commit:     ad571c0178bef7c9019cdcec5566e8aad9ebf21c
Author:     Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Fri Dec 11 12:54:46 2020 +0000
Commit:     Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Fri Dec 11 12:54:46 2020 +0000
URL:        https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=ad571c01

Linux patch 4.9.248

Signed-off-by: Mike Pagano <mpagano <AT> gentoo.org>

 0000_README              |    4 +
 1247_linux-4.9.248.patch | 1701 ++++++++++++++++++++++++++++++++++++++++++++++
 2 files changed, 1705 insertions(+)

diff --git a/0000_README b/0000_README
index c4d4e26..e3ccddb 100644
--- a/0000_README
+++ b/0000_README
@@ -1031,6 +1031,10 @@ Patch:  1246_linux-4.9.247.patch
 From:   http://www.kernel.org
 Desc:   Linux 4.9.247
 
+Patch:  1247_linux-4.9.248.patch
+From:   http://www.kernel.org
+Desc:   Linux 4.9.248
+
 Patch:  1500_XATTR_USER_PREFIX.patch
 From:   https://bugs.gentoo.org/show_bug.cgi?id=470644
 Desc:   Support for namespace user.pax.* on tmpfs.

diff --git a/1247_linux-4.9.248.patch b/1247_linux-4.9.248.patch
new file mode 100644
index 0000000..02e2343
--- /dev/null
+++ b/1247_linux-4.9.248.patch
@@ -0,0 +1,1701 @@
+diff --git a/Documentation/devicetree/bindings/net/nfc/nxp-nci.txt 
b/Documentation/devicetree/bindings/net/nfc/nxp-nci.txt
+index 5b6cd9b3f628a..0188bbd2e35f8 100644
+--- a/Documentation/devicetree/bindings/net/nfc/nxp-nci.txt
++++ b/Documentation/devicetree/bindings/net/nfc/nxp-nci.txt
+@@ -27,7 +27,7 @@ Example (for ARM-based BeagleBone with NPC100 NFC controller 
on I2C2):
+               clock-frequency = <100000>;
+ 
+               interrupt-parent = <&gpio1>;
+-              interrupts = <29 GPIO_ACTIVE_HIGH>;
++              interrupts = <29 IRQ_TYPE_LEVEL_HIGH>;
+ 
+               enable-gpios = <&gpio0 30 GPIO_ACTIVE_HIGH>;
+               firmware-gpios = <&gpio0 31 GPIO_ACTIVE_HIGH>;
+diff --git a/Documentation/devicetree/bindings/net/nfc/pn544.txt 
b/Documentation/devicetree/bindings/net/nfc/pn544.txt
+index dab69f36167c7..8541e8dafd55c 100644
+--- a/Documentation/devicetree/bindings/net/nfc/pn544.txt
++++ b/Documentation/devicetree/bindings/net/nfc/pn544.txt
+@@ -27,7 +27,7 @@ Example (for ARM-based BeagleBone with PN544 on I2C2):
+               clock-frequency = <400000>;
+ 
+               interrupt-parent = <&gpio1>;
+-              interrupts = <17 GPIO_ACTIVE_HIGH>;
++              interrupts = <17 IRQ_TYPE_LEVEL_HIGH>;
+ 
+               enable-gpios = <&gpio3 21 GPIO_ACTIVE_HIGH>;
+               firmware-gpios = <&gpio3 19 GPIO_ACTIVE_HIGH>;
+diff --git a/Makefile b/Makefile
+index 82f71f9460cb6..f6680569c0008 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,6 +1,6 @@
+ VERSION = 4
+ PATCHLEVEL = 9
+-SUBLEVEL = 247
++SUBLEVEL = 248
+ EXTRAVERSION =
+ NAME = Roaring Lionus
+ 
+diff --git a/arch/x86/include/asm/insn.h b/arch/x86/include/asm/insn.h
+index c2c01f84df75f..3e0e18d376d2c 100644
+--- a/arch/x86/include/asm/insn.h
++++ b/arch/x86/include/asm/insn.h
+@@ -208,6 +208,21 @@ static inline int insn_offset_immediate(struct insn *insn)
+       return insn_offset_displacement(insn) + insn->displacement.nbytes;
+ }
+ 
++/**
++ * for_each_insn_prefix() -- Iterate prefixes in the instruction
++ * @insn: Pointer to struct insn.
++ * @idx:  Index storage.
++ * @prefix: Prefix byte.
++ *
++ * Iterate prefix bytes of given @insn. Each prefix byte is stored in @prefix
++ * and the index is stored in @idx (note that this @idx is just for a cursor,
++ * do not change it.)
++ * Since prefixes.nbytes can be bigger than 4 if some prefixes
++ * are repeated, it cannot be used for looping over the prefixes.
++ */
++#define for_each_insn_prefix(insn, idx, prefix)       \
++      for (idx = 0; idx < ARRAY_SIZE(insn->prefixes.bytes) && (prefix = 
insn->prefixes.bytes[idx]) != 0; idx++)
++
+ #define POP_SS_OPCODE 0x1f
+ #define MOV_SREG_OPCODE 0x8e
+ 
+diff --git a/arch/x86/kernel/uprobes.c b/arch/x86/kernel/uprobes.c
+index 73391c1bd2a9a..52bb7413f3524 100644
+--- a/arch/x86/kernel/uprobes.c
++++ b/arch/x86/kernel/uprobes.c
+@@ -268,10 +268,11 @@ static volatile u32 good_2byte_insns[256 / 32] = {
+ 
+ static bool is_prefix_bad(struct insn *insn)
+ {
++      insn_byte_t p;
+       int i;
+ 
+-      for (i = 0; i < insn->prefixes.nbytes; i++) {
+-              switch (insn->prefixes.bytes[i]) {
++      for_each_insn_prefix(insn, i, p) {
++              switch (p) {
+               case 0x26:      /* INAT_PFX_ES   */
+               case 0x2E:      /* INAT_PFX_CS   */
+               case 0x36:      /* INAT_PFX_DS   */
+@@ -711,6 +712,7 @@ static const struct uprobe_xol_ops branch_xol_ops = {
+ static int branch_setup_xol_ops(struct arch_uprobe *auprobe, struct insn 
*insn)
+ {
+       u8 opc1 = OPCODE1(insn);
++      insn_byte_t p;
+       int i;
+ 
+       switch (opc1) {
+@@ -741,8 +743,8 @@ static int branch_setup_xol_ops(struct arch_uprobe 
*auprobe, struct insn *insn)
+        * Intel and AMD behavior differ in 64-bit mode: Intel ignores 66 
prefix.
+        * No one uses these insns, reject any branch insns with such prefix.
+        */
+-      for (i = 0; i < insn->prefixes.nbytes; i++) {
+-              if (insn->prefixes.bytes[i] == 0x66)
++      for_each_insn_prefix(insn, i, p) {
++              if (p == 0x66)
+                       return -ENOTSUPP;
+       }
+ 
+diff --git a/drivers/i2c/busses/i2c-imx.c b/drivers/i2c/busses/i2c-imx.c
+index 5a148b515f3df..b91ad668202e7 100644
+--- a/drivers/i2c/busses/i2c-imx.c
++++ b/drivers/i2c/busses/i2c-imx.c
+@@ -413,6 +413,19 @@ static void i2c_imx_dma_free(struct imx_i2c_struct 
*i2c_imx)
+       dma->chan_using = NULL;
+ }
+ 
++static void i2c_imx_clear_irq(struct imx_i2c_struct *i2c_imx, unsigned int 
bits)
++{
++      unsigned int temp;
++
++      /*
++       * i2sr_clr_opcode is the value to clear all interrupts. Here we want to
++       * clear only <bits>, so we write ~i2sr_clr_opcode with just <bits>
++       * toggled. This is required because i.MX needs W0C and Vybrid uses W1C.
