diff --git a/Documentation/arm/kernel_mode_neon.txt 
b/Documentation/arm/kernel_mode_neon.txt
index 525452726d31..b9e060c5b61e 100644
--- a/Documentation/arm/kernel_mode_neon.txt
+++ b/Documentation/arm/kernel_mode_neon.txt
@@ -6,7 +6,7 @@ TL;DR summary
 * Use only NEON instructions, or VFP instructions that don't rely on support
   code
 * Isolate your NEON code in a separate compilation unit, and compile it with
-  '-mfpu=neon -mfloat-abi=softfp'
+  '-march=armv7-a -mfpu=neon -mfloat-abi=softfp'
 * Put kernel_neon_begin() and kernel_neon_end() calls around the calls into 
your
   NEON code
 * Don't sleep in your NEON code, and be aware that it will be executed with
@@ -87,7 +87,7 @@ instructions appearing in unexpected places if no special 
care is taken.
 Therefore, the recommended and only supported way of using NEON/VFP in the
 kernel is by adhering to the following rules:
 * isolate the NEON code in a separate compilation unit and compile it with
-  '-mfpu=neon -mfloat-abi=softfp';
+  '-march=armv7-a -mfpu=neon -mfloat-abi=softfp';
 * issue the calls to kernel_neon_begin(), kernel_neon_end() as well as the 
calls
   into the unit containing the NEON code from a compilation unit which is *not*
   built with the GCC flag '-mfpu=neon' set.
diff --git a/Makefile b/Makefile
index 2f030baeb162..f44094d2b147 100644
--- a/Makefile
+++ b/Makefile
@@ -1,6 +1,6 @@
 VERSION = 4
 PATCHLEVEL = 9
-SUBLEVEL = 167
+SUBLEVEL = 168
 EXTRAVERSION =
 NAME = Roaring Lionus
 
diff --git a/arch/arm/boot/dts/lpc32xx.dtsi b/arch/arm/boot/dts/lpc32xx.dtsi
index b5841fab51c1..0d20aadc78bb 100644
--- a/arch/arm/boot/dts/lpc32xx.dtsi
+++ b/arch/arm/boot/dts/lpc32xx.dtsi
@@ -230,7 +230,7 @@
                                status = "disabled";
                        };
 
-                       i2s1: i2s@2009C000 {
+                       i2s1: i2s@2009c000 {
                                compatible = "nxp,lpc3220-i2s";
                                reg = <0x2009C000 0x1000>;
                        };
@@ -273,7 +273,7 @@
                                status = "disabled";
                        };
 
-                       i2c1: i2c@400A0000 {
+                       i2c1: i2c@400a0000 {
                                compatible = "nxp,pnx-i2c";
                                reg = <0x400A0000 0x100>;
                                interrupt-parent = <&sic1>;
@@ -284,7 +284,7 @@
                                clocks = <&clk LPC32XX_CLK_I2C1>;
                        };
 
-                       i2c2: i2c@400A8000 {
+                       i2c2: i2c@400a8000 {
                                compatible = "nxp,pnx-i2c";
                                reg = <0x400A8000 0x100>;
                                interrupt-parent = <&sic1>;
@@ -295,7 +295,7 @@
                                clocks = <&clk LPC32XX_CLK_I2C2>;
                        };
 
-                       mpwm: mpwm@400E8000 {
+                       mpwm: mpwm@400e8000 {
                                compatible = "nxp,lpc3220-motor-pwm";
                                reg = <0x400E8000 0x78>;
                                status = "disabled";
@@ -394,7 +394,7 @@
                                #gpio-cells = <3>; /* bank, pin, flags */
                        };
 
-                       timer4: timer@4002C000 {
+                       timer4: timer@4002c000 {
                                compatible = "nxp,lpc3220-timer";
                                reg = <0x4002C000 0x1000>;
                                interrupts = <3 IRQ_TYPE_LEVEL_LOW>;
@@ -412,7 +412,7 @@
                                status = "disabled";
                        };
 
-                       watchdog: watchdog@4003C000 {
+                       watchdog: watchdog@4003c000 {
                                compatible = "nxp,pnx4008-wdt";
                                reg = <0x4003C000 0x1000>;
                                clocks = <&clk LPC32XX_CLK_WDOG>;
@@ -451,7 +451,7 @@
                                status = "disabled";
                        };
 
-                       timer1: timer@4004C000 {
+                       timer1: timer@4004c000 {
                                compatible = "nxp,lpc3220-timer";
                                reg = <0x4004C000 0x1000>;
                                interrupts = <17 IRQ_TYPE_LEVEL_LOW>;
@@ -475,14 +475,14 @@
                                status = "disabled";
                        };
 
-                       pwm1: pwm@4005C000 {
+                       pwm1: pwm@4005c000 {
                                compatible = "nxp,lpc3220-pwm";
                                reg = <0x4005C000 0x4>;
                                clocks = <&clk LPC32XX_CLK_PWM1>;
                                status = "disabled";
                        };
 
-                       pwm2: pwm@4005C004 {
+                       pwm2: pwm@4005c004 {
                                compatible = "nxp,lpc3220-pwm";
                                reg = <0x4005C004 0x4>;
                                clocks = <&clk LPC32XX_CLK_PWM2>;
diff --git a/arch/arm/include/asm/barrier.h b/arch/arm/include/asm/barrier.h
index 513e03d138ea..8331cb0d3461 100644
--- a/arch/arm/include/asm/barrier.h
+++ b/arch/arm/include/asm/barrier.h
@@ -10,6 +10,8 @@
 #define sev()  __asm__ __volatile__ ("sev" : : : "memory")
 #define wfe()  __asm__ __volatile__ ("wfe" : : : "memory")
 #define wfi()  __asm__ __volatile__ ("wfi" : : : "memory")
+#else
+#define wfe()  do { } while (0)
 #endif
 
 #if __LINUX_ARM_ARCH__ >= 7
diff --git a/arch/arm/include/asm/processor.h b/arch/arm/include/asm/processor.h
index 8a1e8e995dae..08509183c7df 100644
--- a/arch/arm/include/asm/processor.h
+++ b/arch/arm/include/asm/processor.h
@@ -77,7 +77,11 @@ extern void release_thread(struct task_struct *);
 unsigned long get_wchan(struct task_struct *p);
 
 #if __LINUX_ARM_ARCH__ == 6 || defined(CONFIG_ARM_ERRATA_754327)
-#define cpu_relax()                    smp_mb()
+#define cpu_relax()                                            \
+       do {                                                    \
+               smp_mb();                                       \
+               __asm__ __volatile__("nop; nop; nop; nop; nop; nop; nop; nop; 
nop; nop;");      \
+       } while (0)
 #else
 #define cpu_relax()                    barrier()
 #endif
diff --git a/arch/arm/kernel/machine_kexec.c b/arch/arm/kernel/machine_kexec.c
index b18c1ea56bed..ef6b27fe1d2e 100644
--- a/arch/arm/kernel/machine_kexec.c
+++ b/arch/arm/kernel/machine_kexec.c
@@ -87,8 +87,11 @@ void machine_crash_nonpanic_core(void *unused)
 
        set_cpu_online(smp_processor_id(), false);
        atomic_dec(&waiting_for_crash_ipi);
-       while (1)
+
+       while (1) {
                cpu_relax();
+               wfe();
+       }
 }
 
 static void machine_kexec_mask_interrupts(void)
diff --git a/arch/arm/kernel/smp.c b/arch/arm/kernel/smp.c
index bc83ec7ed53f..7a5dc011c523 100644
--- a/arch/arm/kernel/smp.c
+++ b/arch/arm/kernel/smp.c
@@ -602,8 +602,10 @@ static void ipi_cpu_stop(unsigned int cpu)
        local_fiq_disable();
        local_irq_disable();
 
-       while (1)
+       while (1) {
                cpu_relax();
+               wfe();
+       }
 }
 
 static DEFINE_PER_CPU(struct completion *, cpu_completion);
diff --git a/arch/arm/kernel/unwind.c b/arch/arm/kernel/unwind.c
index 0bee233fef9a..314cfb232a63 100644
--- a/arch/arm/kernel/unwind.c
+++ b/arch/arm/kernel/unwind.c
@@ -93,7 +93,7 @@ extern const struct unwind_idx __start_unwind_idx[];
 static const struct unwind_idx *__origin_unwind_idx;
 extern const struct unwind_idx __stop_unwind_idx[];
 
-static DEFINE_SPINLOCK(unwind_lock);
+static DEFINE_RAW_SPINLOCK(unwind_lock);
 static LIST_HEAD(unwind_tables);
 
 /* Convert a prel31 symbol to an absolute address */
@@ -201,7 +201,7 @@ static const struct unwind_idx *unwind_find_idx(unsigned 
long addr)
                /* module unwind tables */
                struct unwind_table *table;
 
-               spin_lock_irqsave(&unwind_lock, flags);
+               raw_spin_lock_irqsave(&unwind_lock, flags);
                list_for_each_entry(table, &unwind_tables, list) {
                        if (addr >= table->begin_addr &&
                            addr < table->end_addr) {
@@ -213,7 +213,7 @@ static const struct unwind_idx *unwind_find_idx(unsigned 
long addr)
                                break;
                        }
                }
-               spin_unlock_irqrestore(&unwind_lock, flags);
+               raw_spin_unlock_irqrestore(&unwind_lock, flags);
        }
 
        pr_debug("%s: idx = %p\n", __func__, idx);
@@ -529,9 +529,9 @@ struct unwind_table *unwind_table_add(unsigned long start, 
unsigned long size,
        tab->begin_addr = text_addr;
        tab->end_addr = text_addr + text_size;
 
-       spin_lock_irqsave(&unwind_lock, flags);
+       raw_spin_lock_irqsave(&unwind_lock, flags);
        list_add_tail(&tab->list, &unwind_tables);
-       spin_unlock_irqrestore(&unwind_lock, flags);
+       raw_spin_unlock_irqrestore(&unwind_lock, flags);
 
        return tab;
 }
@@ -543,9 +543,9 @@ void unwind_table_del(struct unwind_table *tab)
        if (!tab)
                return;
 
-       spin_lock_irqsave(&unwind_lock, flags);
+       raw_spin_lock_irqsave(&unwind_lock, flags);
        list_del(&tab->list);
-       spin_unlock_irqrestore(&unwind_lock, flags);
+       raw_spin_unlock_irqrestore(&unwind_lock, flags);
 
        kfree(tab);
 }
diff --git a/arch/arm/lib/Makefile b/arch/arm/lib/Makefile
index 27f4d96258a2..b3ecffb76c3f 100644
--- a/arch/arm/lib/Makefile
+++ b/arch/arm/lib/Makefile
@@ -38,7 +38,7 @@ $(obj)/csumpartialcopy.o:     $(obj)/csumpartialcopygeneric.S
 $(obj)/csumpartialcopyuser.o:  $(obj)/csumpartialcopygeneric.S
 
 ifeq ($(CONFIG_KERNEL_MODE_NEON),y)
-  NEON_FLAGS                   := -mfloat-abi=softfp -mfpu=neon
+  NEON_FLAGS                   := -march=armv7-a -mfloat-abi=softfp -mfpu=neon
   CFLAGS_xor-neon.o            += $(NEON_FLAGS)
   obj-$(CONFIG_XOR_BLOCKS)     += xor-neon.o
 endif
diff --git a/arch/arm/lib/xor-neon.c b/arch/arm/lib/xor-neon.c
index 2c40aeab3eaa..c691b901092f 100644
--- a/arch/arm/lib/xor-neon.c
+++ b/arch/arm/lib/xor-neon.c
@@ -14,7 +14,7 @@
 MODULE_LICENSE("GPL");
 
 #ifndef __ARM_NEON__
-#error You should compile this file with '-mfloat-abi=softfp -mfpu=neon'
+#error You should compile this file with '-march=armv7-a -mfloat-abi=softfp 
-mfpu=neon'
 #endif
 
 /*
diff --git a/arch/arm/mach-omap2/prm_common.c b/arch/arm/mach-omap2/prm_common.c
index f1ca9479491b..9e14604b9642 100644
--- a/arch/arm/mach-omap2/prm_common.c
+++ b/arch/arm/mach-omap2/prm_common.c
@@ -533,8 +533,10 @@ void omap_prm_reset_system(void)
 
        prm_ll_data->reset_system();
 
-       while (1)
+       while (1) {
                cpu_relax();
+               wfe();
+       }
 }
 
 /**
diff --git a/arch/arm64/kernel/kgdb.c b/arch/arm64/kernel/kgdb.c
index e017a9493b92..72a660a74ff9 100644
--- a/arch/arm64/kernel/kgdb.c
+++ b/arch/arm64/kernel/kgdb.c
@@ -231,24 +231,33 @@ int kgdb_arch_handle_exception(int exception_vector, int 
signo,
 
 static int kgdb_brk_fn(struct pt_regs *regs, unsigned int esr)
 {
+       if (user_mode(regs))
+               return DBG_HOOK_ERROR;
+
        kgdb_handle_exception(1, SIGTRAP, 0, regs);
-       return 0;
+       return DBG_HOOK_HANDLED;
 }
 NOKPROBE_SYMBOL(kgdb_brk_fn)
 
 static int kgdb_compiled_brk_fn(struct pt_regs *regs, unsigned int esr)
 {
+       if (user_mode(regs))
+               return DBG_HOOK_ERROR;
+
        compiled_break = 1;
        kgdb_handle_exception(1, SIGTRAP, 0, regs);
 
-       return 0;
+       return DBG_HOOK_HANDLED;
 }
 NOKPROBE_SYMBOL(kgdb_compiled_brk_fn);
 
 static int kgdb_step_brk_fn(struct pt_regs *regs, unsigned int esr)
 {
+       if (user_mode(regs))
+               return DBG_HOOK_ERROR;
+
        kgdb_handle_exception(1, SIGTRAP, 0, regs);
-       return 0;
+       return DBG_HOOK_HANDLED;
 }
 NOKPROBE_SYMBOL(kgdb_step_brk_fn);
 
diff --git a/arch/arm64/kernel/probes/kprobes.c 
b/arch/arm64/kernel/probes/kprobes.c
index d2b1b624ddc3..17f647103ed7 100644
--- a/arch/arm64/kernel/probes/kprobes.c
+++ b/arch/arm64/kernel/probes/kprobes.c
@@ -450,6 +450,9 @@ kprobe_single_step_handler(struct pt_regs *regs, unsigned 
int esr)
        struct kprobe_ctlblk *kcb = get_kprobe_ctlblk();
        int retval;
 
+       if (user_mode(regs))
+               return DBG_HOOK_ERROR;
+
        /* return error if this is not our step */
        retval = kprobe_ss_hit(kcb, instruction_pointer(regs));
 
@@ -466,6 +469,9 @@ kprobe_single_step_handler(struct pt_regs *regs, unsigned 
int esr)
 int __kprobes
 kprobe_breakpoint_handler(struct pt_regs *regs, unsigned int esr)
 {
+       if (user_mode(regs))
+               return DBG_HOOK_ERROR;
+
        kprobe_handler(regs);
        return DBG_HOOK_HANDLED;
 }
diff --git a/arch/arm64/mm/fault.c b/arch/arm64/mm/fault.c
index ad49ae8f3967..051b32084776 100644
--- a/arch/arm64/mm/fault.c
+++ b/arch/arm64/mm/fault.c
@@ -673,11 +673,12 @@ void __init hook_debug_fault_code(int nr,
        debug_fault_info[nr].name       = name;
 }
 
-asmlinkage int __exception do_debug_exception(unsigned long addr,
+asmlinkage int __exception do_debug_exception(unsigned long addr_if_watchpoint,
                                              unsigned int esr,
                                              struct pt_regs *regs)
 {
        const struct fault_info *inf = debug_fault_info + DBG_ESR_EVT(esr);
+       unsigned long pc = instruction_pointer(regs);
        struct siginfo info;
        int rv;
 
@@ -688,19 +689,19 @@ asmlinkage int __exception do_debug_exception(unsigned 
long addr,
        if (interrupts_enabled(regs))
                trace_hardirqs_off();
 
-       if (user_mode(regs) && instruction_pointer(regs) > TASK_SIZE)
+       if (user_mode(regs) && pc > TASK_SIZE)
                arm64_apply_bp_hardening();
 
