPORT_SYMBOL(dev_set_mac_address_user);
++
++int dev_get_mac_address(struct sockaddr *sa, struct net *net, char *dev_name)
++{
++ size_t size = sizeof(sa->sa_data);
++ struct net_device *dev;
++ int ret = 0;
++
++ down_read(&dev_addr_sem);
++ rcu_read_lock();
++
++ dev = dev_get_by_name_rcu(net, dev_name);
++ if (!dev) {
++ ret = -ENODEV;
++ goto unlock;
++ }
++ if (!dev->addr_len)
++ memset(sa->sa_data, 0, size);
++ else
++ memcpy(sa->sa_data, dev->dev_addr,
++ min_t(size_t, size, dev->addr_len));
++ sa->sa_family = dev->type;
++
++unlock:
++ rcu_read_unlock();
++ up_read(&dev_addr_sem);
++ return ret;
++}
++EXPORT_SYMBOL(dev_get_mac_address);
++
+ /**
+ * dev_change_carrier - Change device carrier
+ * @dev: device
+diff --git a/net/core/dev_ioctl.c b/net/core/dev_ioctl.c
+index 5163d900bb4fb..69fb9219d51dd 100644
+--- a/net/core/dev_ioctl.c
++++ b/net/core/dev_ioctl.c
+@@ -122,17 +122,6 @@ static int dev_ifsioc_locked(struct net *net, struct ifreq *ifr, unsigned int cm
+ ifr->ifr_mtu = dev->mtu;
+ return 0;
+
+- case SIOCGIFHWADDR:
+- if (!dev->addr_len)
+- memset(ifr->ifr_hwaddr.sa_data, 0,
+- sizeof(ifr->ifr_hwaddr.sa_data));
+- else
+- memcpy(ifr->ifr_hwaddr.sa_data, dev->dev_addr,
+- min(sizeof(ifr->ifr_hwaddr.sa_data),
+- (size_t)dev->addr_len));
+- ifr->ifr_hwaddr.sa_family = dev->type;
+- return 0;
+-
+ case SIOCGIFSLAVE:
+ err = -EINVAL;
+ break;
+@@ -246,7 +235,7 @@ static int dev_ifsioc(struct net *net, struct ifreq *ifr, unsigned int cmd)
+ case SIOCSIFHWADDR:
+ if (dev->addr_len > sizeof(struct sockaddr))
+ return -EINVAL;
+- return dev_set_mac_address(dev, &ifr->ifr_hwaddr, NULL);
++ return dev_set_mac_address_user(dev, &ifr->ifr_hwaddr, NULL);
+
+ case SIOCSIFHWBROADCAST:
+ if (ifr->ifr_hwaddr.sa_family != dev->type)
+@@ -396,6 +385,12 @@ int dev_ioctl(struct net *net, unsigned int cmd, struct ifreq *ifr, bool *need_c
+ */
+
+ switch (cmd) {
++ case SIOCGIFHWADDR:
++ dev_load(net, ifr->ifr_name);
++ ret = dev_get_mac_address(&ifr->ifr_hwaddr, net, ifr->ifr_name);
++ if (colon)
++ *colon = ':';
++ return ret;
+ /*
+ * These ioctl calls:
+ * - can be done by all.