++       */
++      temp = ~i2c_imx->hwdata->i2sr_clr_opcode ^ bits;
++      imx_i2c_write_reg(temp, i2c_imx, IMX_I2C_I2SR);
++}
++
+ static int i2c_imx_bus_busy(struct imx_i2c_struct *i2c_imx, int for_busy)
+ {
+       unsigned long orig_jiffies = jiffies;
+@@ -425,8 +438,7 @@ static int i2c_imx_bus_busy(struct imx_i2c_struct 
*i2c_imx, int for_busy)
+ 
+               /* check for arbitration lost */
+               if (temp & I2SR_IAL) {
+-                      temp &= ~I2SR_IAL;
+-                      imx_i2c_write_reg(temp, i2c_imx, IMX_I2C_I2SR);
++                      i2c_imx_clear_irq(i2c_imx, I2SR_IAL);
+                       return -EAGAIN;
+               }
+ 
+@@ -453,6 +465,16 @@ static int i2c_imx_trx_complete(struct imx_i2c_struct 
*i2c_imx)
+               dev_dbg(&i2c_imx->adapter.dev, "<%s> Timeout\n", __func__);
+               return -ETIMEDOUT;
+       }
++
++      /* check for arbitration lost */
++      if (i2c_imx->i2csr & I2SR_IAL) {
++              dev_dbg(&i2c_imx->adapter.dev, "<%s> Arbitration lost\n", 
__func__);
++              i2c_imx_clear_irq(i2c_imx, I2SR_IAL);
++
++              i2c_imx->i2csr = 0;
++              return -EAGAIN;
++      }
++
+       dev_dbg(&i2c_imx->adapter.dev, "<%s> TRX complete\n", __func__);
+       i2c_imx->i2csr = 0;
+       return 0;
+@@ -595,9 +617,7 @@ static irqreturn_t i2c_imx_isr(int irq, void *dev_id)
+       if (temp & I2SR_IIF) {
+               /* save status register */
+               i2c_imx->i2csr = temp;
+-              temp &= ~I2SR_IIF;
+-              temp |= (i2c_imx->hwdata->i2sr_clr_opcode & I2SR_IIF);
+-              imx_i2c_write_reg(temp, i2c_imx, IMX_I2C_I2SR);
++              i2c_imx_clear_irq(i2c_imx, I2SR_IIF);
+               wake_up(&i2c_imx->queue);
+               return IRQ_HANDLED;
+       }
+diff --git a/drivers/i2c/busses/i2c-qup.c b/drivers/i2c/busses/i2c-qup.c
+index 7524e17ac966e..00366cf896171 100644
+--- a/drivers/i2c/busses/i2c-qup.c
++++ b/drivers/i2c/busses/i2c-qup.c
+@@ -810,7 +810,8 @@ static int qup_i2c_bam_do_xfer(struct qup_i2c_dev *qup, 
struct i2c_msg *msg,
+       if (ret || qup->bus_err || qup->qup_err) {
+               reinit_completion(&qup->xfer);
+ 
+-              if (qup_i2c_change_state(qup, QUP_RUN_STATE)) {
++              ret = qup_i2c_change_state(qup, QUP_RUN_STATE);
++              if (ret) {
+                       dev_err(qup->dev, "change to run state timed out");
+                       goto desc_err;
+               }
+diff --git a/drivers/infiniband/hw/i40iw/i40iw_main.c 
b/drivers/infiniband/hw/i40iw/i40iw_main.c
+index ac2f3cd9478c9..aafe9989b33dc 100644
+--- a/drivers/infiniband/hw/i40iw/i40iw_main.c
++++ b/drivers/infiniband/hw/i40iw/i40iw_main.c
+@@ -54,10 +54,6 @@
+ #define DRV_VERSION   __stringify(DRV_VERSION_MAJOR) "."              \
+       __stringify(DRV_VERSION_MINOR) "." __stringify(DRV_VERSION_BUILD)
+ 
+-static int push_mode;
+-module_param(push_mode, int, 0644);
+-MODULE_PARM_DESC(push_mode, "Low latency mode: 0=disabled (default), 
1=enabled)");
+-
+ static int debug;
+ module_param(debug, int, 0644);
+ MODULE_PARM_DESC(debug, "debug flags: 0=disabled (default), 0x7fffffff=all");
+@@ -1524,7 +1520,6 @@ static enum i40iw_status_code 
i40iw_setup_init_state(struct i40iw_handler *hdl,
+       if (status)
+               goto exit;
+       iwdev->obj_next = iwdev->obj_mem;
+-      iwdev->push_mode = push_mode;
+ 
+       init_waitqueue_head(&iwdev->vchnl_waitq);
+       init_waitqueue_head(&dev->vf_reqs);
+diff --git a/drivers/infiniband/hw/i40iw/i40iw_verbs.c 
b/drivers/infiniband/hw/i40iw/i40iw_verbs.c
+index c3d2400e36b94..ece83aff2a2d3 100644
+--- a/drivers/infiniband/hw/i40iw/i40iw_verbs.c
++++ b/drivers/infiniband/hw/i40iw/i40iw_verbs.c
+@@ -208,38 +208,16 @@ static int i40iw_dealloc_ucontext(struct ib_ucontext 
*context)
+  */
+ static int i40iw_mmap(struct ib_ucontext *context, struct vm_area_struct *vma)
+ {
+-      struct i40iw_ucontext *ucontext;
+-      u64 db_addr_offset;
+-      u64 push_offset;
+-
+-      ucontext = to_ucontext(context);
+-      if (ucontext->iwdev->sc_dev.is_pf) {
+-              db_addr_offset = I40IW_DB_ADDR_OFFSET;
+-              push_offset = I40IW_PUSH_OFFSET;
+-              if (vma->vm_pgoff)
+-                      vma->vm_pgoff += I40IW_PF_FIRST_PUSH_PAGE_INDEX - 1;
+-      } else {
+-              db_addr_offset = I40IW_VF_DB_ADDR_OFFSET;
+-              push_offset = I40IW_VF_PUSH_OFFSET;
+-              if (vma->vm_pgoff)
+-                      vma->vm_pgoff += I40IW_VF_FIRST_PUSH_PAGE_INDEX - 1;
+-      }
++      struct i40iw_ucontext *ucontext = to_ucontext(context);
++      u64 dbaddr;
+ 
+-      vma->vm_pgoff += db_addr_offset >> PAGE_SHIFT;
++      if (vma->vm_pgoff || vma->vm_end - vma->vm_start != PAGE_SIZE)
++              return -EINVAL;
+ 
+-      if (vma->vm_pgoff == (db_addr_offset >> PAGE_SHIFT)) {
+-              vma->vm_page_prot = pgprot_noncached(vma->vm_page_prot);
+-              vma->vm_private_data = ucontext;
+-      } else {
+-              if ((vma->vm_pgoff - (push_offset >> PAGE_SHIFT)) % 2)
+-                      vma->vm_page_prot = pgprot_noncached(vma->vm_page_prot);
+-              else
+-                      vma->vm_page_prot = 
pgprot_writecombine(vma->vm_page_prot);
+-      }
++      dbaddr = I40IW_DB_ADDR_OFFSET + 
pci_resource_start(ucontext->iwdev->ldev->pcidev, 0);
+ 
+-      if (io_remap_pfn_range(vma, vma->vm_start,
+-                             vma->vm_pgoff + 
(pci_resource_start(ucontext->iwdev->ldev->pcidev, 0) >> PAGE_SHIFT),
+-                             PAGE_SIZE, vma->vm_page_prot))
++      if (io_remap_pfn_range(vma, vma->vm_start, dbaddr >> PAGE_SHIFT, 
PAGE_SIZE,
++                             pgprot_noncached(vma->vm_page_prot)))
+               return -EAGAIN;
+ 
+       return 0;
+diff --git a/drivers/input/joystick/xpad.c b/drivers/input/joystick/xpad.c
+index 54a6691d7d878..637f1347cd13d 100644
+--- a/drivers/input/joystick/xpad.c
++++ b/drivers/input/joystick/xpad.c
+@@ -258,6 +258,7 @@ static const struct xpad_device {
+       { 0x1038, 0x1430, "SteelSeries Stratus Duo", 0, XTYPE_XBOX360 },
+       { 0x1038, 0x1431, "SteelSeries Stratus Duo", 0, XTYPE_XBOX360 },
+       { 0x11c9, 0x55f0, "Nacon GC-100XF", 0, XTYPE_XBOX360 },
++      { 0x1209, 0x2882, "Ardwiino Controller", 0, XTYPE_XBOX360 },
+       { 0x12ab, 0x0004, "Honey Bee Xbox360 dancepad", MAP_DPAD_TO_BUTTONS, 
XTYPE_XBOX360 },
+       { 0x12ab, 0x0301, "PDP AFTERGLOW AX.1", 0, XTYPE_XBOX360 },
+       { 0x12ab, 0x0303, "Mortal Kombat Klassic FightStick", 
MAP_TRIGGERS_TO_BUTTONS, XTYPE_XBOX360 },
+@@ -435,6 +436,7 @@ static const struct usb_device_id xpad_table[] = {
+       XPAD_XBOXONE_VENDOR(0x0f0d),            /* Hori Controllers */
+       XPAD_XBOX360_VENDOR(0x1038),            /* SteelSeries Controllers */
+       XPAD_XBOX360_VENDOR(0x11c9),            /* Nacon GC100XF */
++      XPAD_XBOX360_VENDOR(0x1209),            /* Ardwiino Controllers */
+       XPAD_XBOX360_VENDOR(0x12ab),            /* X-Box 360 dance pads */
+       XPAD_XBOX360_VENDOR(0x1430),            /* RedOctane X-Box 360 
controllers */
+       XPAD_XBOX360_VENDOR(0x146b),            /* BigBen Interactive 
Controllers */
+diff --git a/drivers/input/serio/i8042-x86ia64io.h 
b/drivers/input/serio/i8042-x86ia64io.h
+index 82ff44637ed78..1f45010a5b814 100644
+--- a/drivers/input/serio/i8042-x86ia64io.h
++++ b/drivers/input/serio/i8042-x86ia64io.h
+@@ -223,6 +223,10 @@ static const struct dmi_system_id __initconst 
i8042_dmi_noloop_table[] = {
+                       DMI_MATCH(DMI_SYS_VENDOR, "PEGATRON CORPORATION"),
+                       DMI_MATCH(DMI_PRODUCT_NAME, "C15B"),
+               },
++              .matches = {
++                      DMI_MATCH(DMI_SYS_VENDOR, "ByteSpeed LLC"),
++                      DMI_MATCH(DMI_PRODUCT_NAME, "ByteSpeed Laptop C15B"),
++              },
+       },
+       { }
+ };
+diff --git a/drivers/input/serio/i8042.c b/drivers/input/serio/i8042.c
+index 6b648339733fa..37f84ba11f05e 100644
+--- a/drivers/input/serio/i8042.c
++++ b/drivers/input/serio/i8042.c
+@@ -1456,7 +1456,8 @@ static int __init i8042_setup_aux(void)
+       if (error)
+               goto err_free_ports;
+ 
+-      if (aux_enable())
++      error = aux_enable();
++      if (error)
+               goto err_free_irq;
+ 
+       i8042_aux_irq_registered = true;
+diff --git a/drivers/iommu/amd_iommu.c b/drivers/iommu/amd_iommu.c
+index bb0448c91f672..f4a15d9f2bbb2 100644
+--- a/drivers/iommu/amd_iommu.c
++++ b/drivers/iommu/amd_iommu.c
+@@ -3661,7 +3661,7 @@ static struct irq_chip amd_ir_chip;
+ 
+ #define DTE_IRQ_PHYS_ADDR_MASK        (((1ULL << 45)-1) << 6)
+ #define DTE_IRQ_REMAP_INTCTL    (2ULL << 60)
+-#define DTE_IRQ_TABLE_LEN       (8ULL << 1)
++#define DTE_IRQ_TABLE_LEN       (9ULL << 1)
+ #define DTE_IRQ_REMAP_ENABLE    1ULL
+ 
+ static void set_dte_irq_entry(u16 devid, struct irq_remap_table *table)
+diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c
+index 240d7850c8252..16437aa35bc4c 100644
+--- a/drivers/net/bonding/bond_main.c
++++ b/drivers/net/bonding/bond_main.c
+@@ -1238,7 +1238,39 @@ static void bond_upper_dev_unlink(struct bonding *bond, 
struct slave *slave)
+       rtmsg_ifinfo(RTM_NEWLINK, slave->dev, IFF_SLAVE, GFP_KERNEL);
+ }
+ 
+-static struct slave *bond_alloc_slave(struct bonding *bond)
++static void slave_kobj_release(struct kobject *kobj)
++{
++      struct slave *slave = to_slave(kobj);
++      struct bonding *bond = bond_get_bond_by_slave(slave);
++
++      cancel_delayed_work_sync(&slave->notify_work);
++      if (BOND_MODE(bond) == BOND_MODE_8023AD)
++              kfree(SLAVE_AD_INFO(slave));
++
++      kfree(slave);
++}
++
++static struct kobj_type slave_ktype = {
++      .release = slave_kobj_release,
++#ifdef CONFIG_SYSFS
++      .sysfs_ops = &slave_sysfs_ops,
++#endif
++};
++
++static int bond_kobj_init(struct slave *slave)
++{
++      int err;
++
++      err = kobject_init_and_add(&slave->kobj, &slave_ktype,
++                                 &(slave->dev->dev.kobj), "bonding_slave");
++      if (err)
++              kobject_put(&slave->kobj);
++
++      return err;
++}
++
++static struct slave *bond_alloc_slave(struct bonding *bond,
++                                    struct net_device *slave_dev)
+ {
+       struct slave *slave = NULL;
+ 
+@@ -1246,11 +1278,17 @@ static struct slave *bond_alloc_slave(struct bonding 
*bond)
+       if (!slave)
+               return NULL;
+ 
++      slave->bond = bond;
++      slave->dev = slave_dev;
++
++      if (bond_kobj_init(slave))
++              return NULL;
++
+       if (BOND_MODE(bond) == BOND_MODE_8023AD) {
+               SLAVE_AD_INFO(slave) = kzalloc(sizeof(struct ad_slave_info),
+                                              GFP_KERNEL);
+               if (!SLAVE_AD_INFO(slave)) {
+-                      kfree(slave);
++                      kobject_put(&slave->kobj);
+                       return NULL;
+               }
+       }
+@@ -1259,17 +1297,6 @@ static struct slave *bond_alloc_slave(struct bonding 
*bond)
+       return slave;
+ }
+ 
+-static void bond_free_slave(struct slave *slave)
+-{
+-      struct bonding *bond = bond_get_bond_by_slave(slave);
+-
+-      cancel_delayed_work_sync(&slave->notify_work);
+-      if (BOND_MODE(bond) == BOND_MODE_8023AD)
+-              kfree(SLAVE_AD_INFO(slave));
+-
+-      kfree(slave);
+-}
+-
+ static void bond_fill_ifbond(struct bonding *bond, struct ifbond *info)
+ {
+       info->bond_mode = BOND_MODE(bond);
+@@ -1449,14 +1476,12 @@ int bond_enslave(struct net_device *bond_dev, struct 
net_device *slave_dev)
+           bond->dev->addr_assign_type == NET_ADDR_RANDOM)
+               bond_set_dev_addr(bond->dev, slave_dev);
+ 
+-      new_slave = bond_alloc_slave(bond);
++      new_slave = bond_alloc_slave(bond, slave_dev);
+       if (!new_slave) {
+               res = -ENOMEM;
+               goto err_undo_flags;
+       }
+ 
+-      new_slave->bond = bond;
+-      new_slave->dev = slave_dev;
+       /* Set the new_slave's queue_id to be zero.  Queue ID mapping
+        * is set via sysfs or module option if desired.