-       if (!inf->fn(addr, esr, regs)) {
+       if (!inf->fn(addr_if_watchpoint, esr, regs)) {
                rv = 1;
        } else {
                pr_alert("Unhandled debug exception: %s (0x%08x) at 0x%016lx\n",
-                        inf->name, esr, addr);
+                        inf->name, esr, pc);
 
                info.si_signo = inf->sig;
                info.si_errno = 0;
                info.si_code  = inf->code;
-               info.si_addr  = (void __user *)addr;
+               info.si_addr  = (void __user *)pc;
                arm64_notify_die("", regs, &info, 0);
                rv = 0;
        }
diff --git a/arch/h8300/Makefile b/arch/h8300/Makefile
index e1c02ca230cb..073bba6f9f60 100644
--- a/arch/h8300/Makefile
+++ b/arch/h8300/Makefile
@@ -23,7 +23,7 @@ KBUILD_AFLAGS += $(aflags-y)
 LDFLAGS += $(ldflags-y)
 
 ifeq ($(CROSS_COMPILE),)
-CROSS_COMPILE := h8300-unknown-linux-
+CROSS_COMPILE := $(call cc-cross-prefix, h8300-unknown-linux- h8300-linux-)
 endif
 
 core-y += arch/$(ARCH)/kernel/ arch/$(ARCH)/mm/
diff --git a/arch/powerpc/include/asm/topology.h 
b/arch/powerpc/include/asm/topology.h
index 8b3b46b7b0f2..229c91bcf616 100644
--- a/arch/powerpc/include/asm/topology.h
+++ b/arch/powerpc/include/asm/topology.h
@@ -90,6 +90,8 @@ static inline int prrn_is_enabled(void)
 #define topology_sibling_cpumask(cpu)  (per_cpu(cpu_sibling_map, cpu))
 #define topology_core_cpumask(cpu)     (per_cpu(cpu_core_map, cpu))
 #define topology_core_id(cpu)          (cpu_to_core_id(cpu))
+
+int dlpar_cpu_readd(int cpu);
 #endif
 #endif
 
diff --git a/arch/powerpc/mm/numa.c b/arch/powerpc/mm/numa.c
index 0ef83c274019..9cad2ed812ab 100644
--- a/arch/powerpc/mm/numa.c
+++ b/arch/powerpc/mm/numa.c
@@ -1540,13 +1540,6 @@ static void reset_topology_timer(void)
 
 #ifdef CONFIG_SMP
 
-static void stage_topology_update(int core_id)
-{
-       cpumask_or(&cpu_associativity_changes_mask,
-               &cpu_associativity_changes_mask, cpu_sibling_mask(core_id));
-       reset_topology_timer();
-}
-
 static int dt_update_callback(struct notifier_block *nb,
                                unsigned long action, void *data)
 {
@@ -1559,7 +1552,7 @@ static int dt_update_callback(struct notifier_block *nb,
                    !of_prop_cmp(update->prop->name, "ibm,associativity")) {
                        u32 core_id;
                        of_property_read_u32(update->dn, "reg", &core_id);
-                       stage_topology_update(core_id);
+                       rc = dlpar_cpu_readd(core_id);
                        rc = NOTIFY_OK;
                }
                break;
diff --git a/arch/powerpc/platforms/pseries/hotplug-cpu.c 
b/arch/powerpc/platforms/pseries/hotplug-cpu.c
index a1b63e00b2f7..7a2beedb9740 100644
--- a/arch/powerpc/platforms/pseries/hotplug-cpu.c
+++ b/arch/powerpc/platforms/pseries/hotplug-cpu.c
@@ -785,6 +785,25 @@ static int dlpar_cpu_add_by_count(u32 cpus_to_add)
        return rc;
 }
 
+int dlpar_cpu_readd(int cpu)
+{
+       struct device_node *dn;
+       struct device *dev;
+       u32 drc_index;
+       int rc;
+
+       dev = get_cpu_device(cpu);
+       dn = dev->of_node;
+
+       rc = of_property_read_u32(dn, "ibm,my-drc-index", &drc_index);
+
+       rc = dlpar_cpu_remove_by_index(drc_index);
+       if (!rc)
+               rc = dlpar_cpu_add(drc_index);
+
+       return rc;
+}
+
 int dlpar_cpu(struct pseries_hp_errorlog *hp_elog)
 {
        u32 count, drc_index;
diff --git a/arch/x86/boot/Makefile b/arch/x86/boot/Makefile
index 3b7156f46bc1..3b16935b22bc 100644
--- a/arch/x86/boot/Makefile
+++ b/arch/x86/boot/Makefile
@@ -100,7 +100,7 @@ $(obj)/zoffset.h: $(obj)/compressed/vmlinux FORCE
 AFLAGS_header.o += -I$(objtree)/$(obj)
 $(obj)/header.o: $(obj)/zoffset.h
 
-LDFLAGS_setup.elf      := -T
+LDFLAGS_setup.elf      := -m elf_i386 -T
 $(obj)/setup.elf: $(src)/setup.ld $(SETUP_OBJS) FORCE
        $(call if_changed,ld)
 
diff --git a/arch/x86/kernel/vmlinux.lds.S b/arch/x86/kernel/vmlinux.lds.S
index e783a5daaab2..55f04875293f 100644
--- a/arch/x86/kernel/vmlinux.lds.S
+++ b/arch/x86/kernel/vmlinux.lds.S
@@ -367,7 +367,7 @@ SECTIONS
  * Per-cpu symbols which need to be offset from __per_cpu_load
  * for the boot processor.
  */
-#define INIT_PER_CPU(x) init_per_cpu__##x = x + __per_cpu_load
+#define INIT_PER_CPU(x) init_per_cpu__##x = ABSOLUTE(x) + __per_cpu_load
 INIT_PER_CPU(gdt_page);
 INIT_PER_CPU(irq_stack_union);
 
diff --git a/arch/x86/realmode/rm/Makefile b/arch/x86/realmode/rm/Makefile
index 25012abc3409..ce5f431e6823 100644
--- a/arch/x86/realmode/rm/Makefile
+++ b/arch/x86/realmode/rm/Makefile
@@ -47,7 +47,7 @@ $(obj)/pasyms.h: $(REALMODE_OBJS) FORCE
 targets += realmode.lds
 $(obj)/realmode.lds: $(obj)/pasyms.h
 
-LDFLAGS_realmode.elf := --emit-relocs -T
+LDFLAGS_realmode.elf := -m elf_i386 --emit-relocs -T
 CPPFLAGS_realmode.lds += -P -C -I$(objtree)/$(obj)
 
 targets += realmode.elf
diff --git a/drivers/acpi/acpi_video.c b/drivers/acpi/acpi_video.c
index 667dc5c86fef..ea0573176894 100644
--- a/drivers/acpi/acpi_video.c
+++ b/drivers/acpi/acpi_video.c
@@ -2069,21 +2069,29 @@ static int __init intel_opregion_present(void)
        return opregion;
 }
 
+/* Check if the chassis-type indicates there is no builtin LCD panel */
 static bool dmi_is_desktop(void)
 {
        const char *chassis_type;
+       unsigned long type;
 
        chassis_type = dmi_get_system_info(DMI_CHASSIS_TYPE);
        if (!chassis_type)
                return false;
 
-       if (!strcmp(chassis_type, "3") || /*  3: Desktop */
-           !strcmp(chassis_type, "4") || /*  4: Low Profile Desktop */
-           !strcmp(chassis_type, "5") || /*  5: Pizza Box */
-           !strcmp(chassis_type, "6") || /*  6: Mini Tower */
-           !strcmp(chassis_type, "7") || /*  7: Tower */
-           !strcmp(chassis_type, "11"))  /* 11: Main Server Chassis */
+       if (kstrtoul(chassis_type, 10, &type) != 0)
+               return false;
+
+       switch (type) {
+       case 0x03: /* Desktop */
+       case 0x04: /* Low Profile Desktop */
+       case 0x05: /* Pizza Box */
+       case 0x06: /* Mini Tower */
+       case 0x07: /* Tower */
+       case 0x10: /* Lunch Box */
+       case 0x11: /* Main Server Chassis */
                return true;
+       }
 
        return false;
 }
diff --git a/drivers/cdrom/cdrom.c b/drivers/cdrom/cdrom.c
index ff4280800cd0..a46f188f679e 100644
--- a/drivers/cdrom/cdrom.c
+++ b/drivers/cdrom/cdrom.c
@@ -265,6 +265,7 @@
 /* #define ERRLOGMASK (CD_WARNING|CD_OPEN|CD_COUNT_TRACKS|CD_CLOSE) */
 /* #define ERRLOGMASK 
(CD_WARNING|CD_REG_UNREG|CD_DO_IOCTL|CD_OPEN|CD_CLOSE|CD_COUNT_TRACKS) */
 
+#include <linux/atomic.h>
 #include <linux/module.h>
 #include <linux/fs.h>
 #include <linux/major.h>
@@ -3683,9 +3684,9 @@ static struct ctl_table_header *cdrom_sysctl_header;
 
 static void cdrom_sysctl_register(void)
 {
-       static int initialized;
+       static atomic_t initialized = ATOMIC_INIT(0);
 
-       if (initialized == 1)
+       if (!atomic_add_unless(&initialized, 1, 1))
                return;
 
        cdrom_sysctl_header = register_sysctl_table(cdrom_root_table);
@@ -3696,8 +3697,6 @@ static void cdrom_sysctl_register(void)
        cdrom_sysctl_settings.debug = debug;
        cdrom_sysctl_settings.lock = lockdoor;
        cdrom_sysctl_settings.check = check_media_type;
-
-       initialized = 1;
 }
 
 static void cdrom_sysctl_unregister(void)
diff --git a/drivers/char/hpet.c b/drivers/char/hpet.c
index 50272fe81f26..818a8d40e5c9 100644
--- a/drivers/char/hpet.c
+++ b/drivers/char/hpet.c
@@ -376,7 +376,7 @@ static __init int hpet_mmap_enable(char *str)
        pr_info("HPET mmap %s\n", hpet_mmap_enabled ? "enabled" : "disabled");
        return 1;
 }
-__setup("hpet_mmap", hpet_mmap_enable);
+__setup("hpet_mmap=", hpet_mmap_enable);
 
 static int hpet_mmap(struct file *file, struct vm_area_struct *vma)
 {
diff --git a/drivers/char/hw_random/virtio-rng.c 
b/drivers/char/hw_random/virtio-rng.c
index 3fa2f8a009b3..1c5c4314c6b5 100644
--- a/drivers/char/hw_random/virtio-rng.c
+++ b/drivers/char/hw_random/virtio-rng.c
@@ -73,7 +73,7 @@ static int virtio_read(struct hwrng *rng, void *buf, size_t 
size, bool wait)
 
        if (!vi->busy) {
                vi->busy = true;
-               init_completion(&vi->have_data);
+               reinit_completion(&vi->have_data);
                register_buffer(vi, buf, size);
        }
 
diff --git a/drivers/crypto/amcc/crypto4xx_trng.c 
b/drivers/crypto/amcc/crypto4xx_trng.c
index 677ca17fd223..368c5599515e 100644
--- a/drivers/crypto/amcc/crypto4xx_trng.c
+++ b/drivers/crypto/amcc/crypto4xx_trng.c
@@ -80,8 +80,10 @@ void ppc4xx_trng_probe(struct crypto4xx_core_device 
*core_dev)
 
        /* Find the TRNG device node and map it */
        trng = of_find_matching_node(NULL, ppc4xx_trng_match);
-       if (!trng || !of_device_is_available(trng))
+       if (!trng || !of_device_is_available(trng)) {
+               of_node_put(trng);
                return;
+       }
 
        dev->trng_base = of_iomap(trng, 0);
        of_node_put(trng);
diff --git a/drivers/dma/imx-dma.c b/drivers/dma/imx-dma.c
index 1cfa1d9bc971..f8786f60cdc1 100644
--- a/drivers/dma/imx-dma.c
+++ b/drivers/dma/imx-dma.c
@@ -290,7 +290,7 @@ static inline int imxdma_sg_next(struct imxdma_desc *d)
        struct scatterlist *sg = d->sg;
        unsigned long now;
 
-       now = min(d->len, sg_dma_len(sg));
+       now = min_t(size_t, d->len, sg_dma_len(sg));
        if (d->len != IMX_DMA_LENGTH_LOOP)
                d->len -= now;
 
diff --git a/drivers/dma/qcom/hidma.c b/drivers/dma/qcom/hidma.c
index e244e10a94b5..5444f39bf939 100644
--- a/drivers/dma/qcom/hidma.c
+++ b/drivers/dma/qcom/hidma.c
@@ -131,24 +131,25 @@ static void hidma_process_completed(struct hidma_chan 
*mchan)
                desc = &mdesc->desc;
                last_cookie = desc->cookie;
 
+               llstat = hidma_ll_status(mdma->lldev, mdesc->tre_ch);
+
                spin_lock_irqsave(&mchan->lock, irqflags);
+               if (llstat == DMA_COMPLETE) {
+                       mchan->last_success = last_cookie;
+                       result.result = DMA_TRANS_NOERROR;
+               } else {
+                       result.result = DMA_TRANS_ABORTED;
+               }
+
                dma_cookie_complete(desc);
                spin_unlock_irqrestore(&mchan->lock, irqflags);
 
-               llstat = hidma_ll_status(mdma->lldev, mdesc->tre_ch);
                dmaengine_desc_get_callback(desc, &cb);
 
                dma_run_dependencies(desc);
 
                spin_lock_irqsave(&mchan->lock, irqflags);
                list_move(&mdesc->node, &mchan->free);
-
-               if (llstat == DMA_COMPLETE) {
-                       mchan->last_success = last_cookie;
-                       result.result = DMA_TRANS_NOERROR;
-               } else
-                       result.result = DMA_TRANS_ABORTED;
-
                spin_unlock_irqrestore(&mchan->lock, irqflags);
 
                dmaengine_desc_callback_invoke(&cb, &result);
diff --git a/drivers/dma/tegra20-apb-dma.c b/drivers/dma/tegra20-apb-dma.c
index 3722b9d8d9fe..22f7f0c68a48 100644
--- a/drivers/dma/tegra20-apb-dma.c
+++ b/drivers/dma/tegra20-apb-dma.c
@@ -635,7 +635,10 @@ static void handle_cont_sngl_cycle_dma_done(struct 
tegra_dma_channel *tdc,
 
        sgreq = list_first_entry(&tdc->pending_sg_req, typeof(*sgreq), node);
        dma_desc = sgreq->dma_desc;
-       dma_desc->bytes_transferred += sgreq->req_len;
+       /* if we dma for long enough the transfer count will wrap */
+       dma_desc->bytes_transferred =
+               (dma_desc->bytes_transferred + sgreq->req_len) %
+               dma_desc->bytes_requested;
 
        /* Callback need to be call */
        if (!dma_desc->cb_count)
diff --git a/drivers/firmware/efi/memattr.c b/drivers/firmware/efi/memattr.c
index 236004b9a50d..9faa09e7c31f 100644
--- a/drivers/firmware/efi/memattr.c
+++ b/drivers/firmware/efi/memattr.c
@@ -93,7 +93,7 @@ static bool entry_is_valid(const efi_memory_desc_t *in, 
efi_memory_desc_t *out)
 
                if (!(md->attribute & EFI_MEMORY_RUNTIME))
                        continue;
-               if (md->virt_addr == 0) {
+               if (md->virt_addr == 0 && md->phys_addr != 0) {
                        /* no virtual mapping has been installed by the stub */
                        break;
                }
diff --git a/drivers/gpio/gpio-omap.c b/drivers/gpio/gpio-omap.c
index 6f9c9ac6ee70..75f30a0c418a 100644
--- a/drivers/gpio/gpio-omap.c
+++ b/drivers/gpio/gpio-omap.c
@@ -837,14 +837,16 @@ static void omap_gpio_unmask_irq(struct irq_data *d)
        if (trigger)
                omap_set_gpio_triggering(bank, offset, trigger);
 
-       /* For level-triggered GPIOs, the clearing must be done after
-        * the HW source is cleared, thus after the handler has run */
-       if (bank->level_mask & BIT(offset)) {
-               omap_set_gpio_irqenable(bank, offset, 0);
+       omap_set_gpio_irqenable(bank, offset, 1);
+
+       /*
+        * For level-triggered GPIOs, clearing must be done after the source
+        * is cleared, thus after the handler has run. OMAP4 needs this done
+        * after enabing the interrupt to clear the wakeup status.
+        */
+       if (bank->level_mask & BIT(offset))
                omap_clear_gpio_irqstatus(bank, offset);
-       }
 
