commit: 55556458720a655972433c367328b0cb918faebe Author: Mike Pagano <mpagano <AT> gentoo <DOT> org> AuthorDate: Wed Nov 21 12:26:45 2018 +0000 Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org> CommitDate: Wed Nov 21 12:26:45 2018 +0000 URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=55556458
proj/linux-patches: Linux patch 4.14.82 Signed-off-by: Mike Pagano <mpagano <AT> gentoo.org> 0000_README | 4 + 1081_linux-4.14.82.patch | 3276 ++++++++++++++++++++++++++++++++++++++++++++++ 2 files changed, 3280 insertions(+) diff --git a/0000_README b/0000_README index 70ae288..b8ff7e8 100644 --- a/0000_README +++ b/0000_README @@ -367,6 +367,10 @@ Patch: 1080-4.14.81.patch From: http://www.kernel.org Desc: Linux 4.14.81 +Patch: 1081-4.14.82.patch +From: http://www.kernel.org +Desc: Linux 4.14.82 + Patch: 1500_XATTR_USER_PREFIX.patch From: https://bugs.gentoo.org/show_bug.cgi?id=470644 Desc: Support for namespace user.pax.* on tmpfs. diff --git a/1081_linux-4.14.82.patch b/1081_linux-4.14.82.patch new file mode 100644 index 0000000..d95f88b --- /dev/null +++ b/1081_linux-4.14.82.patch @@ -0,0 +1,3276 @@ +diff --git a/Makefile b/Makefile +index 2fe1424d61d2..cac5323bc95d 100644 +--- a/Makefile ++++ b/Makefile +@@ -1,7 +1,7 @@ + # SPDX-License-Identifier: GPL-2.0 + VERSION = 4 + PATCHLEVEL = 14 +-SUBLEVEL = 81 ++SUBLEVEL = 82 + EXTRAVERSION = + NAME = Petit Gorille + +diff --git a/arch/alpha/include/asm/termios.h b/arch/alpha/include/asm/termios.h +index 6a8c53dec57e..b7c77bb1bfd2 100644 +--- a/arch/alpha/include/asm/termios.h ++++ b/arch/alpha/include/asm/termios.h +@@ -73,9 +73,15 @@ + }) + + #define user_termios_to_kernel_termios(k, u) \ +- copy_from_user(k, u, sizeof(struct termios)) ++ copy_from_user(k, u, sizeof(struct termios2)) + + #define kernel_termios_to_user_termios(u, k) \ ++ copy_to_user(u, k, sizeof(struct termios2)) ++ ++#define user_termios_to_kernel_termios_1(k, u) \ ++ copy_from_user(k, u, sizeof(struct termios)) ++ ++#define kernel_termios_to_user_termios_1(u, k) \ + copy_to_user(u, k, sizeof(struct termios)) + + #endif /* _ALPHA_TERMIOS_H */ +diff --git a/arch/alpha/include/uapi/asm/ioctls.h b/arch/alpha/include/uapi/asm/ioctls.h +index 3729d92d3fa8..dc8c20ac7191 100644 +--- a/arch/alpha/include/uapi/asm/ioctls.h ++++ b/arch/alpha/include/uapi/asm/ioctls.h +@@ -32,6 +32,11 @@ + #define TCXONC _IO('t', 30) + #define TCFLSH _IO('t', 31) + ++#define TCGETS2 _IOR('T', 42, struct termios2) ++#define TCSETS2 _IOW('T', 43, struct termios2) ++#define TCSETSW2 _IOW('T', 44, struct termios2) ++#define TCSETSF2 _IOW('T', 45, struct termios2) ++ + #define TIOCSWINSZ _IOW('t', 103, struct winsize) + #define TIOCGWINSZ _IOR('t', 104, struct winsize) + #define TIOCSTART _IO('t', 110) /* start output, like ^Q */ +diff --git a/arch/alpha/include/uapi/asm/termbits.h b/arch/alpha/include/uapi/asm/termbits.h +index 05e0398a83a6..53b3ecff2f50 100644 +--- a/arch/alpha/include/uapi/asm/termbits.h ++++ b/arch/alpha/include/uapi/asm/termbits.h +@@ -26,6 +26,19 @@ struct termios { + speed_t c_ospeed; /* output speed */ + }; + ++/* Alpha has identical termios and termios2 */ ++ ++struct termios2 { ++ tcflag_t c_iflag; /* input mode flags */ ++ tcflag_t c_oflag; /* output mode flags */ ++ tcflag_t c_cflag; /* control mode flags */ ++ tcflag_t c_lflag; /* local mode flags */ ++ cc_t c_cc[NCCS]; /* control characters */ ++ cc_t c_line; /* line discipline (== c_cc[19]) */ ++ speed_t c_ispeed; /* input speed */ ++ speed_t c_ospeed; /* output speed */ ++}; ++ + /* Alpha has matching termios and ktermios */ + + struct ktermios { +@@ -148,6 +161,7 @@ struct ktermios { + #define B3000000 00034 + #define B3500000 00035 + #define B4000000 00036 ++#define BOTHER 00037 + + #define CSIZE 00001400 + #define CS5 00000000 +@@ -165,6 +179,9 @@ struct ktermios { + #define CMSPAR 010000000000 /* mark or space (stick) parity */ + #define CRTSCTS 020000000000 /* flow control */ + ++#define CIBAUD 07600000 ++#define IBSHIFT 16 ++ + /* c_lflag bits */ + #define ISIG 0x00000080 + #define ICANON 0x00000100 +diff --git a/arch/arm/configs/imx_v6_v7_defconfig b/arch/arm/configs/imx_v6_v7_defconfig +index 32acac9ab81a..9c795ceedd5b 100644 +--- a/arch/arm/configs/imx_v6_v7_defconfig ++++ b/arch/arm/configs/imx_v6_v7_defconfig +@@ -383,6 +383,7 @@ CONFIG_ZISOFS=y + CONFIG_UDF_FS=m + CONFIG_MSDOS_FS=m + CONFIG_VFAT_FS=y ++CONFIG_TMPFS_POSIX_ACL=y + CONFIG_JFFS2_FS=y + CONFIG_UBIFS_FS=y + CONFIG_NFS_FS=y +diff --git a/arch/arm/mm/proc-v7.S b/arch/arm/mm/proc-v7.S +index 12468d9378d8..d8d90cf65b39 100644 +--- a/arch/arm/mm/proc-v7.S ++++ b/arch/arm/mm/proc-v7.S +@@ -112,7 +112,7 @@ ENTRY(cpu_v7_hvc_switch_mm) + hvc #0 + ldmfd sp!, {r0 - r3} + b cpu_v7_switch_mm +-ENDPROC(cpu_v7_smc_switch_mm) ++ENDPROC(cpu_v7_hvc_switch_mm) + #endif + ENTRY(cpu_v7_iciallu_switch_mm) + mov r3, #0 +diff --git a/arch/mips/include/asm/mach-loongson64/irq.h b/arch/mips/include/asm/mach-loongson64/irq.h +index 3644b68c0ccc..be9f727a9328 100644 +--- a/arch/mips/include/asm/mach-loongson64/irq.h ++++ b/arch/mips/include/asm/mach-loongson64/irq.h +@@ -10,7 +10,7 @@ + #define MIPS_CPU_IRQ_BASE 56 + + #define LOONGSON_UART_IRQ (MIPS_CPU_IRQ_BASE + 2) /* UART */ +-#define LOONGSON_HT1_IRQ (MIPS_CPU_IRQ_BASE + 3) /* HT1 */ ++#define LOONGSON_BRIDGE_IRQ (MIPS_CPU_IRQ_BASE + 3) /* CASCADE */ + #define LOONGSON_TIMER_IRQ (MIPS_CPU_IRQ_BASE + 7) /* CPU Timer */ + + #define LOONGSON_HT1_CFG_BASE loongson_sysconf.ht_control_base +diff --git a/arch/mips/kernel/crash.c b/arch/mips/kernel/crash.c +index d455363d51c3..4c07a43a3242 100644 +--- a/arch/mips/kernel/crash.c ++++ b/arch/mips/kernel/crash.c +@@ -36,6 +36,9 @@ static void crash_shutdown_secondary(void *passed_regs) + if (!cpu_online(cpu)) + return; + ++ /* We won't be sent IPIs any more. */ ++ set_cpu_online(cpu, false); ++ + local_irq_disable(); + if (!cpumask_test_cpu(cpu, &cpus_in_crash)) + crash_save_cpu(regs, cpu); +diff --git a/arch/mips/kernel/machine_kexec.c b/arch/mips/kernel/machine_kexec.c +index 8b574bcd39ba..4b3726e4fe3a 100644 +--- a/arch/mips/kernel/machine_kexec.c ++++ b/arch/mips/kernel/machine_kexec.c +@@ -118,6 +118,9 @@ machine_kexec(struct kimage *image) + *ptr = (unsigned long) phys_to_virt(*ptr); + } + ++ /* Mark offline BEFORE disabling local irq. */ ++ set_cpu_online(smp_processor_id(), false); ++ + /* + * we do not want to be bothered. + */ +diff --git a/arch/mips/loongson64/loongson-3/irq.c b/arch/mips/loongson64/loongson-3/irq.c +index cbeb20f9fc95..5605061f5f98 100644 +--- a/arch/mips/loongson64/loongson-3/irq.c ++++ b/arch/mips/loongson64/loongson-3/irq.c +@@ -96,51 +96,8 @@ void mach_irq_dispatch(unsigned int pending) + } + } + +-static struct irqaction cascade_irqaction = { +- .handler = no_action, +- .flags = IRQF_NO_SUSPEND, +- .name = "cascade", +-}; +- +-static inline void mask_loongson_irq(struct irq_data *d) +-{ +- clear_c0_status(0x100 << (d->irq - MIPS_CPU_IRQ_BASE)); +- irq_disable_hazard(); +- +- /* Workaround: UART IRQ may deliver to any core */ +- if (d->irq == LOONGSON_UART_IRQ) { +- int cpu = smp_processor_id(); +- int node_id = cpu_logical_map(cpu) / loongson_sysconf.cores_per_node; +- int core_id = cpu_logical_map(cpu) % loongson_sysconf.cores_per_node; +- u64 intenclr_addr = smp_group[node_id] | +- (u64)(&LOONGSON_INT_ROUTER_INTENCLR); +- u64 introuter_lpc_addr = smp_group[node_id] | +- (u64)(&LOONGSON_INT_ROUTER_LPC); +- +- *(volatile u32 *)intenclr_addr = 1 << 10; +- *(volatile u8 *)introuter_lpc_addr = 0x10 + (1<<core_id); +- } +-} +- +-static inline void unmask_loongson_irq(struct irq_data *d) +-{ +- /* Workaround: UART IRQ may deliver to any core */ +- if (d->irq == LOONGSON_UART_IRQ) { +- int cpu = smp_processor_id(); +- int node_id = cpu_logical_map(cpu) / loongson_sysconf.cores_per_node; +- int core_id = cpu_logical_map(cpu) % loongson_sysconf.cores_per_node; +- u64 intenset_addr = smp_group[node_id] | +- (u64)(&LOONGSON_INT_ROUTER_INTENSET); +- u64 introuter_lpc_addr = smp_group[node_id] | +- (u64)(&LOONGSON_INT_ROUTER_LPC); +- +- *(volatile u32 *)intenset_addr = 1 << 10; +- *(volatile u8 *)introuter_lpc_addr = 0x10 + (1<<core_id); +- } +- +- set_c0_status(0x100 << (d->irq - MIPS_CPU_IRQ_BASE)); +- irq_enable_hazard(); +-} ++static inline void mask_loongson_irq(struct irq_data *d) { } ++static inline void unmask_loongson_irq(struct irq_data *d) { } + + /* For MIPS IRQs which shared by all cores */ + static struct irq_chip loongson_irq_chip = { +@@ -183,12 +140,11 @@ void __init mach_init_irq(void) + chip->irq_set_affinity = plat_set_irq_affinity; + + irq_set_chip_and_handler(LOONGSON_UART_IRQ, +- &loongson_irq_chip, handle_level_irq); +- +- /* setup HT1 irq */ +- setup_irq(LOONGSON_HT1_IRQ, &cascade_irqaction); ++ &loongson_irq_chip, handle_percpu_irq); ++ irq_set_chip_and_handler(LOONGSON_BRIDGE_IRQ, ++ &loongson_irq_chip, handle_percpu_irq); + +- set_c0_status(STATUSF_IP2 | STATUSF_IP6); ++ set_c0_status(STATUSF_IP2 | STATUSF_IP3 | STATUSF_IP6); + } + + #ifdef CONFIG_HOTPLUG_CPU +diff --git a/arch/mips/pci/pci-legacy.c b/arch/mips/pci/pci-legacy.c +index 0c65c38e05d6..1ae6bc414e2b 100644 +--- a/arch/mips/pci/pci-legacy.c ++++ b/arch/mips/pci/pci-legacy.c +@@ -127,8 +127,12 @@ static void pcibios_scanbus(struct pci_controller *hose) + if (pci_has_flag(PCI_PROBE_ONLY)) { + pci_bus_claim_resources(bus); + } else { ++ struct pci_bus *child; ++ + pci_bus_size_bridges(bus); + pci_bus_assign_resources(bus); ++ list_for_each_entry(child, &bus->children, node) ++ pcie_bus_configure_settings(child); + } + pci_bus_add_devices(bus); + } +diff --git a/arch/powerpc/boot/crt0.S b/arch/powerpc/boot/crt0.S +index dcf2f15e6797..32dfe6d083f3 100644 +--- a/arch/powerpc/boot/crt0.S ++++ b/arch/powerpc/boot/crt0.S +@@ -47,8 +47,10 @@ p_end: .long _end + p_pstack: .long _platform_stack_top + #endif + +- .weak _zimage_start + .globl _zimage_start ++ /* Clang appears to require the .weak directive to be after the symbol ++ * is defined. See https://bugs.llvm.org/show_bug.cgi?id=38921 */ ++ .weak _zimage_start + _zimage_start: + .globl _zimage_start_lib + _zimage_start_lib: +diff --git a/arch/powerpc/kernel/eeh.c b/arch/powerpc/kernel/eeh.c +index 116000b45531..45322b37669a 100644 +--- a/arch/powerpc/kernel/eeh.c ++++ b/arch/powerpc/kernel/eeh.c +@@ -169,6 +169,11 @@ static size_t eeh_dump_dev_log(struct eeh_dev *edev, char *buf, size_t len) + int n = 0, l = 0; + char buffer[128]; + ++ if (!pdn) { ++ pr_warn("EEH: Note: No error log for absent device.\n"); ++ return 0; ++ } ++ + n += scnprintf(buf+n, len-n, "%04x:%02x:%02x.%01x\n", + pdn->phb->global_number, pdn->busno, + PCI_SLOT(pdn->devfn), PCI_FUNC(pdn->devfn)); +diff --git a/arch/powerpc/kernel/module_64.c b/arch/powerpc/kernel/module_64.c +index 2a1b1273a312..4d8f6291b766 100644 +--- a/arch/powerpc/kernel/module_64.c ++++ b/arch/powerpc/kernel/module_64.c +@@ -656,7 +656,14 @@ int apply_relocate_add(Elf64_Shdr *sechdrs, + + case R_PPC64_REL32: + /* 32 bits relative (used by relative exception tables) */ +- *(u32 *)location = value - (unsigned long)location; ++ /* Convert value to relative */ ++ value -= (unsigned long)location; ++ if (value + 0x80000000 > 0xffffffff) { ++ pr_err("%s: REL32 %li out of range!\n", ++ me->name, (long int)value); ++ return -ENOEXEC; ++ } ++ *(u32 *)location = value; + break; + + case R_PPC64_TOCSAVE: +diff --git a/arch/powerpc/kernel/traps.c b/arch/powerpc/kernel/traps.c +index ac2e5e56a9f0..a5f2b7593976 100644 +--- a/arch/powerpc/kernel/traps.c ++++ b/arch/powerpc/kernel/traps.c +@@ -694,12 +694,17 @@ void machine_check_exception(struct pt_regs *regs) + if (check_io_access(regs)) + goto bail; + +- die("Machine check", regs, SIGBUS); +- + /* Must die if the interrupt is not recoverable */ + if (!(regs->msr & MSR_RI)) + nmi_panic(regs, "Unrecoverable Machine check"); + ++ if (!nested) ++ nmi_exit(); ++ ++ die("Machine check", regs, SIGBUS); ++ ++ return; ++ + bail: + if (!nested) + nmi_exit(); +diff --git a/arch/powerpc/mm/dump_linuxpagetables.c b/arch/powerpc/mm/dump_linuxpagetables.c +index c9282d27b203..31c1c61afaa4 100644 +--- a/arch/powerpc/mm/dump_linuxpagetables.c ++++ b/arch/powerpc/mm/dump_linuxpagetables.c +@@ -422,12 +422,13 @@ static void walk_pagetables(struct pg_state *st) + unsigned int i; + unsigned long addr; + ++ addr = st->start_address; ++ + /* + * Traverse the linux pagetable structure and dump pages that are in + * the hash pagetable. + */ +- for (i = 0; i < PTRS_PER_PGD; i++, pgd++) { +- addr = KERN_VIRT_START + i * PGDIR_SIZE; ++ for (i = 0; i < PTRS_PER_PGD; i++, pgd++, addr += PGDIR_SIZE) { + if (!pgd_none(*pgd) && !pgd_huge(*pgd)) + /* pgd exists */ + walk_pud(st, pgd, addr); +@@ -476,9 +477,14 @@ static int ptdump_show(struct seq_file *m, void *v) + { + struct pg_state st = { + .seq = m, +- .start_address = KERN_VIRT_START, + .marker = address_markers, + }; ++ ++ if (radix_enabled()) ++ st.start_address = PAGE_OFFSET; ++ else ++ st.start_address = KERN_VIRT_START; ++ + /* Traverse kernel page tables */ + walk_pagetables(&st); + note_page(&st, 0, 0, 0); +diff --git a/arch/powerpc/mm/hugetlbpage.c b/arch/powerpc/mm/hugetlbpage.c +index 4c9e5f9c7a44..e2d929ddad7f 100644 +--- a/arch/powerpc/mm/hugetlbpage.c ++++ b/arch/powerpc/mm/hugetlbpage.c +@@ -19,6 +19,7 @@ + #include <linux/moduleparam.h> + #include <linux/swap.h> + #include <linux/swapops.h> ++#include <linux/kmemleak.h> + #include <asm/pgtable.h> + #include <asm/pgalloc.h> + #include <asm/tlb.h> +@@ -110,6 +111,8 @@ static int __hugepte_alloc(struct mm_struct *mm, hugepd_t *hpdp, + for (i = i - 1 ; i >= 0; i--, hpdp--) + *hpdp = __hugepd(0); + kmem_cache_free(cachep, new); ++ } else { ++ kmemleak_ignore(new); + } + spin_unlock(&mm->page_table_lock); + return 0; +diff --git a/arch/powerpc/mm/tlb_nohash.c b/arch/powerpc/mm/tlb_nohash.c +index bfc4a0869609..2ae18e90e0ba 100644 +--- a/arch/powerpc/mm/tlb_nohash.c ++++ b/arch/powerpc/mm/tlb_nohash.c +@@ -500,6 +500,9 @@ static void setup_page_sizes(void) + for (psize = 0; psize < MMU_PAGE_COUNT; ++psize) { + struct mmu_psize_def *def = &mmu_psize_defs[psize]; + ++ if (!def->shift) ++ continue; ++ + if (tlb1ps & (1U << (def->shift - 10))) { + def->flags |= MMU_PAGE_SIZE_DIRECT; + +diff --git a/arch/powerpc/platforms/powernv/memtrace.c b/arch/powerpc/platforms/powernv/memtrace.c +index fc222a0c2ac4..c9a6d4f3403c 100644 +--- a/arch/powerpc/platforms/powernv/memtrace.c ++++ b/arch/powerpc/platforms/powernv/memtrace.c +@@ -119,17 +119,15 @@ static bool memtrace_offline_pages(u32 nid, u64 start_pfn, u64 nr_pages) + walk_memory_range(start_pfn, end_pfn, (void *)MEM_OFFLINE, + change_memblock_state); + +- lock_device_hotplug(); +- remove_memory(nid, start_pfn << PAGE_SHIFT, nr_pages << PAGE_SHIFT); +- unlock_device_hotplug(); + + return true; + } + + static u64 memtrace_alloc_node(u32 nid, u64 size) + { +- u64 start_pfn, end_pfn, nr_pages; ++ u64 start_pfn, end_pfn, nr_pages, pfn; + u64 base_pfn; ++ u64 bytes = memory_block_size_bytes(); + + if (!NODE_DATA(nid) || !node_spanned_pages(nid)) + return 0; +@@ -142,8 +140,21 @@ static u64 memtrace_alloc_node(u32 nid, u64 size) + end_pfn = round_down(end_pfn - nr_pages, nr_pages); + + for (base_pfn = end_pfn; base_pfn > start_pfn; base_pfn -= nr_pages) { +- if (memtrace_offline_pages(nid, base_pfn, nr_pages) == true) ++ if (memtrace_offline_pages(nid, base_pfn, nr_pages) == true) { ++ /* ++ * Remove memory in memory block size chunks so that ++ * iomem resources are always split to the same size and ++ * we never try to remove memory that spans two iomem ++ * resources. ++ */ ++ lock_device_hotplug(); ++ end_pfn = base_pfn + nr_pages; ++ for (pfn = base_pfn; pfn < end_pfn; pfn += bytes>> PAGE_SHIFT) { ++ remove_memory(nid, pfn << PAGE_SHIFT, bytes); ++ } ++ unlock_device_hotplug(); + return base_pfn << PAGE_SHIFT; ++ } + } + + return 0; +diff --git a/arch/x86/kernel/cpu/mshyperv.c b/arch/x86/kernel/cpu/mshyperv.c +index 85eb5fc180c8..c0201b11e9e2 100644 +--- a/arch/x86/kernel/cpu/mshyperv.c ++++ b/arch/x86/kernel/cpu/mshyperv.c +@@ -20,6 +20,7 @@ + #include <linux/interrupt.h> + #include <linux/irq.h> + #include <linux/kexec.h> ++#include <linux/i8253.h> + #include <asm/processor.h> + #include <asm/hypervisor.h> + #include <asm/hyperv.h> +@@ -243,6 +244,16 @@ static void __init ms_hyperv_init_platform(void) + if (efi_enabled(EFI_BOOT)) + x86_platform.get_nmi_reason = hv_get_nmi_reason; + ++ /* ++ * Hyper-V VMs have a PIT emulation quirk such that zeroing the ++ * counter register during PIT shutdown restarts the PIT. So it ++ * continues to interrupt @18.2 HZ. Setting i8253_clear_counter ++ * to false tells pit_shutdown() not to zero the counter so that ++ * the PIT really is shutdown. Generation 2 VMs don't have a PIT, ++ * and setting this value has no effect. ++ */ ++ i8253_clear_counter_on_shutdown = false; ++ + #if IS_ENABLED(CONFIG_HYPERV) + /* + * Setup the hook to get control post apic initialization. +diff --git a/arch/x86/kernel/cpu/vmware.c b/arch/x86/kernel/cpu/vmware.c +index 8e005329648b..d805202c63cd 100644 +--- a/arch/x86/kernel/cpu/vmware.c ++++ b/arch/x86/kernel/cpu/vmware.c +@@ -77,7 +77,7 @@ static __init int setup_vmw_sched_clock(char *s) + } + early_param("no-vmw-sched-clock", setup_vmw_sched_clock); + +-static unsigned long long vmware_sched_clock(void) ++static unsigned long long notrace vmware_sched_clock(void) + { + unsigned long long ns; + +diff --git a/arch/x86/um/shared/sysdep/ptrace_32.h b/arch/x86/um/shared/sysdep/ptrace_32.h +index b94a108de1dc..ae00d22bce02 100644 +--- a/arch/x86/um/shared/sysdep/ptrace_32.h ++++ b/arch/x86/um/shared/sysdep/ptrace_32.h +@@ -10,20 +10,10 @@ + + static inline void update_debugregs(int seq) {} + +-/* syscall emulation path in ptrace */ +- +-#ifndef PTRACE_SYSEMU +-#define PTRACE_SYSEMU 31 +-#endif +- + void set_using_sysemu(int value); + int get_using_sysemu(void); + extern int sysemu_supported; + +-#ifndef PTRACE_SYSEMU_SINGLESTEP +-#define PTRACE_SYSEMU_SINGLESTEP 32 +-#endif +- + #define UPT_SYSCALL_ARG1(r) UPT_BX(r) + #define UPT_SYSCALL_ARG2(r) UPT_CX(r) + #define UPT_SYSCALL_ARG3(r) UPT_DX(r) +diff --git a/arch/xtensa/boot/Makefile b/arch/xtensa/boot/Makefile +index 53e4178711e6..8c20a7965bda 100644 +--- a/arch/xtensa/boot/Makefile ++++ b/arch/xtensa/boot/Makefile +@@ -34,7 +34,7 @@ boot-elf boot-redboot: $(addprefix $(obj)/,$(subdir-y)) \ + $(addprefix $(obj)/,$(host-progs)) + $(Q)$(MAKE) $(build)=$(obj)/$@ $(MAKECMDGOALS) + +-OBJCOPYFLAGS = --strip-all -R .comment -R .note.gnu.build-id -O binary ++OBJCOPYFLAGS = --strip-all -R .comment -R .notes -O binary + + vmlinux.bin: vmlinux FORCE + $(call if_changed,objcopy) +diff --git a/arch/xtensa/include/asm/processor.h b/arch/xtensa/include/asm/processor.h +index 5b0027d4ecc0..a39cd81b741a 100644 +--- a/arch/xtensa/include/asm/processor.h ++++ b/arch/xtensa/include/asm/processor.h +@@ -24,7 +24,11 @@ + # error Linux requires the Xtensa Windowed Registers Option. + #endif + +-#define ARCH_SLAB_MINALIGN XCHAL_DATA_WIDTH ++/* Xtensa ABI requires stack alignment to be at least 16 */ ++ ++#define STACK_ALIGN (XCHAL_DATA_WIDTH > 16 ? XCHAL_DATA_WIDTH : 16) ++ ++#define ARCH_SLAB_MINALIGN STACK_ALIGN + + /* + * User space process size: 1 GB. +diff --git a/arch/xtensa/kernel/head.S b/arch/xtensa/kernel/head.S +index 23ce62e60435..27c8e07ace43 100644 +--- a/arch/xtensa/kernel/head.S ++++ b/arch/xtensa/kernel/head.S +@@ -88,9 +88,12 @@ _SetupMMU: + initialize_mmu + #if defined(CONFIG_MMU) && XCHAL_HAVE_PTP_MMU && XCHAL_HAVE_SPANNING_WAY + rsr a2, excsave1 +- movi a3, 0x08000000 ++ movi a3, XCHAL_KSEG_PADDR ++ bltu a2, a3, 1f ++ sub a2, a2, a3 ++ movi a3, XCHAL_KSEG_SIZE + bgeu a2, a3, 1f +- movi a3, 0xd0000000 ++ movi a3, XCHAL_KSEG_CACHED_VADDR + add a2, a2, a3 + wsr a2, excsave1 + 1: +diff --git a/arch/xtensa/kernel/vmlinux.lds.S b/arch/xtensa/kernel/vmlinux.lds.S +index 162c77e53ca8..3e04845a15e6 100644 +--- a/arch/xtensa/kernel/vmlinux.lds.S ++++ b/arch/xtensa/kernel/vmlinux.lds.S +@@ -146,6 +146,7 @@ SECTIONS + .fixup : { *(.fixup) } + + EXCEPTION_TABLE(16) ++ NOTES + /* Data section */ + + _sdata = .; +diff --git a/block/blk-core.c b/block/blk-core.c +index 6aa2bc4e9652..0b14aebfd1a8 100644 +--- a/block/blk-core.c ++++ b/block/blk-core.c +@@ -671,9 +671,8 @@ void blk_cleanup_queue(struct request_queue *q) + * dispatch may still be in-progress since we dispatch requests + * from more than one contexts. + * +- * No need to quiesce queue if it isn't initialized yet since +- * blk_freeze_queue() should be enough for cases of passthrough +- * request. ++ * We rely on driver to deal with the race in case that queue ++ * initialization isn't done. + */ + if (q->mq_ops && blk_queue_init_done(q)) + blk_mq_quiesce_queue(q); +diff --git a/crypto/crypto_user.c b/crypto/crypto_user.c +index 0dbe2be7f783..b5758768920b 100644 +--- a/crypto/crypto_user.c ++++ b/crypto/crypto_user.c +@@ -83,7 +83,7 @@ static int crypto_report_cipher(struct sk_buff *skb, struct crypto_alg *alg) + { + struct crypto_report_cipher rcipher; + +- strlcpy(rcipher.type, "cipher", sizeof(rcipher.type)); ++ strncpy(rcipher.type, "cipher", sizeof(rcipher.type)); + + rcipher.blocksize = alg->cra_blocksize; + rcipher.min_keysize = alg->cra_cipher.cia_min_keysize; +@@ -102,7 +102,7 @@ static int crypto_report_comp(struct sk_buff *skb, struct crypto_alg *alg) + { + struct crypto_report_comp rcomp; + +- strlcpy(rcomp.type, "compression", sizeof(rcomp.type)); ++ strncpy(rcomp.type, "compression", sizeof(rcomp.type)); + if (nla_put(skb, CRYPTOCFGA_REPORT_COMPRESS, + sizeof(struct crypto_report_comp), &rcomp)) + goto nla_put_failure; +@@ -116,7 +116,7 @@ static int crypto_report_acomp(struct sk_buff *skb, struct crypto_alg *alg) + { + struct crypto_report_acomp racomp; + +- strlcpy(racomp.type, "acomp", sizeof(racomp.type)); ++ strncpy(racomp.type, "acomp", sizeof(racomp.type)); + + if (nla_put(skb, CRYPTOCFGA_REPORT_ACOMP, + sizeof(struct crypto_report_acomp), &racomp)) +@@ -131,7 +131,7 @@ static int crypto_report_akcipher(struct sk_buff *skb, struct crypto_alg *alg) + { + struct crypto_report_akcipher rakcipher; + +- strlcpy(rakcipher.type, "akcipher", sizeof(rakcipher.type)); ++ strncpy(rakcipher.type, "akcipher", sizeof(rakcipher.type)); + + if (nla_put(skb, CRYPTOCFGA_REPORT_AKCIPHER, + sizeof(struct crypto_report_akcipher), &rakcipher)) +@@ -146,7 +146,7 @@ static int crypto_report_kpp(struct sk_buff *skb, struct crypto_alg *alg) + { + struct crypto_report_kpp rkpp; + +- strlcpy(rkpp.type, "kpp", sizeof(rkpp.type)); ++ strncpy(rkpp.type, "kpp", sizeof(rkpp.type)); + + if (nla_put(skb, CRYPTOCFGA_REPORT_KPP, + sizeof(struct crypto_report_kpp), &rkpp)) +@@ -160,10 +160,10 @@ nla_put_failure: + static int crypto_report_one(struct crypto_alg *alg, + struct crypto_user_alg *ualg, struct sk_buff *skb) + { +- strlcpy(ualg->cru_name, alg->cra_name, sizeof(ualg->cru_name)); +- strlcpy(ualg->cru_driver_name, alg->cra_driver_name, ++ strncpy(ualg->cru_name, alg->cra_name, sizeof(ualg->cru_name)); ++ strncpy(ualg->cru_driver_name, alg->cra_driver_name, + sizeof(ualg->cru_driver_name)); +- strlcpy(ualg->cru_module_name, module_name(alg->cra_module), ++ strncpy(ualg->cru_module_name, module_name(alg->cra_module), + sizeof(ualg->cru_module_name)); + + ualg->cru_type = 0; +@@ -176,7 +176,7 @@ static int crypto_report_one(struct crypto_alg *alg, + if (alg->cra_flags & CRYPTO_ALG_LARVAL) { + struct crypto_report_larval rl; + +- strlcpy(rl.type, "larval", sizeof(rl.type)); ++ strncpy(rl.type, "larval", sizeof(rl.type)); + if (nla_put(skb, CRYPTOCFGA_REPORT_LARVAL, + sizeof(struct crypto_report_larval), &rl)) + goto nla_put_failure; +diff --git a/drivers/cdrom/cdrom.c b/drivers/cdrom/cdrom.c +index 8cfa10ab7abc..930b49606a8c 100644 +--- a/drivers/cdrom/cdrom.c ++++ b/drivers/cdrom/cdrom.c +@@ -2441,7 +2441,7 @@ static int cdrom_ioctl_select_disc(struct cdrom_device_info *cdi, + return -ENOSYS; + + if (arg != CDSL_CURRENT && arg != CDSL_NONE) { +- if ((int)arg >= cdi->capacity) ++ if (arg >= cdi->capacity) + return -EINVAL; + } + +diff --git a/drivers/clk/at91/clk-pll.c b/drivers/clk/at91/clk-pll.c +index 72b6091eb7b9..dc7fbc796cb6 100644 +--- a/drivers/clk/at91/clk-pll.c ++++ b/drivers/clk/at91/clk-pll.c +@@ -133,6 +133,9 @@ static unsigned long clk_pll_recalc_rate(struct clk_hw *hw, + { + struct clk_pll *pll = to_clk_pll(hw); + ++ if (!pll->div || !pll->mul) ++ return 0; ++ + return (parent_rate / pll->div) * (pll->mul + 1); + } + +diff --git a/drivers/clk/clk-s2mps11.c b/drivers/clk/clk-s2mps11.c +index fbaa84a33c46..14071a57c926 100644 +--- a/drivers/clk/clk-s2mps11.c ++++ b/drivers/clk/clk-s2mps11.c +@@ -245,6 +245,36 @@ static const struct platform_device_id s2mps11_clk_id[] = { + }; + MODULE_DEVICE_TABLE(platform, s2mps11_clk_id); + ++#ifdef CONFIG_OF ++/* ++ * Device is instantiated through parent MFD device and device matching is done ++ * through platform_device_id. ++ * ++ * However if device's DT node contains proper clock compatible and driver is ++ * built as a module, then the *module* matching will be done trough DT aliases. ++ * This requires of_device_id table. In the same time this will not change the ++ * actual *device* matching so do not add .of_match_table. ++ */ ++static const struct of_device_id s2mps11_dt_match[] = { ++ { ++ .compatible = "samsung,s2mps11-clk", ++ .data = (void *)S2MPS11X, ++ }, { ++ .compatible = "samsung,s2mps13-clk", ++ .data = (void *)S2MPS13X, ++ }, { ++ .compatible = "samsung,s2mps14-clk", ++ .data = (void *)S2MPS14X, ++ }, { ++ .compatible = "samsung,s5m8767-clk", ++ .data = (void *)S5M8767X, ++ }, { ++ /* Sentinel */ ++ }, ++}; ++MODULE_DEVICE_TABLE(of, s2mps11_dt_match); ++#endif ++ + static struct platform_driver s2mps11_clk_driver = { + .driver = { + .name = "s2mps11-clk", +diff --git a/drivers/clk/hisilicon/reset.c b/drivers/clk/hisilicon/reset.c +index 2a5015c736ce..43e82fa64422 100644 +--- a/drivers/clk/hisilicon/reset.c ++++ b/drivers/clk/hisilicon/reset.c +@@ -109,9 +109,8 @@ struct hisi_reset_controller *hisi_reset_init(struct platform_device *pdev) + return NULL; + + res = platform_get_resource(pdev, IORESOURCE_MEM, 0); +- rstc->membase = devm_ioremap(&pdev->dev, +- res->start, resource_size(res)); +- if (!rstc->membase) ++ rstc->membase = devm_ioremap_resource(&pdev->dev, res); ++ if (IS_ERR(rstc->membase)) + return NULL; + + spin_lock_init(&rstc->lock); +diff --git a/drivers/clk/mvebu/clk-corediv.c b/drivers/clk/mvebu/clk-corediv.c +index 8491979f4096..68f05c53d40e 100644 +--- a/drivers/clk/mvebu/clk-corediv.c ++++ b/drivers/clk/mvebu/clk-corediv.c +@@ -72,7 +72,7 @@ static const struct clk_corediv_desc mvebu_corediv_desc[] = { + }; + + static const struct clk_corediv_desc mv98dx3236_corediv_desc[] = { +- { .mask = 0x0f, .offset = 6, .fieldbit = 26 }, /* NAND clock */ ++ { .mask = 0x0f, .offset = 6, .fieldbit = 27 }, /* NAND clock */ + }; + + #define to_corediv_clk(p) container_of(p, struct clk_corediv, hw) +diff --git a/drivers/clk/rockchip/clk-ddr.c b/drivers/clk/rockchip/clk-ddr.c +index e8075359366b..ebce5260068b 100644 +--- a/drivers/clk/rockchip/clk-ddr.c ++++ b/drivers/clk/rockchip/clk-ddr.c +@@ -80,16 +80,12 @@ static long rockchip_ddrclk_sip_round_rate(struct clk_hw *hw, + static u8 rockchip_ddrclk_get_parent(struct clk_hw *hw) + { + struct rockchip_ddrclk *ddrclk = to_rockchip_ddrclk_hw(hw); +- int num_parents = clk_hw_get_num_parents(hw); + u32 val; + + val = clk_readl(ddrclk->reg_base + + ddrclk->mux_offset) >> ddrclk->mux_shift; + val &= GENMASK(ddrclk->mux_width - 1, 0); + +- if (val >= num_parents) +- return -EINVAL; +- + return val; + } + +diff --git a/drivers/clocksource/i8253.c b/drivers/clocksource/i8253.c +index 9c38895542f4..d4350bb10b83 