+        */
+@@ -1781,7 +1806,7 @@ err_restore_mtu:
+       dev_set_mtu(slave_dev, new_slave->original_mtu);
+ 
+ err_free:
+-      bond_free_slave(new_slave);
++      kobject_put(&new_slave->kobj);
+ 
+ err_undo_flags:
+       /* Enslave of first slave has failed and we need to fix master's mac */
+@@ -1965,7 +1990,7 @@ static int __bond_release_one(struct net_device 
*bond_dev,
+       if (!netif_is_bond_master(slave_dev))
+               slave_dev->priv_flags &= ~IFF_BONDING;
+ 
+-      bond_free_slave(slave);
++      kobject_put(&slave->kobj);
+ 
+       return 0;
+ }
+diff --git a/drivers/net/bonding/bond_sysfs_slave.c 
b/drivers/net/bonding/bond_sysfs_slave.c
+index 3f756fa2f603b..68bbac4715c35 100644
+--- a/drivers/net/bonding/bond_sysfs_slave.c
++++ b/drivers/net/bonding/bond_sysfs_slave.c
+@@ -125,7 +125,6 @@ static const struct slave_attribute *slave_attrs[] = {
+ };
+ 
+ #define to_slave_attr(_at) container_of(_at, struct slave_attribute, attr)
+-#define to_slave(obj) container_of(obj, struct slave, kobj)
+ 
+ static ssize_t slave_show(struct kobject *kobj,
+                         struct attribute *attr, char *buf)
+@@ -136,28 +135,15 @@ static ssize_t slave_show(struct kobject *kobj,
+       return slave_attr->show(slave, buf);
+ }
+ 
+-static const struct sysfs_ops slave_sysfs_ops = {
++const struct sysfs_ops slave_sysfs_ops = {
+       .show = slave_show,
+ };
+ 
+-static struct kobj_type slave_ktype = {
+-#ifdef CONFIG_SYSFS
+-      .sysfs_ops = &slave_sysfs_ops,
+-#endif
+-};
+-
+ int bond_sysfs_slave_add(struct slave *slave)
+ {
+       const struct slave_attribute **a;
+       int err;
+ 
+-      err = kobject_init_and_add(&slave->kobj, &slave_ktype,
+-                                 &(slave->dev->dev.kobj), "bonding_slave");
+-      if (err) {
+-              kobject_put(&slave->kobj);
+-              return err;
+-      }
+-
+       for (a = slave_attrs; *a; ++a) {
+               err = sysfs_create_file(&slave->kobj, &((*a)->attr));
+               if (err) {
+@@ -175,6 +161,4 @@ void bond_sysfs_slave_del(struct slave *slave)
+ 
+       for (a = slave_attrs; *a; ++a)
+               sysfs_remove_file(&slave->kobj, &((*a)->attr));
+-
+-      kobject_put(&slave->kobj);
+ }
+diff --git a/drivers/net/ethernet/chelsio/cxgb3/sge.c 
b/drivers/net/ethernet/chelsio/cxgb3/sge.c
+index e4b5b057f4178..f012649891dad 100644
+--- a/drivers/net/ethernet/chelsio/cxgb3/sge.c
++++ b/drivers/net/ethernet/chelsio/cxgb3/sge.c
+@@ -3111,6 +3111,7 @@ int t3_sge_alloc_qset(struct adapter *adapter, unsigned 
int id, int nports,
+                         GFP_KERNEL | __GFP_COMP);
+       if (!avail) {
+               CH_ALERT(adapter, "free list queue 0 initialization failed\n");
++              ret = -ENOMEM;
+               goto err;
+       }
+       if (avail < q->fl[0].size)
+diff --git a/drivers/net/ethernet/ibm/ibmvnic.c 
b/drivers/net/ethernet/ibm/ibmvnic.c
+index 88c837504c7d6..a8ff4f8a6b87d 100644
+--- a/drivers/net/ethernet/ibm/ibmvnic.c
++++ b/drivers/net/ethernet/ibm/ibmvnic.c
+@@ -985,6 +985,12 @@ restart_poll:
+ 
+               if (!pending_scrq(adapter, adapter->rx_scrq[scrq_num]))
+                       break;
++              /* The queue entry at the current index is peeked at above
++               * to determine that there is a valid descriptor awaiting
++               * processing. We want to be sure that the current slot
++               * holds a valid descriptor before reading its contents.
++               */
++              dma_rmb();
+               next = ibmvnic_next_scrq(adapter, adapter->rx_scrq[scrq_num]);
+               rx_buff =
+                   (struct ibmvnic_rx_buff *)be64_to_cpu(next->
+@@ -1373,13 +1379,18 @@ restart_loop:
+       while (pending_scrq(adapter, scrq)) {
+               unsigned int pool = scrq->pool_index;
+ 
++              /* The queue entry at the current index is peeked at above
++               * to determine that there is a valid descriptor awaiting
++               * processing. We want to be sure that the current slot
++               * holds a valid descriptor before reading its contents.
++               */
++              dma_rmb();
++
+               next = ibmvnic_next_scrq(adapter, scrq);
+               for (i = 0; i < next->tx_comp.num_comps; i++) {
+-                      if (next->tx_comp.rcs[i]) {
++                      if (next->tx_comp.rcs[i])
+                               dev_err(dev, "tx error %x\n",
+                                       next->tx_comp.rcs[i]);
+-                              continue;
+-                      }
+                       index = be32_to_cpu(next->tx_comp.correlators[i]);
+                       txbuff = &adapter->tx_pool[pool].tx_buff[index];
+ 
+@@ -1707,6 +1718,11 @@ static union sub_crq *ibmvnic_next_scrq(struct 
ibmvnic_adapter *adapter,
+       }
+       spin_unlock_irqrestore(&scrq->lock, flags);
+ 
++      /* Ensure that the entire buffer descriptor has been
++       * loaded before reading its contents
++       */
++      dma_rmb();
++
+       return entry;
+ }
+ 
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/pagealloc.c 
b/drivers/net/ethernet/mellanox/mlx5/core/pagealloc.c
+index a57d5a81eb05d..858c99864047c 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/pagealloc.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/pagealloc.c
+@@ -331,6 +331,24 @@ out_free:
+       return err;
+ }
+ 
++static u32 fwp_fill_manage_pages_out(struct fw_page *fwp, u32 *out, u32 index,
++                                   u32 npages)
++{
++      u32 pages_set = 0;
++      unsigned int n;
++
++      for_each_clear_bit(n, &fwp->bitmask, MLX5_NUM_4K_IN_PAGE) {
++              MLX5_ARRAY_SET64(manage_pages_out, out, pas, index + pages_set,
++                               fwp->addr + (n * MLX5_ADAPTER_PAGE_SIZE));
++              pages_set++;
++
++              if (!--npages)
++                      break;
++      }
++
++      return pages_set;
++}
++
+ static int reclaim_pages_cmd(struct mlx5_core_dev *dev,
+                            u32 *in, int in_size, u32 *out, int out_size)
+ {
+@@ -354,8 +372,7 @@ static int reclaim_pages_cmd(struct mlx5_core_dev *dev,
+               if (fwp->func_id != func_id)
+                       continue;
+ 
+-              MLX5_ARRAY_SET64(manage_pages_out, out, pas, i, fwp->addr);
+-              i++;
++              i += fwp_fill_manage_pages_out(fwp, out, i, npages - i);
+       }
+ 
+       MLX5_SET(manage_pages_out, out, output_num_entries, i);
+diff --git a/drivers/net/ethernet/pasemi/pasemi_mac.c 
b/drivers/net/ethernet/pasemi/pasemi_mac.c
+index dcd56ac687482..585225fbe2933 100644
+--- a/drivers/net/ethernet/pasemi/pasemi_mac.c
++++ b/drivers/net/ethernet/pasemi/pasemi_mac.c
+@@ -1089,16 +1089,20 @@ static int pasemi_mac_open(struct net_device *dev)
+ 
+       mac->tx = pasemi_mac_setup_tx_resources(dev);
+ 
+-      if (!mac->tx)
++      if (!mac->tx) {
++              ret = -ENOMEM;
+               goto out_tx_ring;
++      }
+ 
+       /* We might already have allocated rings in case mtu was changed
+        * before interface was brought up.