-       omap_set_gpio_irqenable(bank, offset, 1);
        raw_spin_unlock_irqrestore(&bank->lock, flags);
 }
 
diff --git a/drivers/gpu/drm/drm_dp_mst_topology.c 
b/drivers/gpu/drm/drm_dp_mst_topology.c
index b59441d109a5..4a959740058e 100644
--- a/drivers/gpu/drm/drm_dp_mst_topology.c
+++ b/drivers/gpu/drm/drm_dp_mst_topology.c
@@ -3069,6 +3069,7 @@ static int drm_dp_mst_i2c_xfer(struct i2c_adapter 
*adapter, struct i2c_msg *msgs
                msg.u.i2c_read.transactions[i].i2c_dev_id = msgs[i].addr;
                msg.u.i2c_read.transactions[i].num_bytes = msgs[i].len;
                msg.u.i2c_read.transactions[i].bytes = msgs[i].buf;
+               msg.u.i2c_read.transactions[i].no_stop_bit = !(msgs[i].flags & 
I2C_M_STOP);
        }
        msg.u.i2c_read.read_i2c_device_id = msgs[num - 1].addr;
        msg.u.i2c_read.num_bytes_read = msgs[num - 1].len;
diff --git a/drivers/gpu/drm/nouveau/dispnv04/tvnv17.c 
b/drivers/gpu/drm/nouveau/dispnv04/tvnv17.c
index 434d1e29f279..cd37d00e9723 100644
--- a/drivers/gpu/drm/nouveau/dispnv04/tvnv17.c
+++ b/drivers/gpu/drm/nouveau/dispnv04/tvnv17.c
@@ -750,7 +750,9 @@ static int nv17_tv_set_property(struct drm_encoder *encoder,
                /* Disable the crtc to ensure a full modeset is
                 * performed whenever it's turned on again. */
                if (crtc)
-                       drm_crtc_force_disable(crtc);
+                       drm_crtc_helper_set_mode(crtc, &crtc->mode,
+                                                crtc->x, crtc->y,
+                                                crtc->primary->fb);
        }
 
        return 0;
diff --git a/drivers/hid/intel-ish-hid/ipc/ipc.c 
b/drivers/hid/intel-ish-hid/ipc/ipc.c
index 0c9ac4d5d850..41d44536aa15 100644
--- a/drivers/hid/intel-ish-hid/ipc/ipc.c
+++ b/drivers/hid/intel-ish-hid/ipc/ipc.c
@@ -92,7 +92,10 @@ static bool check_generated_interrupt(struct ishtp_device 
*dev)
                        IPC_INT_FROM_ISH_TO_HOST_CHV_AB(pisr_val);
        } else {
                pisr_val = ish_reg_read(dev, IPC_REG_PISR_BXT);
-               interrupt_generated = IPC_INT_FROM_ISH_TO_HOST_BXT(pisr_val);
+               interrupt_generated = !!pisr_val;
+               /* only busy-clear bit is RW, others are RO */
+               if (pisr_val)
+                       ish_reg_write(dev, IPC_REG_PISR_BXT, pisr_val);
        }
 
        return interrupt_generated;
@@ -795,11 +798,11 @@ int ish_hw_start(struct ishtp_device *dev)
 {
        ish_set_host_rdy(dev);
 
+       set_host_ready(dev);
+
        /* After that we can enable ISH DMA operation and wakeup ISHFW */
        ish_wakeup(dev);
 
-       set_host_ready(dev);
-
        /* wait for FW-initiated reset flow */
        if (!dev->recvd_hw_ready)
                wait_event_interruptible_timeout(dev->wait_hw_ready,
diff --git a/drivers/hid/intel-ish-hid/ishtp/bus.c 
b/drivers/hid/intel-ish-hid/ishtp/bus.c
index 256521509d20..0de18c76f8d4 100644
--- a/drivers/hid/intel-ish-hid/ishtp/bus.c
+++ b/drivers/hid/intel-ish-hid/ishtp/bus.c
@@ -628,7 +628,8 @@ int ishtp_cl_device_bind(struct ishtp_cl *cl)
        spin_lock_irqsave(&cl->dev->device_list_lock, flags);
        list_for_each_entry(cl_device, &cl->dev->device_list,
                        device_link) {
-               if (cl_device->fw_client->client_id == cl->fw_client_id) {
+               if (cl_device->fw_client &&
+                   cl_device->fw_client->client_id == cl->fw_client_id) {
                        cl->device = cl_device;
                        rv = 0;
                        break;
@@ -688,6 +689,7 @@ void ishtp_bus_remove_all_clients(struct ishtp_device 
*ishtp_dev,
        spin_lock_irqsave(&ishtp_dev->device_list_lock, flags);
        list_for_each_entry_safe(cl_device, n, &ishtp_dev->device_list,
                                 device_link) {
+               cl_device->fw_client = NULL;
                if (warm_reset && cl_device->reference_count)
                        continue;
 
diff --git a/drivers/hwtracing/coresight/coresight-etm4x.c 
b/drivers/hwtracing/coresight/coresight-etm4x.c
index 4db8d6a4d0cb..da27f8edba50 100644
--- a/drivers/hwtracing/coresight/coresight-etm4x.c
+++ b/drivers/hwtracing/coresight/coresight-etm4x.c
@@ -61,7 +61,8 @@ static void etm4_os_unlock(struct etmv4_drvdata *drvdata)
 
 static bool etm4_arch_supported(u8 arch)
 {
-       switch (arch) {
+       /* Mask out the minor version number */
+       switch (arch & 0xf0) {
        case ETM_ARCH_V4:
                break;
        default:
diff --git a/drivers/i2c/i2c-core.c b/drivers/i2c/i2c-core.c
index 7484aac1e14d..80d82c6792d8 100644
--- a/drivers/i2c/i2c-core.c
+++ b/drivers/i2c/i2c-core.c
@@ -3250,16 +3250,16 @@ static s32 i2c_smbus_xfer_emulated(struct i2c_adapter 
*adapter, u16 addr,
                                   the underlying bus driver */
                break;
        case I2C_SMBUS_I2C_BLOCK_DATA:
+               if (data->block[0] > I2C_SMBUS_BLOCK_MAX) {
+                       dev_err(&adapter->dev, "Invalid block %s size %d\n",
+                               read_write == I2C_SMBUS_READ ? "read" : "write",
+                               data->block[0]);
+                       return -EINVAL;
+               }
                if (read_write == I2C_SMBUS_READ) {
                        msg[1].len = data->block[0];
                } else {
                        msg[0].len = data->block[0] + 1;
-                       if (msg[0].len > I2C_SMBUS_BLOCK_MAX + 1) {
-                               dev_err(&adapter->dev,
-                                       "Invalid block write size %d\n",
-                                       data->block[0]);
-                               return -EINVAL;
-                       }
                        for (i = 1; i <= data->block[0]; i++)
                                msgbuf0[i] = data->block[i];
                }
diff --git a/drivers/infiniband/hw/cxgb4/cm.c b/drivers/infiniband/hw/cxgb4/cm.c
index dd18b74cd01d..a2322b2dbd82 100644
--- a/drivers/infiniband/hw/cxgb4/cm.c
+++ b/drivers/infiniband/hw/cxgb4/cm.c
@@ -1872,8 +1872,10 @@ static int abort_rpl(struct c4iw_dev *dev, struct 
sk_buff *skb)
        }
        mutex_unlock(&ep->com.mutex);
 
-       if (release)
+       if (release) {
+               close_complete_upcall(ep, -ECONNRESET);
                release_ep_resources(ep);
+       }
        c4iw_put_ep(&ep->com);
        return 0;
 }
@@ -3567,7 +3569,6 @@ int c4iw_ep_disconnect(struct c4iw_ep *ep, int abrupt, 
gfp_t gfp)
        if (close) {
                if (abrupt) {
                        set_bit(EP_DISC_ABORT, &ep->com.history);
-                       close_complete_upcall(ep, -ECONNRESET);
                        ret = send_abort(ep);
                } else {
                        set_bit(EP_DISC_CLOSE, &ep->com.history);
diff --git a/drivers/infiniband/hw/mlx4/cm.c b/drivers/infiniband/hw/mlx4/cm.c
index 39a488889fc7..5dc920fe1326 100644
--- a/drivers/infiniband/hw/mlx4/cm.c
+++ b/drivers/infiniband/hw/mlx4/cm.c
@@ -39,7 +39,7 @@
 
 #include "mlx4_ib.h"
 
-#define CM_CLEANUP_CACHE_TIMEOUT  (5 * HZ)
+#define CM_CLEANUP_CACHE_TIMEOUT  (30 * HZ)
 
 struct id_map_entry {
        struct rb_node node;
diff --git a/drivers/iommu/io-pgtable-arm-v7s.c 
b/drivers/iommu/io-pgtable-arm-v7s.c
index d68a552cfe8d..3085b47fac1d 100644
--- a/drivers/iommu/io-pgtable-arm-v7s.c
+++ b/drivers/iommu/io-pgtable-arm-v7s.c
@@ -207,7 +207,8 @@ static void *__arm_v7s_alloc_table(int lvl, gfp_t gfp,
                if (dma != virt_to_phys(table))
                        goto out_unmap;
        }
-       kmemleak_ignore(table);
+       if (lvl == 2)
+               kmemleak_ignore(table);
        return table;
 
 out_unmap:
diff --git a/drivers/leds/leds-lp55xx-common.c 
b/drivers/leds/leds-lp55xx-common.c
index 5377f22ff994..e2655953667c 100644
--- a/drivers/leds/leds-lp55xx-common.c
+++ b/drivers/leds/leds-lp55xx-common.c
@@ -201,7 +201,7 @@ static void lp55xx_firmware_loaded(const struct firmware 
*fw, void *context)
 
        if (!fw) {
                dev_err(dev, "firmware request failed\n");
-               goto out;
+               return;
        }
 
        /* handling firmware data is chip dependent */
@@ -214,9 +214,9 @@ static void lp55xx_firmware_loaded(const struct firmware 
*fw, void *context)
 
        mutex_unlock(&chip->lock);
 
-out:
        /* firmware should be released for other channel use */
        release_firmware(chip->fw);
+       chip->fw = NULL;
 }
 
 static int lp55xx_request_firmware(struct lp55xx_chip *chip)
diff --git a/drivers/md/bcache/sysfs.c b/drivers/md/bcache/sysfs.c
index 5a5c1f1bd8a5..463ce6757338 100644
--- a/drivers/md/bcache/sysfs.c
+++ b/drivers/md/bcache/sysfs.c
@@ -215,7 +215,9 @@ STORE(__cached_dev)
        d_strtoul(writeback_rate_d_term);
        d_strtoul_nonzero(writeback_rate_p_term_inverse);
 
-       d_strtoi_h(sequential_cutoff);
+       sysfs_strtoul_clamp(sequential_cutoff,
+                           dc->sequential_cutoff,
+                           0, UINT_MAX);
        d_strtoi_h(readahead);
 
        if (attr == &sysfs_clear_stats)
@@ -645,8 +647,17 @@ STORE(__bch_cache_set)
                c->error_limit = strtoul_or_return(buf) << IO_ERROR_SHIFT;
 
        /* See count_io_errors() for why 88 */
-       if (attr == &sysfs_io_error_halflife)
-               c->error_decay = strtoul_or_return(buf) / 88;
+       if (attr == &sysfs_io_error_halflife) {
+               unsigned long v = 0;
+               ssize_t ret;
+
+               ret = strtoul_safe_clamp(buf, v, 0, UINT_MAX);
+               if (!ret) {
+                       c->error_decay = v / 88;
+                       return size;
+               }
+               return ret;
+       }
 
        sysfs_strtoul(journal_delay_ms,         c->journal_delay_ms);
        sysfs_strtoul(verify,                   c->verify);
diff --git a/drivers/md/bcache/sysfs.h b/drivers/md/bcache/sysfs.h
index 0526fe92a683..e7a3c12aa66f 100644
--- a/drivers/md/bcache/sysfs.h
+++ b/drivers/md/bcache/sysfs.h
@@ -80,9 +80,16 @@ do {                                                         
        \
 
 #define sysfs_strtoul_clamp(file, var, min, max)                       \
 do {                                                                   \
-       if (attr == &sysfs_ ## file)                                    \
-               return strtoul_safe_clamp(buf, var, min, max)           \
-                       ?: (ssize_t) size;                              \
+       if (attr == &sysfs_ ## file) {                                  \
+               unsigned long v = 0;                                    \
+               ssize_t ret;                                            \
+               ret = strtoul_safe_clamp(buf, v, min, max);             \
+               if (!ret) {                                             \
+                       var = v;                                        \
+                       return size;                                    \
+               }                                                       \
+               return ret;                                             \
+       }                                                               \
 } while (0)
 
 #define strtoul_or_return(cp)                                          \
diff --git a/drivers/md/dm-thin.c b/drivers/md/dm-thin.c
index 345f4d81ba07..23a7e108352a 100644
--- a/drivers/md/dm-thin.c
+++ b/drivers/md/dm-thin.c
@@ -3295,6 +3295,13 @@ static int pool_ctr(struct dm_target *ti, unsigned argc, 
char **argv)
        as.argc = argc;
        as.argv = argv;
 
+       /* make sure metadata and data are different devices */
+       if (!strcmp(argv[0], argv[1])) {
+               ti->error = "Error setting metadata or data device";
+               r = -EINVAL;
+               goto out_unlock;
+       }
+
        /*
         * Set default pool features.
         */
@@ -4177,6 +4184,12 @@ static int thin_ctr(struct dm_target *ti, unsigned argc, 
char **argv)
        tc->sort_bio_list = RB_ROOT;
 
        if (argc == 3) {
+               if (!strcmp(argv[0], argv[2])) {
+                       ti->error = "Error setting origin device";
+                       r = -EINVAL;
+                       goto bad_origin_dev;
+               }
+
                r = dm_get_device(ti, argv[2], FMODE_READ, &origin_dev);
                if (r) {
                        ti->error = "Error opening origin device";
diff --git a/drivers/media/i2c/mt9m111.c b/drivers/media/i2c/mt9m111.c
index 72e71b762827..a6145877bd00 100644
--- a/drivers/media/i2c/mt9m111.c
+++ b/drivers/media/i2c/mt9m111.c
@@ -974,6 +974,8 @@ static int mt9m111_probe(struct i2c_client *client,
        mt9m111->rect.top       = MT9M111_MIN_DARK_ROWS;
        mt9m111->rect.width     = MT9M111_MAX_WIDTH;
        mt9m111->rect.height    = MT9M111_MAX_HEIGHT;
+       mt9m111->width          = mt9m111->rect.width;
+       mt9m111->height         = mt9m111->rect.height;
        mt9m111->fmt            = &mt9m111_colour_fmts[0];
        mt9m111->lastpage       = -1;
        mutex_init(&mt9m111->power_lock);
diff --git a/drivers/media/platform/mx2_emmaprp.c 
b/drivers/media/platform/mx2_emmaprp.c
index e68d271b10af..8354ad20865a 100644
--- a/drivers/media/platform/mx2_emmaprp.c
+++ b/drivers/media/platform/mx2_emmaprp.c
@@ -288,7 +288,7 @@ static void emmaprp_device_run(void *priv)
 {
        struct emmaprp_ctx *ctx = priv;
        struct emmaprp_q_data *s_q_data, *d_q_data;
-       struct vb2_buffer *src_buf, *dst_buf;
+       struct vb2_v4l2_buffer *src_buf, *dst_buf;
        struct emmaprp_dev *pcdev = ctx->dev;
        unsigned int s_width, s_height;
        unsigned int d_width, d_height;
@@ -308,8 +308,8 @@ static void emmaprp_device_run(void *priv)
        d_height = d_q_data->height;
        d_size = d_width * d_height;
 
-       p_in = vb2_dma_contig_plane_dma_addr(src_buf, 0);
-       p_out = vb2_dma_contig_plane_dma_addr(dst_buf, 0);
+       p_in = vb2_dma_contig_plane_dma_addr(&src_buf->vb2_buf, 0);
+       p_out = vb2_dma_contig_plane_dma_addr(&dst_buf->vb2_buf, 0);
        if (!p_in || !p_out) {
                v4l2_err(&pcdev->v4l2_dev,
                         "Acquiring kernel pointers to buffers failed\n");
diff --git a/drivers/media/platform/s5p-g2d/g2d.c 
b/drivers/media/platform/s5p-g2d/g2d.c
index 62c0dec30b59..5f6ccf492111 100644
--- a/drivers/media/platform/s5p-g2d/g2d.c
+++ b/drivers/media/platform/s5p-g2d/g2d.c
@@ -498,7 +498,7 @@ static void device_run(void *prv)
 {
        struct g2d_ctx *ctx = prv;
        struct g2d_dev *dev = ctx->dev;
-       struct vb2_buffer *src, *dst;
+       struct vb2_v4l2_buffer *src, *dst;
        unsigned long flags;
        u32 cmd = 0;
 