100644 +--- a/drivers/clocksource/i8253.c ++++ b/drivers/clocksource/i8253.c +@@ -20,6 +20,13 @@ + DEFINE_RAW_SPINLOCK(i8253_lock); + EXPORT_SYMBOL(i8253_lock); + ++/* ++ * Handle PIT quirk in pit_shutdown() where zeroing the counter register ++ * restarts the PIT, negating the shutdown. On platforms with the quirk, ++ * platform specific code can set this to false. ++ */ ++bool i8253_clear_counter_on_shutdown __ro_after_init = true; ++ + #ifdef CONFIG_CLKSRC_I8253 + /* + * Since the PIT overflows every tick, its not very useful +@@ -109,8 +116,11 @@ static int pit_shutdown(struct clock_event_device *evt) + raw_spin_lock(&i8253_lock); + + outb_p(0x30, PIT_MODE); +- outb_p(0, PIT_CH0); +- outb_p(0, PIT_CH0); ++ ++ if (i8253_clear_counter_on_shutdown) { ++ outb_p(0, PIT_CH0); ++ outb_p(0, PIT_CH0); ++ } + + raw_spin_unlock(&i8253_lock); + return 0; +diff --git a/drivers/firmware/efi/libstub/fdt.c b/drivers/firmware/efi/libstub/fdt.c +index 8830fa601e45..0c0d2312f4a8 100644 +--- a/drivers/firmware/efi/libstub/fdt.c ++++ b/drivers/firmware/efi/libstub/fdt.c +@@ -158,6 +158,10 @@ static efi_status_t update_fdt(efi_system_table_t *sys_table, void *orig_fdt, + return efi_status; + } + } ++ ++ /* shrink the FDT back to its minimum size */ ++ fdt_pack(fdt); ++ + return EFI_SUCCESS; + + fdt_set_fail: +diff --git a/drivers/gpio/gpio-brcmstb.c b/drivers/gpio/gpio-brcmstb.c +index dd0308cc8bb0..bfc9b1afa388 100644 +--- a/drivers/gpio/gpio-brcmstb.c ++++ b/drivers/gpio/gpio-brcmstb.c +@@ -63,6 +63,21 @@ brcmstb_gpio_gc_to_priv(struct gpio_chip *gc) + return bank->parent_priv; + } + ++static unsigned long ++brcmstb_gpio_get_active_irqs(struct brcmstb_gpio_bank *bank) ++{ ++ void __iomem *reg_base = bank->parent_priv->reg_base; ++ unsigned long status; ++ unsigned long flags; ++ ++ spin_lock_irqsave(&bank->gc.bgpio_lock, flags); ++ status = bank->gc.read_reg(reg_base + GIO_STAT(bank->id)) & ++ bank->gc.read_reg(reg_base + GIO_MASK(bank->id)); ++ spin_unlock_irqrestore(&bank->gc.bgpio_lock, flags); ++ ++ return status; ++} ++ + static void brcmstb_gpio_set_imask(struct brcmstb_gpio_bank *bank, + unsigned int offset, bool enable) + { +@@ -205,11 +220,8 @@ static void brcmstb_gpio_irq_bank_handler(struct brcmstb_gpio_bank *bank) + struct irq_domain *irq_domain = bank->gc.irqdomain; + void __iomem *reg_base = priv->reg_base; + unsigned long status; +- unsigned long flags; + +- spin_lock_irqsave(&bank->gc.bgpio_lock, flags); +- while ((status = bank->gc.read_reg(reg_base + GIO_STAT(bank->id)) & +- bank->gc.read_reg(reg_base + GIO_MASK(bank->id)))) { ++ while ((status = brcmstb_gpio_get_active_irqs(bank))) { + int bit; + + for_each_set_bit(bit, &status, 32) { +@@ -224,7 +236,6 @@ static void brcmstb_gpio_irq_bank_handler(struct brcmstb_gpio_bank *bank) + generic_handle_irq(irq_find_mapping(irq_domain, bit)); + } + } +- spin_unlock_irqrestore(&bank->gc.bgpio_lock, flags); + } + + /* Each UPG GIO block has one IRQ for all banks */ +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_ucode.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_ucode.c +index 36c763310df5..684769c9a48e 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_ucode.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_ucode.c +@@ -247,6 +247,7 @@ amdgpu_ucode_get_load_type(struct amdgpu_device *adev, int load_type) + case CHIP_PITCAIRN: + case CHIP_VERDE: + case CHIP_OLAND: ++ case CHIP_HAINAN: + return AMDGPU_FW_LOAD_DIRECT; + #endif + #ifdef CONFIG_DRM_AMDGPU_CIK +diff --git a/drivers/gpu/drm/drm_dp_mst_topology.c b/drivers/gpu/drm/drm_dp_mst_topology.c +index c022ab6e84bd..2a4cf6837324 100644 +--- a/drivers/gpu/drm/drm_dp_mst_topology.c ++++ b/drivers/gpu/drm/drm_dp_mst_topology.c +@@ -1232,6 +1232,9 @@ static struct drm_dp_mst_branch *drm_dp_get_mst_branch_device(struct drm_dp_mst_ + mutex_lock(&mgr->lock); + mstb = mgr->mst_primary; + ++ if (!mstb) ++ goto out; ++ + for (i = 0; i < lct - 1; i++) { + int shift = (i % 2) ? 0 : 4; + int port_num = (rad[i / 2] >> shift) & 0xf; +diff --git a/drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_fbdev.c b/drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_fbdev.c +index b92595c477ef..8bd29075ae4e 100644 +--- a/drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_fbdev.c ++++ b/drivers/gpu/drm/hisilicon/hibmc/hibmc_drm_fbdev.c +@@ -122,6 +122,7 @@ static int hibmc_drm_fb_create(struct drm_fb_helper *helper, + hi_fbdev->fb = hibmc_framebuffer_init(priv->dev, &mode_cmd, gobj); + if (IS_ERR(hi_fbdev->fb)) { + ret = PTR_ERR(hi_fbdev->fb); ++ hi_fbdev->fb = NULL; + DRM_ERROR("failed to initialize framebuffer: %d\n", ret); + goto out_release_fbi; + } +diff --git a/drivers/gpu/drm/i915/i915_gem.c b/drivers/gpu/drm/i915/i915_gem.c +index f354cfe63f7b..1f19e6d9a717 100644 +--- a/drivers/gpu/drm/i915/i915_gem.c ++++ b/drivers/gpu/drm/i915/i915_gem.c +@@ -980,11 +980,7 @@ i915_gem_shmem_pread(struct drm_i915_gem_object *obj, + offset = offset_in_page(args->offset); + for (idx = args->offset >> PAGE_SHIFT; remain; idx++) { + struct page *page = i915_gem_object_get_page(obj, idx); +- int length; +- +- length = remain; +- if (offset + length > PAGE_SIZE) +- length = PAGE_SIZE - offset; ++ unsigned int length = min_t(u64, remain, PAGE_SIZE - offset); + + ret = shmem_pread(page, offset, length, user_data, + page_to_phys(page) & obj_do_bit17_swizzling, +@@ -1406,11 +1402,7 @@ i915_gem_shmem_pwrite(struct drm_i915_gem_object *obj, + offset = offset_in_page(args->offset); + for (idx = args->offset >> PAGE_SHIFT; remain; idx++) { + struct page *page = i915_gem_object_get_page(obj, idx); +- int length; +- +- length = remain; +- if (offset + length > PAGE_SIZE) +- length = PAGE_SIZE - offset; ++ unsigned int length = min_t(u64, remain, PAGE_SIZE - offset); + + ret = shmem_pwrite(page, offset, length, user_data, + page_to_phys(page) & obj_do_bit17_swizzling, +diff --git a/drivers/gpu/drm/i915/i915_gem_gtt.h b/drivers/gpu/drm/i915/i915_gem_gtt.h +index b4e3aa7c0ce1..0dbbe840f5f0 100644 +--- a/drivers/gpu/drm/i915/i915_gem_gtt.h ++++ b/drivers/gpu/drm/i915/i915_gem_gtt.h +@@ -584,20 +584,20 @@ int i915_gem_gtt_insert(struct i915_address_space *vm, + u64 start, u64 end, unsigned int flags); + + /* Flags used by pin/bind&friends. */ +-#define PIN_NONBLOCK BIT(0) +-#define PIN_MAPPABLE BIT(1) +-#define PIN_ZONE_4G BIT(2) +-#define PIN_NONFAULT BIT(3) +-#define PIN_NOEVICT BIT(4) +- +-#define PIN_MBZ BIT(5) /* I915_VMA_PIN_OVERFLOW */ +-#define PIN_GLOBAL BIT(6) /* I915_VMA_GLOBAL_BIND */ +-#define PIN_USER BIT(7) /* I915_VMA_LOCAL_BIND */ +-#define PIN_UPDATE BIT(8) +- +-#define PIN_HIGH BIT(9) +-#define PIN_OFFSET_BIAS BIT(10) +-#define PIN_OFFSET_FIXED BIT(11) ++#define PIN_NONBLOCK BIT_ULL(0) ++#define PIN_MAPPABLE BIT_ULL(1) ++#define PIN_ZONE_4G BIT_ULL(2) ++#define PIN_NONFAULT BIT_ULL(3) ++#define PIN_NOEVICT BIT_ULL(4) ++ ++#define PIN_MBZ BIT_ULL(5) /* I915_VMA_PIN_OVERFLOW */ ++#define PIN_GLOBAL BIT_ULL(6) /* I915_VMA_GLOBAL_BIND */ ++#define PIN_USER BIT_ULL(7) /* I915_VMA_LOCAL_BIND */ ++#define PIN_UPDATE BIT_ULL(8) ++ ++#define PIN_HIGH BIT_ULL(9) ++#define PIN_OFFSET_BIAS BIT_ULL(10) ++#define PIN_OFFSET_FIXED BIT_ULL(11) + #define PIN_OFFSET_MASK (-I915_GTT_PAGE_SIZE) + + #endif +diff --git a/drivers/gpu/drm/i915/intel_audio.c b/drivers/gpu/drm/i915/intel_audio.c +index 9240fa79de7c..bc9f735395bc 100644 +--- a/drivers/gpu/drm/i915/intel_audio.c ++++ b/drivers/gpu/drm/i915/intel_audio.c +@@ -134,6 +134,9 @@ static const struct { + /* HDMI N/CTS table */ + #define TMDS_297M 297000 + #define TMDS_296M 296703 ++#define TMDS_594M 594000 ++#define TMDS_593M 593407 ++ + static const struct { + int sample_rate; + int clock; +@@ -154,6 +157,20 @@ static const struct { + { 176400, TMDS_297M, 18816, 247500 }, + { 192000, TMDS_296M, 23296, 281250 }, + { 192000, TMDS_297M, 20480, 247500 }, ++ { 44100, TMDS_593M, 8918, 937500 }, ++ { 44100, TMDS_594M, 9408, 990000 }, ++ { 48000, TMDS_593M, 5824, 562500 }, ++ { 48000, TMDS_594M, 6144, 594000 }, ++ { 32000, TMDS_593M, 5824, 843750 }, ++ { 32000, TMDS_594M, 3072, 445500 }, ++ { 88200, TMDS_593M, 17836, 937500 }, ++ { 88200, TMDS_594M, 18816, 990000 }, ++ { 96000, TMDS_593M, 11648, 562500 }, ++ { 96000, TMDS_594M, 12288, 594000 }, ++ { 176400, TMDS_593M, 35672, 937500 }, ++ { 176400, TMDS_594M, 37632, 990000 }, ++ { 192000, TMDS_593M, 23296, 562500 }, ++ { 192000, TMDS_594M, 24576, 594000 }, + }; + + /* get AUD_CONFIG_PIXEL_CLOCK_HDMI_* value for mode */ +diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c +index 2006ab44fbf9..944cb3c2ba5c 100644 +--- a/drivers/gpu/drm/i915/intel_display.c ++++ b/drivers/gpu/drm/i915/intel_display.c +@@ -14829,13 +14829,9 @@ static void intel_sanitize_crtc(struct intel_crtc *crtc, + I915_READ(reg) & ~PIPECONF_FRAME_START_DELAY_MASK); + } + +- /* restore vblank interrupts to correct state */ +- drm_crtc_vblank_reset(&crtc->base); + if (crtc->active) { + struct intel_plane *plane; + +- drm_crtc_vblank_on(&crtc->base); +- + /* Disable everything but the primary plane */ + for_each_intel_plane_on_crtc(dev, crtc, plane) { + const struct intel_plane_state *plane_state = +@@ -15148,7 +15144,6 @@ intel_modeset_setup_hw_state(struct drm_device *dev, + struct drm_modeset_acquire_ctx *ctx) + { + struct drm_i915_private *dev_priv = to_i915(dev); +- enum pipe pipe; + struct intel_crtc *crtc; + struct intel_encoder *encoder; + int i; +@@ -15167,15 +15162,23 @@ intel_modeset_setup_hw_state(struct drm_device *dev, + /* HW state is read out, now we need to sanitize this mess. */ + get_encoder_power_domains(dev_priv); + +- intel_sanitize_plane_mapping(dev_priv); ++ /* ++ * intel_sanitize_plane_mapping() may need to do vblank ++ * waits, so we need vblank interrupts restored beforehand. ++ */ ++ for_each_intel_crtc(&dev_priv->drm, crtc) { ++ drm_crtc_vblank_reset(&crtc->base); + +- for_each_intel_encoder(dev, encoder) { +- intel_sanitize_encoder(encoder); ++ if (crtc->active) ++ drm_crtc_vblank_on(&crtc->base); + } + +- for_each_pipe(dev_priv, pipe) { +- crtc = intel_get_crtc_for_pipe(dev_priv, pipe); ++ intel_sanitize_plane_mapping(dev_priv); + ++ for_each_intel_encoder(dev, encoder) ++ intel_sanitize_encoder(encoder); ++ ++ for_each_intel_crtc(&dev_priv->drm, crtc) { + intel_sanitize_crtc(crtc, ctx); + intel_dump_pipe_config(crtc, crtc->config, + "[setup_hw_state]"); +diff --git a/drivers/gpu/drm/i915/intel_dp_mst.c b/drivers/gpu/drm/i915/intel_dp_mst.c +index 93fc8ab9bb31..b83a8f2b2a3a 100644 +--- a/drivers/gpu/drm/i915/intel_dp_mst.c ++++ b/drivers/gpu/drm/i915/intel_dp_mst.c +@@ -37,11 +37,11 @@ static bool intel_dp_mst_compute_config(struct intel_encoder *encoder, + struct intel_dp_mst_encoder *intel_mst = enc_to_mst(&encoder->base); + struct intel_digital_port *intel_dig_port = intel_mst->primary; + struct intel_dp *intel_dp = &intel_dig_port->dp; +- struct intel_connector *connector = +- to_intel_connector(conn_state->connector); ++ struct drm_connector *connector = conn_state->connector; ++ void *port = to_intel_connector(connector)->port; + struct drm_atomic_state *state = pipe_config->base.state; + int bpp; +- int lane_count, slots; ++ int lane_count, slots = 0; + const struct drm_display_mode *adjusted_mode = &pipe_config->base.adjusted_mode; + int mst_pbn; + bool reduce_m_n = drm_dp_has_quirk(&intel_dp->desc, +@@ -66,17 +66,23 @@ static bool intel_dp_mst_compute_config(struct intel_encoder *encoder, + + pipe_config->port_clock = intel_dp_max_link_rate(intel_dp); + +- if (drm_dp_mst_port_has_audio(&intel_dp->mst_mgr, connector->port)) ++ if (drm_dp_mst_port_has_audio(&intel_dp->mst_mgr, port)) + pipe_config->has_audio = true; + + mst_pbn = drm_dp_calc_pbn_mode(adjusted_mode->crtc_clock, bpp); + pipe_config->pbn = mst_pbn; + +- slots = drm_dp_atomic_find_vcpi_slots(state, &intel_dp->mst_mgr, +- connector->port, mst_pbn); +- if (slots < 0) { +- DRM_DEBUG_KMS("failed finding vcpi slots:%d\n", slots); +- return false; ++ /* Zombie connectors can't have VCPI slots */ ++ if (READ_ONCE(connector->registered)) { ++ slots = drm_dp_atomic_find_vcpi_slots(state, ++ &intel_dp->mst_mgr, ++ port, ++ mst_pbn); ++ if (slots < 0) { ++ DRM_DEBUG_KMS("failed finding vcpi slots:%d\n", ++ slots); ++ return false; ++ } + } + + intel_link_compute_m_n(bpp, lane_count, +@@ -311,9 +317,8 @@ static int intel_dp_mst_get_ddc_modes(struct drm_connector *connector) + struct edid *edid; + int ret; + +- if (!intel_dp) { ++ if (!READ_ONCE(connector->registered)) + return intel_connector_update_modes(connector, NULL); +- } + + edid = drm_dp_mst_get_edid(connector, &intel_dp->mst_mgr, intel_connector->port); + ret = intel_connector_update_modes(connector, edid); +@@ -328,9 +333,10 @@ intel_dp_mst_detect(struct drm_connector *connector, bool force) + struct intel_connector *intel_connector = to_intel_connector(connector); + struct intel_dp *intel_dp = intel_connector->mst_port; + +- if (!intel_dp) ++ if (!READ_ONCE(connector->registered)) + return connector_status_disconnected; +- return drm_dp_mst_detect_port(connector, &intel_dp->mst_mgr, intel_connector->port); ++ return drm_dp_mst_detect_port(connector, &intel_dp->mst_mgr, ++ intel_connector->port); + } + + static void +@@ -370,7 +376,7 @@ intel_dp_mst_mode_valid(struct drm_connector *connector, + int bpp = 24; /* MST uses fixed bpp */ + int max_rate, mode_rate, max_lanes, max_link_clock; + +- if (!intel_dp) ++ if (!READ_ONCE(connector->registered)) + return MODE_ERROR; + + max_link_clock = intel_dp_max_link_rate(intel_dp); +@@ -399,7 +405,7 @@ static struct drm_encoder *intel_mst_atomic_best_encoder(struct drm_connector *c + struct intel_dp *intel_dp = intel_connector->mst_port; + struct intel_crtc *crtc = to_intel_crtc(state->crtc); + +- if (!intel_dp) ++ if (!READ_ONCE(connector->registered)) + return NULL; + return &intel_dp->mst_encoders[crtc->pipe]->base.base; + } +@@ -491,7 +497,6 @@ static void intel_dp_register_mst_connector(struct drm_connector *connector) + static void intel_dp_destroy_mst_connector(struct drm_dp_mst_topology_mgr *mgr, + struct drm_connector *connector) + { +- struct intel_connector *intel_connector = to_intel_connector(connector); + struct drm_i915_private *dev_priv = to_i915(connector->dev); + + drm_connector_unregister(connector); +@@ -499,10 +504,6 @@ static void intel_dp_destroy_mst_connector(struct drm_dp_mst_topology_mgr *mgr, + if (dev_priv->fbdev) + drm_fb_helper_remove_one_connector(&dev_priv->fbdev->helper, + connector); +- /* prevent race with the check in ->detect */ +- drm_modeset_lock(&connector->dev->mode_config.connection_mutex, NULL); +- intel_connector->mst_port = NULL; +- drm_modeset_unlock(&connector->dev->mode_config.connection_mutex); + + drm_connector_unreference(connector); + DRM_DEBUG_KMS("\n"); +diff --git a/drivers/gpu/drm/i915/intel_lpe_audio.c b/drivers/gpu/drm/i915/intel_lpe_audio.c +index 8a541d0e3e80..30280323e1d8 100644 +--- a/drivers/gpu/drm/i915/intel_lpe_audio.c ++++ b/drivers/gpu/drm/i915/intel_lpe_audio.c +@@ -303,8 +303,10 @@ void intel_lpe_audio_teardown(struct drm_i915_private *dev_priv) + lpe_audio_platdev_destroy(dev_priv); + + irq_free_desc(dev_priv->lpe_audio.irq); +-} + ++ dev_priv->lpe_audio.irq = -1; ++ dev_priv->lpe_audio.platdev = NULL; ++} + + /** + * intel_lpe_audio_notify() - notify lpe audio event +diff --git a/drivers/gpu/drm/i915/intel_lrc.c b/drivers/gpu/drm/i915/intel_lrc.c +index d638b641b760..0775e71ea95b 100644 +--- a/drivers/gpu/drm/i915/intel_lrc.c ++++ b/drivers/gpu/drm/i915/intel_lrc.c +@@ -325,7 +325,8 @@ static u64 execlists_update_context(struct drm_i915_gem_request *rq) + + reg_state[CTX_RING_TAIL+1] = intel_ring_set_tail(rq->ring, rq->tail); + +- /* True 32b PPGTT with dynamic page allocation: update PDP ++ /* ++ * True 32b PPGTT with dynamic page allocation: update PDP + * registers and point the unallocated PDPs to scratch page. + * PML4 is allocated during ppgtt init, so this is not needed + * in 48-bit mode. +@@ -333,6 +334,17 @@ static u64 execlists_update_context(struct drm_i915_gem_request *rq) + if (ppgtt && !i915_vm_is_48bit(&ppgtt->base)) + execlists_update_context_pdps(ppgtt, reg_state); + ++ /* ++ * Make sure the context image is complete before we submit it to HW. ++ * ++ * Ostensibly, writes (including the WCB) should be flushed prior to ++ * an uncached write such as our mmio register access, the empirical ++ * evidence (esp. on Braswell) suggests that the WC write into memory ++ * may not be visible to the HW prior to the completion of the UC ++ * register write and that we may begin execution from the context ++ * before its image is complete leading to invalid PD chasing. ++ */ ++ wmb(); + return ce->lrc_desc; + } + +diff --git a/drivers/gpu/drm/nouveau/nouveau_backlight.c b/drivers/gpu/drm/nouveau/nouveau_backlight.c +index 408b955e5c39..6dd72bc32897 100644 +--- a/drivers/gpu/drm/nouveau/nouveau_backlight.c ++++ b/drivers/gpu/drm/nouveau/nouveau_backlight.c +@@ -116,7 +116,7 @@ nv40_backlight_init(struct drm_connector *connector) + &nv40_bl_ops, &props); + + if (IS_ERR(bd)) { +- if (bl_connector.id > 0) ++ if (bl_connector.id >= 0) + ida_simple_remove(&bl_ida, bl_connector.id); + return PTR_ERR(bd); + } +@@ -249,7 +249,7 @@ nv50_backlight_init(struct drm_connector *connector) + nv_encoder, ops, &props); + + if (IS_ERR(bd)) { +- if (bl_connector.id > 0) ++ if (bl_connector.id >= 0) + ida_simple_remove(&bl_ida, bl_connector.id); + return PTR_ERR(bd); + } +diff --git a/drivers/gpu/drm/omapdrm/omap_dmm_tiler.c b/drivers/gpu/drm/omapdrm/omap_dmm_tiler.c +index df05fe53c399..32901c6fe3df 100644 +--- a/drivers/gpu/drm/omapdrm/omap_dmm_tiler.c ++++ b/drivers/gpu/drm/omapdrm/omap_dmm_tiler.c +@@ -273,6 +273,17 @@ static int dmm_txn_commit(struct dmm_txn *txn, bool wait) + } + + txn->last_pat->next_pa = 0; ++ /* ensure that the written descriptors are visible to DMM */ ++ wmb(); ++ ++ /* ++ * NOTE: the wmb() above should be enough, but there seems to be a bug ++ * in OMAP's memory barrier implementation, which in some rare cases may ++ * cause the writes not to be observable after wmb(). ++ */ ++ ++ /* read back to ensure the data is in RAM */ ++ readl(&txn->last_pat->next_pa); + + /* write to PAT_DESCR to clear out any pending transaction */ + dmm_write(dmm, 0x0, reg[PAT_DESCR][engine->id]); +diff --git a/drivers/gpu/drm/rockchip/rockchip_drm_drv.c b/drivers/gpu/drm/rockchip/rockchip_drm_drv.c +index ff3d0f5efbb1..4cacb03f6733 100644 +--- a/drivers/gpu/drm/rockchip/rockchip_drm_drv.c ++++ b/drivers/gpu/drm/rockchip/rockchip_drm_drv.c +@@ -425,6 +425,11 @@ static int rockchip_drm_platform_remove(struct platform_device *pdev) + return 0; + } + ++static void rockchip_drm_platform_shutdown(struct platform_device *pdev) ++{ ++ rockchip_drm_platform_remove(pdev); ++} ++ + static const struct of_device_id rockchip_drm_dt_ids[] = { + { .compatible = "rockchip,display-subsystem", }, + { /* sentinel */ }, +@@ -434,6 +439,7 @@ MODULE_DEVICE_TABLE(of, rockchip_drm_dt_ids); + static struct platform_driver rockchip_drm_platform_driver = { + .probe = rockchip_drm_platform_probe, + .remove = rockchip_drm_platform_remove, ++ .shutdown = rockchip_drm_platform_shutdown, + .driver = { + .name = "rockchip-drm", + .of_match_table = rockchip_drm_dt_ids, +diff --git a/drivers/media/i2c/ov7670.c b/drivers/media/i2c/ov7670.c +index e88549f0e704..39ff73a6a807 100644 +--- a/drivers/media/i2c/ov7670.c ++++ b/drivers/media/i2c/ov7670.c +@@ -1612,23 +1612,29 @@ static int ov7670_probe(struct i2c_client *client, + info->pclk_hb_disable = true; + } + +- info->clk = devm_clk_get(&client->dev, "xclk"); +- if (IS_ERR(info->clk)) +- return PTR_ERR(info->clk); +- ret = clk_prepare_enable(info->clk); +- if (ret) +- return ret; ++ info->clk = devm_clk_get(&client->dev, "xclk"); /* optional */ ++ if (IS_ERR(info->clk)) { ++ ret = PTR_ERR(info->clk); ++ if (ret == -ENOENT) ++ info->clk = NULL; ++ else ++ return ret; ++ } ++ if (info->clk) { ++ ret = clk_prepare_enable(info->clk); ++ if (ret) ++ return ret; ++ info->clock_speed = clk_get_rate(info->clk) / 1000000; ++ if (info->clock_speed < 10 || info->clock_speed > 48) { ++ ret = -EINVAL; ++ goto clk_disable; ++ } ++ } + + ret = ov7670_init_gpio(client, info); + if (ret) + goto clk_disable; + +- info->clock_speed = clk_get_rate(info->clk) / 1000000; +- if (info->clock_speed < 10 || info->clock_speed > 48) { +- ret = -EINVAL; +- goto clk_disable; +- } +- + /* Make sure it's an ov7670 */ + ret = ov7670_detect(sd); + if (ret) { +diff --git a/drivers/media/i2c/tvp5150.c b/drivers/media/i2c/tvp5150.c +index 4d3e97f97c76..b41f7fafb731 100644 +--- a/drivers/media/i2c/tvp5150.c ++++ b/drivers/media/i2c/tvp5150.c +@@ -900,9 +900,6 @@ static int tvp5150_set_selection(struct v4l2_subdev *sd, + + /* tvp5150 has some special limits */ + rect.left = clamp(rect.left, 0, TVP5150_MAX_CROP_LEFT); +- rect.width = clamp_t(unsigned int, rect.width, +- TVP5150_H_MAX - TVP5150_MAX_CROP_LEFT - rect.left, +- TVP5150_H_MAX - rect.left); + rect.top = clamp(rect.top, 0, TVP5150_MAX_CROP_TOP); + + /* Calculate height based on current standard */ +@@ -916,9 +913,16 @@ static int tvp5150_set_selection(struct v4l2_subdev *sd, + else + hmax = TVP5150_V_MAX_OTHERS; + +- rect.height = clamp_t(unsigned int, rect.height, ++ /* ++ * alignments: ++ * - width = 2 due to UYVY colorspace ++ * - height, image = no special alignment ++ */ ++ v4l_bound_align_image(&rect.width, ++ TVP5150_H_MAX - TVP5150_MAX_CROP_LEFT - rect.left, ++ TVP5150_H_MAX - rect.left, 1, &rect.height, + hmax - TVP5150_MAX_CROP_TOP - rect.top, +- hmax - rect.top); ++ hmax - rect.top, 0, 0); + + tvp5150_write(sd, TVP5150_VERT_BLANKING_START, rect.top); + tvp5150_write(sd, TVP5150_VERT_BLANKING_STOP, +diff --git a/drivers/media/pci/cx23885/altera-ci.c b/drivers/media/pci/cx23885/altera-ci.c +index 5c94e312cba3..f77254cc16bf 100644 +--- a/drivers/media/pci/cx23885/altera-ci.c ++++ b/drivers/media/pci/cx23885/altera-ci.c +@@ -665,6 +665,10 @@ static int altera_hw_filt_init(struct altera_ci_config *config, int hw_filt_nr) + } + + temp_int = append_internal(inter); ++ if (!temp_int) { ++ ret = -ENOMEM; ++ goto err; ++ } + inter->filts_used = 1; + inter->dev = config->dev; + inter->fpga_rw = config->fpga_rw; +@@ -699,6 +703,7 @@ err: + __func__, ret); + + kfree(pid_filt); ++ kfree(inter); + + return ret; + } +@@ -733,6 +738,10 @@ int altera_ci_init(struct altera_ci_config *config, int ci_nr) + } + + temp_int = append_internal(inter); ++ if (!temp_int) { ++ ret = -ENOMEM; ++ goto err; ++ } + inter->cis_used = 1; + inter->dev = config->dev; + inter->fpga_rw = config->fpga_rw; +@@ -801,6 +810,7 @@ err: + ci_dbg_print("%s: Cannot initialize CI: Error %d.\n", __func__, ret); + + kfree(state); ++ kfree(inter); + + return ret; + } +diff --git a/drivers/media/platform/coda/coda-common.c b/drivers/media/platform/coda/coda-common.c +index 15eb5dc4dff9..99d138d3f87f 100644 +--- a/drivers/media/platform/coda/coda-common.c ++++ b/drivers/media/platform/coda/coda-common.c +@@ -1686,7 +1686,8 @@ static int coda_s_ctrl(struct v4l2_ctrl *ctrl) + break; + case V4L2_CID_MPEG_VIDEO_H264_PROFILE: + /* TODO: switch between baseline and constrained baseline */ +- ctx->params.h264_profile_idc = 66; ++ if (ctx->inst_type == CODA_INST_ENCODER) ++ ctx->params.h264_profile_idc = 66; + break; + case V4L2_CID_MPEG_VIDEO_H264_LEVEL: + /* nothing to do, this is set by the encoder */ +diff --git a/drivers/mtd/devices/Kconfig b/drivers/mtd/devices/Kconfig +index 6def5445e03e..64731e3221ef 100644 +--- a/drivers/mtd/devices/Kconfig ++++ b/drivers/mtd/devices/Kconfig +@@ -206,7 +206,7 @@ comment "Disk-On-Chip Device Drivers" + config MTD_DOCG3 + tristate "M-Systems Disk-On-Chip G3" + select BCH +- select BCH_CONST_PARAMS ++ select BCH_CONST_PARAMS if !MTD_NAND_BCH + select BITREVERSE + ---help--- + This provides an MTD device driver for the M-Systems DiskOnChip +diff --git a/drivers/nvme/target/loop.c b/drivers/nvme/target/loop.c +index 02aff5cc48bf..3388d2788fe0 100644 +--- a/drivers/nvme/target/loop.c ++++ b/drivers/nvme/target/loop.c +@@ -183,15 +183,12 @@ static blk_status_t nvme_loop_queue_rq(struct blk_mq_hw_ctx *hctx, + if (ret) + return ret; + ++ blk_mq_start_request(req); + iod->cmd.common.flags |= NVME_CMD_SGL_METABUF; + iod->req.port = nvmet_loop_port; + if (!nvmet_req_init(&iod->req, &queue->nvme_cq, +- &queue->nvme_sq, &nvme_loop_ops)) { +- nvme_cleanup_cmd(req); +- blk_mq_start_request(req); +- nvme_loop_queue_response(&iod->req); ++ &queue->nvme_sq, &nvme_loop_ops)) + return BLK_STS_OK; +- } + + if (blk_rq_bytes(req)) { + iod->sg_table.sgl = iod->first_sgl; +@@ -204,8 +201,6 @@ static blk_status_t nvme_loop_queue_rq(struct blk_mq_hw_ctx *hctx, + iod->req.sg_cnt = blk_rq_map_sg(req->q, req, iod->sg_table.sgl); + } + +- blk_mq_start_request(req); +- + schedule_work(&iod->work); + return BLK_STS_OK; + } +diff --git a/drivers/of/of_numa.c b/drivers/of/of_numa.c +index 2db1f7a04baf..0b29ee9ee8c3 100644 +--- a/drivers/of/of_numa.c ++++ b/drivers/of/of_numa.c +@@ -126,9 +126,14 @@ static int __init of_numa_parse_distance_map_v1(struct device_node *map) + distance = of_read_number(matrix, 1); + matrix++; + ++ if ((nodea == nodeb && distance != LOCAL_DISTANCE) || ++ (nodea != nodeb && distance <= LOCAL_DISTANCE)) { ++ pr_err("Invalid distance[node%d -> node%d] = %d\n", ++ nodea, nodeb, distance); ++ return -EINVAL; ++ } ++ + numa_set_distance(nodea, nodeb, distance); +- pr_debug("distance[node%d -> node%d] = %d\n", +- nodea, nodeb, distance); + + /* Set default distance of node B->A same as A->B */ + if (nodeb > nodea) +diff --git a/drivers/rtc/hctosys.c b/drivers/rtc/hctosys.c +index e79f2a181ad2..b9ec4a16db1f 100644 +--- a/drivers/rtc/hctosys.c ++++ b/drivers/rtc/hctosys.c +@@ -50,8 +50,10 @@ static int __init rtc_hctosys(void) + tv64.tv_sec = rtc_tm_to_time64(&tm); + + #if BITS_PER_LONG == 32 +- if (tv64.tv_sec > INT_MAX) ++ if (tv64.tv_sec > INT_MAX) { ++ err = -ERANGE; + goto err_read; ++ } + #endif + + err = do_settimeofday64(&tv64); +diff --git a/drivers/scsi/qla2xxx/qla_init.c b/drivers/scsi/qla2xxx/qla_init.c +index 0e19f6bc24ff..aef1e1a55535 100644 +--- a/drivers/scsi/qla2xxx/qla_init.c ++++ b/drivers/scsi/qla2xxx/qla_init.c +@@ -1511,25 +1511,15 @@ qla24xx_handle_plogi_done_event(struct scsi_qla_host *vha, struct event_arg *ea) + cid.b.rsvd_1 = 0; + + ql_dbg(ql_dbg_disc, vha, 0x20ec, +- "%s %d %8phC LoopID 0x%x in use post gnl\n", ++ "%s %d %8phC lid %#x in use with pid %06x post gnl\n", + __func__, __LINE__, ea->fcport->port_name, +- ea->fcport->loop_id); ++ ea->fcport->loop_id, cid.b24); + +- if (IS_SW_RESV_ADDR(cid)) { +- set_bit(ea->fcport->loop_id, vha->hw->loop_id_map); +- ea->fcport->loop_id = FC_NO_LOOP_ID; +- } else { +- qla2x00_clear_loop_id(ea->fcport); +- } ++ set_bit(ea->fcport->loop_id, vha->hw->loop_id_map); ++ ea->fcport->loop_id = FC_NO_LOOP_ID; + qla24xx_post_gnl_work(vha, ea->fcport); + break; + case MBS_PORT_ID_USED: +- ql_dbg(ql_dbg_disc, vha, 0x20ed, +- "%s %d %8phC NPortId %02x%02x%02x inuse post gidpn\n", +- __func__, __LINE__, ea->fcport->port_name, +- ea->fcport->d_id.b.domain, ea->fcport->d_id.b.area, +- ea->fcport->d_id.b.al_pa); +- + lid = ea->iop[1] & 0xffff; + qlt_find_sess_invalidate_other(vha, + wwn_to_u64(ea->fcport->port_name), +@@ -4246,6 +4236,7 @@ qla2x00_alloc_fcport(scsi_qla_host_t *vha, gfp_t flags) + fcport->loop_id = FC_NO_LOOP_ID; + qla2x00_set_fcport_state(fcport, FCS_UNCONFIGURED); + fcport->supported_classes = FC_COS_UNSPECIFIED; ++ fcport->fp_speed = PORT_SPEED_UNKNOWN; + + fcport->ct_desc.ct_sns = dma_alloc_coherent(&vha->hw->pdev->dev, + sizeof(struct ct_sns_pkt), &fcport->ct_desc.ct_sns_dma, +@@ -6077,7 +6068,7 @@ qla2x00_abort_isp(scsi_qla_host_t *vha) + * The