+        */
+       if (dev->mtu > 1500 && !mac->num_cs) {
+               pasemi_mac_setup_csrings(mac);
+-              if (!mac->num_cs)
++              if (!mac->num_cs) {
++                      ret = -ENOMEM;
+                       goto out_tx_ring;
++              }
+       }
+ 
+       /* Zero out rmon counters */
+diff --git a/drivers/net/usb/ipheth.c b/drivers/net/usb/ipheth.c
+index 2b16a5fed9ded..0cf5324d493e8 100644
+--- a/drivers/net/usb/ipheth.c
++++ b/drivers/net/usb/ipheth.c
+@@ -70,7 +70,7 @@
+ #define IPHETH_USBINTF_SUBCLASS 253
+ #define IPHETH_USBINTF_PROTO    1
+ 
+-#define IPHETH_BUF_SIZE         1516
++#define IPHETH_BUF_SIZE         1514
+ #define IPHETH_IP_ALIGN               2       /* padding at front of URB */
+ #define IPHETH_TX_TIMEOUT       (5 * HZ)
+ 
+diff --git a/drivers/pinctrl/intel/pinctrl-baytrail.c 
b/drivers/pinctrl/intel/pinctrl-baytrail.c
+index 1e945aa77734b..fc51922839f82 100644
+--- a/drivers/pinctrl/intel/pinctrl-baytrail.c
++++ b/drivers/pinctrl/intel/pinctrl-baytrail.c
+@@ -1017,6 +1017,21 @@ static void byt_gpio_disable_free(struct pinctrl_dev 
*pctl_dev,
+       pm_runtime_put(&vg->pdev->dev);
+ }
+ 
++static void byt_gpio_direct_irq_check(struct byt_gpio *vg,
++                                    unsigned int offset)
++{
++      void __iomem *conf_reg = byt_gpio_reg(vg, offset, BYT_CONF0_REG);
++
++      /*
++       * Before making any direction modifications, do a check if gpio is set
++       * for direct IRQ. On Bay Trail, setting GPIO to output does not make
++       * sense, so let's at least inform the caller before they shoot
++       * themselves in the foot.
++       */
++      if (readl(conf_reg) & BYT_DIRECT_IRQ_EN)
++              dev_info_once(&vg->pdev->dev, "Potential Error: Setting GPIO 
with direct_irq_en to output");
++}
++
+ static int byt_gpio_set_direction(struct pinctrl_dev *pctl_dev,
+                                 struct pinctrl_gpio_range *range,
+                                 unsigned int offset,
+@@ -1024,7 +1039,6 @@ static int byt_gpio_set_direction(struct pinctrl_dev 
*pctl_dev,
+ {
+       struct byt_gpio *vg = pinctrl_dev_get_drvdata(pctl_dev);
+       void __iomem *val_reg = byt_gpio_reg(vg, offset, BYT_VAL_REG);
+-      void __iomem *conf_reg = byt_gpio_reg(vg, offset, BYT_CONF0_REG);
+       unsigned long flags;
+       u32 value;
+ 
+@@ -1035,14 +1049,8 @@ static int byt_gpio_set_direction(struct pinctrl_dev 
*pctl_dev,
+       if (input)
+               value |= BYT_OUTPUT_EN;
+       else
+-              /*
+-               * Before making any direction modifications, do a check if gpio
+-               * is set for direct IRQ.  On baytrail, setting GPIO to output
+-               * does not make sense, so let's at least warn the caller before
+-               * they shoot themselves in the foot.
+-               */
+-              WARN(readl(conf_reg) & BYT_DIRECT_IRQ_EN,
+-                   "Potential Error: Setting GPIO with direct_irq_en to 
output");
++              byt_gpio_direct_irq_check(vg, offset);
++
+       writel(value, val_reg);
+ 
+       raw_spin_unlock_irqrestore(&byt_lock, flags);
+@@ -1382,19 +1390,50 @@ static int byt_gpio_get_direction(struct gpio_chip 
*chip, unsigned int offset)
+ 
+ static int byt_gpio_direction_input(struct gpio_chip *chip, unsigned int 
offset)
+ {
+-      return pinctrl_gpio_direction_input(chip->base + offset);
++      struct byt_gpio *vg = gpiochip_get_data(chip);
++      void __iomem *val_reg = byt_gpio_reg(vg, offset, BYT_VAL_REG);
++      unsigned long flags;
++      u32 reg;
++
++      raw_spin_lock_irqsave(&byt_lock, flags);
++
++      reg = readl(val_reg);
++      reg &= ~BYT_DIR_MASK;
++      reg |= BYT_OUTPUT_EN;
++      writel(reg, val_reg);
++
++      raw_spin_unlock_irqrestore(&byt_lock, flags);
++      return 0;
+ }
+ 
++/*
++ * Note despite the temptation this MUST NOT be converted into a call to
++ * pinctrl_gpio_direction_output() + byt_gpio_set() that does not work this
++ * MUST be done as a single BYT_VAL_REG register write.
++ * See the commit message of the commit adding this comment for details.
++ */
+ static int byt_gpio_direction_output(struct gpio_chip *chip,
+                                    unsigned int offset, int value)
+ {
+-      int ret = pinctrl_gpio_direction_output(chip->base + offset);
++      struct byt_gpio *vg = gpiochip_get_data(chip);
++      void __iomem *val_reg = byt_gpio_reg(vg, offset, BYT_VAL_REG);
++      unsigned long flags;
++      u32 reg;
+ 
+-      if (ret)
+-              return ret;
++      raw_spin_lock_irqsave(&byt_lock, flags);
+ 
+-      byt_gpio_set(chip, offset, value);
++      byt_gpio_direct_irq_check(vg, offset);
+ 
++      reg = readl(val_reg);
++      reg &= ~BYT_DIR_MASK;
++      if (value)
++              reg |= BYT_LEVEL;
++      else
++              reg &= ~BYT_LEVEL;
++
++      writel(reg, val_reg);
++
++      raw_spin_unlock_irqrestore(&byt_lock, flags);
+       return 0;
+ }
+ 
+diff --git a/drivers/spi/spi-bcm-qspi.c b/drivers/spi/spi-bcm-qspi.c
+index 1906b2319e5bd..5453910d8abc3 100644
+--- a/drivers/spi/spi-bcm-qspi.c
++++ b/drivers/spi/spi-bcm-qspi.c
+@@ -1185,7 +1185,7 @@ int bcm_qspi_probe(struct platform_device *pdev,
+       if (!of_match_node(bcm_qspi_of_match, dev->of_node))
+               return -ENODEV;
+ 
+-      master = spi_alloc_master(dev, sizeof(struct bcm_qspi));
++      master = devm_spi_alloc_master(dev, sizeof(struct bcm_qspi));
+       if (!master) {
+               dev_err(dev, "error allocating spi_master\n");
+               return -ENOMEM;
+@@ -1218,21 +1218,17 @@ int bcm_qspi_probe(struct platform_device *pdev,
+ 
+       if (res) {
+               qspi->base[MSPI]  = devm_ioremap_resource(dev, res);
+-              if (IS_ERR(qspi->base[MSPI])) {
+-                      ret = PTR_ERR(qspi->base[MSPI]);
+-                      goto qspi_resource_err;
+-              }
++              if (IS_ERR(qspi->base[MSPI]))
++                      return PTR_ERR(qspi->base[MSPI]);
+       } else {
+-              goto qspi_resource_err;
++              return 0;
+       }
+ 
+       res = platform_get_resource_byname(pdev, IORESOURCE_MEM, "bspi");
+       if (res) {
+               qspi->base[BSPI]  = devm_ioremap_resource(dev, res);
+-              if (IS_ERR(qspi->base[BSPI])) {
+-                      ret = PTR_ERR(qspi->base[BSPI]);
+-                      goto qspi_resource_err;
+-              }
++              if (IS_ERR(qspi->base[BSPI]))
++                      return PTR_ERR(qspi->base[BSPI]);
+               qspi->bspi_mode = true;
+       } else {
+               qspi->bspi_mode = false;
+@@ -1243,18 +1239,14 @@ int bcm_qspi_probe(struct platform_device *pdev,
+       res = platform_get_resource_byname(pdev, IORESOURCE_MEM, "cs_reg");
+       if (res) {
+               qspi->base[CHIP_SELECT]  = devm_ioremap_resource(dev, res);
+-              if (IS_ERR(qspi->base[CHIP_SELECT])) {
+-                      ret = PTR_ERR(qspi->base[CHIP_SELECT]);
+-                      goto qspi_resource_err;
+-              }
++              if (IS_ERR(qspi->base[CHIP_SELECT]))
++                      return PTR_ERR(qspi->base[CHIP_SELECT]);
+       }
+ 
+       qspi->dev_ids = kcalloc(num_irqs, sizeof(struct bcm_qspi_dev_id),
+                               GFP_KERNEL);
+-      if (!qspi->dev_ids) {
+-              ret = -ENOMEM;
+-              goto qspi_resource_err;
+-      }
++      if (!qspi->dev_ids)
++              return -ENOMEM;
+ 
+       for (val = 0; val < num_irqs; val++) {
+               irq = -1;
+@@ -1330,7 +1322,7 @@ int bcm_qspi_probe(struct platform_device *pdev,
+       qspi->xfer_mode.addrlen = -1;
+       qspi->xfer_mode.hp = -1;
+ 
+-      ret = devm_spi_register_master(&pdev->dev, master);
++      ret = spi_register_master(master);
+       if (ret < 0) {
+               dev_err(dev, "can't register master\n");
+               goto qspi_reg_err;
+@@ -1343,8 +1335,6 @@ qspi_reg_err:
+       clk_disable_unprepare(qspi->clk);
+ qspi_probe_err:
+       kfree(qspi->dev_ids);
+-qspi_resource_err:
+-      spi_master_put(master);
+       return ret;
+ }
+ /* probe function to be called by SoC specific platform driver probe */
+@@ -1355,10 +1345,10 @@ int bcm_qspi_remove(struct platform_device *pdev)
+       struct bcm_qspi *qspi = platform_get_drvdata(pdev);
+ 
+       platform_set_drvdata(pdev, NULL);
++      spi_unregister_master(qspi->master);
+       bcm_qspi_hw_uninit(qspi);
+       clk_disable_unprepare(qspi->clk);
+       kfree(qspi->dev_ids);
+-      spi_unregister_master(qspi->master);
+ 
+       return 0;
+ }
+diff --git a/drivers/spi/spi-bcm2835.c b/drivers/spi/spi-bcm2835.c
+index df6abc75bc167..6824beae18e4a 100644