@@ -513,10 +513,10 @@ static void device_run(void *prv)
        spin_lock_irqsave(&dev->ctrl_lock, flags);
 
        g2d_set_src_size(dev, &ctx->in);
-       g2d_set_src_addr(dev, vb2_dma_contig_plane_dma_addr(src, 0));
+       g2d_set_src_addr(dev, vb2_dma_contig_plane_dma_addr(&src->vb2_buf, 0));
 
        g2d_set_dst_size(dev, &ctx->out);
-       g2d_set_dst_addr(dev, vb2_dma_contig_plane_dma_addr(dst, 0));
+       g2d_set_dst_addr(dev, vb2_dma_contig_plane_dma_addr(&dst->vb2_buf, 0));
 
        g2d_set_rop4(dev, ctx->rop);
        g2d_set_flip(dev, ctx->flip);
diff --git a/drivers/media/platform/s5p-jpeg/jpeg-core.c 
b/drivers/media/platform/s5p-jpeg/jpeg-core.c
index 1da2c94e1dca..c89922fb42ce 100644
--- a/drivers/media/platform/s5p-jpeg/jpeg-core.c
+++ b/drivers/media/platform/s5p-jpeg/jpeg-core.c
@@ -789,14 +789,14 @@ static void skip(struct s5p_jpeg_buffer *buf, long len);
 static void exynos4_jpeg_parse_decode_h_tbl(struct s5p_jpeg_ctx *ctx)
 {
        struct s5p_jpeg *jpeg = ctx->jpeg;
-       struct vb2_buffer *vb = v4l2_m2m_next_src_buf(ctx->fh.m2m_ctx);
+       struct vb2_v4l2_buffer *vb = v4l2_m2m_next_src_buf(ctx->fh.m2m_ctx);
        struct s5p_jpeg_buffer jpeg_buffer;
        unsigned int word;
        int c, x, components;
 
        jpeg_buffer.size = 2; /* Ls */
        jpeg_buffer.data =
-               (unsigned long)vb2_plane_vaddr(vb, 0) + ctx->out_q.sos + 2;
+               (unsigned long)vb2_plane_vaddr(&vb->vb2_buf, 0) + 
ctx->out_q.sos + 2;
        jpeg_buffer.curr = 0;
 
        word = 0;
@@ -826,14 +826,14 @@ static void exynos4_jpeg_parse_decode_h_tbl(struct 
s5p_jpeg_ctx *ctx)
 static void exynos4_jpeg_parse_huff_tbl(struct s5p_jpeg_ctx *ctx)
 {
        struct s5p_jpeg *jpeg = ctx->jpeg;
-       struct vb2_buffer *vb = v4l2_m2m_next_src_buf(ctx->fh.m2m_ctx);
+       struct vb2_v4l2_buffer *vb = v4l2_m2m_next_src_buf(ctx->fh.m2m_ctx);
        struct s5p_jpeg_buffer jpeg_buffer;
        unsigned int word;
        int c, i, n, j;
 
        for (j = 0; j < ctx->out_q.dht.n; ++j) {
                jpeg_buffer.size = ctx->out_q.dht.len[j];
-               jpeg_buffer.data = (unsigned long)vb2_plane_vaddr(vb, 0) +
+               jpeg_buffer.data = (unsigned long)vb2_plane_vaddr(&vb->vb2_buf, 
0) +
                                   ctx->out_q.dht.marker[j];
                jpeg_buffer.curr = 0;
 
@@ -885,13 +885,13 @@ static void exynos4_jpeg_parse_huff_tbl(struct 
s5p_jpeg_ctx *ctx)
 static void exynos4_jpeg_parse_decode_q_tbl(struct s5p_jpeg_ctx *ctx)
 {
        struct s5p_jpeg *jpeg = ctx->jpeg;
-       struct vb2_buffer *vb = v4l2_m2m_next_src_buf(ctx->fh.m2m_ctx);
+       struct vb2_v4l2_buffer *vb = v4l2_m2m_next_src_buf(ctx->fh.m2m_ctx);
        struct s5p_jpeg_buffer jpeg_buffer;
        int c, x, components;
 
        jpeg_buffer.size = ctx->out_q.sof_len;
        jpeg_buffer.data =
-               (unsigned long)vb2_plane_vaddr(vb, 0) + ctx->out_q.sof;
+               (unsigned long)vb2_plane_vaddr(&vb->vb2_buf, 0) + 
ctx->out_q.sof;
        jpeg_buffer.curr = 0;
 
        skip(&jpeg_buffer, 5); /* P, Y, X */
@@ -916,14 +916,14 @@ static void exynos4_jpeg_parse_decode_q_tbl(struct 
s5p_jpeg_ctx *ctx)
 static void exynos4_jpeg_parse_q_tbl(struct s5p_jpeg_ctx *ctx)
 {
        struct s5p_jpeg *jpeg = ctx->jpeg;
-       struct vb2_buffer *vb = v4l2_m2m_next_src_buf(ctx->fh.m2m_ctx);
+       struct vb2_v4l2_buffer *vb = v4l2_m2m_next_src_buf(ctx->fh.m2m_ctx);
        struct s5p_jpeg_buffer jpeg_buffer;
        unsigned int word;
        int c, i, j;
 
        for (j = 0; j < ctx->out_q.dqt.n; ++j) {
                jpeg_buffer.size = ctx->out_q.dqt.len[j];
-               jpeg_buffer.data = (unsigned long)vb2_plane_vaddr(vb, 0) +
+               jpeg_buffer.data = (unsigned long)vb2_plane_vaddr(&vb->vb2_buf, 
0) +
                                   ctx->out_q.dqt.marker[j];
                jpeg_buffer.curr = 0;
 
@@ -1264,13 +1264,16 @@ static int s5p_jpeg_querycap(struct file *file, void 
*priv,
        return 0;
 }
 
-static int enum_fmt(struct s5p_jpeg_fmt *sjpeg_formats, int n,
+static int enum_fmt(struct s5p_jpeg_ctx *ctx,
+                   struct s5p_jpeg_fmt *sjpeg_formats, int n,
                    struct v4l2_fmtdesc *f, u32 type)
 {
        int i, num = 0;
+       unsigned int fmt_ver_flag = ctx->jpeg->variant->fmt_ver_flag;
 
        for (i = 0; i < n; ++i) {
-               if (sjpeg_formats[i].flags & type) {
+               if (sjpeg_formats[i].flags & type &&
+                   sjpeg_formats[i].flags & fmt_ver_flag) {
                        /* index-th format of type type found ? */
                        if (num == f->index)
                                break;
@@ -1297,11 +1300,11 @@ static int s5p_jpeg_enum_fmt_vid_cap(struct file *file, 
void *priv,
        struct s5p_jpeg_ctx *ctx = fh_to_ctx(priv);
 
        if (ctx->mode == S5P_JPEG_ENCODE)
-               return enum_fmt(sjpeg_formats, SJPEG_NUM_FORMATS, f,
+               return enum_fmt(ctx, sjpeg_formats, SJPEG_NUM_FORMATS, f,
                                SJPEG_FMT_FLAG_ENC_CAPTURE);
 
-       return enum_fmt(sjpeg_formats, SJPEG_NUM_FORMATS, f,
-                                       SJPEG_FMT_FLAG_DEC_CAPTURE);
+       return enum_fmt(ctx, sjpeg_formats, SJPEG_NUM_FORMATS, f,
+                       SJPEG_FMT_FLAG_DEC_CAPTURE);
 }
 
 static int s5p_jpeg_enum_fmt_vid_out(struct file *file, void *priv,
@@ -1310,11 +1313,11 @@ static int s5p_jpeg_enum_fmt_vid_out(struct file *file, 
void *priv,
        struct s5p_jpeg_ctx *ctx = fh_to_ctx(priv);
 
        if (ctx->mode == S5P_JPEG_ENCODE)
-               return enum_fmt(sjpeg_formats, SJPEG_NUM_FORMATS, f,
+               return enum_fmt(ctx, sjpeg_formats, SJPEG_NUM_FORMATS, f,
                                SJPEG_FMT_FLAG_ENC_OUTPUT);
 
-       return enum_fmt(sjpeg_formats, SJPEG_NUM_FORMATS, f,
-                                       SJPEG_FMT_FLAG_DEC_OUTPUT);
+       return enum_fmt(ctx, sjpeg_formats, SJPEG_NUM_FORMATS, f,
+                       SJPEG_FMT_FLAG_DEC_OUTPUT);
 }
 
 static struct s5p_jpeg_q_data *get_q_data(struct s5p_jpeg_ctx *ctx,
@@ -2027,15 +2030,15 @@ static void s5p_jpeg_device_run(void *priv)
 {
        struct s5p_jpeg_ctx *ctx = priv;
        struct s5p_jpeg *jpeg = ctx->jpeg;
-       struct vb2_buffer *src_buf, *dst_buf;
+       struct vb2_v4l2_buffer *src_buf, *dst_buf;
        unsigned long src_addr, dst_addr, flags;
 
        spin_lock_irqsave(&ctx->jpeg->slock, flags);
 
        src_buf = v4l2_m2m_next_src_buf(ctx->fh.m2m_ctx);
        dst_buf = v4l2_m2m_next_dst_buf(ctx->fh.m2m_ctx);
-       src_addr = vb2_dma_contig_plane_dma_addr(src_buf, 0);
-       dst_addr = vb2_dma_contig_plane_dma_addr(dst_buf, 0);
+       src_addr = vb2_dma_contig_plane_dma_addr(&src_buf->vb2_buf, 0);
+       dst_addr = vb2_dma_contig_plane_dma_addr(&dst_buf->vb2_buf, 0);
 
        s5p_jpeg_reset(jpeg->regs);
        s5p_jpeg_poweron(jpeg->regs);
@@ -2108,7 +2111,7 @@ static void exynos4_jpeg_set_img_addr(struct s5p_jpeg_ctx 
*ctx)
 {
        struct s5p_jpeg *jpeg = ctx->jpeg;
        struct s5p_jpeg_fmt *fmt;
-       struct vb2_buffer *vb;
+       struct vb2_v4l2_buffer *vb;
        struct s5p_jpeg_addr jpeg_addr = {};
        u32 pix_size, padding_bytes = 0;
 
@@ -2127,7 +2130,7 @@ static void exynos4_jpeg_set_img_addr(struct s5p_jpeg_ctx 
*ctx)
                vb = v4l2_m2m_next_dst_buf(ctx->fh.m2m_ctx);
        }
 
-       jpeg_addr.y = vb2_dma_contig_plane_dma_addr(vb, 0);
+       jpeg_addr.y = vb2_dma_contig_plane_dma_addr(&vb->vb2_buf, 0);
 
        if (fmt->colplanes == 2) {
                jpeg_addr.cb = jpeg_addr.y + pix_size - padding_bytes;
@@ -2145,7 +2148,7 @@ static void exynos4_jpeg_set_img_addr(struct s5p_jpeg_ctx 
*ctx)
 static void exynos4_jpeg_set_jpeg_addr(struct s5p_jpeg_ctx *ctx)
 {
        struct s5p_jpeg *jpeg = ctx->jpeg;
-       struct vb2_buffer *vb;
+       struct vb2_v4l2_buffer *vb;
        unsigned int jpeg_addr = 0;
 
        if (ctx->mode == S5P_JPEG_ENCODE)
@@ -2153,7 +2156,7 @@ static void exynos4_jpeg_set_jpeg_addr(struct 
s5p_jpeg_ctx *ctx)
        else
                vb = v4l2_m2m_next_src_buf(ctx->fh.m2m_ctx);
 
-       jpeg_addr = vb2_dma_contig_plane_dma_addr(vb, 0);
+       jpeg_addr = vb2_dma_contig_plane_dma_addr(&vb->vb2_buf, 0);
        if (jpeg->variant->version == SJPEG_EXYNOS5433 &&
            ctx->mode == S5P_JPEG_DECODE)
                jpeg_addr += ctx->out_q.sos;
@@ -2268,7 +2271,7 @@ static void exynos3250_jpeg_set_img_addr(struct 
s5p_jpeg_ctx *ctx)
 {
        struct s5p_jpeg *jpeg = ctx->jpeg;
        struct s5p_jpeg_fmt *fmt;
-       struct vb2_buffer *vb;
+       struct vb2_v4l2_buffer *vb;
        struct s5p_jpeg_addr jpeg_addr = {};
        u32 pix_size;
 
@@ -2282,7 +2285,7 @@ static void exynos3250_jpeg_set_img_addr(struct 
s5p_jpeg_ctx *ctx)
                fmt = ctx->cap_q.fmt;
        }
 
-       jpeg_addr.y = vb2_dma_contig_plane_dma_addr(vb, 0);
+       jpeg_addr.y = vb2_dma_contig_plane_dma_addr(&vb->vb2_buf, 0);
 
        if (fmt->colplanes == 2) {
                jpeg_addr.cb = jpeg_addr.y + pix_size;
@@ -2300,7 +2303,7 @@ static void exynos3250_jpeg_set_img_addr(struct 
s5p_jpeg_ctx *ctx)
 static void exynos3250_jpeg_set_jpeg_addr(struct s5p_jpeg_ctx *ctx)
 {
        struct s5p_jpeg *jpeg = ctx->jpeg;
-       struct vb2_buffer *vb;
+       struct vb2_v4l2_buffer *vb;
        unsigned int jpeg_addr = 0;
 
        if (ctx->mode == S5P_JPEG_ENCODE)
@@ -2308,7 +2311,7 @@ static void exynos3250_jpeg_set_jpeg_addr(struct 
s5p_jpeg_ctx *ctx)
        else
                vb = v4l2_m2m_next_src_buf(ctx->fh.m2m_ctx);
 
-       jpeg_addr = vb2_dma_contig_plane_dma_addr(vb, 0);
+       jpeg_addr = vb2_dma_contig_plane_dma_addr(&vb->vb2_buf, 0);
        exynos3250_jpeg_jpgadr(jpeg->regs, jpeg_addr);
 }
 
diff --git a/drivers/media/platform/sh_veu.c b/drivers/media/platform/sh_veu.c
index 15a562af13c7..a4f593220ef0 100644
--- a/drivers/media/platform/sh_veu.c
+++ b/drivers/media/platform/sh_veu.c
@@ -276,13 +276,13 @@ static void sh_veu_process(struct sh_veu_dev *veu,
 static void sh_veu_device_run(void *priv)
 {
        struct sh_veu_dev *veu = priv;
-       struct vb2_buffer *src_buf, *dst_buf;
+       struct vb2_v4l2_buffer *src_buf, *dst_buf;
 
        src_buf = v4l2_m2m_next_src_buf(veu->m2m_ctx);
        dst_buf = v4l2_m2m_next_dst_buf(veu->m2m_ctx);
 
        if (src_buf && dst_buf)
-               sh_veu_process(veu, src_buf, dst_buf);
+               sh_veu_process(veu, &src_buf->vb2_buf, &dst_buf->vb2_buf);
 }
 
                /* ========== video ioctls ========== */
diff --git a/drivers/mmc/host/omap.c b/drivers/mmc/host/omap.c
index a4bf14e21b5e..21dfce21aa63 100644
--- a/drivers/mmc/host/omap.c
+++ b/drivers/mmc/host/omap.c
@@ -920,7 +920,7 @@ static inline void set_cmd_timeout(struct mmc_omap_host 
*host, struct mmc_reques
        reg &= ~(1 << 5);
        OMAP_MMC_WRITE(host, SDIO, reg);
        /* Set maximum timeout */
-       OMAP_MMC_WRITE(host, CTO, 0xff);
+       OMAP_MMC_WRITE(host, CTO, 0xfd);
 }
 
 static inline void set_data_timeout(struct mmc_omap_host *host, struct 
mmc_request *req)
diff --git a/drivers/net/ethernet/cisco/enic/enic_main.c 
b/drivers/net/ethernet/cisco/enic/enic_main.c
index 89acf7bc4cf9..b73d9ba9496c 100644
--- a/drivers/net/ethernet/cisco/enic/enic_main.c
+++ b/drivers/net/ethernet/cisco/enic/enic_main.c
@@ -120,7 +120,7 @@ static void enic_init_affinity_hint(struct enic *enic)
 
        for (i = 0; i < enic->intr_count; i++) {
                if (enic_is_err_intr(enic, i) || enic_is_notify_intr(enic, i) ||
-                   (enic->msix[i].affinity_mask &&
+                   (cpumask_available(enic->msix[i].affinity_mask) &&
                     !cpumask_empty(enic->msix[i].affinity_mask)))
                        continue;
                if (zalloc_cpumask_var(&enic->msix[i].affinity_mask,
@@ -149,7 +149,7 @@ static void enic_set_affinity_hint(struct enic *enic)
        for (i = 0; i < enic->intr_count; i++) {
                if (enic_is_err_intr(enic, i)           ||
                    enic_is_notify_intr(enic, i)        ||
-                   !enic->msix[i].affinity_mask        ||
+                   !cpumask_available(enic->msix[i].affinity_mask) ||
                    cpumask_empty(enic->msix[i].affinity_mask))
                        continue;
                err = irq_set_affinity_hint(enic->msix_entry[i].vector,
@@ -162,7 +162,7 @@ static void enic_set_affinity_hint(struct enic *enic)
        for (i = 0; i < enic->wq_count; i++) {
                int wq_intr = enic_msix_wq_intr(enic, i);
 