+@@ -405,7 +400,6 @@ int dev_ioctl(struct net *net, unsigned int cmd, struct ifreq *ifr, bool *need_c
+ case SIOCGIFFLAGS:
+ case SIOCGIFMETRIC:
+ case SIOCGIFMTU:
+- case SIOCGIFHWADDR:
+ case SIOCGIFSLAVE:
+ case SIOCGIFMAP:
+ case SIOCGIFINDEX:
+diff --git a/net/core/pktgen.c b/net/core/pktgen.c
+index cb3b565ff5adc..1d20dd70879bb 100644
+--- a/net/core/pktgen.c
++++ b/net/core/pktgen.c
+@@ -3465,7 +3465,7 @@ static int pktgen_thread_worker(void *arg)
+ struct pktgen_dev *pkt_dev = NULL;
+ int cpu = t->cpu;
+
+- BUG_ON(smp_processor_id() != cpu);
++ WARN_ON(smp_processor_id() != cpu);
+
+ init_waitqueue_head(&t->queue);
+ complete(&t->start_done);
+diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c
+index b0c06a0637765..73c09b5864d70 100644
+--- a/net/core/rtnetlink.c
++++ b/net/core/rtnetlink.c
+@@ -2471,7 +2471,7 @@ static int do_setlink(const struct sk_buff *skb,
+ sa->sa_family = dev->type;
+ memcpy(sa->sa_data, nla_data(tb[IFLA_ADDRESS]),
+ dev->addr_len);
+- err = dev_set_mac_address(dev, sa, extack);
++ err = dev_set_mac_address_user(dev, sa, extack);
+ kfree(sa);
+ if (err)
+ goto errout;
+diff --git a/net/core/skbuff.c b/net/core/skbuff.c
+index 45117fa299837..99d6f4d1297ca 100644
+--- a/net/core/skbuff.c
++++ b/net/core/skbuff.c
+@@ -3290,7 +3290,19 @@ EXPORT_SYMBOL(skb_split);
+ */
+ static int skb_prepare_for_shift(struct sk_buff *skb)
+ {
+- return skb_cloned(skb) && pskb_expand_head(skb, 0, 0, GFP_ATOMIC);
++ int ret = 0;
++
++ if (skb_cloned(skb)) {
++ /* Save and restore truesize: pskb_expand_head() may reallocate
++ * memory where ksize(kmalloc(S)) != ksize(kmalloc(S)), but we
++ * cannot change truesize at this point.
++ */
++ unsigned int save_truesize = skb->truesize;
++
++ ret = pskb_expand_head(skb, 0, 0, GFP_ATOMIC);
++ skb->truesize = save_truesize;
++ }
++ return ret;
+ }
+
+ /**
+diff --git a/net/iucv/af_iucv.c b/net/iucv/af_iucv.c
+index fdced0a7bd776..bbc1924d64e51 100644
+--- a/net/iucv/af_iucv.c
++++ b/net/iucv/af_iucv.c
+@@ -2176,7 +2176,6 @@ static int afiucv_hs_rcv(struct sk_buff *skb, struct net_device *dev,
+ char nullstring[8];
+
+ if (!pskb_may_pull(skb, sizeof(*trans_hdr))) {
+- WARN_ONCE(1, "AF_IUCV failed to receive skb, len=%u", skb->len);
+ kfree_skb(skb);
+ return NET_RX_SUCCESS;
+ }
+diff --git a/security/smack/smackfs.c b/security/smack/smackfs.c
+index 9c4308077574c..5e75ff2e1b14f 100644
+--- a/security/smack/smackfs.c
++++ b/security/smack/smackfs.c
+@@ -1163,7 +1163,7 @@ static ssize_t smk_write_net4addr(struct file *file, const char __user *buf,
+ return -EPERM;
+ if (*ppos != 0)
+ return -EINVAL;
+- if (count < SMK_NETLBLADDRMIN)
++ if (count < SMK_NETLBLADDRMIN || count > PAGE_SIZE - 1)
+ return -EINVAL;
+
+ data = memdup_user_nul(buf, count);
+@@ -1423,7 +1423,7 @@ static ssize_t smk_write_net6addr(struct file *file, const char __user *buf,
+ return -EPERM;
+ if (*ppos != 0)
+ return -EINVAL;
+- if (count < SMK_NETLBLADDRMIN)