next call disables the board + * completely. + */ +- ha->isp_ops->reset_adapter(vha); ++ qla2x00_abort_isp_cleanup(vha); + vha->flags.online = 0; + clear_bit(ISP_ABORT_RETRY, + &vha->dpc_flags); +@@ -7591,7 +7582,6 @@ qla81xx_nvram_config(scsi_qla_host_t *vha) + } + icb->firmware_options_2 &= cpu_to_le32( + ~(BIT_3 | BIT_2 | BIT_1 | BIT_0)); +- vha->flags.process_response_queue = 0; + if (ha->zio_mode != QLA_ZIO_DISABLED) { + ha->zio_mode = QLA_ZIO_MODE_6; + +@@ -7603,7 +7593,6 @@ qla81xx_nvram_config(scsi_qla_host_t *vha) + icb->firmware_options_2 |= cpu_to_le32( + (uint32_t)ha->zio_mode); + icb->interrupt_delay_timer = cpu_to_le16(ha->zio_timer); +- vha->flags.process_response_queue = 1; + } + + /* enable RIDA Format2 */ +diff --git a/drivers/scsi/qla2xxx/qla_iocb.c b/drivers/scsi/qla2xxx/qla_iocb.c +index 8d579bf0fc81..85cb4e30f742 100644 +--- a/drivers/scsi/qla2xxx/qla_iocb.c ++++ b/drivers/scsi/qla2xxx/qla_iocb.c +@@ -1524,12 +1524,6 @@ qla24xx_start_scsi(srb_t *sp) + + /* Set chip new ring index. */ + WRT_REG_DWORD(req->req_q_in, req->ring_index); +- RD_REG_DWORD_RELAXED(&ha->iobase->isp24.hccr); +- +- /* Manage unprocessed RIO/ZIO commands in response queue. */ +- if (vha->flags.process_response_queue && +- rsp->ring_ptr->signature != RESPONSE_PROCESSED) +- qla24xx_process_response_queue(vha, rsp); + + spin_unlock_irqrestore(&ha->hardware_lock, flags); + return QLA_SUCCESS; +@@ -1723,12 +1717,6 @@ qla24xx_dif_start_scsi(srb_t *sp) + + /* Set chip new ring index. */ + WRT_REG_DWORD(req->req_q_in, req->ring_index); +- RD_REG_DWORD_RELAXED(&ha->iobase->isp24.hccr); +- +- /* Manage unprocessed RIO/ZIO commands in response queue. */ +- if (vha->flags.process_response_queue && +- rsp->ring_ptr->signature != RESPONSE_PROCESSED) +- qla24xx_process_response_queue(vha, rsp); + + spin_unlock_irqrestore(&ha->hardware_lock, flags); + +@@ -1878,11 +1866,6 @@ qla2xxx_start_scsi_mq(srb_t *sp) + /* Set chip new ring index. */ + WRT_REG_DWORD(req->req_q_in, req->ring_index); + +- /* Manage unprocessed RIO/ZIO commands in response queue. */ +- if (vha->flags.process_response_queue && +- rsp->ring_ptr->signature != RESPONSE_PROCESSED) +- qla24xx_process_response_queue(vha, rsp); +- + spin_unlock_irqrestore(&qpair->qp_lock, flags); + return QLA_SUCCESS; + +diff --git a/drivers/scsi/qla2xxx/qla_mbx.c b/drivers/scsi/qla2xxx/qla_mbx.c +index 2d909e12e23a..929ec087b8eb 100644 +--- a/drivers/scsi/qla2xxx/qla_mbx.c ++++ b/drivers/scsi/qla2xxx/qla_mbx.c +@@ -3682,10 +3682,7 @@ qla2x00_set_idma_speed(scsi_qla_host_t *vha, uint16_t loop_id, + mcp->mb[0] = MBC_PORT_PARAMS; + mcp->mb[1] = loop_id; + mcp->mb[2] = BIT_0; +- if (IS_CNA_CAPABLE(vha->hw)) +- mcp->mb[3] = port_speed & (BIT_5|BIT_4|BIT_3|BIT_2|BIT_1|BIT_0); +- else +- mcp->mb[3] = port_speed & (BIT_2|BIT_1|BIT_0); ++ mcp->mb[3] = port_speed & (BIT_5|BIT_4|BIT_3|BIT_2|BIT_1|BIT_0); + mcp->mb[9] = vha->vp_idx; + mcp->out_mb = MBX_9|MBX_3|MBX_2|MBX_1|MBX_0; + mcp->in_mb = MBX_3|MBX_1|MBX_0; +diff --git a/drivers/scsi/qla2xxx/qla_target.c b/drivers/scsi/qla2xxx/qla_target.c +index d6fe08de59a0..87e04c4a4982 100644 +--- a/drivers/scsi/qla2xxx/qla_target.c ++++ b/drivers/scsi/qla2xxx/qla_target.c +@@ -1203,7 +1203,8 @@ void qlt_schedule_sess_for_deletion(struct fc_port *sess, + qla24xx_chk_fcp_state(sess); + + ql_dbg(ql_dbg_tgt, sess->vha, 0xe001, +- "Scheduling sess %p for deletion\n", sess); ++ "Scheduling sess %p for deletion %8phC\n", ++ sess, sess->port_name); + + INIT_WORK(&sess->del_work, qla24xx_delete_sess_fn); + queue_work(sess->vha->hw->wq, &sess->del_work); +diff --git a/drivers/scsi/qla2xxx/tcm_qla2xxx.c b/drivers/scsi/qla2xxx/tcm_qla2xxx.c +index 3f82ea1b72dc..9465acd18df0 100644 +--- a/drivers/scsi/qla2xxx/tcm_qla2xxx.c ++++ b/drivers/scsi/qla2xxx/tcm_qla2xxx.c +@@ -693,10 +693,6 @@ static int tcm_qla2xxx_queue_status(struct se_cmd *se_cmd) + cmd->sg_cnt = 0; + cmd->offset = 0; + cmd->dma_data_direction = target_reverse_dma_direction(se_cmd); +- if (cmd->trc_flags & TRC_XMIT_STATUS) { +- pr_crit("Multiple calls for status = %p.\n", cmd); +- dump_stack(); +- } + cmd->trc_flags |= TRC_XMIT_STATUS; + + if (se_cmd->data_direction == DMA_FROM_DEVICE) { +diff --git a/drivers/scsi/scsi_lib.c b/drivers/scsi/scsi_lib.c +index bfd8f12d4e9a..7f505c027ce7 100644 +--- a/drivers/scsi/scsi_lib.c ++++ b/drivers/scsi/scsi_lib.c +@@ -683,6 +683,12 @@ static bool scsi_end_request(struct request *req, blk_status_t error, + */ + scsi_mq_uninit_cmd(cmd); + ++ /* ++ * queue is still alive, so grab the ref for preventing it ++ * from being cleaned up during running queue. ++ */ ++ percpu_ref_get(&q->q_usage_counter); ++ + __blk_mq_end_request(req, error); + + if (scsi_target(sdev)->single_lun || +@@ -690,6 +696,8 @@ static bool scsi_end_request(struct request *req, blk_status_t error, + kblockd_schedule_work(&sdev->requeue_work); + else + blk_mq_run_hw_queues(q, true); ++ ++ percpu_ref_put(&q->q_usage_counter); + } else { + unsigned long flags; + +diff --git a/drivers/soc/ti/knav_qmss.h b/drivers/soc/ti/knav_qmss.h +index 905b974d1bdc..4686192e719e 100644 +--- a/drivers/soc/ti/knav_qmss.h ++++ b/drivers/soc/ti/knav_qmss.h +@@ -321,8 +321,8 @@ struct knav_range_ops { + }; + + struct knav_irq_info { +- int irq; +- u32 cpu_map; ++ int irq; ++ struct cpumask *cpu_mask; + }; + + struct knav_range_info { +diff --git a/drivers/soc/ti/knav_qmss_acc.c b/drivers/soc/ti/knav_qmss_acc.c +index 3d7225f4e77f..672aebe1e378 100644 +--- a/drivers/soc/ti/knav_qmss_acc.c ++++ b/drivers/soc/ti/knav_qmss_acc.c +@@ -205,18 +205,18 @@ static int knav_range_setup_acc_irq(struct knav_range_info *range, + { + struct knav_device *kdev = range->kdev; + struct knav_acc_channel *acc; +- unsigned long cpu_map; ++ struct cpumask *cpu_mask; + int ret = 0, irq; + u32 old, new; + + if (range->flags & RANGE_MULTI_QUEUE) { + acc = range->acc; + irq = range->irqs[0].irq; +- cpu_map = range->irqs[0].cpu_map; ++ cpu_mask = range->irqs[0].cpu_mask; + } else { + acc = range->acc + queue; + irq = range->irqs[queue].irq; +- cpu_map = range->irqs[queue].cpu_map; ++ cpu_mask = range->irqs[queue].cpu_mask; + } + + old = acc->open_mask; +@@ -239,8 +239,8 @@ static int knav_range_setup_acc_irq(struct knav_range_info *range, + acc->name, acc->name); + ret = request_irq(irq, knav_acc_int_handler, 0, acc->name, + range); +- if (!ret && cpu_map) { +- ret = irq_set_affinity_hint(irq, to_cpumask(&cpu_map)); ++ if (!ret && cpu_mask) { ++ ret = irq_set_affinity_hint(irq, cpu_mask); + if (ret) { + dev_warn(range->kdev->dev, + "Failed to set IRQ affinity\n"); +diff --git a/drivers/soc/ti/knav_qmss_queue.c b/drivers/soc/ti/knav_qmss_queue.c +index 39225de9d7f1..9879ca5f8c5f 100644 +--- a/drivers/soc/ti/knav_qmss_queue.c ++++ b/drivers/soc/ti/knav_qmss_queue.c +@@ -102,19 +102,17 @@ static int knav_queue_setup_irq(struct knav_range_info *range, + struct knav_queue_inst *inst) + { + unsigned queue = inst->id - range->queue_base; +- unsigned long cpu_map; + int ret = 0, irq; + + if (range->flags & RANGE_HAS_IRQ) { + irq = range->irqs[queue].irq; +- cpu_map = range->irqs[queue].cpu_map; + ret = request_irq(irq, knav_queue_int_handler, 0, + inst->irq_name, inst); + if (ret) + return ret; + disable_irq(irq); +- if (cpu_map) { +- ret = irq_set_affinity_hint(irq, to_cpumask(&cpu_map)); ++ if (range->irqs[queue].cpu_mask) { ++ ret = irq_set_affinity_hint(irq, range->irqs[queue].cpu_mask); + if (ret) { + dev_warn(range->kdev->dev, + "Failed to set IRQ affinity\n"); +@@ -1222,9 +1220,19 @@ static int knav_setup_queue_range(struct knav_device *kdev, + + range->num_irqs++; + +- if (IS_ENABLED(CONFIG_SMP) && oirq.args_count == 3) +- range->irqs[i].cpu_map = +- (oirq.args[2] & 0x0000ff00) >> 8; ++ if (IS_ENABLED(CONFIG_SMP) && oirq.args_count == 3) { ++ unsigned long mask; ++ int bit; ++ ++ range->irqs[i].cpu_mask = devm_kzalloc(dev, ++ cpumask_size(), GFP_KERNEL); ++ if (!range->irqs[i].cpu_mask) ++ return -ENOMEM; ++ ++ mask = (oirq.args[2] & 0x0000ff00) >> 8; ++ for_each_set_bit(bit, &mask, BITS_PER_LONG) ++ cpumask_set_cpu(bit, range->irqs[i].cpu_mask); ++ } + } + + range->num_irqs = min(range->num_irqs, range->num_queues); +diff --git a/drivers/staging/iio/adc/ad7606.c b/drivers/staging/iio/adc/ad7606.c +index 18f5f139117e..0ff458fbee5e 100644 +--- a/drivers/staging/iio/adc/ad7606.c ++++ b/drivers/staging/iio/adc/ad7606.c +@@ -26,9 +26,12 @@ + + #include "ad7606.h" + +-/* Scales are computed as 2.5/2**16 and 5/2**16 respectively */ ++/* ++ * Scales are computed as 5000/32768 and 10000/32768 respectively, ++ * so that when applied to the raw values they provide mV values ++ */ + static const unsigned int scale_avail[2][2] = { +- {0, 38147}, {0, 76294} ++ {0, 152588}, {0, 305176} + }; + + static int ad7606_reset(struct ad7606_state *st) +diff --git a/drivers/thermal/Kconfig b/drivers/thermal/Kconfig +index 07002df4f83a..e3f0d1fd1720 100644 +--- a/drivers/thermal/Kconfig ++++ b/drivers/thermal/Kconfig +@@ -408,7 +408,7 @@ config MTK_THERMAL + controller present in Mediatek SoCs + + menu "Broadcom thermal drivers" +-depends on ARCH_BCM || COMPILE_TEST ++depends on ARCH_BCM || ARCH_BCM2835 || COMPILE_TEST + source "drivers/thermal/broadcom/Kconfig" + endmenu + +diff --git a/drivers/tty/serial/sc16is7xx.c b/drivers/tty/serial/sc16is7xx.c +index ca54ce074a5f..a79f18edf2bd 100644 +--- a/drivers/tty/serial/sc16is7xx.c ++++ b/drivers/tty/serial/sc16is7xx.c +@@ -662,7 +662,7 @@ static void sc16is7xx_handle_tx(struct uart_port *port) + uart_write_wakeup(port); + } + +-static void sc16is7xx_port_irq(struct sc16is7xx_port *s, int portno) ++static bool sc16is7xx_port_irq(struct sc16is7xx_port *s, int portno) + { + struct uart_port *port = &s->p[portno].port; + +@@ -671,7 +671,7 @@ static void sc16is7xx_port_irq(struct sc16is7xx_port *s, int portno) + + iir = sc16is7xx_port_read(port, SC16IS7XX_IIR_REG); + if (iir & SC16IS7XX_IIR_NO_INT_BIT) +- break; ++ return false; + + iir &= SC16IS7XX_IIR_ID_MASK; + +@@ -693,16 +693,23 @@ static void sc16is7xx_port_irq(struct sc16is7xx_port *s, int portno) + port->line, iir); + break; + } +- } while (1); ++ } while (0); ++ return true; + } + + static void sc16is7xx_ist(struct kthread_work *ws) + { + struct sc16is7xx_port *s = to_sc16is7xx_port(ws, irq_work); +- int i; + +- for (i = 0; i < s->devtype->nr_uart; ++i) +- sc16is7xx_port_irq(s, i); ++ while (1) { ++ bool keep_polling = false; ++ int i; ++ ++ for (i = 0; i < s->devtype->nr_uart; ++i) ++ keep_polling |= sc16is7xx_port_irq(s, i); ++ if (!keep_polling) ++ break; ++ } + } + + static irqreturn_t sc16is7xx_irq(int irq, void *dev_id) +diff --git a/drivers/tty/tty_baudrate.c b/drivers/tty/tty_baudrate.c +index ebc797fc1afd..42e5683147d5 100644 +--- a/drivers/tty/tty_baudrate.c ++++ b/drivers/tty/tty_baudrate.c +@@ -76,7 +76,7 @@ speed_t tty_termios_baud_rate(struct ktermios *termios) + else + cbaud += 15; + } +- return baud_table[cbaud]; ++ return cbaud >= n_baud_table ? 0 : baud_table[cbaud]; + } + EXPORT_SYMBOL(tty_termios_baud_rate); + +@@ -112,7 +112,7 @@ speed_t tty_termios_input_baud_rate(struct ktermios *termios) + else + cbaud += 15; + } +- return baud_table[cbaud]; ++ return cbaud >= n_baud_table ? 0 : baud_table[cbaud]; + #else + return tty_termios_baud_rate(termios); + #endif +diff --git a/drivers/tty/tty_io.c b/drivers/tty/tty_io.c +index 8d65b2f9ee80..83376caa571b 100644 +--- a/drivers/tty/tty_io.c ++++ b/drivers/tty/tty_io.c +@@ -407,7 +407,7 @@ struct tty_driver *tty_find_polling_driver(char *name, int *line) + mutex_lock(&tty_mutex); + /* Search through the tty devices to look for a match */ + list_for_each_entry(p, &tty_drivers, tty_drivers) { +- if (strncmp(name, p->name, len) != 0) ++ if (!len || strncmp(name, p->name, len) != 0) + continue; + stp = str; + if (*stp == ',') +diff --git a/drivers/vhost/scsi.c b/drivers/vhost/scsi.c +index e47c5bc3ddca..35ebf06d9ecb 100644 +--- a/drivers/vhost/scsi.c ++++ b/drivers/vhost/scsi.c +@@ -993,7 +993,8 @@ vhost_scsi_handle_vq(struct vhost_scsi *vs, struct vhost_virtqueue *vq) + prot_bytes = vhost32_to_cpu(vq, v_req_pi.pi_bytesin); + } + /* +- * Set prot_iter to data_iter, and advance past any ++ * Set prot_iter to data_iter and truncate it to ++ * prot_bytes, and advance data_iter past any + * preceeding prot_bytes that may be present. + * + * Also fix up the exp_data_len to reflect only the +@@ -1002,6 +1003,7 @@ vhost_scsi_handle_vq(struct vhost_scsi *vs, struct vhost_virtqueue *vq) + if (prot_bytes) { + exp_data_len -= prot_bytes; + prot_iter = data_iter; ++ iov_iter_truncate(&prot_iter, prot_bytes); + iov_iter_advance(&data_iter, prot_bytes); + } + tag = vhost64_to_cpu(vq, v_req_pi.tag); +diff --git a/drivers/video/fbdev/aty/mach64_accel.c b/drivers/video/fbdev/aty/mach64_accel.c +index 2541a0e0de76..3ad46255f990 100644 +--- a/drivers/video/fbdev/aty/mach64_accel.c ++++ b/drivers/video/fbdev/aty/mach64_accel.c +@@ -127,7 +127,7 @@ void aty_init_engine(struct atyfb_par *par, struct fb_info *info) + + /* set host attributes */ + wait_for_fifo(13, par); +- aty_st_le32(HOST_CNTL, 0, par); ++ aty_st_le32(HOST_CNTL, HOST_BYTE_ALIGN, par); + + /* set pattern attributes */ + aty_st_le32(PAT_REG0, 0, par); +@@ -233,7 +233,8 @@ void atyfb_copyarea(struct fb_info *info, const struct fb_copyarea *area) + rotation = rotation24bpp(dx, direction); + } + +- wait_for_fifo(4, par); ++ wait_for_fifo(5, par); ++ aty_st_le32(DP_PIX_WIDTH, par->crtc.dp_pix_width, par); + aty_st_le32(DP_SRC, FRGD_SRC_BLIT, par); + aty_st_le32(SRC_Y_X, (sx << 16) | sy, par); + aty_st_le32(SRC_HEIGHT1_WIDTH1, (width << 16) | area->height, par); +@@ -269,7 +270,8 @@ void atyfb_fillrect(struct fb_info *info, const struct fb_fillrect *rect) + rotation = rotation24bpp(dx, DST_X_LEFT_TO_RIGHT); + } + +- wait_for_fifo(3, par); ++ wait_for_fifo(4, par); ++ aty_st_le32(DP_PIX_WIDTH, par->crtc.dp_pix_width, par); + aty_st_le32(DP_FRGD_CLR, color, par); + aty_st_le32(DP_SRC, + BKGD_SRC_BKGD_CLR | FRGD_SRC_FRGD_CLR | MONO_SRC_ONE, +@@ -284,7 +286,7 @@ void atyfb_imageblit(struct fb_info *info, const struct fb_image *image) + { + struct atyfb_par *par = (struct atyfb_par *) info->par; + u32 src_bytes, dx = image->dx, dy = image->dy, width = image->width; +- u32 pix_width_save, pix_width, host_cntl, rotation = 0, src, mix; ++ u32 pix_width, rotation = 0, src, mix; + + if (par->asleep) + return; +@@ -296,8 +298,7 @@ void atyfb_imageblit(struct fb_info *info, const struct fb_image *image) + return; + } + +- pix_width = pix_width_save = aty_ld_le32(DP_PIX_WIDTH, par); +- host_cntl = aty_ld_le32(HOST_CNTL, par) | HOST_BYTE_ALIGN; ++ pix_width = par->crtc.dp_pix_width; + + switch (image->depth) { + case 1: +@@ -345,7 +346,7 @@ void atyfb_imageblit(struct fb_info *info, const struct fb_image *image) + * since Rage 3D IIc we have DP_HOST_TRIPLE_EN bit + * this hwaccelerated triple has an issue with not aligned data + */ +- if (M64_HAS(HW_TRIPLE) && image->width % 8 == 0) ++ if (image->depth == 1 && M64_HAS(HW_TRIPLE) && image->width % 8 == 0) + pix_width |= DP_HOST_TRIPLE_EN; + } + +@@ -370,19 +371,18 @@ void atyfb_imageblit(struct fb_info *info, const struct fb_image *image) + mix = FRGD_MIX_D_XOR_S | BKGD_MIX_D; + } + +- wait_for_fifo(6, par); +- aty_st_le32(DP_WRITE_MASK, 0xFFFFFFFF, par); ++ wait_for_fifo(5, par); + aty_st_le32(DP_PIX_WIDTH, pix_width, par); + aty_st_le32(DP_MIX, mix, par); + aty_st_le32(DP_SRC, src, par); +- aty_st_le32(HOST_CNTL, host_cntl, par); ++ aty_st_le32(HOST_CNTL, HOST_BYTE_ALIGN, par); + aty_st_le32(DST_CNTL, DST_Y_TOP_TO_BOTTOM | DST_X_LEFT_TO_RIGHT | rotation, par); + + draw_rect(dx, dy, width, image->height, par); + src_bytes = (((image->width * image->depth) + 7) / 8) * image->height; + + /* manual triple each pixel */ +- if (info->var.bits_per_pixel == 24 && !