-               if (enic->msix[wq_intr].affinity_mask &&
+               if (cpumask_available(enic->msix[wq_intr].affinity_mask) &&
                    !cpumask_empty(enic->msix[wq_intr].affinity_mask))
                        netif_set_xps_queue(enic->netdev,
                                            enic->msix[wq_intr].affinity_mask,
diff --git a/drivers/net/ethernet/intel/e1000e/netdev.c 
b/drivers/net/ethernet/intel/e1000e/netdev.c
index 6855b3380a83..8bbedfc9c48f 100644
--- a/drivers/net/ethernet/intel/e1000e/netdev.c
+++ b/drivers/net/ethernet/intel/e1000e/netdev.c
@@ -2121,7 +2121,7 @@ static int e1000_request_msix(struct e1000_adapter 
*adapter)
        if (strlen(netdev->name) < (IFNAMSIZ - 5))
                snprintf(adapter->rx_ring->name,
                         sizeof(adapter->rx_ring->name) - 1,
-                        "%s-rx-0", netdev->name);
+                        "%.14s-rx-0", netdev->name);
        else
                memcpy(adapter->rx_ring->name, netdev->name, IFNAMSIZ);
        err = request_irq(adapter->msix_entries[vector].vector,
@@ -2137,7 +2137,7 @@ static int e1000_request_msix(struct e1000_adapter 
*adapter)
        if (strlen(netdev->name) < (IFNAMSIZ - 5))
                snprintf(adapter->tx_ring->name,
                         sizeof(adapter->tx_ring->name) - 1,
-                        "%s-tx-0", netdev->name);
+                        "%.14s-tx-0", netdev->name);
        else
                memcpy(adapter->tx_ring->name, netdev->name, IFNAMSIZ);
        err = request_irq(adapter->msix_entries[vector].vector,
@@ -5291,8 +5291,13 @@ static void e1000_watchdog_task(struct work_struct *work)
                        /* 8000ES2LAN requires a Rx packet buffer work-around
                         * on link down event; reset the controller to flush
                         * the Rx packet buffer.
+                        *
+                        * If the link is lost the controller stops DMA, but
+                        * if there is queued Tx work it cannot be done.  So
+                        * reset the controller to flush the Tx packet buffers.
                         */
-                       if (adapter->flags & FLAG_RX_NEEDS_RESTART)
+                       if ((adapter->flags & FLAG_RX_NEEDS_RESTART) ||
+                           e1000_desc_unused(tx_ring) + 1 < tx_ring->count)
                                adapter->flags |= FLAG_RESTART_NOW;
                        else
                                pm_schedule_suspend(netdev->dev.parent,
@@ -5315,14 +5320,6 @@ static void e1000_watchdog_task(struct work_struct *work)
        adapter->gotc_old = adapter->stats.gotc;
        spin_unlock(&adapter->stats64_lock);
 
-       /* If the link is lost the controller stops DMA, but
-        * if there is queued Tx work it cannot be done.  So
-        * reset the controller to flush the Tx packet buffers.
-        */
-       if (!netif_carrier_ok(netdev) &&
-           (e1000_desc_unused(tx_ring) + 1 < tx_ring->count))
-               adapter->flags |= FLAG_RESTART_NOW;
-
        /* If reset is necessary, do it outside of interrupt context. */
        if (adapter->flags & FLAG_RESTART_NOW) {
                schedule_work(&adapter->reset_task);
diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum.c 
b/drivers/net/ethernet/mellanox/mlxsw/spectrum.c
index 22a5916e477e..cc847e0cac2d 100644
--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum.c
+++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum.c
@@ -1565,7 +1565,7 @@ static void mlxsw_sp_port_get_prio_strings(u8 **p, int 
prio)
        int i;
 
        for (i = 0; i < MLXSW_SP_PORT_HW_PRIO_STATS_LEN; i++) {
-               snprintf(*p, ETH_GSTRING_LEN, "%s_%d",
+               snprintf(*p, ETH_GSTRING_LEN, "%.29s_%.1d",
                         mlxsw_sp_port_hw_prio_stats[i].str, prio);
                *p += ETH_GSTRING_LEN;
        }
@@ -1576,7 +1576,7 @@ static void mlxsw_sp_port_get_tc_strings(u8 **p, int tc)
        int i;
 
        for (i = 0; i < MLXSW_SP_PORT_HW_TC_STATS_LEN; i++) {
-               snprintf(*p, ETH_GSTRING_LEN, "%s_%d",
+               snprintf(*p, ETH_GSTRING_LEN, "%.29s_%.1d",
                         mlxsw_sp_port_hw_tc_stats[i].str, tc);
                *p += ETH_GSTRING_LEN;
        }
diff --git a/drivers/net/wireless/ath/wil6210/cfg80211.c 
b/drivers/net/wireless/ath/wil6210/cfg80211.c
index d117240d9a73..b8eeaef17edc 100644
--- a/drivers/net/wireless/ath/wil6210/cfg80211.c
+++ b/drivers/net/wireless/ath/wil6210/cfg80211.c
@@ -1005,6 +1005,12 @@ static int _wil_cfg80211_merge_extra_ies(const u8 *ies1, 
u16 ies1_len,
        u8 *buf, *dpos;
        const u8 *spos;
 
+       if (!ies1)
+               ies1_len = 0;
+
+       if (!ies2)
+               ies2_len = 0;
+
        if (ies1_len == 0 && ies2_len == 0) {
                *merged_ies = NULL;
                *merged_len = 0;
@@ -1014,17 +1020,19 @@ static int _wil_cfg80211_merge_extra_ies(const u8 
*ies1, u16 ies1_len,
        buf = kmalloc(ies1_len + ies2_len, GFP_KERNEL);
        if (!buf)
                return -ENOMEM;
-       memcpy(buf, ies1, ies1_len);
+       if (ies1)
+               memcpy(buf, ies1, ies1_len);
        dpos = buf + ies1_len;
        spos = ies2;
-       while (spos + 1 < ies2 + ies2_len) {
+       while (spos && (spos + 1 < ies2 + ies2_len)) {
                /* IE tag at offset 0, length at offset 1 */
                u16 ielen = 2 + spos[1];
 
                if (spos + ielen > ies2 + ies2_len)
                        break;
                if (spos[0] == WLAN_EID_VENDOR_SPECIFIC &&
-                   !_wil_cfg80211_find_ie(ies1, ies1_len, spos, ielen)) {
+                   (!ies1 || !_wil_cfg80211_find_ie(ies1, ies1_len,
+                                                    spos, ielen))) {
                        memcpy(dpos, spos, ielen);
                        dpos += ielen;
                }
diff --git a/drivers/net/wireless/intel/iwlwifi/pcie/rx.c 
b/drivers/net/wireless/intel/iwlwifi/pcie/rx.c
index e58a50d31d96..c21f8bd32d08 100644
--- a/drivers/net/wireless/intel/iwlwifi/pcie/rx.c
+++ b/drivers/net/wireless/intel/iwlwifi/pcie/rx.c
@@ -475,7 +475,7 @@ static void iwl_pcie_rx_allocator(struct iwl_trans *trans)
        struct iwl_trans_pcie *trans_pcie = IWL_TRANS_GET_PCIE_TRANS(trans);
        struct iwl_rb_allocator *rba = &trans_pcie->rba;
        struct list_head local_empty;
-       int pending = atomic_xchg(&rba->req_pending, 0);
+       int pending = atomic_read(&rba->req_pending);
 
        IWL_DEBUG_RX(trans, "Pending allocation requests = %d\n", pending);
 
@@ -530,11 +530,13 @@ static void iwl_pcie_rx_allocator(struct iwl_trans *trans)
                        i++;
                }
 
+               atomic_dec(&rba->req_pending);
                pending--;
+
                if (!pending) {
-                       pending = atomic_xchg(&rba->req_pending, 0);
+                       pending = atomic_read(&rba->req_pending);
                        IWL_DEBUG_RX(trans,
-                                    "Pending allocation requests = %d\n",
+                                    "Got more pending allocation requests = 
%d\n",
                                     pending);
                }
 
@@ -546,12 +548,15 @@ static void iwl_pcie_rx_allocator(struct iwl_trans *trans)
                spin_unlock(&rba->lock);
 
                atomic_inc(&rba->req_ready);
+
        }
 
        spin_lock(&rba->lock);
        /* return unused rbds to the allocator empty list */
        list_splice_tail(&local_empty, &rba->rbd_empty);
        spin_unlock(&rba->lock);
+
+       IWL_DEBUG_RX(trans, "%s, exit.\n", __func__);
 }
 
 /*
diff --git a/drivers/net/wireless/mediatek/mt7601u/eeprom.h 
b/drivers/net/wireless/mediatek/mt7601u/eeprom.h
index 662d12703b69..57b503ae63f1 100644
--- a/drivers/net/wireless/mediatek/mt7601u/eeprom.h
+++ b/drivers/net/wireless/mediatek/mt7601u/eeprom.h
@@ -17,7 +17,7 @@
 
 struct mt7601u_dev;
 
-#define MT7601U_EE_MAX_VER                     0x0c
+#define MT7601U_EE_MAX_VER                     0x0d
 #define MT7601U_EEPROM_SIZE                    256
 
 #define MT7601U_DEFAULT_TX_POWER               6
diff --git a/drivers/net/wireless/ti/wlcore/main.c 
b/drivers/net/wireless/ti/wlcore/main.c
index 5438975c7ff2..17d32ce5d16b 100644
--- a/drivers/net/wireless/ti/wlcore/main.c
+++ b/drivers/net/wireless/ti/wlcore/main.c
@@ -1058,8 +1058,11 @@ static int wl12xx_chip_wakeup(struct wl1271 *wl, bool 
plt)
                goto out;
 
        ret = wl12xx_fetch_firmware(wl, plt);
-       if (ret < 0)
-               goto out;
+       if (ret < 0) {
+               kfree(wl->fw_status);
+               kfree(wl->raw_fw_status);
+               kfree(wl->tx_res_if);
+       }
 
 out:
        return ret;
diff --git a/drivers/regulator/act8865-regulator.c 
b/drivers/regulator/act8865-regulator.c
index 7652477e6a9d..39e8d60df060 100644
--- a/drivers/regulator/act8865-regulator.c
+++ b/drivers/regulator/act8865-regulator.c
@@ -131,7 +131,7 @@
  * ACT8865 voltage number
  */
 #define        ACT8865_VOLTAGE_NUM     64
-#define ACT8600_SUDCDC_VOLTAGE_NUM     255
+#define ACT8600_SUDCDC_VOLTAGE_NUM     256
 
 struct act8865 {
        struct regmap *regmap;
@@ -222,7 +222,8 @@ static const struct regulator_linear_range 
act8600_sudcdc_voltage_ranges[] = {
        REGULATOR_LINEAR_RANGE(3000000, 0, 63, 0),
        REGULATOR_LINEAR_RANGE(3000000, 64, 159, 100000),
        REGULATOR_LINEAR_RANGE(12600000, 160, 191, 200000),
-       REGULATOR_LINEAR_RANGE(19000000, 191, 255, 400000),
+       REGULATOR_LINEAR_RANGE(19000000, 192, 247, 400000),
+       REGULATOR_LINEAR_RANGE(41400000, 248, 255, 0),
 };
 
 static struct regulator_ops act8865_ops = {
diff --git a/drivers/scsi/hisi_sas/hisi_sas_main.c 
b/drivers/scsi/hisi_sas/hisi_sas_main.c
index 2f872f784e10..5252dd5d3f4b 100644
--- a/drivers/scsi/hisi_sas/hisi_sas_main.c
+++ b/drivers/scsi/hisi_sas/hisi_sas_main.c
@@ -10,6 +10,7 @@
  */
 
 #include "hisi_sas.h"
+#include "../libsas/sas_internal.h"
 #define DRV_NAME "hisi_sas"
 
 #define DEV_IS_GONE(dev) \
@@ -1128,9 +1129,18 @@ static void hisi_sas_port_deformed(struct asd_sas_phy 
*sas_phy)
 
 static void hisi_sas_phy_disconnected(struct hisi_sas_phy *phy)
 {
+       struct asd_sas_phy *sas_phy = &phy->sas_phy;
+       struct sas_phy *sphy = sas_phy->phy;
+       struct sas_phy_data *d = sphy->hostdata;
+
        phy->phy_attached = 0;
        phy->phy_type = 0;
        phy->port = NULL;
+
+       if (d->enable)
+               sphy->negotiated_linkrate = SAS_LINK_RATE_UNKNOWN;
+       else
+               sphy->negotiated_linkrate = SAS_PHY_DISABLED;
 }
 
 void hisi_sas_phy_down(struct hisi_hba *hisi_hba, int phy_no, int rdy)
diff --git a/drivers/scsi/megaraid/megaraid_sas_base.c 
b/drivers/scsi/megaraid/megaraid_sas_base.c
index 5de024a50e15..5b1c37e3913c 100644
--- a/drivers/scsi/megaraid/megaraid_sas_base.c
+++ b/drivers/scsi/megaraid/megaraid_sas_base.c
@@ -3956,6 +3956,7 @@ int megasas_alloc_cmds(struct megasas_instance *instance)
        if (megasas_create_frame_pool(instance)) {
                dev_printk(KERN_DEBUG, &instance->pdev->dev, "Error creating 
frame DMA pool\n");
                megasas_free_cmds(instance);
+               return -ENOMEM;
        }
 
        return 0;
diff --git a/drivers/scsi/scsi_scan.c b/drivers/scsi/scsi_scan.c
index 27a6d3c6cb7c..67f6f134abc4 100644
--- a/drivers/scsi/scsi_scan.c
+++ b/drivers/scsi/scsi_scan.c
@@ -219,7 +219,7 @@ static struct scsi_device *scsi_alloc_sdev(struct 
scsi_target *starget,
        struct Scsi_Host *shost = dev_to_shost(starget->dev.parent);
 
        sdev = kzalloc(sizeof(*sdev) + shost->transportt->device_size,
-                      GFP_ATOMIC);
+                      GFP_KERNEL);
        if (!sdev)
                goto out;
 
@@ -796,7 +796,7 @@ static int scsi_add_lun(struct scsi_device *sdev, unsigned 
char *inq_result,
         */
        sdev->inquiry = kmemdup(inq_result,
                                max_t(size_t, sdev->inquiry_len, 36),
-                               GFP_ATOMIC);
+                               GFP_KERNEL);
        if (sdev->inquiry == NULL)
                return SCSI_SCAN_NO_RESPONSE;
 
@@ -1095,7 +1095,7 @@ static int scsi_probe_and_add_lun(struct scsi_target 
*starget,
        if (!sdev)
                goto out;
 
-       result = kmalloc(result_len, GFP_ATOMIC |
+       result = kmalloc(result_len, GFP_KERNEL |
                        ((shost->unchecked_isa_dma) ? __GFP_DMA : 0));
        if (!result)
                goto out_free_sdev;
diff --git a/drivers/soc/qcom/qcom_gsbi.c b/drivers/soc/qcom/qcom_gsbi.c
index 09c669e70d63..038abc377fdb 100644
--- a/drivers/soc/qcom/qcom_gsbi.c
+++ b/drivers/soc/qcom/qcom_gsbi.c
@@ -138,7 +138,7 @@ static int gsbi_probe(struct platform_device *pdev)
        struct resource *res;
        void __iomem *base;
        struct gsbi_info *gsbi;
-       int i;
+       int i, ret;
        u32 mask, gsbi_num;
        const struct crci_config *config = NULL;
 
@@ -221,7 +221,10 @@ static int gsbi_probe(struct platform_device *pdev)
 
        platform_set_drvdata(pdev, gsbi);
 