+--- a/drivers/spi/spi-bcm2835.c
++++ b/drivers/spi/spi-bcm2835.c
+@@ -737,7 +737,7 @@ static int bcm2835_spi_probe(struct platform_device *pdev)
+       struct resource *res;
+       int err;
+ 
+-      master = spi_alloc_master(&pdev->dev, sizeof(*bs));
++      master = devm_spi_alloc_master(&pdev->dev, sizeof(*bs));
+       if (!master) {
+               dev_err(&pdev->dev, "spi_alloc_master() failed\n");
+               return -ENOMEM;
+@@ -759,23 +759,20 @@ static int bcm2835_spi_probe(struct platform_device 
*pdev)
+ 
+       res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
+       bs->regs = devm_ioremap_resource(&pdev->dev, res);
+-      if (IS_ERR(bs->regs)) {
+-              err = PTR_ERR(bs->regs);
+-              goto out_master_put;
+-      }
++      if (IS_ERR(bs->regs))
++              return PTR_ERR(bs->regs);
+ 
+       bs->clk = devm_clk_get(&pdev->dev, NULL);
+       if (IS_ERR(bs->clk)) {
+               err = PTR_ERR(bs->clk);
+               dev_err(&pdev->dev, "could not get clk: %d\n", err);
+-              goto out_master_put;
++              return err;
+       }
+ 
+       bs->irq = platform_get_irq(pdev, 0);
+       if (bs->irq <= 0) {
+               dev_err(&pdev->dev, "could not get IRQ: %d\n", bs->irq);
+-              err = bs->irq ? bs->irq : -ENODEV;
+-              goto out_master_put;
++              return bs->irq ? bs->irq : -ENODEV;
+       }
+ 
+       clk_prepare_enable(bs->clk);
+@@ -790,21 +787,20 @@ static int bcm2835_spi_probe(struct platform_device 
*pdev)
+                              dev_name(&pdev->dev), master);
+       if (err) {
+               dev_err(&pdev->dev, "could not request IRQ: %d\n", err);
+-              goto out_clk_disable;
++              goto out_dma_release;
+       }
+ 
+       err = spi_register_master(master);
+       if (err) {
+               dev_err(&pdev->dev, "could not register SPI master: %d\n", err);
+-              goto out_clk_disable;
++              goto out_dma_release;
+       }
+ 
+       return 0;
+ 
+-out_clk_disable:
++out_dma_release:
++      bcm2835_dma_release(master);
+       clk_disable_unprepare(bs->clk);
+-out_master_put:
+-      spi_master_put(master);
+       return err;
+ }
+ 
+diff --git a/drivers/spi/spi.c b/drivers/spi/spi.c
+index 3fadc564d781c..e0632ee1723b0 100644
+--- a/drivers/spi/spi.c
++++ b/drivers/spi/spi.c
+@@ -1827,6 +1827,46 @@ struct spi_master *spi_alloc_master(struct device *dev, 
unsigned size)
+ }
+ EXPORT_SYMBOL_GPL(spi_alloc_master);
+ 
++static void devm_spi_release_master(struct device *dev, void *master)
++{
++      spi_master_put(*(struct spi_master **)master);
++}
++
++/**
++ * devm_spi_alloc_master - resource-managed spi_alloc_master()
++ * @dev: physical device of SPI master
++ * @size: how much zeroed driver-private data to allocate
++ * Context: can sleep
++ *
++ * Allocate an SPI master and automatically release a reference on it
++ * when @dev is unbound from its driver.  Drivers are thus relieved from
++ * having to call spi_master_put().
++ *
++ * The arguments to this function are identical to spi_alloc_master().
++ *
++ * Return: the SPI master structure on success, else NULL.
++ */
++struct spi_master *devm_spi_alloc_master(struct device *dev, unsigned int 
size)
++{
++      struct spi_master **ptr, *master;
++
++      ptr = devres_alloc(devm_spi_release_master, sizeof(*ptr),
++                         GFP_KERNEL);
++      if (!ptr)
++              return NULL;
++
++      master = spi_alloc_master(dev, size);
++      if (master) {
++              *ptr = master;
++              devres_add(dev, ptr);
++      } else {
++              devres_free(ptr);
++      }
++
++      return master;
++}
++EXPORT_SYMBOL_GPL(devm_spi_alloc_master);
++
+ #ifdef CONFIG_OF
+ static int of_spi_register_master(struct spi_master *master)
+ {
+@@ -2007,6 +2047,11 @@ int devm_spi_register_master(struct device *dev, struct 
spi_master *master)
+ }
+ EXPORT_SYMBOL_GPL(devm_spi_register_master);
+ 
++static int devm_spi_match_master(struct device *dev, void *res, void *master)
++{
++      return *(struct spi_master **)res == master;
++}
++
+ static int __unregister(struct device *dev, void *null)
+ {
+       spi_unregister_device(to_spi_device(dev));
+@@ -2025,18 +2070,25 @@ static int __unregister(struct device *dev, void *null)
+  */
+ void spi_unregister_master(struct spi_master *master)
+ {
++      device_for_each_child(&master->dev, NULL, __unregister);
++
+       if (master->queued) {
+               if (spi_destroy_queue(master))
+                       dev_err(&master->dev, "queue remove failed\n");
+       }
+ 
+-      device_for_each_child(&master->dev, NULL, __unregister);
+-
+       mutex_lock(&board_lock);
+       list_del(&master->list);
+       mutex_unlock(&board_lock);
+ 
+-      device_unregister(&master->dev);
++      device_del(&master->dev);
++
++      /* Release the last reference on the master if its driver
++       * has not yet been converted to devm_spi_alloc_master().
++       */
++      if (!devres_find(master->dev.parent, devm_spi_release_master,
++                       devm_spi_match_master, master))
++              put_device(&master->dev);
+ }
+ EXPORT_SYMBOL_GPL(spi_unregister_master);
+ 
+diff --git a/drivers/tty/tty_io.c b/drivers/tty/tty_io.c
+index 15e0116e1232e..7b4aca20cb299 100644
+--- a/drivers/tty/tty_io.c
++++ b/drivers/tty/tty_io.c
+@@ -544,8 +544,8 @@ static void __proc_set_tty(struct tty_struct *tty)
+       put_pid(tty->session);
+       put_pid(tty->pgrp);
+       tty->pgrp = get_pid(task_pgrp(current));
+-      spin_unlock_irqrestore(&tty->ctrl_lock, flags);
+       tty->session = get_pid(task_session(current));
++      spin_unlock_irqrestore(&tty->ctrl_lock, flags);
+       if (current->signal->tty) {
+               tty_debug(tty, "current tty %s not NULL!!\n",
+                         current->signal->tty->name);
+@@ -935,21 +935,24 @@ void disassociate_ctty(int on_exit)
+       spin_lock_irq(&current->sighand->siglock);
+       put_pid(current->signal->tty_old_pgrp);
+       current->signal->tty_old_pgrp = NULL;
+-
+       tty = tty_kref_get(current->signal->tty);
++      spin_unlock_irq(&current->sighand->siglock);
++
+       if (tty) {
+               unsigned long flags;
++
++              tty_lock(tty);
+               spin_lock_irqsave(&tty->ctrl_lock, flags);
+               put_pid(tty->session);
+               put_pid(tty->pgrp);
+               tty->session = NULL;
+               tty->pgrp = NULL;
+               spin_unlock_irqrestore(&tty->ctrl_lock, flags);
++              tty_unlock(tty);
+               tty_kref_put(tty);
+       } else
+               tty_debug_hangup(tty, "no current tty\n");
+ 
+-      spin_unlock_irq(&current->sighand->siglock);
+       /* Now clear signal->tty under the lock */
+       read_lock(&tasklist_lock);
+       session_clear_tty(task_session(current));
+@@ -2628,14 +2631,19 @@ static int tiocspgrp(struct tty_struct *tty, struct 
tty_struct *real_tty, pid_t
+               return -ENOTTY;
+       if (retval)
+               return retval;
+-      if (!current->signal->tty ||
+-          (current->signal->tty != real_tty) ||
+-          (real_tty->session != task_session(current)))
+-              return -ENOTTY;
++
+       if (get_user(pgrp_nr, p))
+               return -EFAULT;
+       if (pgrp_nr < 0)
+               return -EINVAL;
++
++      spin_lock_irq(&real_tty->ctrl_lock);
++      if (!current->signal->tty ||
++          (current->signal->tty != real_tty) ||
++          (real_tty->session != task_session(current))) {
++              retval = -ENOTTY;
++              goto out_unlock_ctrl;
++      }
+       rcu_read_lock();
+       pgrp = find_vpid(pgrp_nr);
+       retval = -ESRCH;
+@@ -2645,12 +2653,12 @@ static int tiocspgrp(struct tty_struct *tty, struct 
tty_struct *real_tty, pid_t
+       if (session_of_pgrp(pgrp) != task_session(current))
+               goto out_unlock;
+       retval = 0;
+-      spin_lock_irq(&tty->ctrl_lock);
+       put_pid(real_tty->pgrp);
+       real_tty->pgrp = get_pid(pgrp);
+-      spin_unlock_irq(&tty->ctrl_lock);
+ out_unlock:
+       rcu_read_unlock();
++out_unlock_ctrl:
++      spin_unlock_irq(&real_tty->ctrl_lock);
+       return retval;
+ }
+ 
+@@ -2662,21 +2670,31 @@ out_unlock:
+  *
+  *    Obtain the session id of the tty. If there is no session
+  *    return an error.
+- *
+- *    Locking: none. Reference to current->signal->tty is safe.
+  */
+ 
+ static int tiocgsid(struct tty_struct *tty, struct tty_struct *real_tty, 
pid_t __user *p)
+ {
++      unsigned long flags;
++      pid_t sid;
++
+       /*
+        * (tty == real_tty) is a cheap way of
+        * testing if the tty is NOT a master pty.