++ if (count < SMK_NETLBLADDRMIN || count > PAGE_SIZE - 1)
+ return -EINVAL;
+
+ data = memdup_user_nul(buf, count);
+@@ -1830,6 +1830,10 @@ static ssize_t smk_write_ambient(struct file *file, const char __user *buf,
+ if (!smack_privileged(CAP_MAC_ADMIN))
+ return -EPERM;
+
++ /* Enough data must be present */
++ if (count == 0 || count > PAGE_SIZE)
++ return -EINVAL;
++
+ data = memdup_user_nul(buf, count);
+ if (IS_ERR(data))
+ return PTR_ERR(data);
+@@ -2001,6 +2005,9 @@ static ssize_t smk_write_onlycap(struct file *file, const char __user *buf,
+ if (!smack_privileged(CAP_MAC_ADMIN))
+ return -EPERM;
+
++ if (count > PAGE_SIZE)
++ return -EINVAL;
++
+ data = memdup_user_nul(buf, count);
+ if (IS_ERR(data))
+ return PTR_ERR(data);
+@@ -2088,6 +2095,9 @@ static ssize_t smk_write_unconfined(struct file *file, const char __user *buf,
+ if (!smack_privileged(CAP_MAC_ADMIN))
+ return -EPERM;
+
++ if (count > PAGE_SIZE)
++ return -EINVAL;
++
+ data = memdup_user_nul(buf, count);
+ if (IS_ERR(data))
+ return PTR_ERR(data);
+@@ -2643,6 +2653,10 @@ static ssize_t smk_write_syslog(struct file *file, const char __user *buf,
+ if (!smack_privileged(CAP_MAC_ADMIN))
+ return -EPERM;
+
++ /* Enough data must be present */
++ if (count == 0 || count > PAGE_SIZE)
++ return -EINVAL;
++
+ data = memdup_user_nul(buf, count);
+ if (IS_ERR(data))
+ return PTR_ERR(data);
+@@ -2735,10 +2749,13 @@ static ssize_t smk_write_relabel_self(struct file *file, const char __user *buf,
+ return -EPERM;
+
+ /*
++ * No partial write.
+ * Enough data must be present.
+ */
+ if (*ppos != 0)
+ return -EINVAL;
++ if (count == 0 || count > PAGE_SIZE)
++ return -EINVAL;
+
+ data = memdup_user_nul(buf, count);
+ if (IS_ERR(data))
+diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
+index a132fe4537a55..1283796316b62 100644
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -2522,6 +2522,7 @@ static const struct snd_pci_quirk alc882_fixup_tbl[] = {
+ SND_PCI_QUIRK(0x1462, 0x1276, "MSI-GL73", ALC1220_FIXUP_CLEVO_P950),
+ SND_PCI_QUIRK(0x1462, 0x1293, "MSI-GP65", ALC1220_FIXUP_CLEVO_P950),
+ SND_PCI_QUIRK(0x1462, 0x7350, "MSI-7350", ALC889_FIXUP_CD),
++ SND_PCI_QUIRK(0x1462, 0xcc34, "MSI Godlike X570", ALC1220_FIXUP_GB_DUAL_CODECS),
+ SND_PCI_QUIRK(0x1462, 0xda57, "MSI Z270-Gaming", ALC1220_FIXUP_GB_DUAL_CODECS),
+ SND_PCI_QUIRK_VENDOR(0x1462, "MSI", ALC882_FIXUP_GPIO3),
+ SND_PCI_QUIRK(0x147b, 0x107a, "Abit AW9D-MAX", ALC882_FIXUP_ABIT_AW9D_MAX),
+@@ -6320,6 +6321,7 @@ enum {
+ ALC269_FIXUP_LEMOTE_A1802,
+ ALC269_FIXUP_LEMOTE_A190X,
+ ALC256_FIXUP_INTEL_NUC8_RUGGED,
++ ALC256_FIXUP_INTEL_NUC10,
+ ALC255_FIXUP_XIAOMI_HEADSET_MIC,
+ ALC274_FIXUP_HP_MIC,
+ ALC274_FIXUP_HP_HEADSET_MIC,
+@@ -7697,6 +7699,15 @@ static const struct hda_fixup alc269_fixups[] = {
+ .chained = true,
+ .chain_id = ALC269_FIXUP_HEADSET_MODE
+ },
++ [ALC256_FIXUP_INTEL_NUC10] = {
++ .type = HDA_FIXUP_PINS,