-       return of_platform_populate(node, NULL, NULL, &pdev->dev);
+       ret = of_platform_populate(node, NULL, NULL, &pdev->dev);
+       if (ret)
+               clk_disable_unprepare(gsbi->hclk);
+       return ret;
 }
 
 static int gsbi_remove(struct platform_device *pdev)
diff --git a/drivers/soc/tegra/fuse/fuse-tegra.c 
b/drivers/soc/tegra/fuse/fuse-tegra.c
index de2c1bfe28b5..c4f5e5bbb8dc 100644
--- a/drivers/soc/tegra/fuse/fuse-tegra.c
+++ b/drivers/soc/tegra/fuse/fuse-tegra.c
@@ -131,13 +131,17 @@ static int tegra_fuse_probe(struct platform_device *pdev)
        /* take over the memory region from the early initialization */
        res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
        fuse->base = devm_ioremap_resource(&pdev->dev, res);
-       if (IS_ERR(fuse->base))
-               return PTR_ERR(fuse->base);
+       if (IS_ERR(fuse->base)) {
+               err = PTR_ERR(fuse->base);
+               fuse->base = base;
+               return err;
+       }
 
        fuse->clk = devm_clk_get(&pdev->dev, "fuse");
        if (IS_ERR(fuse->clk)) {
                dev_err(&pdev->dev, "failed to get FUSE clock: %ld",
                        PTR_ERR(fuse->clk));
+               fuse->base = base;
                return PTR_ERR(fuse->clk);
        }
 
@@ -146,8 +150,10 @@ static int tegra_fuse_probe(struct platform_device *pdev)
 
        if (fuse->soc->probe) {
                err = fuse->soc->probe(fuse);
-               if (err < 0)
+               if (err < 0) {
+                       fuse->base = base;
                        return err;
+               }
        }
 
        if (tegra_fuse_create_sysfs(&pdev->dev, fuse->soc->info->size,
diff --git a/drivers/tty/serial/atmel_serial.c 
b/drivers/tty/serial/atmel_serial.c
index d8e1945cb627..ef688aadb032 100644
--- a/drivers/tty/serial/atmel_serial.c
+++ b/drivers/tty/serial/atmel_serial.c
@@ -175,6 +175,8 @@ struct atmel_uart_port {
        unsigned int            pending_status;
        spinlock_t              lock_suspended;
 
+       bool                    hd_start_rx;    /* can start RX during 
half-duplex operation */
+
        int (*prepare_rx)(struct uart_port *port);
        int (*prepare_tx)(struct uart_port *port);
        void (*schedule_rx)(struct uart_port *port);
@@ -241,6 +243,12 @@ static inline void atmel_uart_write_char(struct uart_port 
*port, u8 value)
 
 #endif
 
+static inline int atmel_uart_is_half_duplex(struct uart_port *port)
+{
+       return (port->rs485.flags & SER_RS485_ENABLED) &&
+               !(port->rs485.flags & SER_RS485_RX_DURING_TX);
+}
+
 #ifdef CONFIG_SERIAL_ATMEL_PDC
 static bool atmel_use_pdc_rx(struct uart_port *port)
 {
@@ -492,9 +500,9 @@ static void atmel_stop_tx(struct uart_port *port)
        /* Disable interrupts */
        atmel_uart_writel(port, ATMEL_US_IDR, atmel_port->tx_done_mask);
 
-       if ((port->rs485.flags & SER_RS485_ENABLED) &&
-           !(port->rs485.flags & SER_RS485_RX_DURING_TX))
+       if (atmel_uart_is_half_duplex(port))
                atmel_start_rx(port);
+
 }
 
 /*
@@ -511,8 +519,7 @@ static void atmel_start_tx(struct uart_port *port)
                return;
 
        if (atmel_use_pdc_tx(port) || atmel_use_dma_tx(port))
-               if ((port->rs485.flags & SER_RS485_ENABLED) &&
-                   !(port->rs485.flags & SER_RS485_RX_DURING_TX))
+               if (atmel_uart_is_half_duplex(port))
                        atmel_stop_rx(port);
 
        if (atmel_use_pdc_tx(port))
@@ -809,10 +816,14 @@ static void atmel_complete_tx_dma(void *arg)
         */
        if (!uart_circ_empty(xmit))
                atmel_tasklet_schedule(atmel_port, &atmel_port->tasklet_tx);
-       else if ((port->rs485.flags & SER_RS485_ENABLED) &&
-                !(port->rs485.flags & SER_RS485_RX_DURING_TX)) {
-               /* DMA done, stop TX, start RX for RS485 */
-               atmel_start_rx(port);
+       else if (atmel_uart_is_half_duplex(port)) {
+               /*
+                * DMA done, re-enable TXEMPTY and signal that we can stop
+                * TX and start RX for RS485
+                */
+               atmel_port->hd_start_rx = true;
+               atmel_uart_writel(port, ATMEL_US_IER,
+                                 atmel_port->tx_done_mask);
        }
 
        spin_unlock_irqrestore(&port->lock, flags);
@@ -1257,9 +1268,20 @@ atmel_handle_transmit(struct uart_port *port, unsigned 
int pending)
        struct atmel_uart_port *atmel_port = to_atmel_uart_port(port);
 
        if (pending & atmel_port->tx_done_mask) {
-               /* Either PDC or interrupt transmission */
                atmel_uart_writel(port, ATMEL_US_IDR,
                                  atmel_port->tx_done_mask);
+
+               /* Start RX if flag was set and FIFO is empty */
+               if (atmel_port->hd_start_rx) {
+                       if (!(atmel_uart_readl(port, ATMEL_US_CSR)
+                                       & ATMEL_US_TXEMPTY))
+                               dev_warn(port->dev, "Should start RX, but TX 
fifo is not empty\n");
+
+                       atmel_port->hd_start_rx = false;
+                       atmel_start_rx(port);
+                       return;
+               }
+
                atmel_tasklet_schedule(atmel_port, &atmel_port->tasklet_tx);
        }
 }
@@ -1386,8 +1408,7 @@ static void atmel_tx_pdc(struct uart_port *port)
                atmel_uart_writel(port, ATMEL_US_IER,
                                  atmel_port->tx_done_mask);
        } else {
-               if ((port->rs485.flags & SER_RS485_ENABLED) &&
-                   !(port->rs485.flags & SER_RS485_RX_DURING_TX)) {
+               if (atmel_uart_is_half_duplex(port)) {
                        /* DMA done, stop TX, start RX for RS485 */
                        atmel_start_rx(port);
                }
diff --git a/drivers/tty/tty_buffer.c b/drivers/tty/tty_buffer.c
index 41b9a7ccce08..ca9c82ee6c35 100644
--- a/drivers/tty/tty_buffer.c
+++ b/drivers/tty/tty_buffer.c
@@ -25,7 +25,7 @@
  * Byte threshold to limit memory consumption for flip buffers.
  * The actual memory limit is > 2x this amount.
  */
-#define TTYB_DEFAULT_MEM_LIMIT 65536
+#define TTYB_DEFAULT_MEM_LIMIT (640 * 1024UL)
 
 /*
  * We default to dicing tty buffer allocations to this many characters
diff --git a/drivers/usb/chipidea/core.c b/drivers/usb/chipidea/core.c
index 64c6af2c8559..e96e3a5808b3 100644
--- a/drivers/usb/chipidea/core.c
+++ b/drivers/usb/chipidea/core.c
@@ -901,8 +901,15 @@ static int ci_hdrc_probe(struct platform_device *pdev)
        } else if (ci->platdata->usb_phy) {
                ci->usb_phy = ci->platdata->usb_phy;
        } else {
+               ci->usb_phy = devm_usb_get_phy_by_phandle(dev->parent, "phys",
+                                                         0);
                ci->phy = devm_phy_get(dev->parent, "usb-phy");
-               ci->usb_phy = devm_usb_get_phy(dev->parent, USB_PHY_TYPE_USB2);
+
+               /* Fallback to grabbing any registered USB2 PHY */
+               if (IS_ERR(ci->usb_phy) &&
+                   PTR_ERR(ci->usb_phy) != -EPROBE_DEFER)
+                       ci->usb_phy = devm_usb_get_phy(dev->parent,
+                                                      USB_PHY_TYPE_USB2);
 
                /* if both generic PHY and USB PHY layers aren't enabled */
                if (PTR_ERR(ci->phy) == -ENOSYS &&
diff --git a/drivers/usb/gadget/function/f_fs.c 
b/drivers/usb/gadget/function/f_fs.c
index 04eb64381d92..927ac0ee09b7 100644
--- a/drivers/usb/gadget/function/f_fs.c
+++ b/drivers/usb/gadget/function/f_fs.c
@@ -1008,6 +1008,7 @@ static ssize_t ffs_epfile_io(struct file *file, struct 
ffs_io_data *io_data)
                         * condition with req->complete callback.
                         */
                        usb_ep_dequeue(ep->ep, req);
+                       wait_for_completion(&done);
                        interrupted = ep->status < 0;
                }
 
diff --git a/drivers/video/fbdev/core/fbmem.c b/drivers/video/fbdev/core/fbmem.c
index a1d93151c059..c928190666ac 100644
--- a/drivers/video/fbdev/core/fbmem.c
+++ b/drivers/video/fbdev/core/fbmem.c
@@ -425,6 +425,9 @@ static void fb_do_show_logo(struct fb_info *info, struct 
fb_image *image,
 {
        unsigned int x;
 
+       if (image->width > info->var.xres || image->height > info->var.yres)
+               return;
+
        if (rotate == FB_ROTATE_UR) {
                for (x = 0;
                     x < num && image->dx + image->width <= info->var.xres;
diff --git a/fs/buffer.c b/fs/buffer.c
index e0d46d47e358..a89be9741d12 100644
--- a/fs/buffer.c
+++ b/fs/buffer.c
@@ -3041,6 +3041,13 @@ void guard_bio_eod(int op, struct bio *bio)
        /* Uhhuh. We've got a bio that straddles the device size! */
        truncated_bytes = bio->bi_iter.bi_size - (maxsector << 9);
 
+       /*
+        * The bio contains more than one segment which spans EOD, just return
+        * and let IO layer turn it into an EIO
+        */
+       if (truncated_bytes > bvec->bv_len)
+               return;
+
        /* Truncate the bio.. */
        bio->bi_iter.bi_size -= truncated_bytes;
        bvec->bv_len -= truncated_bytes;
diff --git a/fs/cifs/cifs_dfs_ref.c b/fs/cifs/cifs_dfs_ref.c
index 9156be545b0f..4660208132a2 100644
--- a/fs/cifs/cifs_dfs_ref.c
+++ b/fs/cifs/cifs_dfs_ref.c
@@ -271,9 +271,9 @@ static void dump_referral(const struct dfs_info3_param *ref)
 {
        cifs_dbg(FYI, "DFS: ref path: %s\n", ref->path_name);
        cifs_dbg(FYI, "DFS: node path: %s\n", ref->node_name);
-       cifs_dbg(FYI, "DFS: fl: %hd, srv_type: %hd\n",
+       cifs_dbg(FYI, "DFS: fl: %d, srv_type: %d\n",
                 ref->flags, ref->server_type);
-       cifs_dbg(FYI, "DFS: ref_flags: %hd, path_consumed: %hd\n",
+       cifs_dbg(FYI, "DFS: ref_flags: %d, path_consumed: %d\n",
                 ref->ref_flag, ref->path_consumed);
 }
 
diff --git a/fs/cifs/connect.c b/fs/cifs/connect.c
index 33e65b71c49a..f291ed0c155d 100644
--- a/fs/cifs/connect.c
+++ b/fs/cifs/connect.c
@@ -1201,6 +1201,11 @@ cifs_parse_devname(const char *devname, struct smb_vol 
*vol)
        const char *delims = "/\\";
        size_t len;
 
+       if (unlikely(!devname || !*devname)) {
+               cifs_dbg(VFS, "Device name not specified.\n");
+               return -EINVAL;
+       }
+
        /* make sure we have a valid UNC double delimiter prefix */
        len = strspn(devname, delims);
        if (len != 2)
diff --git a/fs/cifs/file.c b/fs/cifs/file.c
index 1c5099fffaec..7d295bf283ca 100644
--- a/fs/cifs/file.c
+++ b/fs/cifs/file.c
@@ -1627,8 +1627,20 @@ cifs_setlk(struct file *file, struct file_lock *flock, 
__u32 type,
                rc = server->ops->mand_unlock_range(cfile, flock, xid);
 
 out:
-       if (flock->fl_flags & FL_POSIX && !rc)
+       if (flock->fl_flags & FL_POSIX) {
+               /*
+                * If this is a request to remove all locks because we
+                * are closing the file, it doesn't matter if the
+                * unlocking failed as both cifs.ko and the SMB server
+                * remove the lock on file close
+                */
+               if (rc) {
+                       cifs_dbg(VFS, "%s failed rc=%d\n", __func__, rc);
+                       if (!(flock->fl_flags & FL_CLOSE))
+                               return rc;
+               }
                rc = locks_lock_file_wait(file, flock);
+       }
        return rc;
 }
 
diff --git a/fs/cifs/smb1ops.c b/fs/cifs/smb1ops.c
index efd72e1fae74..f7a9adab0b84 100644
--- a/fs/cifs/smb1ops.c
+++ b/fs/cifs/smb1ops.c
@@ -305,7 +305,7 @@ coalesce_t2(char *second_buf, struct smb_hdr *target_hdr)
        remaining = tgt_total_cnt - total_in_tgt;
 
        if (remaining < 0) {
-               cifs_dbg(FYI, "Server sent too much data. tgt_total_cnt=%hu 
total_in_tgt=%hu\n",
+               cifs_dbg(FYI, "Server sent too much data. tgt_total_cnt=%hu 
total_in_tgt=%u\n",
                         tgt_total_cnt, total_in_tgt);
                return -EPROTO;
        }
diff --git a/fs/ext4/indirect.c b/fs/ext4/indirect.c
index 14007e621d2a..d2844fe9040d 100644
--- a/fs/ext4/indirect.c
+++ b/fs/ext4/indirect.c
@@ -1217,6 +1217,7 @@ int ext4_ind_remove_space(handle_t *handle, struct inode 
*inode,
        ext4_lblk_t offsets[4], offsets2[4];
        Indirect chain[4], chain2[4];
        Indirect *partial, *partial2;
+       Indirect *p = NULL, *p2 = NULL;
        ext4_lblk_t max_block;
        __le32 nr = 0, nr2 = 0;
        int n = 0, n2 = 0;
@@ -1258,7 +1259,7 @@ int ext4_ind_remove_space(handle_t *handle, struct inode 
*inode,
                }
 
 
-               partial = ext4_find_shared(inode, n, offsets, chain, &nr);
+               partial = p = ext4_find_shared(inode, n, offsets, chain, &nr);
                if (nr) {
                        if (partial == chain) {
                                /* Shared branch grows from the inode */
@@ -1283,13 +1284,11 @@ int ext4_ind_remove_space(handle_t *handle, struct 
inode *inode,
                                partial->p + 1,
                                (__le32 *)partial->bh->b_data+addr_per_block,
                                (chain+n-1) - partial);
-                       BUFFER_TRACE(partial->bh, "call brelse");
-                       brelse(partial->bh);
                        partial--;
                }
 
 end_range:
-               partial2 = ext4_find_shared(inode, n2, offsets2, chain2, &nr2);
+               partial2 = p2 = ext4_find_shared(inode, n2, offsets2, chain2, 
&nr2);
                if (nr2) {
                        if (partial2 == chain2) {
                                /*
@@ -1319,16 +1318,14 @@ int ext4_ind_remove_space(handle_t *handle, struct 
inode *inode,
                                           (__le32 *)partial2->bh->b_data,
                                           partial2->p,
                                           (chain2+n2-1) - partial2);
-                       BUFFER_TRACE(partial2->bh, "call brelse");
-                       brelse(partial2->bh);
                        partial2--;
                }
                goto do_indirects;
        }
 
        /* Punch happened within the same level (n == n2) */
-       partial = ext4_find_shared(inode, n, offsets, chain, &nr);
-       partial2 = ext4_find_shared(inode, n2, offsets2, chain2, &nr2);
+       partial = p = ext4_find_shared(inode, n, offsets, chain, &nr);
+       partial2 = p2 = ext4_find_shared(inode, n2, offsets2, chain2, &nr2);
 
        /* Free top, but only if partial2 isn't its subtree. */
        if (nr) {
@@ -1385,15 +1382,7 @@ int ext4_ind_remove_space(handle_t *handle, struct inode 
*inode,
                                           partial->p + 1,
                                           partial2->p,
                                           (chain+n-1) - partial);
-                       while (partial > chain) {
-                               BUFFER_TRACE(partial->bh, "call brelse");
-                               brelse(partial->bh);
-                       }
-                       while (partial2 > chain2) {
-                               BUFFER_TRACE(partial2->bh, "call brelse");
-                               brelse(partial2->bh);
-                       }
-                       return 0;
+                       goto cleanup;
                }
 