+       */
+       if (tty == real_tty && current->signal->tty != real_tty)
+               return -ENOTTY;
++
++      spin_lock_irqsave(&real_tty->ctrl_lock, flags);
+       if (!real_tty->session)
+-              return -ENOTTY;
+-      return put_user(pid_vnr(real_tty->session), p);
++              goto err;
++      sid = pid_vnr(real_tty->session);
++      spin_unlock_irqrestore(&real_tty->ctrl_lock, flags);
++
++      return put_user(sid, p);
++
++err:
++      spin_unlock_irqrestore(&real_tty->ctrl_lock, flags);
++      return -ENOTTY;
+ }
+ 
+ /**
+@@ -3094,10 +3112,14 @@ void __do_SAK(struct tty_struct *tty)
+       struct task_struct *g, *p;
+       struct pid *session;
+       int             i;
++      unsigned long flags;
+ 
+       if (!tty)
+               return;
+-      session = tty->session;
++
++      spin_lock_irqsave(&tty->ctrl_lock, flags);
++      session = get_pid(tty->session);
++      spin_unlock_irqrestore(&tty->ctrl_lock, flags);
+ 
+       tty_ldisc_flush(tty);
+ 
+@@ -3129,6 +3151,7 @@ void __do_SAK(struct tty_struct *tty)
+               task_unlock(p);
+       } while_each_thread(g, p);
+       read_unlock(&tasklist_lock);
++      put_pid(session);
+ #endif
+ }
+ 
+diff --git a/drivers/usb/gadget/function/f_fs.c 
b/drivers/usb/gadget/function/f_fs.c
+index bea11be98526c..68489557752da 100644
+--- a/drivers/usb/gadget/function/f_fs.c
++++ b/drivers/usb/gadget/function/f_fs.c
+@@ -1224,7 +1224,7 @@ static long ffs_epfile_ioctl(struct file *file, unsigned 
code,
+               case FUNCTIONFS_ENDPOINT_DESC:
+               {
+                       int desc_idx;
+-                      struct usb_endpoint_descriptor *desc;
++                      struct usb_endpoint_descriptor desc1, *desc;
+ 
+                       switch (epfile->ffs->gadget->speed) {
+                       case USB_SPEED_SUPER:
+@@ -1236,10 +1236,12 @@ static long ffs_epfile_ioctl(struct file *file, 
unsigned code,
+                       default:
+                               desc_idx = 0;
+                       }
++
+                       desc = epfile->ep->descs[desc_idx];
++                      memcpy(&desc1, desc, desc->bLength);
+ 
+                       spin_unlock_irq(&epfile->ffs->eps_lock);
+-                      ret = copy_to_user((void *)value, desc, sizeof(*desc));
++                      ret = copy_to_user((void *)value, &desc1, 
desc1.bLength);
+                       if (ret)
+                               ret = -EFAULT;
+                       return ret;
+diff --git a/drivers/usb/serial/ch341.c b/drivers/usb/serial/ch341.c
+index cfa02d7123623..fc1c8f4f34c18 100644
+--- a/drivers/usb/serial/ch341.c
++++ b/drivers/usb/serial/ch341.c
+@@ -70,10 +70,11 @@
+ 
+ 
+ static const struct usb_device_id id_table[] = {
+-      { USB_DEVICE(0x4348, 0x5523) },
++      { USB_DEVICE(0x1a86, 0x5512) },
++      { USB_DEVICE(0x1a86, 0x5523) },
+       { USB_DEVICE(0x1a86, 0x7522) },
+       { USB_DEVICE(0x1a86, 0x7523) },
+-      { USB_DEVICE(0x1a86, 0x5523) },
++      { USB_DEVICE(0x4348, 0x5523) },
+       { },
+ };
+ MODULE_DEVICE_TABLE(usb, id_table);
+diff --git a/drivers/usb/serial/kl5kusb105.c b/drivers/usb/serial/kl5kusb105.c
+index 6cb45757818fa..64f5765df5b61 100644
+--- a/drivers/usb/serial/kl5kusb105.c
++++ b/drivers/usb/serial/kl5kusb105.c
+@@ -293,12 +293,12 @@ static int  klsi_105_open(struct tty_struct *tty, struct 
usb_serial_port *port)
+       priv->cfg.unknown2 = cfg->unknown2;
+       spin_unlock_irqrestore(&priv->lock, flags);
+ 
++      kfree(cfg);
++
+       /* READ_ON and urb submission */
+       rc = usb_serial_generic_open(tty, port);
+-      if (rc) {
+-              retval = rc;
+-              goto err_free_cfg;
+-      }
++      if (rc)
++              return rc;
+ 
+       rc = usb_control_msg(port->serial->dev,
+                            usb_sndctrlpipe(port->serial->dev, 0),
+@@ -341,8 +341,6 @@ err_disable_read:
+                            KLSI_TIMEOUT);
+ err_generic_close:
+       usb_serial_generic_close(port);
+-err_free_cfg:
+-      kfree(cfg);
+ 
+       return retval;
+ }
+diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c
+index 34ac1265afe46..e8643612e9a39 100644
+--- a/drivers/usb/serial/option.c
++++ b/drivers/usb/serial/option.c
+@@ -419,6 +419,7 @@ static void option_instat_callback(struct urb *urb);
+ #define CINTERION_PRODUCT_PH8                 0x0053
+ #define CINTERION_PRODUCT_AHXX                        0x0055
+ #define CINTERION_PRODUCT_PLXX                        0x0060
++#define CINTERION_PRODUCT_EXS82                       0x006c
+ #define CINTERION_PRODUCT_PH8_2RMNET          0x0082
+ #define CINTERION_PRODUCT_PH8_AUDIO           0x0083
+ #define CINTERION_PRODUCT_AHXX_2RMNET         0x0084
+@@ -1885,6 +1886,7 @@ static const struct usb_device_id option_ids[] = {
+       { USB_DEVICE_INTERFACE_CLASS(CINTERION_VENDOR_ID, 
CINTERION_PRODUCT_AHXX_AUDIO, 0xff) },
+       { USB_DEVICE_INTERFACE_CLASS(CINTERION_VENDOR_ID, 
CINTERION_PRODUCT_CLS8, 0xff),
+         .driver_info = RSVD(0) | RSVD(4) },
++      { USB_DEVICE_INTERFACE_CLASS(CINTERION_VENDOR_ID, 
CINTERION_PRODUCT_EXS82, 0xff) },
+       { USB_DEVICE(CINTERION_VENDOR_ID, CINTERION_PRODUCT_HC28_MDM) },
+       { USB_DEVICE(CINTERION_VENDOR_ID, CINTERION_PRODUCT_HC28_MDMNET) },
+       { USB_DEVICE(SIEMENS_VENDOR_ID, CINTERION_PRODUCT_HC25_MDM) },
+@@ -2031,12 +2033,13 @@ static const struct usb_device_id option_ids[] = {
+         .driver_info = RSVD(0) | RSVD(1) | RSVD(6) },
+       { USB_DEVICE(0x0489, 0xe0b5),                                           
/* Foxconn T77W968 ESIM */
+         .driver_info = RSVD(0) | RSVD(1) | RSVD(6) },
+-      { USB_DEVICE(0x1508, 0x1001),                                           
/* Fibocom NL668 */
++      { USB_DEVICE(0x1508, 0x1001),                                           
/* Fibocom NL668 (IOT version) */
+         .driver_info = RSVD(4) | RSVD(5) | RSVD(6) },
+       { USB_DEVICE(0x2cb7, 0x0104),                                           
/* Fibocom NL678 series */
+         .driver_info = RSVD(4) | RSVD(5) },
+       { USB_DEVICE_INTERFACE_CLASS(0x2cb7, 0x0105, 0xff),                     
/* Fibocom NL678 series */
+         .driver_info = RSVD(6) },
++      { USB_DEVICE_INTERFACE_CLASS(0x2cb7, 0x01a0, 0xff) },                   
/* Fibocom NL668-AM/NL652-EU (laptop MBIM) */
+       { USB_DEVICE_INTERFACE_CLASS(0x305a, 0x1404, 0xff) },                   
/* GosunCn GM500 RNDIS */
+       { USB_DEVICE_INTERFACE_CLASS(0x305a, 0x1405, 0xff) },                   
/* GosunCn GM500 MBIM */
+       { USB_DEVICE_INTERFACE_CLASS(0x305a, 0x1406, 0xff) },                   
/* GosunCn GM500 ECM/NCM */
+diff --git a/fs/btrfs/volumes.c b/fs/btrfs/volumes.c
+index 7391634520ab2..6afaacb791a13 100644
+--- a/fs/btrfs/volumes.c
++++ b/fs/btrfs/volumes.c
+@@ -2431,9 +2431,6 @@ int btrfs_init_new_device(struct btrfs_root *root, char 
*device_path)
+       btrfs_set_super_num_devices(root->fs_info->super_copy,
+                                   tmp + 1);
+ 
+-      /* add sysfs device entry */
+-      btrfs_sysfs_add_device_link(root->fs_info->fs_devices, device);
+-
+       /*
+        * we've got more storage, clear any full flags on the space
+        * infos
+@@ -2441,6 +2438,10 @@ int btrfs_init_new_device(struct btrfs_root *root, char 
*device_path)
+       btrfs_clear_space_info_full(root->fs_info);
+ 
+       unlock_chunks(root);
++
++      /* add sysfs device entry */
++      btrfs_sysfs_add_device_link(root->fs_info->fs_devices, device);
++
+       mutex_unlock(&root->fs_info->fs_devices->device_list_mutex);
+ 
+       if (seeding_dev) {
+diff --git a/fs/cifs/connect.c b/fs/cifs/connect.c
+index df8fab6fc2cac..af78de9ef036c 100644
+--- a/fs/cifs/connect.c
++++ b/fs/cifs/connect.c
+@@ -730,6 +730,8 @@ static void clean_demultiplex_info(struct TCP_Server_Info 
*server)
+       list_del_init(&server->tcp_ses_list);
+       spin_unlock(&cifs_tcp_ses_lock);
+ 
++      cancel_delayed_work_sync(&server->echo);
++
+       spin_lock(&GlobalMid_Lock);
+       server->tcpStatus = CifsExiting;
+       spin_unlock(&GlobalMid_Lock);
+diff --git a/fs/gfs2/rgrp.c b/fs/gfs2/rgrp.c
+index 9621badb95995..56a94535c246f 100644
+--- a/fs/gfs2/rgrp.c
++++ b/fs/gfs2/rgrp.c
+@@ -1000,6 +1000,10 @@ static int gfs2_ri_update(struct gfs2_inode *ip)
+       if (error < 0)
+               return error;
+ 
++      if (RB_EMPTY_ROOT(&sdp->sd_rindex_tree)) {
++              fs_err(sdp, "no resource groups found in the file system.\n");
++              return -ENOENT;
++      }
+       set_rgrp_preferences(sdp);
+ 
+       sdp->sd_rindex_uptodate = 1;
+diff --git a/include/linux/if_vlan.h b/include/linux/if_vlan.h
+index 7e39719e27cbc..27edc7f2de31b 100644
+--- a/include/linux/if_vlan.h
++++ b/include/linux/if_vlan.h
+@@ -30,6 +30,8 @@
+ #define VLAN_ETH_DATA_LEN     1500    /* Max. octets in payload        */
+ #define VLAN_ETH_FRAME_LEN    1518    /* Max. octets in frame sans FCS */
+ 
++#define VLAN_MAX_DEPTH        8               /* Max. number of nested VLAN 
tags parsed */
++
+ /*
+  *    struct vlan_hdr - vlan header
+  *    @h_vlan_TCI: priority and VLAN ID
+@@ -495,10 +497,10 @@ static inline int vlan_get_tag(const struct sk_buff 
*skb, u16 *vlan_tci)
+  * Returns the EtherType of the packet, regardless of whether it is
+  * vlan encapsulated (normal or hardware accelerated) or not.