++ .v.pins = (const struct hda_pintbl[]) {
++ { 0x19, 0x01a1913c }, /* use as headset mic, without its own jack detect */
++ { }
++ },
++ .chained = true,
++ .chain_id = ALC269_FIXUP_HEADSET_MODE
++ },
+ [ALC255_FIXUP_XIAOMI_HEADSET_MIC] = {
+ .type = HDA_FIXUP_VERBS,
+ .v.verbs = (const struct hda_verb[]) {
+@@ -8001,6 +8012,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = {
+ SND_PCI_QUIRK(0x1558, 0x8551, "System76 Gazelle (gaze14)", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE),
+ SND_PCI_QUIRK(0x1558, 0x8560, "System76 Gazelle (gaze14)", ALC269_FIXUP_HEADSET_MIC),
+ SND_PCI_QUIRK(0x1558, 0x8561, "System76 Gazelle (gaze14)", ALC269_FIXUP_HEADSET_MIC),
++ SND_PCI_QUIRK(0x1558, 0x8562, "Clevo NH[5|7][0-9]RZ[Q]", ALC269_FIXUP_DMIC),
+ SND_PCI_QUIRK(0x1558, 0x8668, "Clevo NP50B[BE]", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE),
+ SND_PCI_QUIRK(0x1558, 0x8680, "Clevo NJ50LU", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE),
+ SND_PCI_QUIRK(0x1558, 0x8686, "Clevo NH50[CZ]U", ALC293_FIXUP_SYSTEM76_MIC_NO_PRESENCE),
+@@ -8095,6 +8107,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = {
+ SND_PCI_QUIRK(0x1c06, 0x2013, "Lemote A1802", ALC269_FIXUP_LEMOTE_A1802),
+ SND_PCI_QUIRK(0x1c06, 0x2015, "Lemote A190X", ALC269_FIXUP_LEMOTE_A190X),
+ SND_PCI_QUIRK(0x8086, 0x2080, "Intel NUC 8 Rugged", ALC256_FIXUP_INTEL_NUC8_RUGGED),
++ SND_PCI_QUIRK(0x8086, 0x2081, "Intel NUC 10", ALC256_FIXUP_INTEL_NUC10),
+
+ #if 0
+ /* Below is a quirk table taken from the old code.
+diff --git a/sound/soc/intel/boards/bytcr_rt5640.c b/sound/soc/intel/boards/bytcr_rt5640.c
+index 6012367f6fe48..9ee610504bac9 100644
+--- a/sound/soc/intel/boards/bytcr_rt5640.c
++++ b/sound/soc/intel/boards/bytcr_rt5640.c
+@@ -400,6 +400,19 @@ static const struct dmi_system_id byt_rt5640_quirk_table[] = {
+ BYT_RT5640_SSP0_AIF1 |
+ BYT_RT5640_MCLK_EN),
+ },
++ { /* Acer One 10 S1002 */
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "Acer"),
++ DMI_MATCH(DMI_PRODUCT_NAME, "One S1002"),
++ },
++ .driver_data = (void *)(BYT_RT5640_IN1_MAP |
++ BYT_RT5640_JD_SRC_JD2_IN4N |
++ BYT_RT5640_OVCD_TH_2000UA |
++ BYT_RT5640_OVCD_SF_0P75 |
++ BYT_RT5640_DIFF_MIC |
++ BYT_RT5640_SSP0_AIF2 |
++ BYT_RT5640_MCLK_EN),
++ },
+ {
+ .matches = {
+ DMI_MATCH(DMI_SYS_VENDOR, "Acer"),
+@@ -513,6 +526,16 @@ static const struct dmi_system_id byt_rt5640_quirk_table[] = {
+ BYT_RT5640_MONO_SPEAKER |
+ BYT_RT5640_MCLK_EN),
+ },
++ { /* Estar Beauty HD MID 7316R */
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "Estar"),
++ DMI_MATCH(DMI_PRODUCT_NAME, "eSTAR BEAUTY HD Intel Quad core"),
++ },
++ .driver_data = (void *)(BYTCR_INPUT_DEFAULTS |
++ BYT_RT5640_MONO_SPEAKER |
++ BYT_RT5640_SSP0_AIF1 |
++ BYT_RT5640_MCLK_EN),
++ },
+ {
+ .matches = {
+ DMI_EXACT_MATCH(DMI_SYS_VENDOR, "Hewlett-Packard"),
+@@ -776,6 +799,20 @@ static const struct dmi_system_id byt_rt5640_quirk_table[] = {
+ BYT_RT5640_SSP0_AIF2 |
+ BYT_RT5640_MCLK_EN),