                /*
@@ -1408,8 +1397,6 @@ int ext4_ind_remove_space(handle_t *handle, struct inode 
*inode,
                                           partial->p + 1,
                                           (__le32 
*)partial->bh->b_data+addr_per_block,
                                           (chain+n-1) - partial);
-                       BUFFER_TRACE(partial->bh, "call brelse");
-                       brelse(partial->bh);
                        partial--;
                }
                if (partial2 > chain2 && depth2 <= depth) {
@@ -1417,11 +1404,21 @@ int ext4_ind_remove_space(handle_t *handle, struct 
inode *inode,
                                           (__le32 *)partial2->bh->b_data,
                                           partial2->p,
                                           (chain2+n2-1) - partial2);
-                       BUFFER_TRACE(partial2->bh, "call brelse");
-                       brelse(partial2->bh);
                        partial2--;
                }
        }
+
+cleanup:
+       while (p && p > chain) {
+               BUFFER_TRACE(p->bh, "call brelse");
+               brelse(p->bh);
+               p--;
+       }
+       while (p2 && p2 > chain2) {
+               BUFFER_TRACE(p2->bh, "call brelse");
+               brelse(p2->bh);
+               p2--;
+       }
        return 0;
 
 do_indirects:
@@ -1429,7 +1426,7 @@ int ext4_ind_remove_space(handle_t *handle, struct inode 
*inode,
        switch (offsets[0]) {
        default:
                if (++n >= n2)
-                       return 0;
+                       break;
                nr = i_data[EXT4_IND_BLOCK];
                if (nr) {
                        ext4_free_branches(handle, inode, NULL, &nr, &nr+1, 1);
@@ -1437,7 +1434,7 @@ int ext4_ind_remove_space(handle_t *handle, struct inode 
*inode,
                }
        case EXT4_IND_BLOCK:
                if (++n >= n2)
-                       return 0;
+                       break;
                nr = i_data[EXT4_DIND_BLOCK];
                if (nr) {
                        ext4_free_branches(handle, inode, NULL, &nr, &nr+1, 2);
@@ -1445,7 +1442,7 @@ int ext4_ind_remove_space(handle_t *handle, struct inode 
*inode,
                }
        case EXT4_DIND_BLOCK:
                if (++n >= n2)
-                       return 0;
+                       break;
                nr = i_data[EXT4_TIND_BLOCK];
                if (nr) {
                        ext4_free_branches(handle, inode, NULL, &nr, &nr+1, 3);
@@ -1454,5 +1451,5 @@ int ext4_ind_remove_space(handle_t *handle, struct inode 
*inode,
        case EXT4_TIND_BLOCK:
                ;
        }
-       return 0;
+       goto cleanup;
 }
diff --git a/fs/f2fs/trace.c b/fs/f2fs/trace.c
index 73b4e1d1912a..501c283761d2 100644
--- a/fs/f2fs/trace.c
+++ b/fs/f2fs/trace.c
@@ -61,6 +61,7 @@ void f2fs_trace_pid(struct page *page)
 
        page->private = pid;
 
+retry:
        if (radix_tree_preload(GFP_NOFS))
                return;
 
@@ -71,7 +72,12 @@ void f2fs_trace_pid(struct page *page)
        if (p)
                radix_tree_delete(&pids, pid);
 
-       f2fs_radix_tree_insert(&pids, pid, current);
+       if (radix_tree_insert(&pids, pid, current)) {
+               spin_unlock(&pids_lock);
+               radix_tree_preload_end();
+               cond_resched();
+               goto retry;
+       }
 
        trace_printk("%3x:%3x %4x %-16s\n",
                        MAJOR(inode->i_sb->s_dev), MINOR(inode->i_sb->s_dev),
diff --git a/fs/file.c b/fs/file.c
index 69d6990e3021..09aac4d4729b 100644
--- a/fs/file.c
+++ b/fs/file.c
@@ -475,6 +475,7 @@ struct files_struct init_files = {
                .full_fds_bits  = init_files.full_fds_bits_init,
        },
        .file_lock      = __SPIN_LOCK_UNLOCKED(init_files.file_lock),
+       .resize_wait    = __WAIT_QUEUE_HEAD_INITIALIZER(init_files.resize_wait),
 };
 
 static unsigned int find_next_fd(struct fdtable *fdt, unsigned int start)
diff --git a/fs/jbd2/commit.c b/fs/jbd2/commit.c
index 31f8ca046639..10ec27676191 100644
--- a/fs/jbd2/commit.c
+++ b/fs/jbd2/commit.c
@@ -700,9 +700,11 @@ void jbd2_journal_commit_transaction(journal_t *journal)
                            the last tag we set up. */
 
                        tag->t_flags |= cpu_to_be16(JBD2_FLAG_LAST_TAG);
-
-                       jbd2_descriptor_block_csum_set(journal, descriptor);
 start_journal_io:
+                       if (descriptor)
+                               jbd2_descriptor_block_csum_set(journal,
+                                                       descriptor);
+
                        for (i = 0; i < bufs; i++) {
                                struct buffer_head *bh = wbuf[i];
                                /*
diff --git a/fs/ocfs2/cluster/nodemanager.c b/fs/ocfs2/cluster/nodemanager.c
index c204ac9b49e5..81a0d5d82757 100644
--- a/fs/ocfs2/cluster/nodemanager.c
+++ b/fs/ocfs2/cluster/nodemanager.c
@@ -621,13 +621,15 @@ static void o2nm_node_group_drop_item(struct config_group 
*group,
        struct o2nm_node *node = to_o2nm_node(item);
        struct o2nm_cluster *cluster = 
to_o2nm_cluster(group->cg_item.ci_parent);
 
-       o2net_disconnect_node(node);
+       if (cluster->cl_nodes[node->nd_num] == node) {
+               o2net_disconnect_node(node);
 
-       if (cluster->cl_has_local &&
-           (cluster->cl_local_node == node->nd_num)) {
-               cluster->cl_has_local = 0;
-               cluster->cl_local_node = O2NM_INVALID_NODE_NUM;
-               o2net_stop_listening(node);
+               if (cluster->cl_has_local &&
+                   (cluster->cl_local_node == node->nd_num)) {
+                       cluster->cl_has_local = 0;
+                       cluster->cl_local_node = O2NM_INVALID_NODE_NUM;
+                       o2net_stop_listening(node);
+               }
        }
 
        /* XXX call into net to stop this node from trading messages */
diff --git a/fs/read_write.c b/fs/read_write.c
index 9819f7c6c8c5..6ab67b860159 100644
--- a/fs/read_write.c
+++ b/fs/read_write.c
@@ -1204,6 +1204,9 @@ COMPAT_SYSCALL_DEFINE5(preadv64v2, unsigned long, fd,
                const struct compat_iovec __user *,vec,
                unsigned long, vlen, loff_t, pos, int, flags)
 {
+       if (pos == -1)
+               return do_compat_readv(fd, vec, vlen, flags);
+
        return do_compat_preadv64(fd, vec, vlen, pos, flags);
 }
 #endif
@@ -1310,6 +1313,9 @@ COMPAT_SYSCALL_DEFINE5(pwritev64v2, unsigned long, fd,
                const struct compat_iovec __user *,vec,
                unsigned long, vlen, loff_t, pos, int, flags)
 {
+       if (pos == -1)
+               return do_compat_writev(fd, vec, vlen, flags);
+
        return do_compat_pwritev64(fd, vec, vlen, pos, flags);
 }
 #endif
diff --git a/include/linux/irqdesc.h b/include/linux/irqdesc.h
index c9be57931b58..bb5547a83daf 100644
--- a/include/linux/irqdesc.h
+++ b/include/linux/irqdesc.h
@@ -61,6 +61,7 @@ struct irq_desc {
        unsigned int            core_internal_state__do_not_mess_with_it;
        unsigned int            depth;          /* nested irq disables */
        unsigned int            wake_depth;     /* nested wake enables */
+       unsigned int            tot_count;
        unsigned int            irq_count;      /* For detecting broken IRQs */
        unsigned long           last_unhandled; /* Aging timer for unhandled 
count */
        unsigned int            irqs_unhandled;
diff --git a/include/linux/relay.h b/include/linux/relay.h
index 68c1448e56bb..2560f8706408 100644
--- a/include/linux/relay.h
+++ b/include/linux/relay.h
@@ -65,7 +65,7 @@ struct rchan
        struct kref kref;               /* channel refcount */
        void *private_data;             /* for user-defined data */
        size_t last_toobig;             /* tried to log event > subbuf size */
-       struct rchan_buf ** __percpu buf; /* per-cpu channel buffers */
+       struct rchan_buf * __percpu *buf; /* per-cpu channel buffers */
        int is_global;                  /* One global buffer ? */
        struct list_head list;          /* for channel list */
        struct dentry *parent;          /* parent dentry passed to open */
diff --git a/include/linux/ring_buffer.h b/include/linux/ring_buffer.h
index 19d0778ec382..121c8f99ecdd 100644
--- a/include/linux/ring_buffer.h
+++ b/include/linux/ring_buffer.h
@@ -125,7 +125,7 @@ ring_buffer_consume(struct ring_buffer *buffer, int cpu, 
u64 *ts,
                    unsigned long *lost_events);
 
 struct ring_buffer_iter *
-ring_buffer_read_prepare(struct ring_buffer *buffer, int cpu);
+ring_buffer_read_prepare(struct ring_buffer *buffer, int cpu, gfp_t flags);
 void ring_buffer_read_prepare_sync(void);
 void ring_buffer_read_start(struct ring_buffer_iter *iter);
 void ring_buffer_read_finish(struct ring_buffer_iter *iter);
diff --git a/include/net/netfilter/br_netfilter.h 
b/include/net/netfilter/br_netfilter.h
index 0b0c35c37125..238d1b83a45a 100644
--- a/include/net/netfilter/br_netfilter.h
+++ b/include/net/netfilter/br_netfilter.h
@@ -48,7 +48,6 @@ static inline struct rtable *bridge_parent_rtable(const 
struct net_device *dev)
 }
 
 struct net_device *setup_pre_routing(struct sk_buff *skb);
-void br_netfilter_enable(void);
 
 #if IS_ENABLED(CONFIG_IPV6)
 int br_validate_ipv6(struct net *net, struct sk_buff *skb);
diff --git a/kernel/irq/chip.c b/kernel/irq/chip.c
index f30110e1b8c9..9e745cc0726d 100644
--- a/kernel/irq/chip.c
+++ b/kernel/irq/chip.c
@@ -729,7 +729,11 @@ void handle_percpu_irq(struct irq_desc *desc)
 {
        struct irq_chip *chip = irq_desc_get_chip(desc);
 
-       kstat_incr_irqs_this_cpu(desc);
+       /*
+        * PER CPU interrupts are not serialized. Do not touch
+        * desc->tot_count.
+        */
+       __kstat_incr_irqs_this_cpu(desc);
 
        if (chip->irq_ack)
                chip->irq_ack(&desc->irq_data);
@@ -758,7 +762,11 @@ void handle_percpu_devid_irq(struct irq_desc *desc)
        unsigned int irq = irq_desc_get_irq(desc);
        irqreturn_t res;
 
-       kstat_incr_irqs_this_cpu(desc);
+       /*
+        * PER CPU interrupts are not serialized. Do not touch
+        * desc->tot_count.
+        */
+       __kstat_incr_irqs_this_cpu(desc);
 
        if (chip->irq_ack)
                chip->irq_ack(&desc->irq_data);
diff --git a/kernel/irq/internals.h b/kernel/irq/internals.h
index bc226e783bd2..22e3f29a30d8 100644
--- a/kernel/irq/internals.h
+++ b/kernel/irq/internals.h
@@ -199,12 +199,18 @@ static inline bool irqd_has_set(struct irq_data *d, 
unsigned int mask)
 
 #undef __irqd_to_state
 
-static inline void kstat_incr_irqs_this_cpu(struct irq_desc *desc)
+static inline void __kstat_incr_irqs_this_cpu(struct irq_desc *desc)
 {
        __this_cpu_inc(*desc->kstat_irqs);
        __this_cpu_inc(kstat.irqs_sum);
 }
 
+static inline void kstat_incr_irqs_this_cpu(struct irq_desc *desc)
+{
+       __kstat_incr_irqs_this_cpu(desc);
+       desc->tot_count++;
+}
+
 static inline int irq_desc_get_node(struct irq_desc *desc)
 {
        return irq_common_data_get_node(&desc->irq_common_data);
diff --git a/kernel/irq/irqdesc.c b/kernel/irq/irqdesc.c
index 77977f55dff7..5e0ea17d01a6 100644
--- a/kernel/irq/irqdesc.c
+++ b/kernel/irq/irqdesc.c
@@ -109,6 +109,7 @@ static void desc_set_defaults(unsigned int irq, struct 
irq_desc *desc, int node,
        desc->depth = 1;
        desc->irq_count = 0;
        desc->irqs_unhandled = 0;
+       desc->tot_count = 0;
        desc->name = NULL;
        desc->owner = owner;
        for_each_possible_cpu(cpu)
@@ -880,11 +881,15 @@ unsigned int kstat_irqs_cpu(unsigned int irq, int cpu)
 unsigned int kstat_irqs(unsigned int irq)
 {
        struct irq_desc *desc = irq_to_desc(irq);
-       int cpu;
        unsigned int sum = 0;
+       int cpu;
 
        if (!desc || !desc->kstat_irqs)
                return 0;
+       if (!irq_settings_is_per_cpu_devid(desc) &&
+           !irq_settings_is_per_cpu(desc))
+           return desc->tot_count;
+
        for_each_possible_cpu(cpu)
                sum += *per_cpu_ptr(desc->kstat_irqs, cpu);
        return sum;
diff --git a/kernel/sysctl.c b/kernel/sysctl.c
index efd340a510a9..5515d578095b 100644
--- a/kernel/sysctl.c
+++ b/kernel/sysctl.c
@@ -125,6 +125,7 @@ static int __maybe_unused one = 1;
 static int __maybe_unused two = 2;
 static int __maybe_unused four = 4;
 static unsigned long one_ul = 1;
+static unsigned long long_max = LONG_MAX;
 static int one_hundred = 100;
 static int one_thousand = 1000;
 #ifdef CONFIG_PRINTK
@@ -1682,6 +1683,8 @@ static struct ctl_table fs_table[] = {
                .maxlen         = sizeof(files_stat.max_files),
                .mode           = 0644,
                .proc_handler   = proc_doulongvec_minmax,
+               .extra1         = &zero,
+               .extra2         = &long_max,
        },
        {
                .procname       = "nr_open",
diff --git a/kernel/trace/ring_buffer.c b/kernel/trace/ring_buffer.c
index f316e90ad538..5473dcaaca8d 100644
--- a/kernel/trace/ring_buffer.c
+++ b/kernel/trace/ring_buffer.c
@@ -4037,6 +4037,7 @@ EXPORT_SYMBOL_GPL(ring_buffer_consume);
  * ring_buffer_read_prepare - Prepare for a non consuming read of the buffer
  * @buffer: The ring buffer to read from
  * @cpu: The cpu buffer to iterate over
+ * @flags: gfp flags to use for memory allocation
  *
  * This performs the initial preparations necessary to iterate
  * through the buffer.  Memory is allocated, buffer recording
@@ -4054,7 +4055,7 @@ EXPORT_SYMBOL_GPL(ring_buffer_consume);
  * This overall must be paired with ring_buffer_read_finish.
  */
 struct ring_buffer_iter *
-ring_buffer_read_prepare(struct ring_buffer *buffer, int cpu)
+ring_buffer_read_prepare(struct ring_buffer *buffer, int cpu, gfp_t flags)
 {
        struct ring_buffer_per_cpu *cpu_buffer;
        struct ring_buffer_iter *iter;
@@ -4062,7 +4063,7 @@ ring_buffer_read_prepare(struct ring_buffer *buffer, int 
cpu)
        if (!cpumask_test_cpu(cpu, buffer->cpumask))
                return NULL;
 