+  */
+-static inline __be16 __vlan_get_protocol(struct sk_buff *skb, __be16 type,
++static inline __be16 __vlan_get_protocol(const struct sk_buff *skb, __be16 
type,
+                                        int *depth)
+ {
+-      unsigned int vlan_depth = skb->mac_len;
++      unsigned int vlan_depth = skb->mac_len, parse_depth = VLAN_MAX_DEPTH;
+ 
+       /* if type is 802.1Q/AD then the header should already be
+        * present at mac_len - VLAN_HLEN (if mac_len > 0), or at
+@@ -513,13 +515,12 @@ static inline __be16 __vlan_get_protocol(struct sk_buff 
*skb, __be16 type,
+                       vlan_depth = ETH_HLEN;
+               }
+               do {
+-                      struct vlan_hdr *vh;
++                      struct vlan_hdr vhdr, *vh;
+ 
+-                      if (unlikely(!pskb_may_pull(skb,
+-                                                  vlan_depth + VLAN_HLEN)))
++                      vh = skb_header_pointer(skb, vlan_depth, sizeof(vhdr), 
&vhdr);
++                      if (unlikely(!vh || !--parse_depth))
+                               return 0;
+ 
+-                      vh = (struct vlan_hdr *)(skb->data + vlan_depth);
+                       type = vh->h_vlan_encapsulated_proto;
+                       vlan_depth += VLAN_HLEN;
+               } while (eth_type_vlan(type));
+@@ -538,11 +539,25 @@ static inline __be16 __vlan_get_protocol(struct sk_buff 
*skb, __be16 type,
+  * Returns the EtherType of the packet, regardless of whether it is
+  * vlan encapsulated (normal or hardware accelerated) or not.
+  */
+-static inline __be16 vlan_get_protocol(struct sk_buff *skb)
++static inline __be16 vlan_get_protocol(const struct sk_buff *skb)
+ {
+       return __vlan_get_protocol(skb, skb->protocol, NULL);
+ }
+ 
++/* A getter for the SKB protocol field which will handle VLAN tags 
consistently
++ * whether VLAN acceleration is enabled or not.
++ */
++static inline __be16 skb_protocol(const struct sk_buff *skb, bool skip_vlan)
++{
++      if (!skip_vlan)
++              /* VLAN acceleration strips the VLAN header from the skb and
++               * moves it to skb->vlan_proto
++               */
++              return skb_vlan_tag_present(skb) ? skb->vlan_proto : 
skb->protocol;
++
++      return vlan_get_protocol(skb);
++}
++
+ static inline void vlan_set_encap_proto(struct sk_buff *skb,
+                                       struct vlan_hdr *vhdr)
+ {
+diff --git a/include/linux/spi/spi.h b/include/linux/spi/spi.h
+index 4b743ac353962..8470695e5dd78 100644
+--- a/include/linux/spi/spi.h
++++ b/include/linux/spi/spi.h
+@@ -601,6 +601,8 @@ extern void spi_finalize_current_transfer(struct 
spi_master *master);
+ /* the spi driver core manages memory for the spi_master classdev */
+ extern struct spi_master *
+ spi_alloc_master(struct device *host, unsigned size);
++extern struct spi_master *
++devm_spi_alloc_master(struct device *dev, unsigned int size);
+ 
+ extern int spi_register_master(struct spi_master *master);
+ extern int devm_spi_register_master(struct device *dev,
+diff --git a/include/linux/tty.h b/include/linux/tty.h
+index 15cf871046b39..a41146b6eaf42 100644
+--- a/include/linux/tty.h
++++ b/include/linux/tty.h
+@@ -293,6 +293,10 @@ struct tty_struct {
+       struct termiox *termiox;        /* May be NULL for unsupported */
+       char name[64];
+       struct pid *pgrp;               /* Protected by ctrl lock */
++      /*
++       * Writes protected by both ctrl lock and legacy mutex, readers must use
++       * at least one of them.
++       */
+       struct pid *session;
+       unsigned long flags;
+       int count;
+diff --git a/include/net/bonding.h b/include/net/bonding.h
+index 8750c2c4871a3..bd29fd190bb12 100644
+--- a/include/net/bonding.h
++++ b/include/net/bonding.h
+@@ -170,6 +170,11 @@ struct slave {
+       struct rtnl_link_stats64 slave_stats;
+ };
+ 
++static inline struct slave *to_slave(struct kobject *kobj)
++{
++      return container_of(kobj, struct slave, kobj);
++}
++
+ struct bond_up_slave {
+       unsigned int    count;
+       struct rcu_head rcu;
+@@ -694,6 +699,9 @@ extern struct bond_parm_tbl ad_select_tbl[];
+ /* exported from bond_netlink.c */
+ extern struct rtnl_link_ops bond_link_ops;
+ 
++/* exported from bond_sysfs_slave.c */
++extern const struct sysfs_ops slave_sysfs_ops;
++
+ static inline void bond_tx_drop(struct net_device *dev, struct sk_buff *skb)
+ {
+       atomic_long_inc(&dev->tx_dropped);
+diff --git a/include/net/inet_ecn.h b/include/net/inet_ecn.h
+index dce2d586d9cec..245d999c0eac8 100644
+--- a/include/net/inet_ecn.h
++++ b/include/net/inet_ecn.h
+@@ -3,6 +3,7 @@
+ 
+ #include <linux/ip.h>
+ #include <linux/skbuff.h>
++#include <linux/if_vlan.h>
+ 
+ #include <net/inet_sock.h>
+ #include <net/dsfield.h>
+diff --git a/kernel/trace/ftrace.c b/kernel/trace/ftrace.c
+index 51e47e18764e3..16ca877745f62 100644
+--- a/kernel/trace/ftrace.c
++++ b/kernel/trace/ftrace.c
+@@ -1634,6 +1634,8 @@ static bool test_rec_ops_needs_regs(struct dyn_ftrace 
*rec)
+ static struct ftrace_ops *
+ ftrace_find_tramp_ops_any(struct dyn_ftrace *rec);
+ static struct ftrace_ops *
++ftrace_find_tramp_ops_any_other(struct dyn_ftrace *rec, struct ftrace_ops 
*op_exclude);
++static struct ftrace_ops *
+ ftrace_find_tramp_ops_next(struct dyn_ftrace *rec, struct ftrace_ops *ops);
+ 
+ static bool __ftrace_hash_rec_update(struct ftrace_ops *ops,
+@@ -1771,7 +1773,7 @@ static bool __ftrace_hash_rec_update(struct ftrace_ops 
*ops,
+                        * to it.
+                        */
+                       if (ftrace_rec_count(rec) == 1 &&
+-                          ftrace_find_tramp_ops_any(rec))
++                          ftrace_find_tramp_ops_any_other(rec, ops))
+                               rec->flags |= FTRACE_FL_TRAMP;
+                       else
+                               rec->flags &= ~FTRACE_FL_TRAMP;
+@@ -2199,6 +2201,24 @@ ftrace_find_tramp_ops_any(struct dyn_ftrace *rec)
+       return NULL;
+ }
+ 
++static struct ftrace_ops *
++ftrace_find_tramp_ops_any_other(struct dyn_ftrace *rec, struct ftrace_ops 
*op_exclude)
++{
++      struct ftrace_ops *op;
++      unsigned long ip = rec->ip;
++
++      do_for_each_ftrace_op(op, ftrace_ops_list) {
++
++              if (op == op_exclude || !op->trampoline)
++                      continue;
++
++              if (hash_contains_ip(ip, op->func_hash))
++                      return op;
++      } while_for_each_ftrace_op(op);
++
++      return NULL;
++}
++
+ static struct ftrace_ops *
+ ftrace_find_tramp_ops_next(struct dyn_ftrace *rec,
+                          struct ftrace_ops *op)
+diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c
+index 2fdebbb30839e..005929d13c7db 100644
+--- a/kernel/trace/trace.c
++++ b/kernel/trace/trace.c
+@@ -2134,7 +2134,7 @@ void trace_buffer_unlock_commit_regs(struct trace_array 
*tr,
+        * two. They are that meaningful.