+ },
++ { /* Voyo Winpad A15 */
++ .matches = {
++ DMI_MATCH(DMI_BOARD_VENDOR, "AMI Corporation"),
++ DMI_MATCH(DMI_BOARD_NAME, "Aptio CRB"),
++ /* Above strings are too generic, also match on BIOS date */
++ DMI_MATCH(DMI_BIOS_DATE, "11/20/2014"),
++ },
++ .driver_data = (void *)(BYT_RT5640_IN1_MAP |
++ BYT_RT5640_JD_SRC_JD2_IN4N |
++ BYT_RT5640_OVCD_TH_2000UA |
++ BYT_RT5640_OVCD_SF_0P75 |
++ BYT_RT5640_DIFF_MIC |
++ BYT_RT5640_MCLK_EN),
++ },
+ { /* Catch-all for generic Insyde tablets, must be last */
+ .matches = {
+ DMI_MATCH(DMI_SYS_VENDOR, "Insyde"),
+diff --git a/sound/soc/intel/boards/bytcr_rt5651.c b/sound/soc/intel/boards/bytcr_rt5651.c
+index 4606f6f582d6f..921c09cdb4800 100644
+--- a/sound/soc/intel/boards/bytcr_rt5651.c
++++ b/sound/soc/intel/boards/bytcr_rt5651.c
+@@ -435,6 +435,19 @@ static const struct dmi_system_id byt_rt5651_quirk_table[] = {
+ BYT_RT5651_SSP0_AIF1 |
+ BYT_RT5651_MONO_SPEAKER),
+ },
++ {
++ /* Jumper EZpad 7 */
++ .callback = byt_rt5651_quirk_cb,
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "Jumper"),
++ DMI_MATCH(DMI_PRODUCT_NAME, "EZpad"),
++ /* Jumper12x.WJ2012.bsBKRCP05 with the version dropped */
++ DMI_MATCH(DMI_BIOS_VERSION, "Jumper12x.WJ2012.bsBKRCP"),
++ },
++ .driver_data = (void *)(BYT_RT5651_DEFAULT_QUIRKS |
++ BYT_RT5651_IN2_MAP |
++ BYT_RT5651_JD_NOT_INV),
++ },
+ {
+ /* KIANO SlimNote 14.2 */
+ .callback = byt_rt5651_quirk_cb,
+diff --git a/sound/soc/intel/common/soc-intel-quirks.h b/sound/soc/intel/common/soc-intel-quirks.h
+index 863a477d34051..645baf0ed3dd1 100644
+--- a/sound/soc/intel/common/soc-intel-quirks.h
++++ b/sound/soc/intel/common/soc-intel-quirks.h
+@@ -11,6 +11,7 @@
+
+ #if IS_ENABLED(CONFIG_X86)
+
++#include <linux/dmi.h>
+ #include <asm/cpu_device_id.h>
+ #include <asm/intel-family.h>
+ #include <asm/iosf_mbi.h>
+@@ -40,12 +41,36 @@ SOC_INTEL_IS_CPU(cml, INTEL_FAM6_KABYLAKE_L);
+
+ static inline bool soc_intel_is_byt_cr(struct platform_device *pdev)
+ {
++ /*
++ * List of systems which:
++ * 1. Use a non CR version of the Bay Trail SoC
++ * 2. Contain at least 6 interrupt resources so that the
++ * platform_get_resource(pdev, IORESOURCE_IRQ, 5) check below
++ * succeeds
++ * 3. Despite 1. and 2. still have their IPC IRQ at index 0 rather then 5
++ *
++ * This needs to be here so that it can be shared between the SST and
++ * SOF drivers. We rely on the compiler to optimize this out in files
++ * where soc_intel_is_byt_cr is not used.
++ */
++ static const struct dmi_system_id force_bytcr_table[] = {
++ { /* Lenovo Yoga Tablet 2 series */
++ .matches = {
++ DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
++ DMI_MATCH(DMI_PRODUCT_FAMILY, "YOGATablet2"),
++ },
++ },
++ {}
++ };
+ struct device *dev = &pdev->dev;
+ int status = 0;
+
+ if (!soc_intel_is_byt())
+ return false;
+
++ if (dmi_check_system(force_bytcr_table))
++ return true;
++
+ if (iosf_mbi_available()) {
+ u32 bios_status;
+