-       iter = kmalloc(sizeof(*iter), GFP_KERNEL);
+       iter = kmalloc(sizeof(*iter), flags);
        if (!iter)
                return NULL;
 
diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c
index f18dedf9195e..d4773939c054 100644
--- a/kernel/trace/trace.c
+++ b/kernel/trace/trace.c
@@ -3449,7 +3449,8 @@ __tracing_open(struct inode *inode, struct file *file, 
bool snapshot)
        if (iter->cpu_file == RING_BUFFER_ALL_CPUS) {
                for_each_tracing_cpu(cpu) {
                        iter->buffer_iter[cpu] =
-                               
ring_buffer_read_prepare(iter->trace_buffer->buffer, cpu);
+                               
ring_buffer_read_prepare(iter->trace_buffer->buffer,
+                                                        cpu, GFP_KERNEL);
                }
                ring_buffer_read_prepare_sync();
                for_each_tracing_cpu(cpu) {
@@ -3459,7 +3460,8 @@ __tracing_open(struct inode *inode, struct file *file, 
bool snapshot)
        } else {
                cpu = iter->cpu_file;
                iter->buffer_iter[cpu] =
-                       ring_buffer_read_prepare(iter->trace_buffer->buffer, 
cpu);
+                       ring_buffer_read_prepare(iter->trace_buffer->buffer,
+                                                cpu, GFP_KERNEL);
                ring_buffer_read_prepare_sync();
                ring_buffer_read_start(iter->buffer_iter[cpu]);
                tracing_iter_reset(iter, cpu);
diff --git a/kernel/trace/trace_kdb.c b/kernel/trace/trace_kdb.c
index 57149bce6aad..896458285fdd 100644
--- a/kernel/trace/trace_kdb.c
+++ b/kernel/trace/trace_kdb.c
@@ -50,14 +50,16 @@ static void ftrace_dump_buf(int skip_lines, long cpu_file)
        if (cpu_file == RING_BUFFER_ALL_CPUS) {
                for_each_tracing_cpu(cpu) {
                        iter.buffer_iter[cpu] =
-                       ring_buffer_read_prepare(iter.trace_buffer->buffer, 
cpu);
+                       ring_buffer_read_prepare(iter.trace_buffer->buffer,
+                                                cpu, GFP_ATOMIC);
                        ring_buffer_read_start(iter.buffer_iter[cpu]);
                        tracing_iter_reset(&iter, cpu);
                }
        } else {
                iter.cpu_file = cpu_file;
                iter.buffer_iter[cpu_file] =
-                       ring_buffer_read_prepare(iter.trace_buffer->buffer, 
cpu_file);
+                       ring_buffer_read_prepare(iter.trace_buffer->buffer,
+                                                cpu_file, GFP_ATOMIC);
                ring_buffer_read_start(iter.buffer_iter[cpu_file]);
                tracing_iter_reset(&iter, cpu_file);
        }
diff --git a/lib/bsearch.c b/lib/bsearch.c
index e33c179089db..d50048446b77 100644
--- a/lib/bsearch.c
+++ b/lib/bsearch.c
@@ -11,6 +11,7 @@
 
 #include <linux/export.h>
 #include <linux/bsearch.h>
+#include <linux/kprobes.h>
 
 /*
  * bsearch - binary search an array of elements
@@ -51,3 +52,4 @@ void *bsearch(const void *key, const void *base, size_t num, 
size_t size,
        return NULL;
 }
 EXPORT_SYMBOL(bsearch);
+NOKPROBE_SYMBOL(bsearch);
diff --git a/lib/int_sqrt.c b/lib/int_sqrt.c
index 1afb545a37c5..6d35274170bc 100644
--- a/lib/int_sqrt.c
+++ b/lib/int_sqrt.c
@@ -7,6 +7,7 @@
 
 #include <linux/kernel.h>
 #include <linux/export.h>
+#include <linux/bitops.h>
 
 /**
  * int_sqrt - rough approximation to sqrt
@@ -21,10 +22,7 @@ unsigned long int_sqrt(unsigned long x)
        if (x <= 1)
                return x;
 
-       m = 1UL << (BITS_PER_LONG - 2);
-       while (m > x)
-               m >>= 2;
-
+       m = 1UL << (__fls(x) & ~1UL);
        while (m != 0) {
                b = y + m;
                y >>= 1;
diff --git a/lib/raid6/Makefile b/lib/raid6/Makefile
index 3057011f5599..10ca69475611 100644
--- a/lib/raid6/Makefile
+++ b/lib/raid6/Makefile
@@ -24,7 +24,7 @@ endif
 ifeq ($(CONFIG_KERNEL_MODE_NEON),y)
 NEON_FLAGS := -ffreestanding
 ifeq ($(ARCH),arm)
-NEON_FLAGS += -mfloat-abi=softfp -mfpu=neon
+NEON_FLAGS += -march=armv7-a -mfloat-abi=softfp -mfpu=neon
 endif
 ifeq ($(ARCH),arm64)
 CFLAGS_REMOVE_neon1.o += -mgeneral-regs-only
diff --git a/mm/cma.c b/mm/cma.c
index 397687fc51f9..b5d8847497a3 100644
--- a/mm/cma.c
+++ b/mm/cma.c
@@ -339,12 +339,14 @@ int __init cma_declare_contiguous(phys_addr_t base,
 
        ret = cma_init_reserved_mem(base, size, order_per_bit, res_cma);
        if (ret)
-               goto err;
+               goto free_mem;
 
        pr_info("Reserved %ld MiB at %pa\n", (unsigned long)size / SZ_1M,
                &base);
        return 0;
 
+free_mem:
+       memblock_free(base, size);
 err:
        pr_err("Failed to reserve %ld MiB\n", (unsigned long)size / SZ_1M);
        return ret;
diff --git a/mm/mempolicy.c b/mm/mempolicy.c
index 593b74bed59b..5cb5147235df 100644
--- a/mm/mempolicy.c
+++ b/mm/mempolicy.c
@@ -547,11 +547,16 @@ static int queue_pages_pte_range(pmd_t *pmd, unsigned 
long addr,
                        goto retry;
                }
 
-               migrate_page_add(page, qp->pagelist, flags);
+               if (flags & (MPOL_MF_MOVE | MPOL_MF_MOVE_ALL)) {
+                       if (!vma_migratable(vma))
+                               break;
+                       migrate_page_add(page, qp->pagelist, flags);
+               } else
+                       break;
        }
        pte_unmap_unlock(pte - 1, ptl);
        cond_resched();
-       return 0;
+       return addr != end ? -EIO : 0;
 }
 
 static int queue_pages_hugetlb(pte_t *pte, unsigned long hmask,
@@ -623,7 +628,12 @@ static int queue_pages_test_walk(unsigned long start, 
unsigned long end,
        unsigned long endvma = vma->vm_end;
        unsigned long flags = qp->flags;
 
-       if (!vma_migratable(vma))
+       /*
+        * Need check MPOL_MF_STRICT to return -EIO if possible
+        * regardless of vma_migratable
+        */
+       if (!vma_migratable(vma) &&
+           !(flags & MPOL_MF_STRICT))
                return 1;
 
        if (endvma > end)
@@ -650,7 +660,7 @@ static int queue_pages_test_walk(unsigned long start, 
unsigned long end,
        }
 
        /* queue pages from current vma */
-       if (flags & (MPOL_MF_MOVE | MPOL_MF_MOVE_ALL))
+       if (flags & MPOL_MF_VALID)
                return 0;
        return 1;
 }
diff --git a/mm/page_ext.c b/mm/page_ext.c
index 121dcffc4ec1..a7be1c7a79f6 100644
--- a/mm/page_ext.c
+++ b/mm/page_ext.c
@@ -286,6 +286,7 @@ static void free_page_ext(void *addr)
                table_size = get_entry_size() * PAGES_PER_SECTION;
 
                BUG_ON(PageReserved(page));
+               kmemleak_free(addr);
                free_pages_exact(addr, table_size);
        }
 }
diff --git a/mm/slab.c b/mm/slab.c
index 354a09deecff..d2c0499c6b15 100644
--- a/mm/slab.c
+++ b/mm/slab.c
@@ -566,14 +566,6 @@ static void start_cpu_timer(int cpu)
 
 static void init_arraycache(struct array_cache *ac, int limit, int batch)
 {
-       /*
-        * The array_cache structures contain pointers to free object.
-        * However, when such objects are allocated or transferred to another
-        * cache the pointers are not cleared and they could be counted as
-        * valid references during a kmemleak scan. Therefore, kmemleak must
-        * not scan such objects.
-        */
-       kmemleak_no_scan(ac);
        if (ac) {
                ac->avail = 0;
                ac->limit = limit;
@@ -589,6 +581,14 @@ static struct array_cache *alloc_arraycache(int node, int 
entries,
        struct array_cache *ac = NULL;
 
        ac = kmalloc_node(memsize, gfp, node);
+       /*
+        * The array_cache structures contain pointers to free object.
+        * However, when such objects are allocated or transferred to another
+        * cache the pointers are not cleared and they could be counted as
+        * valid references during a kmemleak scan. Therefore, kmemleak must
+        * not scan such objects.
+        */
+       kmemleak_no_scan(ac);
        init_arraycache(ac, entries, batchcount);
        return ac;
 }
@@ -683,6 +683,7 @@ static struct alien_cache *__alloc_alien_cache(int node, 
int entries,
 
        alc = kmalloc_node(memsize, gfp, node);
        if (alc) {
+               kmemleak_no_scan(alc);
                init_arraycache(&alc->ac, entries, batch);
                spin_lock_init(&alc->lock);
        }
diff --git a/mm/vmalloc.c b/mm/vmalloc.c
index e6aa073f01df..73afe460caf0 100644
--- a/mm/vmalloc.c
+++ b/mm/vmalloc.c
@@ -459,7 +459,11 @@ static struct vmap_area *alloc_vmap_area(unsigned long 
size,
        }
 
 found:
-       if (addr + size > vend)
+       /*
+        * Check also calculated address against the vstart,
+        * because it can be 0 because of big align request.
+        */
+       if (addr + size > vend || addr < vstart)
                goto overflow;
 
        va->va_start = addr;
diff --git a/net/bridge/br_netfilter_hooks.c b/net/bridge/br_netfilter_hooks.c
index 7e42c0d1f55b..38865deab3ac 100644
--- a/net/bridge/br_netfilter_hooks.c
+++ b/net/bridge/br_netfilter_hooks.c
@@ -878,11 +878,6 @@ static const struct nf_br_ops br_ops = {
        .br_dev_xmit_hook =     br_nf_dev_xmit,
 };
 
-void br_netfilter_enable(void)
-{
-}
-EXPORT_SYMBOL_GPL(br_netfilter_enable);
-
 /* For br_nf_post_routing, we need (prio = NF_BR_PRI_LAST), because
  * br_dev_queue_push_xmit is called afterwards */
 static struct nf_hook_ops br_nf_ops[] __read_mostly = {
diff --git a/net/netfilter/xt_physdev.c b/net/netfilter/xt_physdev.c
index bb33598e4530..ec247d8370e8 100644
--- a/net/netfilter/xt_physdev.c
+++ b/net/netfilter/xt_physdev.c
@@ -96,8 +96,7 @@ physdev_mt(const struct sk_buff *skb, struct xt_action_param 
*par)
 static int physdev_mt_check(const struct xt_mtchk_param *par)
 {
        const struct xt_physdev_info *info = par->matchinfo;
-
-       br_netfilter_enable();
+       static bool brnf_probed __read_mostly;
 
        if (!(info->bitmask & XT_PHYSDEV_OP_MASK) ||
            info->bitmask & ~XT_PHYSDEV_OP_MASK)
@@ -113,6 +112,12 @@ static int physdev_mt_check(const struct xt_mtchk_param 
*par)
                if (par->hook_mask & (1 << NF_INET_LOCAL_OUT))
                        return -EINVAL;
        }
+
+       if (!brnf_probed) {
+               brnf_probed = true;
+               request_module("br_netfilter");
+       }
+
        return 0;
 }
 
diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c
index d293b546a2aa..9bd6f97ccd21 100644
--- a/security/selinux/hooks.c
+++ b/security/selinux/hooks.c
@@ -3265,12 +3265,16 @@ static int selinux_inode_setsecurity(struct inode 
*inode, const char *name,
                                     const void *value, size_t size, int flags)
 {
        struct inode_security_struct *isec = inode_security_novalidate(inode);
+       struct superblock_security_struct *sbsec = inode->i_sb->s_security;
        u32 newsid;
        int rc;
 
        if (strcmp(name, XATTR_SELINUX_SUFFIX))
                return -EOPNOTSUPP;
 
+       if (!(sbsec->flags & SBLABEL_MNT))
+               return -EOPNOTSUPP;
+
        if (!value || !size)
                return -EACCES;
 
@@ -5984,7 +5988,10 @@ static void selinux_inode_invalidate_secctx(struct inode 
*inode)
  */
 static int selinux_inode_notifysecctx(struct inode *inode, void *ctx, u32 
ctxlen)
 {
-       return selinux_inode_setsecurity(inode, XATTR_SELINUX_SUFFIX, ctx, 
ctxlen, 0);
+       int rc = selinux_inode_setsecurity(inode, XATTR_SELINUX_SUFFIX,
+                                          ctx, ctxlen, 0);
+       /* Do not return error when suppressing label (SBLABEL_MNT not set). */
+       return rc == -EOPNOTSUPP ? 0 : rc;
 }
 
 /*
diff --git a/sound/core/pcm_native.c b/sound/core/pcm_native.c
index e1138e70dbb3..f5eb10f8021c 100644
--- a/sound/core/pcm_native.c
+++ b/sound/core/pcm_native.c
@@ -1346,6 +1346,14 @@ int snd_pcm_suspend_all(struct snd_pcm *pcm)
                        /* FIXME: the open/close code should lock this as well 
*/
                        if (substream->runtime == NULL)
                                continue;
+
+                       /*
+                        * Skip BE dai link PCM's that are internal and may
+                        * not have their substream ops set.
+                        */
+                       if (!substream->ops)
+                               continue;
+
                        err = snd_pcm_suspend(substream);
                        if (err < 0 && err != -EBUSY)
                                return err;
diff --git a/sound/soc/fsl/fsl-asoc-card.c b/sound/soc/fsl/fsl-asoc-card.c
index dffd549a0e2a..705d2524ec31 100644
--- a/sound/soc/fsl/fsl-asoc-card.c
+++ b/sound/soc/fsl/fsl-asoc-card.c
@@ -689,6 +689,7 @@ static int fsl_asoc_card_probe(struct platform_device *pdev)
 asrc_fail:
        of_node_put(asrc_np);
        of_node_put(codec_np);
+       put_device(&cpu_pdev->dev);
 fail:
        of_node_put(cpu_np);
 
diff --git a/sound/soc/fsl/imx-sgtl5000.c b/sound/soc/fsl/imx-sgtl5000.c
index b99e0b5e00e9..8e525f7ac08d 100644
--- a/sound/soc/fsl/imx-sgtl5000.c
+++ b/sound/soc/fsl/imx-sgtl5000.c
@@ -115,6 +115,7 @@ static int imx_sgtl5000_probe(struct platform_device *pdev)
                ret = -EPROBE_DEFER;
                goto fail;
        }
+       put_device(&ssi_pdev->dev);
        codec_dev = of_find_i2c_device_by_node(codec_np);
        if (!codec_dev) {
                dev_err(&pdev->dev, "failed to find codec platform device\n");
diff --git a/tools/lib/traceevent/event-parse.c 
b/tools/lib/traceevent/event-parse.c
index 669475300ba8..700c74b0aed0 100644
--- a/tools/lib/traceevent/event-parse.c
+++ b/tools/lib/traceevent/event-parse.c
@@ -2428,7 +2428,7 @@ static int arg_num_eval(struct print_arg *arg, long long 
*val)
 static char *arg_eval (struct print_arg *arg)
 {
        long long val;
-       static char buf[20];
+       static char buf[24];
 
        switch (arg->type) {
        case PRINT_ATOM:
diff --git a/tools/perf/tests/evsel-tp-sched.c 
b/tools/perf/tests/evsel-tp-sched.c
index 66b53f10eb18..ea772d41e472 100644
--- a/tools/perf/tests/evsel-tp-sched.c
+++ b/tools/perf/tests/evsel-tp-sched.c
@@ -42,7 +42,7 @@ int test__perf_evsel__tp_sched_test(int subtest 
__maybe_unused)
                return -1;
        }
 
-       if (perf_evsel__test_field(evsel, "prev_comm", 16, true))
+       if (perf_evsel__test_field(evsel, "prev_comm", 16, false))
                ret = -1;
 
        if (perf_evsel__test_field(evsel, "prev_pid", 4, true))
@@ -54,7 +54,7 @@ int test__perf_evsel__tp_sched_test(int subtest 
__maybe_unused)
        if (perf_evsel__test_field(evsel, "prev_state", sizeof(long), true))
                ret = -1;
 
-       if (perf_evsel__test_field(evsel, "next_comm", 16, true))
+       if (perf_evsel__test_field(evsel, "next_comm", 16, false))
                ret = -1;
 
        if (perf_evsel__test_field(evsel, "next_pid", 4, true))
@@ -72,7 +72,7 @@ int test__perf_evsel__tp_sched_test(int subtest 
__maybe_unused)
                return -1;
        }
 
-       if (perf_evsel__test_field(evsel, "comm", 16, true))
+       if (perf_evsel__test_field(evsel, "comm", 16, false))
                ret = -1;
 
        if (perf_evsel__test_field(evsel, "pid", 4, true))

Reply via email to