+        */
+       ftrace_trace_stack(tr, buffer, flags, regs ? 0 : 4, pc, regs);
+-      ftrace_trace_userstack(buffer, flags, pc);
++      ftrace_trace_userstack(tr, buffer, flags, pc);
+ }
+ 
+ void
+@@ -2299,14 +2299,15 @@ void trace_dump_stack(int skip)
+ static DEFINE_PER_CPU(int, user_stack_count);
+ 
+ void
+-ftrace_trace_userstack(struct ring_buffer *buffer, unsigned long flags, int 
pc)
++ftrace_trace_userstack(struct trace_array *tr,
++                     struct ring_buffer *buffer, unsigned long flags, int pc)
+ {
+       struct trace_event_call *call = &event_user_stack;
+       struct ring_buffer_event *event;
+       struct userstack_entry *entry;
+       struct stack_trace trace;
+ 
+-      if (!(global_trace.trace_flags & TRACE_ITER_USERSTACKTRACE))
++      if (!(tr->trace_flags & TRACE_ITER_USERSTACKTRACE))
+               return;
+ 
+       /*
+diff --git a/kernel/trace/trace.h b/kernel/trace/trace.h
+index 950c0e12a391a..d9b7910ef3658 100644
+--- a/kernel/trace/trace.h
++++ b/kernel/trace/trace.h
+@@ -689,13 +689,15 @@ void update_max_tr_single(struct trace_array *tr,
+ #endif /* CONFIG_TRACER_MAX_TRACE */
+ 
+ #ifdef CONFIG_STACKTRACE
+-void ftrace_trace_userstack(struct ring_buffer *buffer, unsigned long flags,
++void ftrace_trace_userstack(struct trace_array *tr,
++                          struct ring_buffer *buffer, unsigned long flags,
+                           int pc);
+ 
+ void __trace_stack(struct trace_array *tr, unsigned long flags, int skip,
+                  int pc);
+ #else
+-static inline void ftrace_trace_userstack(struct ring_buffer *buffer,
++static inline void ftrace_trace_userstack(struct trace_array *tr,
++                                        struct ring_buffer *buffer,
+                                         unsigned long flags, int pc)
+ {
+ }
+diff --git a/net/bridge/br_netfilter_hooks.c b/net/bridge/br_netfilter_hooks.c
+index 62e045c9d4529..7104d5e64abb3 100644
+--- a/net/bridge/br_netfilter_hooks.c
++++ b/net/bridge/br_netfilter_hooks.c
+@@ -716,6 +716,11 @@ static int br_nf_dev_queue_xmit(struct net *net, struct 
sock *sk, struct sk_buff
+       mtu_reserved = nf_bridge_mtu_reduction(skb);
+       mtu = skb->dev->mtu;
+ 
++      if (nf_bridge->pkt_otherhost) {
++              skb->pkt_type = PACKET_OTHERHOST;
++              nf_bridge->pkt_otherhost = false;
++      }
++
+       if (nf_bridge->frag_max_size && nf_bridge->frag_max_size < mtu)
+               mtu = nf_bridge->frag_max_size;
+ 
+@@ -809,8 +814,6 @@ static unsigned int br_nf_post_routing(void *priv,
+       else
+               return NF_ACCEPT;
+ 
+-      /* We assume any code from br_dev_queue_push_xmit onwards doesn't care
+-       * about the value of skb->pkt_type. */
+       if (skb->pkt_type == PACKET_OTHERHOST) {
+               skb->pkt_type = PACKET_HOST;
+               nf_bridge->pkt_otherhost = true;
+diff --git a/net/iucv/af_iucv.c b/net/iucv/af_iucv.c
+index ba81655a584bd..b139c149c42ac 100644
+--- a/net/iucv/af_iucv.c
++++ b/net/iucv/af_iucv.c
+@@ -1753,7 +1753,7 @@ static int iucv_callback_connreq(struct iucv_path *path,
+       }
+ 
+       /* Create the new socket */
+-      nsk = iucv_sock_alloc(NULL, sk->sk_type, GFP_ATOMIC, 0);
++      nsk = iucv_sock_alloc(NULL, sk->sk_protocol, GFP_ATOMIC, 0);
+       if (!nsk) {
+               err = pr_iucv->path_sever(path, user_data);
+               iucv_path_free(path);
+@@ -1963,7 +1963,7 @@ static int afiucv_hs_callback_syn(struct sock *sk, 
struct sk_buff *skb)
+               goto out;
+       }
+ 
+-      nsk = iucv_sock_alloc(NULL, sk->sk_type, GFP_ATOMIC, 0);
++      nsk = iucv_sock_alloc(NULL, sk->sk_protocol, GFP_ATOMIC, 0);
+       bh_lock_sock(sk);
+       if ((sk->sk_state != IUCV_LISTEN) ||
+           sk_acceptq_is_full(sk) ||
+diff --git a/net/rose/rose_loopback.c b/net/rose/rose_loopback.c
+index 344456206b70b..0f371e50d9c4e 100644
+--- a/net/rose/rose_loopback.c
++++ b/net/rose/rose_loopback.c
+@@ -99,10 +99,19 @@ static void rose_loopback_timer(unsigned long param)
+               }
+ 
+               if (frametype == ROSE_CALL_REQUEST) {
+-                      if ((dev = rose_dev_get(dest)) != NULL) {
+-                              if (rose_rx_call_request(skb, dev, 
rose_loopback_neigh, lci_o) == 0)
+-                                      kfree_skb(skb);
+-                      } else {
++                      if (!rose_loopback_neigh->dev) {
++                              kfree_skb(skb);
++                              continue;
++                      }
++
++                      dev = rose_dev_get(dest);
++                      if (!dev) {
++                              kfree_skb(skb);
++                              continue;
++                      }
++
++                      if (rose_rx_call_request(skb, dev, rose_loopback_neigh, 
lci_o) == 0) {
++                              dev_put(dev);
+                               kfree_skb(skb);
+                       }
+               } else {
+diff --git a/net/x25/af_x25.c b/net/x25/af_x25.c
+index 7bee5ca336fac..9c3fbf4553cc7 100644
+--- a/net/x25/af_x25.c
++++ b/net/x25/af_x25.c
+@@ -679,7 +679,8 @@ static int x25_bind(struct socket *sock, struct sockaddr 
*uaddr, int addr_len)
+       int len, i, rc = 0;
+ 
+       if (addr_len != sizeof(struct sockaddr_x25) ||
+-          addr->sx25_family != AF_X25) {
++          addr->sx25_family != AF_X25 ||
++          strnlen(addr->sx25_addr.x25_addr, X25_ADDR_LEN) == X25_ADDR_LEN) {
+               rc = -EINVAL;
+               goto out;
+       }
+@@ -773,7 +774,8 @@ static int x25_connect(struct socket *sock, struct 
sockaddr *uaddr,
+ 
+       rc = -EINVAL;
+       if (addr_len != sizeof(struct sockaddr_x25) ||
+-          addr->sx25_family != AF_X25)
++          addr->sx25_family != AF_X25 ||
++          strnlen(addr->sx25_addr.x25_addr, X25_ADDR_LEN) == X25_ADDR_LEN)
+               goto out;
+ 
+       rc = -ENETUNREACH;
+diff --git a/sound/pci/hda/hda_generic.c b/sound/pci/hda/hda_generic.c
+index 184089c5e8cbc..6089ed6efc8dd 100644
+--- a/sound/pci/hda/hda_generic.c
++++ b/sound/pci/hda/hda_generic.c
+@@ -1327,16 +1327,20 @@ static int try_assign_dacs(struct hda_codec *codec, 
int num_outs,
+               struct nid_path *path;
+               hda_nid_t pin = pins[i];
+ 
+-              path = snd_hda_get_path_from_idx(codec, path_idx[i]);
+-              if (path) {
+-                      badness += assign_out_path_ctls(codec, path);
+-                      continue;
++              if (!spec->obey_preferred_dacs) {
++                      path = snd_hda_get_path_from_idx(codec, path_idx[i]);
++                      if (path) {
++                              badness += assign_out_path_ctls(codec, path);
++                              continue;
++                      }
+               }
+ 
+               dacs[i] = get_preferred_dac(codec, pin);
+               if (dacs[i]) {
+                       if (is_dac_already_used(codec, dacs[i]))
+                               badness += bad->shared_primary;
++              } else if (spec->obey_preferred_dacs) {
++                      badness += BAD_NO_PRIMARY_DAC;
+               }
+ 
+               if (!dacs[i])
+diff --git a/sound/pci/hda/hda_generic.h b/sound/pci/hda/hda_generic.h
+index 6d1cb2fb447d4..33e7eafd93b3d 100644
+--- a/sound/pci/hda/hda_generic.h
++++ b/sound/pci/hda/hda_generic.h
+@@ -229,6 +229,7 @@ struct hda_gen_spec {
+       unsigned int add_jack_modes:1; /* add i/o jack mode enum ctls */
+       unsigned int power_down_unused:1; /* power down unused widgets */
+       unsigned int dac_min_mute:1; /* minimal = mute for DACs */
++      unsigned int obey_preferred_dacs:1; /* obey preferred_dacs assignment */
+ 
+       /* other internal flags */
+       unsigned int no_analog:1; /* digital I/O only */
+diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
+index df6d0211df515..73acdd43bdc93 100644
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -380,6 +380,7 @@ static void alc_fill_eapd_coef(struct hda_codec *codec)
+                       alc_update_coef_idx(codec, 0x7, 1<<5, 0);
+               break;
+       case 0x10ec0892:
++      case 0x10ec0897:
+               alc_update_coef_idx(codec, 0x7, 1<<5, 0);
+               break;
+       case 0x10ec0899:
+@@ -7487,6 +7488,7 @@ static const struct hda_device_id snd_hda_id_realtek[] = 
{
+       HDA_CODEC_ENTRY(0x10ec0888, "ALC888", patch_alc882),
+       HDA_CODEC_ENTRY(0x10ec0889, "ALC889", patch_alc882),
+       HDA_CODEC_ENTRY(0x10ec0892, "ALC892", patch_alc662),
++      HDA_CODEC_ENTRY(0x10ec0897, "ALC897", patch_alc662),
+       HDA_CODEC_ENTRY(0x10ec0899, "ALC898", patch_alc882),
+       HDA_CODEC_ENTRY(0x10ec0900, "ALC1150", patch_alc882),
+       {} /* terminator */
+diff --git a/tools/objtool/arch/x86/include/asm/insn.h 
b/tools/objtool/arch/x86/include/asm/insn.h
+index b3e32b010ab19..b56241a446393 100644
+--- a/tools/objtool/arch/x86/include/asm/insn.h
++++ b/tools/objtool/arch/x86/include/asm/insn.h
+@@ -208,4 +208,19 @@ static inline int insn_offset_immediate(struct insn *insn)
+       return insn_offset_displacement(insn) + insn->displacement.nbytes;
+ }
+ 
++/**
++ * for_each_insn_prefix() -- Iterate prefixes in the instruction
++ * @insn: Pointer to struct insn.
++ * @idx:  Index storage.
++ * @prefix: Prefix byte.
++ *
++ * Iterate prefix bytes of given @insn. Each prefix byte is stored in @prefix
++ * and the index is stored in @idx (note that this @idx is just for a cursor,
++ * do not change it.)
++ * Since prefixes.nbytes can be bigger than 4 if some prefixes
++ * are repeated, it cannot be used for looping over the prefixes.
++ */
++#define for_each_insn_prefix(insn, idx, prefix)        \
++      for (idx = 0; idx < ARRAY_SIZE(insn->prefixes.bytes) && (prefix = 
insn->prefixes.bytes[idx]) != 0; idx++)
++
+ #endif /* _ASM_X86_INSN_H */

Reply via email to