(pix_width & DP_HOST_TRIPLE_EN)) { ++ if (image->depth == 1 && info->var.bits_per_pixel == 24 && !(pix_width & DP_HOST_TRIPLE_EN)) { + int inbit, outbit, mult24, byte_id_in_dword, width; + u8 *pbitmapin = (u8*)image->data, *pbitmapout; + u32 hostdword; +@@ -415,7 +415,7 @@ void atyfb_imageblit(struct fb_info *info, const struct fb_image *image) + } + } + wait_for_fifo(1, par); +- aty_st_le32(HOST_DATA0, hostdword, par); ++ aty_st_le32(HOST_DATA0, le32_to_cpu(hostdword), par); + } + } else { + u32 *pbitmap, dwords = (src_bytes + 3) / 4; +@@ -424,8 +424,4 @@ void atyfb_imageblit(struct fb_info *info, const struct fb_image *image) + aty_st_le32(HOST_DATA0, get_unaligned_le32(pbitmap), par); + } + } +- +- /* restore pix_width */ +- wait_for_fifo(1, par); +- aty_st_le32(DP_PIX_WIDTH, pix_width_save, par); + } +diff --git a/fs/9p/vfs_file.c b/fs/9p/vfs_file.c +index 03c9e325bfbc..3a2f37ad1f89 100644 +--- a/fs/9p/vfs_file.c ++++ b/fs/9p/vfs_file.c +@@ -204,6 +204,14 @@ static int v9fs_file_do_lock(struct file *filp, int cmd, struct file_lock *fl) + break; + if (schedule_timeout_interruptible(P9_LOCK_TIMEOUT) != 0) + break; ++ /* ++ * p9_client_lock_dotl overwrites flock.client_id with the ++ * server message, free and reuse the client name ++ */ ++ if (flock.client_id != fid->clnt->name) { ++ kfree(flock.client_id); ++ flock.client_id = fid->clnt->name; ++ } + } + + /* map 9p status to VFS status */ +@@ -235,6 +243,8 @@ out_unlock: + locks_lock_file_wait(filp, fl); + fl->fl_type = fl_type; + } ++ if (flock.client_id != fid->clnt->name) ++ kfree(flock.client_id); + out: + return res; + } +@@ -269,7 +279,7 @@ static int v9fs_file_getlock(struct file *filp, struct file_lock *fl) + + res = p9_client_getlock_dotl(fid, &glock); + if (res < 0) +- return res; ++ goto out; + /* map 9p lock type to os lock type */ + switch (glock.type) { + case P9_LOCK_TYPE_RDLCK: +@@ -290,7 +300,9 @@ static int v9fs_file_getlock(struct file *filp, struct file_lock *fl) + fl->fl_end = glock.start + glock.length - 1; + fl->fl_pid = -glock.proc_id; + } +- kfree(glock.client_id); ++out: ++ if (glock.client_id != fid->clnt->name) ++ kfree(glock.client_id); + return res; + } + +diff --git a/fs/btrfs/disk-io.c b/fs/btrfs/disk-io.c +index 5cf1bbe9754c..0e67cee73c53 100644 +--- a/fs/btrfs/disk-io.c ++++ b/fs/btrfs/disk-io.c +@@ -4428,13 +4428,23 @@ static int btrfs_destroy_pinned_extent(struct btrfs_fs_info *fs_info, + unpin = pinned_extents; + again: + while (1) { ++ /* ++ * The btrfs_finish_extent_commit() may get the same range as ++ * ours between find_first_extent_bit and clear_extent_dirty. ++ * Hence, hold the unused_bg_unpin_mutex to avoid double unpin ++ * the same extent range. ++ */ ++ mutex_lock(&fs_info->unused_bg_unpin_mutex); + ret = find_first_extent_bit(unpin, 0, &start, &end, + EXTENT_DIRTY, NULL); +- if (ret) ++ if (ret) { ++ mutex_unlock(&fs_info->unused_bg_unpin_mutex); + break; ++ } + + clear_extent_dirty(unpin, start, end); + btrfs_error_unpin_extent_range(fs_info, start, end); ++ mutex_unlock(&fs_info->unused_bg_unpin_mutex); + cond_resched(); + } + +diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c +index 90568a21fa77..1c340d6c8568 100644 +--- a/fs/btrfs/inode.c ++++ b/fs/btrfs/inode.c +@@ -1565,12 +1565,11 @@ out_check: + } + btrfs_release_path(path); + +- if (cur_offset <= end && cow_start == (u64)-1) { ++ if (cur_offset <= end && cow_start == (u64)-1) + cow_start = cur_offset; +- cur_offset = end; +- } + + if (cow_start != (u64)-1) { ++ cur_offset = end; + ret = cow_file_range(inode, locked_page, cow_start, end, end, + page_started, nr_written, 1, NULL); + if (ret) +diff --git a/fs/btrfs/ioctl.c b/fs/btrfs/ioctl.c +index 9333e4cda68d..cddd63b9103f 100644 +--- a/fs/btrfs/ioctl.c ++++ b/fs/btrfs/ioctl.c +@@ -3178,6 +3178,8 @@ static int btrfs_extent_same(struct inode *src, u64 loff, u64 olen, + const u64 sz = BTRFS_I(src)->root->fs_info->sectorsize; + + len = round_down(i_size_read(src), sz) - loff; ++ if (len == 0) ++ return 0; + olen = len; + } + } +@@ -3907,9 +3909,17 @@ static noinline int btrfs_clone_files(struct file *file, struct file *file_src, + goto out_unlock; + if (len == 0) + olen = len = src->i_size - off; +- /* if we extend to eof, continue to block boundary */ +- if (off + len == src->i_size) ++ /* ++ * If we extend to eof, continue to block boundary if and only if the ++ * destination end offset matches the destination file's size, otherwise ++ * we would be corrupting data by placing the eof block into the middle ++ * of a file. ++ */ ++ if (off + len == src->i_size) { ++ if (!IS_ALIGNED(len, bs) && destoff + len < inode->i_size) ++ goto out_unlock; + len = ALIGN(src->i_size, bs) - off; ++ } + + if (len == 0) { + ret = 0; +diff --git a/fs/ceph/inode.c b/fs/ceph/inode.c +index d5124ed35154..a1492bdc6d03 100644 +--- a/fs/ceph/inode.c ++++ b/fs/ceph/inode.c +@@ -1087,8 +1087,12 @@ static struct dentry *splice_dentry(struct dentry *dn, struct inode *in) + if (IS_ERR(realdn)) { + pr_err("splice_dentry error %ld %p inode %p ino %llx.%llx\n", + PTR_ERR(realdn), dn, in, ceph_vinop(in)); +- dput(dn); +- dn = realdn; /* note realdn contains the error */ ++ dn = realdn; ++ /* ++ * Caller should release 'dn' in the case of error. ++ * If 'req->r_dentry' is passed to this function, ++ * caller should leave 'req->r_dentry' untouched. ++ */ + goto out; + } else if (realdn) { + dout("dn %p (%d) spliced with %p (%d) " +diff --git a/fs/configfs/symlink.c b/fs/configfs/symlink.c +index c8aabba502f6..9993cdb81e7d 100644 +--- a/fs/configfs/symlink.c ++++ b/fs/configfs/symlink.c +@@ -64,7 +64,7 @@ static void fill_item_path(struct config_item * item, char * buffer, int length) + + /* back up enough to print this bus id with '/' */ + length -= cur; +- strncpy(buffer + length,config_item_name(p),cur); ++ memcpy(buffer + length, config_item_name(p), cur); + *(buffer + --length) = '/'; + } + } +diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c +index 9808df52ceca..bd2bf83b1a1f 100644 +--- a/fs/ext4/inode.c ++++ b/fs/ext4/inode.c +@@ -5671,9 +5671,10 @@ int ext4_mark_iloc_dirty(handle_t *handle, + { + int err = 0; + +- if (unlikely(ext4_forced_shutdown(EXT4_SB(inode->i_sb)))) ++ if (unlikely(ext4_forced_shutdown(EXT4_SB(inode->i_sb)))) { ++ put_bh(iloc->bh); + return -EIO; +- ++ } + if (IS_I_VERSION(inode)) + inode_inc_iversion(inode); + +diff --git a/fs/ext4/namei.c b/fs/ext4/namei.c +index eb0d8ee39827..4e301b0cdfb5 100644 +--- a/fs/ext4/namei.c ++++ b/fs/ext4/namei.c +@@ -125,6 +125,7 @@ static struct buffer_head *__ext4_read_dirblock(struct inode *inode, + if (!is_dx_block && type == INDEX) { + ext4_error_inode(inode, func, line, block, + "directory leaf block found instead of index block"); ++ brelse(bh); + return ERR_PTR(-EFSCORRUPTED); + } + if (!ext4_has_metadata_csum(inode->i_sb) || +@@ -2820,7 +2821,9 @@ int ext4_orphan_add(handle_t *handle, struct inode *inode) + list_del_init(&EXT4_I(inode)->i_orphan); + mutex_unlock(&sbi->s_orphan_lock); + } +- } ++ } else ++ brelse(iloc.bh); ++ + jbd_debug(4, "superblock will point to %lu\n", inode->i_ino); + jbd_debug(4, "orphan inode %lu will point to %d\n", + inode->i_ino, NEXT_ORPHAN(inode)); +diff --git a/fs/ext4/resize.c b/fs/ext4/resize.c +index e344e606c054..deebb8842c82 100644 +--- a/fs/ext4/resize.c ++++ b/fs/ext4/resize.c +@@ -444,16 +444,18 @@ static int set_flexbg_block_bitmap(struct super_block *sb, handle_t *handle, + + BUFFER_TRACE(bh, "get_write_access"); + err = ext4_journal_get_write_access(handle, bh); +- if (err) ++ if (err) { ++ brelse(bh); + return err; ++ } + ext4_debug("mark block bitmap %#04llx (+%llu/%u)\n", block, + block - start, count2); + ext4_set_bits(bh->b_data, block - start, count2); + + err = ext4_handle_dirty_metadata(handle, NULL, bh); ++ brelse(bh); + if (unlikely(err)) + return err; +- brelse(bh); + } + + return 0; +@@ -590,7 +592,6 @@ handle_bb: + bh = bclean(handle, sb, block); + if (IS_ERR(bh)) { + err = PTR_ERR(bh); +- bh = NULL; + goto out; + } + overhead = ext4_group_overhead_blocks(sb, group); +@@ -602,9 +603,9 @@ handle_bb: + ext4_mark_bitmap_end(group_data[i].blocks_count, + sb->s_blocksize * 8, bh->b_data); + err = ext4_handle_dirty_metadata(handle, NULL, bh); ++ brelse(bh); + if (err) + goto out; +- brelse(bh); + + handle_ib: + if (bg_flags[i] & EXT4_BG_INODE_UNINIT) +@@ -619,18 +620,16 @@ handle_ib: + bh = bclean(handle, sb, block); + if (IS_ERR(bh)) { + err = PTR_ERR(bh); +- bh = NULL; + goto out; + } + + ext4_mark_bitmap_end(EXT4_INODES_PER_GROUP(sb), + sb->s_blocksize * 8, bh->b_data); + err = ext4_handle_dirty_metadata(handle, NULL, bh); ++ brelse(bh); + if (err) + goto out; +- brelse(bh); + } +- bh = NULL; + + /* Mark group tables in block bitmap */ + for (j = 0; j < GROUP_TABLE_COUNT; j++) { +@@ -661,7 +660,6 @@ handle_ib: + } + + out: +- brelse(bh); + err2 = ext4_journal_stop(handle); + if (err2 && !err) + err = err2; +@@ -848,6 +846,7 @@ static int add_new_gdb(handle_t *handle, struct inode *inode, + err = ext4_handle_dirty_metadata(handle, NULL, gdb_bh); + if (unlikely(err)) { + ext4_std_error(sb, err); ++ iloc.bh = NULL; + goto exit_inode; + } + brelse(dind); +@@ -899,6 +898,7 @@ static int add_new_gdb_meta_bg(struct super_block *sb, + sizeof(struct buffer_head *), + GFP_NOFS); + if (!n_group_desc) { ++ brelse(gdb_bh); + err = -ENOMEM; + ext4_warning(sb, "not enough memory for %lu groups", + gdb_num + 1); +@@ -914,8 +914,6 @@ static int add_new_gdb_meta_bg(struct super_block *sb, + kvfree(o_group_desc); + BUFFER_TRACE(gdb_bh, "get_write_access"); + err = ext4_journal_get_write_access(handle, gdb_bh); +- if (unlikely(err)) +- brelse(gdb_bh); + return err; + } + +@@ -1097,8 +1095,10 @@ static void update_backups(struct super_block *sb, sector_t blk_off, char *data, + backup_block, backup_block - + ext4_group_first_block_no(sb, group)); + BUFFER_TRACE(bh, "get_write_access"); +- if ((err = ext4_journal_get_write_access(handle, bh))) ++ if ((err = ext4_journal_get_write_access(handle, bh))) { ++ brelse(bh); + break; ++ } + lock_buffer(bh); + memcpy(bh->b_data, data, size); + if (rest) +@@ -1993,7 +1993,7 @@ retry: + + err = ext4_alloc_flex_bg_array(sb, n_group + 1); + if (err) +- return err; ++ goto out; + + err = ext4_mb_alloc_groupinfo(sb, n_group + 1); + if (err) +@@ -2029,6 +2029,10 @@ retry: + n_blocks_count_retry = 0; + free_flex_gd(flex_gd); + flex_gd = NULL; ++ if (resize_inode) { ++ iput(resize_inode); ++ resize_inode = NULL; ++ } + goto retry; + } + +diff --git a/fs/ext4/super.c b/fs/ext4/super.c +index 46ad267ef6d6..7fd64f5f70f0 100644 +--- a/fs/ext4/super.c ++++ b/fs/ext4/super.c +@@ -4012,6 +4012,14 @@ static int ext4_fill_super(struct super_block *sb, void *data, int silent) + sbi->s_groups_count = blocks_count; + sbi->s_blockfile_groups = min_t(ext4_group_t, sbi->s_groups_count, + (EXT4_MAX_BLOCK_FILE_PHYS / EXT4_BLOCKS_PER_GROUP(sb))); ++ if (((u64)sbi->s_groups_count * sbi->s_inodes_per_group) != ++ le32_to_cpu(es->s_inodes_count)) { ++ ext4_msg(sb, KERN_ERR, "inodes count not valid: %u vs %llu", ++ le32_to_cpu(es->s_inodes_count), ++ ((u64)sbi->s_groups_count * sbi->s_inodes_per_group)); ++ ret = -EINVAL; ++ goto failed_mount; ++ } + db_count = (sbi->s_groups_count + EXT4_DESC_PER_BLOCK(sb) - 1) / + EXT4_DESC_PER_BLOCK(sb); + if (ext4_has_feature_meta_bg(sb)) { +@@ -4031,14 +4039,6 @@ static int ext4_fill_super(struct super_block *sb, void *data, int silent) + ret = -ENOMEM; + goto failed_mount; + } +- if (((u64)sbi->s_groups_count * sbi->s_inodes_per_group) != +- le32_to_cpu(es->s_inodes_count)) { +- ext4_msg(sb, KERN_ERR, "inodes count not valid: %u vs %llu", +- le32_to_cpu(es->s_inodes_count), +- ((u64)sbi->s_groups_count * sbi->s_inodes_per_group)); +- ret = -EINVAL; +- goto failed_mount; +- } + + bgl_lock_init(sbi->s_blockgroup_lock); + +@@ -4442,6 +4442,7 @@ failed_mount6: + percpu_counter_destroy(&sbi->s_freeinodes_counter); + percpu_counter_destroy(&sbi->s_dirs_counter); + percpu_counter_destroy(&sbi->s_dirtyclusters_counter); ++ percpu_free_rwsem(&sbi->s_journal_flag_rwsem); + failed_mount5: + ext4_ext_release(sb); + ext4_release_system_zone(sb); +diff --git a/fs/ext4/xattr.c b/fs/ext4/xattr.c +index 9bc50eef6127..a5923a1d0ff4 100644 +--- a/fs/ext4/xattr.c ++++ b/fs/ext4/xattr.c +@@ -1387,6 +1387,12 @@ retry: + bh = ext4_getblk(handle, ea_inode, block, 0); + if (IS_ERR(bh)) + return PTR_ERR(bh); ++ if (!bh) { ++ WARN_ON_ONCE(1); ++ EXT4_ERROR_INODE(ea_inode, ++ "ext4_getblk() return bh = NULL"); ++ return -EFSCORRUPTED; ++ } + ret = ext4_journal_get_write_access(handle, bh); + if (ret) + goto out; +@@ -2275,8 +2281,10 @@ static struct buffer_head *ext4_xattr_get_block(struct inode *inode) + if (!bh) + return ERR_PTR(-EIO); + error = ext4_xattr_check_block(inode, bh); +- if (error) ++ if (error) { ++ brelse(bh); + return ERR_PTR(error); ++ } + return bh; + } + +@@ -2396,6 +2404,8 @@ retry_inode: + error = ext4_xattr_block_set(handle, inode, &i, &bs); + } else if (error == -ENOSPC) { + if (EXT4_I(inode)->i_file_acl && !bs.s.base) { ++ brelse(bs.bh); ++ bs.bh = NULL; + error = ext4_xattr_block_find(inode, &i, &bs); + if (error) + goto cleanup; +@@ -2616,6 +2626,8 @@ out: + kfree(buffer); + if (is) + brelse(is->iloc.bh); ++ if (bs) ++ brelse(bs->bh); + kfree(is); + kfree(bs); + +@@ -2695,7 +2707,6 @@ int ext4_expand_extra_isize_ea(struct inode *inode, int new_extra_isize, + struct ext4_inode *raw_inode, handle_t *handle) + { + struct ext4_xattr_ibody_header *header; +- struct buffer_head *bh; + struct ext4_sb_info *sbi = EXT4_SB(inode->i_sb); + static unsigned int mnt_count; + size_t min_offs; +@@ -2736,13 +2747,17 @@ retry: + * EA block can hold new_extra_isize bytes. + */ + if (EXT4_I(inode)->i_file_acl) { ++ struct buffer_head *bh; ++ + bh = sb_bread(inode->i_sb, EXT4_I(inode)->i_file_acl); + error = -EIO; + if (!bh) + goto cleanup; + error = ext4_xattr_check_block(inode, bh); +- if (error) ++ if (error) { ++ brelse(bh); + goto cleanup; ++ } + base = BHDR(bh); + end = bh->b_data + bh->b_size; + min_offs = end - base; +diff --git a/fs/fuse/dev.c b/fs/fuse/dev.c +index ee8105af4001..f7280c44cd4b 100644 +--- a/fs/fuse/dev.c ++++ b/fs/fuse/dev.c +@@ -384,12 +384,19 @@ static void request_end(struct fuse_conn *fc, struct fuse_req *req) + if (test_bit(FR_BACKGROUND, &req->flags)) { + spin_lock(&fc->lock); + clear_bit(FR_BACKGROUND, &req->flags); +- if (fc->num_background == fc->max_background) ++ if (fc->num_background == fc->max_background) { + fc->blocked = 0; +- +- /* Wake up next waiter, if any */ +- if (!fc->blocked && waitqueue_active(&fc->blocked_waitq)) + wake_up(&fc->blocked_waitq); ++ } else if (!fc->blocked) { ++ /* ++ * Wake up next waiter, if any. It's okay to use ++ * waitqueue_active(), as we've already synced up ++ * fc->blocked with waiters with the wake_up() call ++ * above. ++ */ ++ if (waitqueue_active(&fc->blocked_waitq)) ++ wake_up(&fc->blocked_waitq); ++ } + + if (fc->num_background == fc->congestion_threshold && fc->sb) { + clear_bdi_congested(fc->sb->s_bdi, BLK_RW_SYNC); +@@ -1309,12 +1316,14 @@ static ssize_t fuse_dev_do_read(struct fuse_dev *fud, struct file *file, + goto out_end; + } + list_move_tail(&req->list, &fpq->processing); +- spin_unlock(&fpq->lock); ++ __fuse_get_request(req); + set_bit(FR_SENT, &req->flags); ++ spin_unlock(&fpq->lock); + /* matches barrier in request_wait_answer() */ + smp_mb__after_atomic(); + if (test_bit(FR_INTERRUPTED, &req->flags)) + queue_interrupt(fiq, req); ++ fuse_put_request(fc, req); + + return reqsize; + +@@ -1712,8 +1721,10 @@ static int fuse_retrieve(struct fuse_conn *fc, struct inode *inode, + req->in.args[1].size = total_len; + + err = fuse_request_send_notify_reply(fc, req, outarg->notify_unique); +- if (err) ++ if (err) { + fuse_retrieve_end(fc, req); ++ fuse_put_request(fc, req); ++ } + + return err; + } +@@ -1872,16 +1883,20 @@ static ssize_t fuse_dev_do_write(struct fuse_dev *fud, + + /* Is it an interrupt reply? */ + if (req->intr_unique == oh.unique) { ++ __fuse_get_request(req); + spin_unlock(&fpq->lock); + + err = -EINVAL; +- if (nbytes != sizeof(struct fuse_out_header)) ++ if (nbytes != sizeof(struct fuse_out_header)) { ++ fuse_put_request(fc, req); + goto err_finish; ++ } + + if (oh.error == -ENOSYS) + fc->no_interrupt = 1; + else if (oh.error == -EAGAIN) + queue_interrupt(&fc->iq, req); ++ fuse_put_request(fc, req); + + fuse_copy_finish(cs); + return nbytes; +diff --git a/fs/fuse/file.c b/fs/fuse/file.c +index fb4738ef162f..47d7a510be5b 100644 +--- a/fs/fuse/file.c ++++ b/fs/fuse/file.c +@@ -2912,10 +2912,12 @@ fuse_direct_IO(struct kiocb *iocb, struct iov_iter *iter) + } + + if (io->async) { ++ bool blocking = io->blocking; ++ + fuse_aio_complete(io, ret < 0 ? ret : 0, -1); + + /* we have a non-extending, async request, so return */ +- if (!io->blocking) ++ if (!blocking) + return -EIOCBQUEUED; + + wait_for_completion(&wait); +diff --git a/fs/gfs2/rgrp.c b/fs/gfs2/rgrp.c +index 5fe033131f03..b0eee90738ff 100644 +--- a/fs/gfs2/rgrp.c ++++ b/fs/gfs2/rgrp.c +@@ -706,6 +706,7 @@ void gfs2_clear_rgrpd(struct gfs2_sbd *sdp) + + if (gl) { + glock_clear_object(gl, rgd); ++ gfs2_rgrp_brelse(rgd); + gfs2_glock_put(gl); + } + +@@ -1115,7 +1116,7 @@ static u32 count_unlinked(struct gfs2_rgrpd *rgd) + * @rgd: the struct gfs2_rgrpd describing the RG to read in + * + * Read in all of a Resource Group's header and bitmap blocks. +- * Caller must eventually call gfs2_rgrp_relse() to free the bitmaps. ++ * Caller must eventually call gfs2_rgrp_brelse() to free the bitmaps. + * + * Returns: errno + */ +diff --git a/fs/namespace.c b/fs/namespace.c +index 9dc146e7b5e0..e9c13eedd739 100644 +--- a/fs/namespace.c ++++ b/fs/namespace.c +@@ -1625,8 +1625,13 @@ static int do_umount(struct mount *mnt, int flags) + + namespace_lock(); + lock_mount_hash(); +- event++; + ++ /* Recheck MNT_LOCKED with the locks held */ ++ retval = -EINVAL; ++ if (mnt->mnt.mnt_flags & MNT_LOCKED) ++ goto out; ++ ++ event++; + if (flags & MNT_DETACH) { + if (!list_empty(&mnt->mnt_list)) + umount_tree(mnt, UMOUNT_PROPAGATE); +@@ -1640,6 +1645,7 @@ static int do_umount(struct mount *mnt, int flags) + retval = 0; + } + } ++out: + unlock_mount_hash(); + namespace_unlock(); + return retval; +@@ -1730,7 +1736,7 @@ SYSCALL_DEFINE2(umount, char __user *, name, int, flags) + goto dput_and_out; + if (!check_mnt(mnt)) + goto dput_and_out; +- if (mnt->mnt.mnt_flags & MNT_LOCKED) ++ if (mnt->mnt.mnt_flags & MNT_LOCKED) /* Check optimistically */ + goto dput_and_out; + retval = -EPERM; + if (flags & MNT_FORCE && !capable(CAP_SYS_ADMIN)) +@@ -1808,8 +1814,14 @@ struct mount *copy_tree(struct mount *mnt, struct dentry *dentry, + for (s = r; s; s = next_mnt(s, r)) { + if (!(flag & CL_COPY_UNBINDABLE) && + IS_MNT_UNBINDABLE(s)) { +- s = skip_mnt_tree(s); +- continue; ++ if (s->mnt.mnt_flags & MNT_LOCKED) { ++ /* Both unbindable and locked. */ ++ q = ERR_PTR(-EPERM); ++ goto out; ++ } else { ++ s = skip_mnt_tree(s); ++ continue; ++ } + } + if (!(flag & CL_COPY_MNT_NS_FILE) && + is_mnt_ns_file(s->mnt.mnt_root)) { +@@ -1862,7 +1874,7 @@ void drop_collected_mounts(struct vfsmount *mnt) + { + namespace_lock(); + lock_mount_hash(); +- umount_tree(real_mount(mnt), UMOUNT_SYNC); ++ umount_tree(real_mount(mnt), 0); + unlock_mount_hash(); + namespace_unlock(); + } +diff --git a/fs/nfsd/nfs4proc.c b/fs/nfsd/nfs4proc.c +index 6d16399a350e..ee765abad2ef 100644 +--- a/fs/nfsd/nfs4proc.c ++++ b/fs/nfsd/nfs4proc.c +@@ -1049,6 +1049,9 @@ nfsd4_verify_copy(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate, + { + __be32 status; + ++ if (!cstate->save_fh.fh_dentry) ++ return nfserr_nofilehandle; ++ + status = nfs4_preprocess_stateid_op(rqstp, cstate, &cstate->save_fh, + src_stateid, RD_STATE, src, NULL); + if (status) { +diff --git a/fs/ocfs2/aops.c b/fs/ocfs2/aops.c +index d1516327b787..99550f4bd159 100644 +--- a/fs/ocfs2/aops.c ++++ b/fs/ocfs2/aops.c +@@ -2404,8 +2404,16 @@ static int ocfs2_dio_end_io(struct kiocb *iocb, + /* this io's submitter should not have unlocked this before we could */ + BUG_ON(!ocfs2_iocb_is_rw_locked(iocb)); + +- if (bytes > 0 && private) +- ret = ocfs2_dio_end_io_write(inode, private, offset, bytes); ++ if (bytes <= 0) ++ mlog_ratelimited(ML_ERROR, "Direct IO failed, bytes = %lld", ++ (long long)bytes); ++ if (private) { ++ if (bytes > 0) ++ ret = ocfs2_dio_end_io_write(inode, private, offset, ++ bytes); ++ else ++ ocfs2_dio_free_write_ctx(inode, private); ++ } + + ocfs2_iocb_clear_rw_locked(iocb); + +diff --git a/fs/ocfs2/cluster/masklog.h b/fs/ocfs2/cluster/masklog.h +index 308ea0eb35fd..a396096a5099 100644 +--- a/fs/ocfs2/cluster/masklog.h ++++ b/fs/ocfs2/cluster/masklog.h +@@ -178,6 +178,15 @@ do { \ + ##__VA_ARGS__); \ + } while (0) + ++#define mlog_ratelimited(mask, fmt, ...) \ ++do { \ ++ static DEFINE_RATELIMIT_STATE(_rs, \ ++ DEFAULT_RATELIMIT_INTERVAL, \ ++ DEFAULT_RATELIMIT_BURST); \ ++ if (__ratelimit(&_rs)) \ ++ mlog(mask, fmt, ##__VA_ARGS__); \ ++} while (0) ++ + #define mlog_errno(st) ({ \ + int _st = (st); \ + if (_st != -ERESTARTSYS && _st != -EINTR && \ +diff --git a/fs/ocfs2/dir.c b/fs/ocfs2/dir.c +index febe6312ceff..3c26f2dfedf1 100644 +--- a/fs/ocfs2/dir.c ++++ b/fs/ocfs2/dir.c +@@ -1896,8 +1896,7 @@ static int ocfs2_dir_foreach_blk_el(struct inode *inode, + /* On error, skip the f_pos to the + next block. */ + ctx->pos = (ctx->pos | (sb->s_blocksize - 1)) + 1; +- brelse(bh); +- continue; ++ break; + } + if (le64_to_cpu(de->inode)) { + unsigned char d_type = DT_UNKNOWN; +diff --git a/fs/overlayfs/dir.c b/fs/overlayfs/dir.c +index cc961a3bd3bd..ef11fa7b869e 100644 +--- a/fs/overlayfs/dir.c ++++ b/fs/overlayfs/dir.c +@@ -392,6 +392,10 @@ static int ovl_create_over_whiteout(struct dentry *dentry, struct inode *inode, + if (IS_ERR(upper)) + goto out_dput; + ++ err = -ESTALE; ++ if (d_is_negative(upper) || !IS_WHITEOUT(d_inode(upper))) ++ goto out_dput2; ++ + err = ovl_create_real(wdir, newdentry, cattr, hardlink, true); + if (err) + goto out_dput2; +@@ -595,6 +599,11 @@ static int ovl_link(struct dentry *old, struct inode *newdir, + if (err) + goto out_drop_write; + ++ err = ovl_copy_up(new->d_parent); ++ if (err) ++ goto out_drop_write; ++ ++ + err = ovl_nlink_start(old, &locked); + if (err) + goto out_drop_write; +diff --git a/fs/overlayfs/namei.c b/fs/overlayfs/namei.c +index d9468de3c951..8442f9839c90 100644 +--- a/fs/overlayfs/namei.c ++++ b/fs/overlayfs/namei.c +@@ -368,8 +368,10 @@ int ovl_verify_origin(struct dentry *dentry, struct vfsmount *mnt, + + fh = ovl_encode_fh(origin, is_upper); + err = PTR_ERR(fh); +- if (IS_ERR(fh)) ++ if (IS_ERR(fh)) { ++ fh = NULL; + goto fail; ++ } + + err = ovl_verify_origin_fh(dentry, fh); + if (set && err == -ENODATA) +diff --git a/include/linux/ceph/libceph.h b/include/linux/ceph/libceph.h +index c2ec44cf5098..d3b04f9589a9 100644 +--- a/include/linux/ceph/libceph.h ++++ b/include/linux/ceph/libceph.h +@@ -81,7 +81,13 @@ struct ceph_options { + + #define CEPH_MSG_MAX_FRONT_LEN (16*1024*1024) + #define CEPH_MSG_MAX_MIDDLE_LEN (16*1024*1024) +-#define CEPH_MSG_MAX_DATA_LEN (16*1024*1024) ++ ++/* ++ * Handle the largest possible rbd object in one message. ++ * There is no limit on the size of cephfs objects, but it has to obey ++ * rsize and wsize mount options anyway. ++ */ ++#define CEPH_MSG_MAX_DATA_LEN (32*1024*1024) + + #define CEPH_AUTH_NAME_DEFAULT "guest" + +diff --git a/include/linux/i8253.h b/include/linux/i8253.h +index e6bb36a97519..8336b2f6f834 100644 +--- a/include/linux/i8253.h ++++ b/include/linux/i8253.h +@@ -21,6 +21,7 @@ + #define PIT_LATCH ((PIT_TICK_RATE + HZ/2) / HZ) + + extern raw_spinlock_t i8253_lock; ++extern bool i8253_clear_counter_on_shutdown; + extern struct clock_event_device i8253_clockevent; + extern void clockevent_i8253_init(bool oneshot); + +diff --git a/include/linux/nmi.h b/include/linux/nmi.h +index b8d868d23e79..50d143995338 100644 +--- a/include/linux/nmi.h ++++ b/include/linux/nmi.h +@@ -113,6 +113,8 @@ static inline int hardlockup_detector_perf_init(void) { return 0; } + void watchdog_nmi_stop(void); + void watchdog_nmi_start(void); + int watchdog_nmi_probe(void); ++int watchdog_nmi_enable(unsigned int cpu); ++void watchdog_nmi_disable(unsigned int cpu); + + /** + * touch_nmi_watchdog - restart NMI watchdog timeout. +diff --git a/include/xen/xen-ops.h b/include/xen/xen-ops.h +index a95e65ec83c3..8d3786f290d9 100644 +--- a/include/xen/xen-ops.h ++++ b/include/xen/xen-ops.h +@@ -40,7 +40,7 @@ int xen_setup_shutdown_event(void); + + extern unsigned long *xen_contiguous_bitmap; + +-#ifdef CONFIG_XEN_PV ++#if defined(CONFIG_XEN_PV) || defined(CONFIG_ARM) || defined(CONFIG_ARM64) + int xen_create_contiguous_region(phys_addr_t pstart, unsigned int order, + unsigned int address_bits, + dma_addr_t *dma_handle); +diff --git a/kernel/debug/kdb/kdb_bt.c b/kernel/debug/kdb/kdb_bt.c +index 6ad4a9fcbd6f..7921ae4fca8d 100644 +--- a/kernel/debug/kdb/kdb_bt.c ++++ b/kernel/debug/kdb/kdb_bt.c +@@ -179,14 +179,14 @@ kdb_bt(int argc, const char **argv) + kdb_printf("no process for cpu %ld\n", cpu); + return 0; + } +- sprintf(buf, "btt 0x%p\n", KDB_TSK(cpu)); ++ sprintf(buf, "btt 0x%px\n", KDB_TSK(cpu)); + kdb_parse(buf); + return 0; + } + kdb_printf("btc: cpu status: "); + kdb_parse("cpu\n"); + for_each_online_cpu(cpu) { +- sprintf(buf, "btt 0x%p\n", KDB_TSK(cpu)); ++ sprintf(buf, "btt 0x%px\n", KDB_TSK(cpu)); + kdb_parse(buf); + touch_nmi_watchdog(); + } +diff --git a/kernel/debug/kdb/kdb_main.c b/kernel/debug/kdb/kdb_main.c +index 07aefa8dbee8..993db6b2348e 100644 +--- a/kernel/debug/kdb/kdb_main.c ++++ b/kernel/debug/kdb/kdb_main.c +@@ -1182,7 +1182,7 @@ static int kdb_local(kdb_reason_t reason, int error, struct pt_regs *regs, + if (reason == KDB_REASON_DEBUG) { + /* special case below */ + } else { +- kdb_printf("\nEntering kdb (current=0x%p, pid %d) ", ++ kdb_printf("\nEntering kdb (current=0x%px, pid %d) ", + kdb_current, kdb_current ? kdb_current->pid : 0); + #if defined(CONFIG_SMP) + kdb_printf("on processor %d ", raw_smp_processor_id()); +@@ -1198,7 +1198,7 @@ static int kdb_local(kdb_reason_t reason, int error, struct pt_regs *regs, + */ + switch (db_result) { + case KDB_DB_BPT: +- kdb_printf("\nEntering kdb (0x%p, pid %d) ", ++ kdb_printf("\nEntering kdb (0x%px, pid %d) ", + kdb_current, kdb_current->pid); + #if defined(CONFIG_SMP) + kdb_printf("on processor %d ", raw_smp_processor_id()); +@@ -2037,7 +2037,7 @@ static int kdb_lsmod(int argc, const char **argv) + if (mod->state == MODULE_STATE_UNFORMED) + continue; + +- kdb_printf("%-20s%8u 0x%p ", mod->name, ++ kdb_printf("%-20s%8u 0x%px ", mod->name, + mod->core_layout.size, (void *)mod); + #ifdef CONFIG_MODULE_UNLOAD + kdb_printf("%4d ", module_refcount(mod)); +@@ -2048,7 +2048,7 @@ static int kdb_lsmod(int argc, const char **argv) + kdb_printf(" (Loading)"); + else + kdb_printf(" (Live)"); +- kdb_printf(" 0x%p", mod->core_layout.base); ++ kdb_printf(" 0x%px", mod->core_layout.base); + + #ifdef CONFIG_MODULE_UNLOAD + { +@@ -2330,7 +2330,7 @@ void kdb_ps1(const struct task_struct *p) + return; + + cpu = kdb_process_cpu(p); +- kdb_printf("0x%p %8d %8d %d %4d %c 0x%p %c%s\n", ++ kdb_printf("0x%px %8d %8d %d %4d %c 0x%px %c%s\n", + (void *)p, p->pid, p->parent->pid, + kdb_task_has_cpu(p), kdb_process_cpu(p), + kdb_task_state_char(p), +@@ -2343,7 +2343,7 @@ void kdb_ps1(const struct task_struct *p) + } else { + if (KDB_TSK(cpu) != p) + kdb_printf(" Error: does not match running " +- "process table (0x%p)\n", KDB_TSK(cpu)); ++ "process table (0x%px)\n", KDB_TSK(cpu)); + } + } + } +@@ -2722,7 +2722,7 @@ int kdb_register_flags(char *cmd, + for_each_kdbcmd(kp, i) { + if (kp->cmd_name && (strcmp(kp->cmd_name, cmd) == 0)) { + kdb_printf("Duplicate kdb command registered: " +- "%s, func %p help %s\n", cmd, func, help); ++ "%s, func %px help %s\n", cmd, func, help); + return 1; + } + } +diff --git a/kernel/debug/kdb/kdb_support.c b/kernel/debug/kdb/kdb_support.c +index d35cc2d3a4cc..84422d2b95c0 100644 +--- a/kernel/debug/kdb/kdb_support.c ++++ b/kernel/debug/kdb/kdb_support.c +@@ -40,7 +40,7 @@ + int kdbgetsymval(const char *symname, kdb_symtab_t *symtab) + { + if (KDB_DEBUG(AR)) +- kdb_printf("kdbgetsymval: symname=%s, symtab=%p\n", symname, ++ kdb_printf("kdbgetsymval: symname=%s, symtab=%px\n", symname, + symtab); + memset(symtab, 0, sizeof(*symtab)); + symtab->sym_start = kallsyms_lookup_name(symname); +@@ -88,7 +88,7 @@ int kdbnearsym(unsigned long addr, kdb_symtab_t *symtab) + char *knt1 = NULL; + + if (KDB_DEBUG(AR)) +- kdb_printf("kdbnearsym: addr=0x%lx, symtab=%p\n", addr, symtab); ++ kdb_printf("kdbnearsym: addr=0x%lx, symtab=%px\n", addr, symtab); + memset(symtab, 0, sizeof(*symtab)); + + if (addr < 4096) +@@ -149,7 +149,7 @@ int kdbnearsym(unsigned long addr, kdb_symtab_t *symtab) + symtab->mod_name = "kernel"; + if (KDB_DEBUG(AR)) + kdb_printf("kdbnearsym: returns %d symtab->sym_start=0x%lx, " +- "symtab->mod_name=%p, symtab->sym_name=%p (%s)\n", ret, ++ "symtab->mod_name=%px, symtab->sym_name=%px (%s)\n", ret, + symtab->sym_start, symtab->mod_name, symtab->sym_name, + symtab->sym_name); + +@@ -887,13 +887,13 @@ void debug_kusage(void) + __func__, dah_first); + if (dah_first) { + h_used = (struct debug_alloc_header *)debug_alloc_pool; +- kdb_printf("%s: h_used %p size %d\n", __func__, h_used, ++ kdb_printf("%s: h_used %px size %d\n", __func__, h_used, + h_used->size); + } + do { + h_used = (struct debug_alloc_header *) + ((char *)h_free + dah_overhead + h_free->size); +- kdb_printf("%s: h_used %p size %d caller %p\n", ++ kdb_printf("%s: h_used %px size %d caller %px\n", + __func__, h_used, h_used->size, h_used->caller); + h_free = (struct debug_alloc_header *) + (debug_alloc_pool + h_free->next); +@@ -902,7 +902,7 @@ void debug_kusage(void) + ((char *)h_free + dah_overhead + h_free->size); + if ((char *)h_used - debug_alloc_pool != + sizeof(debug_alloc_pool_aligned)) +- kdb_printf("%s: h_used %p size %d caller %p\n", ++ kdb_printf("%s: h_used %px size %d caller %px\n", + __func__, h_used, h_used->size, h_used->caller); + out: + spin_unlock(&dap_lock); +diff --git a/kernel/printk/printk.c b/kernel/printk/printk.c +index 7161312593dd..a9cf2e15f6a3 100644 +--- a/kernel/printk/printk.c ++++ b/kernel/printk/printk.c +@@ -1762,6 +1762,12 @@ asmlinkage int vprintk_emit(int facility, int level, + + /* If called from the scheduler, we can not call up(). */ + if (!in_sched) { ++ /* ++ * Disable preemption to avoid being preempted while holding ++ * console_sem which would prevent anyone from printing to ++ * console ++ */ ++ preempt_disable(); + /* + * Try to acquire and then immediately release the console + * semaphore. The release will print out buffers and wake up +@@ -1769,6 +1775,7 @@ asmlinkage int vprintk_emit(int facility, int level, + */ + if (console_trylock()) + console_unlock(); ++ preempt_enable(); + } + + return printed_len; +@@ -2083,20 +2090,7 @@ int console_trylock(void) + return 0; + } + console_locked = 1; +- /* +- * When PREEMPT_COUNT disabled we can't reliably detect if it's +- * safe to schedule (e.g. calling printk while holding a spin_lock), +- * because preempt_disable()/preempt_enable() are just barriers there +- * and preempt_count() is always 0. +- * +- * RCU read sections have a separate preemption counter when +- * PREEMPT_RCU enabled thus we must take extra care and check +- * rcu_preempt_depth(), otherwise RCU read sections modify +- * preempt_count(). +- */ +- console_may_schedule = !oops_in_progress && +- preemptible() && +- !rcu_preempt_depth(); ++ console_may_schedule = 0; + return 1; + } + EXPORT_SYMBOL(console_trylock); +diff --git a/lib/ubsan.c b/lib/ubsan.c +index 50d1d5c25deb..60e108c5c173 100644 +--- a/lib/ubsan.c ++++ b/lib/ubsan.c +@@ -451,8 +451,7 @@ void __ubsan_handle_shift_out_of_bounds(struct shift_out_of_bounds_data *data, + EXPORT_SYMBOL(__ubsan_handle_shift_out_of_bounds); + + +-void __noreturn +-__ubsan_handle_builtin_unreachable(struct unreachable_data *data) ++void __ubsan_handle_builtin_unreachable(struct unreachable_data *data) + { + unsigned long flags; + +diff --git a/mm/hugetlb.c b/mm/hugetlb.c +index e073099083ca..f46040aed2da 100644 +--- a/mm/hugetlb.c ++++ b/mm/hugetlb.c +@@ -3211,7 +3211,7 @@ static int is_hugetlb_entry_hwpoisoned(pte_t pte) + int copy_hugetlb_page_range(struct mm_struct *dst, struct mm_struct *src, + struct vm_area_struct *vma) + { +- pte_t *src_pte, *dst_pte, entry; ++ pte_t *src_pte, *dst_pte, entry, dst_entry; + struct page *ptepage; + unsigned long addr; + int cow; +@@ -3239,15 +3239,30 @@ int copy_hugetlb_page_range(struct mm_struct *dst, struct mm_struct *src, + break; + } + +- /* If the pagetables are shared don't copy or take references */ +- if (dst_pte == src_pte) ++ /* ++ * If the pagetables are shared don't copy or take references. ++ * dst_pte == src_pte is the common case of src/dest sharing. ++ * ++ * However, src could have 'unshared' and dst shares with ++ * another vma. If dst_pte !none, this implies sharing. ++ * Check here before taking page table lock, and once again ++ * after taking the lock below. ++ */ ++ dst_entry = huge_ptep_get(dst_pte); ++ if ((dst_pte == src_pte) || !huge_pte_none(dst_entry)) + continue; + + dst_ptl = huge_pte_lock(h, dst, dst_pte); + src_ptl = huge_pte_lockptr(h, src, src_pte); + spin_lock_nested(src_ptl, SINGLE_DEPTH_NESTING); + entry = huge_ptep_get(src_pte); +- if (huge_pte_none(entry)) { /* skip none entry */ ++ dst_entry = huge_ptep_get(dst_pte); ++ if (huge_pte_none(entry) || !huge_pte_none(dst_entry)) { ++ /* ++ * Skip if src entry none. Also, skip in the ++ * unlikely case dst entry !none as this implies ++ * sharing with another vma. ++ */ + ; + } else if (unlikely(is_hugetlb_entry_migration(entry) || + is_hugetlb_entry_hwpoisoned(entry))) { +diff --git a/mm/mempolicy.c b/mm/mempolicy.c +index ecbda7f5d494..1b93535d875f 100644 +--- a/mm/mempolicy.c ++++ b/mm/mempolicy.c +@@ -2012,8 +2012,36 @@ alloc_pages_vma(gfp_t gfp, int order, struct vm_area_struct *vma, + nmask = policy_nodemask(gfp, pol); + if (!nmask || node_isset(hpage_node, *nmask)) { + mpol_cond_put(pol); +- page = __alloc_pages_node(hpage_node, +- gfp | __GFP_THISNODE, order); ++ /* ++ * We cannot invoke reclaim if __GFP_THISNODE ++ * is set. Invoking reclaim with ++ * __GFP_THISNODE set, would cause THP ++ * allocations to trigger heavy swapping ++ * despite there may be tons of free memory ++ * (including potentially plenty of THP ++ * already available in the buddy) on all the ++ * other NUMA nodes. ++ * ++ * At most we could invoke compaction when ++ * __GFP_THISNODE is set (but we would need to ++ * refrain from invoking reclaim even if ++ * compaction returned COMPACT_SKIPPED because ++ * there wasn't not enough memory to succeed ++ * compaction). For now just avoid ++ * __GFP_THISNODE instead of limiting the ++ * allocation path to a strict and single ++ * compaction invocation. ++ * ++ * Supposedly if direct reclaim was enabled by ++ * the caller, the app prefers THP regardless ++ * of the node it comes from so this would be ++ * more desiderable behavior than only ++ * providing THP originated from the local ++ * node in such case. ++ */ ++ if (!(gfp & __GFP_DIRECT_RECLAIM)) ++ gfp |= __GFP_THISNODE; ++ page = __alloc_pages_node(hpage_node, gfp, order); + goto out; + } + } +diff --git a/mm/swapfile.c b/mm/swapfile.c +index 8cbc7d6fd52e..08e8cd21770c 100644 +--- a/mm/swapfile.c ++++ b/mm/swapfile.c +@@ -2830,7 +2830,7 @@ static struct swap_info_struct *alloc_swap_info(void) + unsigned int type; + int i; + +- p = kzalloc(sizeof(*p), GFP_KERNEL); ++ p = kvzalloc(sizeof(*p), GFP_KERNEL); + if (!p) + return ERR_PTR(-ENOMEM); + +@@ -2841,7 +2841,7 @@ static struct swap_info_struct *alloc_swap_info(void) + } + if (type >= MAX_SWAPFILES) { + spin_unlock(&swap_lock); +- kfree(p); ++ kvfree(p); + return ERR_PTR(-EPERM); + } + if (type >= nr_swapfiles) { +@@ -2855,7 +2855,7 @@ static struct swap_info_struct *alloc_swap_info(void) + smp_wmb(); + nr_swapfiles++; + } else { +- kfree(p); ++ kvfree(p); + p = swap_info[type]; + /* + * Do not memset this entry: a racing procfs swap_next() +diff --git a/net/9p/protocol.c b/net/9p/protocol.c +index 16e10680518c..9743837aebc6 100644 +--- a/net/9p/protocol.c ++++ b/net/9p/protocol.c +@@ -46,10 +46,15 @@ p9pdu_writef(struct p9_fcall *pdu, int proto_version, const char *fmt, ...); + void p9stat_free(struct p9_wstat *stbuf) + { + kfree(stbuf->name); ++ stbuf->name = NULL; + kfree(stbuf->uid); ++ stbuf->uid = NULL; + kfree(stbuf->gid); ++ stbuf->gid = NULL; + kfree(stbuf->muid); ++ stbuf->muid = NULL; + kfree(stbuf->extension); ++ stbuf->extension = NULL; + } + EXPORT_SYMBOL(p9stat_free); + +diff --git a/net/netfilter/nf_conntrack_core.c b/net/netfilter/nf_conntrack_core.c +index a268acc48af0..b793b55d1488 100644 +--- a/net/netfilter/nf_conntrack_core.c ++++ b/net/netfilter/nf_conntrack_core.c +@@ -932,19 +932,22 @@ static unsigned int early_drop_list(struct net *net, + return drops; + } + +-static noinline int early_drop(struct net *net, unsigned int _hash) ++static noinline int early_drop(struct net *net, unsigned int hash) + { +- unsigned int i; ++ unsigned int i, bucket; + + for (i = 0; i < NF_CT_EVICTION_RANGE; i++) { + struct hlist_nulls_head *ct_hash; +- unsigned int hash, hsize, drops; ++ unsigned int hsize, drops; + + rcu_read_lock(); + nf_conntrack_get_ht(&ct_hash, &hsize); +- hash = reciprocal_scale(_hash++, hsize); ++ if (!i) ++ bucket = reciprocal_scale(hash, hsize); ++ else ++ bucket = (bucket + 1) % hsize; + +- drops = early_drop_list(net, &ct_hash[hash]); ++ drops = early_drop_list(net, &ct_hash[bucket]); + rcu_read_unlock(); + + if (drops) { +diff --git a/net/sunrpc/xdr.c b/net/sunrpc/xdr.c +index e34f4ee7f2b6..13695ba8fc54 100644 +--- a/net/sunrpc/xdr.c ++++ b/net/sunrpc/xdr.c +@@ -639,11 +639,10 @@ void xdr_truncate_encode(struct xdr_stream *xdr, size_t len) + WARN_ON_ONCE(xdr->iov); + return; + } +- if (fraglen) { ++ if (fraglen) + xdr->end = head->iov_base + head->iov_len; +- xdr->page_ptr--; +- } + /* (otherwise assume xdr->end is already set) */ ++ xdr->page_ptr--; + head->iov_len = len; + buf->len = len; + xdr->p = head->iov_base + head->iov_len; +diff --git a/tools/testing/selftests/powerpc/tm/tm-tmspr.c b/tools/testing/selftests/powerpc/tm/tm-tmspr.c +index 2bda81c7bf23..df1d7d4b1c89 100644 +--- a/tools/testing/selftests/powerpc/tm/tm-tmspr.c ++++ b/tools/testing/selftests/powerpc/tm/tm-tmspr.c +@@ -98,7 +98,7 @@ void texasr(void *in) + + int test_tmspr() + { +- pthread_t thread; ++ pthread_t *thread; + int thread_num; + unsigned long i; + +@@ -107,21 +107,28 @@ int test_tmspr() + /* To cause some context switching */ + thread_num = 10 * sysconf(_SC_NPROCESSORS_ONLN); + ++ thread = malloc(thread_num * sizeof(pthread_t)); ++ if (thread == NULL) ++ return EXIT_FAILURE; ++ + /* Test TFIAR and TFHAR */ +- for (i = 0 ; i < thread_num ; i += 2){ +- if (pthread_create(&thread, NULL, (void*)tfiar_tfhar, (void *)i)) ++ for (i = 0; i < thread_num; i += 2) { ++ if (pthread_create(&thread[i], NULL, (void *)tfiar_tfhar, ++ (void *)i)) + return EXIT_FAILURE; + } +- if (pthread_join(thread, NULL) != 0) +- return EXIT_FAILURE; +- + /* Test TEXASR */ +- for (i = 0 ; i < thread_num ; i++){ +- if (pthread_create(&thread, NULL, (void*)texasr, (void *)i)) ++ for (i = 1; i < thread_num; i += 2) { ++ if (pthread_create(&thread[i], NULL, (void *)texasr, (void *)i)) + return EXIT_FAILURE; + } +- if (pthread_join(thread, NULL) != 0) +- return EXIT_FAILURE; ++ ++ for (i = 0; i < thread_num; i++) { ++ if (pthread_join(thread[i], NULL) != 0) ++ return EXIT_FAILURE; ++ } ++ ++ free(thread); + + if (passed) + return 0;
