Merge tag 'android11-5.4.299_r00' into android11-5.4

This merges the android11-5.4.299_r00 tag into the android11-5.4 branch, catching it up with the latest LTS releases. It contains the following commits: * 8b500987d7 Merge 5.4.299 into android11-5.4-lts |\ | * 08c21a7a8d Linux 5.4.299 | * 7d92591af8 dmaengine: mediatek: Fix a flag reuse error in mtk_cqdma_tx_status() | * 1be4500cfa cifs: fix integer overflow in match_server() | * 72c8557e0f spi: spi-fsl-lpspi: Reset FIFO and disable module on transfer abort | * dc5fdb3675 spi: spi-fsl-lpspi: Set correct chip-select polarity bit | * 82224aa86c spi: spi-fsl-lpspi: Fix transmissions when using CONT | * 5b60ed401b pcmcia: Add error handling for add_interval() in do_validate_mem() | * 2baa6c017f ALSA: hda/hdmi: Add pin fix for another HP EliteDesk 800 G4 model | * d3a2d5b755 randstruct: gcc-plugin: Fix attribute addition | * e34c5bbe36 randstruct: gcc-plugin: Remove bogus void member | * 76825d6a79 vmxnet3: update MTU after device quiesce | * 26dc498a9f net: dsa: microchip: linearize skb for tail-tagging switches | * 183037e841 net: dsa: microchip: update tag_ksz masks for KSZ9477 family | * 249bcc912e dmaengine: mediatek: Fix a possible deadlock error in mtk_cqdma_tx_status() | * 2d5f203f17 ALSA: hda/realtek - Add new HP ZBook laptop with micmute led fixup | * b26db1bb51 gpio: pca953x: fix IRQ storm on system wake up | * a9c56ccb7c iio: light: opt3001: fix deadlock due to concurrent flag access | * f991dd32e3 iio: chemical: pms7003: use aligned_s64 for timestamp | * 283114fe15 KVM: x86: Take irqfds.lock when adding/deleting IRQ bypass producer | * 89737f6520 cpufreq/sched: Explicitly synchronize limits_changed flag handling | * 872f2c34ff mm/slub: avoid accessing metadata when pointer is invalid in object_err() | * ab34084f42 scsi: lpfc: Fix buffer free/clear order in deferred receive path | * 352fbf61ce mm/khugepaged: fix ->anon_vma race | * ea832ec058 e1000e: fix heap overflow in e1000_set_eeprom | * 30fc47248f batman-adv: fix OOB read/write in network-coding decode | * 6c9b03571d drm/amdgpu: drop hw access in non-DC audio fini | * 9eb0118b34 wifi: mwifiex: Initialize the chan_stats array to zero | * b990c8c6ff pcmcia: Fix a NULL pointer dereference in __iodyn_find_io_region() | * ec1b3e6d52 ALSA: usb-audio: Add mute TLV for playback volumes on some devices | * 9ca6a040f7 ppp: fix memory leak in pad_compress_skb | * d0e34c9f79 net: atm: fix memory leak in atm_register_sysfs when device_register fail | * 42b46684e2 ax25: properly unshare skbs in ax25_kiss_rcv() | * fce2c735c3 ipv4: Fix NULL vs error pointer check in inet_blackhole_dev_init() | * b2c4685995 net: thunder_bgx: decrement cleanup index before use | * 10d3eb2a34 net: thunder_bgx: add a missing of_node_put | * 00ad031167 wifi: libertas: cap SSID len in lbs_associate() | * 6381da82e2 wifi: cw1200: cap SSID length in cw1200_do_join() | * 6220de8a7b net: ethernet: mtk_eth_soc: fix tx vlan tag for llc packets | * 971feafe15 i40e: Fix potential invalid access when MAC list is empty | * 8937d2fea1 icmp: fix icmp_ndo_send address translation for reply direction | * 615378d5a8 mISDN: Fix memory leak in dsp_hwec_enable() | * 2577bc37c5 xirc2ps_cs: fix register access when enabling FullDuplex | * 964cbb198f Bluetooth: Fix use-after-free in l2cap_sock_cleanup_listen() | * 73aefc142e netfilter: conntrack: helper: Replace -EEXIST by -EBUSY | * a8bb681e87 wifi: cfg80211: fix use-after-free in cmp_bss() | * f84794adaa powerpc: boot: Remove leading zero in label in udelay() * | 4617bff45c Merge 5.4.298 into android11-5.4-lts |\| | * bbe1a55ea8 Linux 5.4.298 | * 2f1a24bacd Revert "drm/dp: Change AUX DPCD probe address from DPCD_REV to LANE0_1_STATUS" | * f987081bd9 net: usb: qmi_wwan: add Telit Cinterion LE910C4-WWX new compositions | * 990d8a84ea Revert "drm/amdgpu: fix incorrect vm flags to map bo" | * 22ddb5eca4 HID: hid-ntrig: fix unable to handle page fault in ntrig_report_version() | * 6bb9d3da2c HID: wacom: Add a new Art Pen 2 | * 9a9e4a8317 HID: asus: fix UAF via HID_CLAIMED_INPUT validation | * 72777fc31a KVM: x86: use array_index_nospec with indices that come from guest | * 0f63fbabea efivarfs: Fix slab-out-of-bounds in efivarfs_d_compare | * 45e4b36593 sctp: initialize more fields in sctp_v6_from_sk() | * c107fd069d net: stmmac: xgmac: Do not enable RX FIFO Overflow interrupts | * 8472b9d893 net/mlx5e: Set local Xoff after FW update | * 72a2d4bc8b net/mlx5e: Update and set Xon/Xoff upon port speed set | * 5c0fe21f43 net/mlx5e: Update and set Xon/Xoff upon MTU set | * f49a44b9c5 net: dlink: fix multicast stats being counted incorrectly | * b502f16bad atm: atmtcp: Prevent arbitrary write in atmtcp_recv_control(). | * da965f751a net/atm: remove the atmdev_ops {get, set}sockopt methods | * dc205c0883 Bluetooth: hci_event: Detect if HCI_EV_NUM_COMP_PKTS is unbalanced | * 935ea87468 powerpc/kvm: Fix ifdef to remove build warning | * b43f5c7ff7 net: ipv4: fix regression in local-broadcast routes | * 821193f4c9 vhost/net: Protect ubufs with rcu read lock in vhost_net_ubuf_put() | * e9d29c6618 scsi: core: sysfs: Correct sysfs attributes access rights | * f299353e7c ftrace: Fix potential warning in trace_printk_seq during ftrace_dump | * 18ba4a7a56 pinctrl: STMFX: add missing HAS_IOMEM dependency * | ede3e90ad9 Revert "PCI/ACPI: Fix runtime PM ref imbalance on Hot-Plug Capable ports" * | e6bbe8cf21 Revert "PM: runtime: Clear power.needs_force_resume in pm_runtime_reinit()" * | 0f7dff11a8 Merge 5.4.297 into android11-5.4-lts |\| | * c25f780e49 Linux 5.4.297 | * fa728ded21 alloc_fdtable(): change calling conventions. | * 7a0208c5b4 s390/hypfs: Enable limited access during lockdown | * bb79734b8b s390/hypfs: Avoid unnecessary ioctl registration in debugfs | * de987b46c4 ALSA: usb-audio: Use correct sub-type for UAC3 feature unit validation | * 1fb7c8400d net/sched: Remove unnecessary WARNING condition for empty child qdisc in htb_activate | * 7689ab22de net/sched: Make cake_enqueue return NET_XMIT_CN when past buffer_limit | * c4f464cfc0 ixgbe: xsk: resolve the negative overflow of budget in ixgbe_xmit_zc | * 89dfc9280e ipv6: sr: validate HMAC algorithm ID in seg6_hmac_info_add | * 6cd6e75cf9 ALSA: usb-audio: Fix size validation in convert_chmap_v3() | * d0225f41ee scsi: qla4xxx: Prevent a potential error pointer dereference | * ef49d17eac usb: xhci: Fix slot_id resource race conflict | * 6cd3f13aaa nfs: fix UAF in direct writes | * ee389fca75 NFS: Fix up commit deadlocks | * fe87e2d0e6 cifs: Fix UAF in cifs_demultiplex_thread() | * 6894717a1e Bluetooth: fix use-after-free in device_for_each_child() | * 6b1a3968fb act_mirred: use the backlog for nested calls to mirred ingress | * cfae16e8f3 net/sched: act_mirred: better wording on protection against excessive stack growth | * 02ca042304 net/sched: act_mirred: refactor the handle of xmit | * 7192eb73a0 selftests: forwarding: tc_actions.sh: add matchall mirror test | * 4d6f20bf0f net: sched: don't expose action qstats to skb_tc_reinsert() | * b7b56a5f5c net: sched: extract qstats update code into functions | * dc15bd5634 net: sched: extract bstats update code into function | * 306e2719c9 net: sched: extract common action counters update code into function | * f11d31371b mm: perform the mapping_map_writable() check after call_mmap() | * 55933e9538 mm: update memfd seal write check to include F_SEAL_WRITE | * 6a8b539c3d mm: drop the assumption that VM_SHARED always implies writable | * 7a742a9506 codel: remove sch->q.qlen check before qdisc_tree_reduce_backlog() | * 4f9cd311b7 sch_qfq: make qfq_qlen_notify() idempotent | * 9a5fd5c2f4 sch_hfsc: make hfsc_qlen_notify() idempotent | * fcf09d75c3 sch_drr: make drr_qlen_notify() idempotent | * d5514a1d67 btrfs: populate otime when logging an inode item | * 8226db2309 media: venus: hfi: explicitly release IRQ during teardown | * ee4d13f540 f2fs: fix to avoid out-of-boundary access in dnode page | * 18c2b2bd98 media: venus: protect against spurious interrupts during probe | * 7e23a595f1 media: qcom: camss: cleanup media device allocated resource on error path | * 6242f1a361 media: venus: vdec: Clamp param smaller than 1fps and bigger than 240. | * 2402adce8d drm/dp: Change AUX DPCD probe address from DPCD_REV to LANE0_1_STATUS | * e1fe95f933 pwm: mediatek: Fix duty and period setting | * 2c8e684df2 pwm: mediatek: Handle hardware enable and clock enable separately | * f070b3171e pwm: mediatek: Implement .apply() callback | * 2964dbe631 media: rainshadow-cec: fix TOCTOU race condition in rain_interrupt() | * 93c8931aef media: v4l2-ctrls: Don't reset handler's error in v4l2_ctrl_handler_free() | * fad9206d7a media: v4l2-ctrls: always copy the controls on completion | * 685ac66793 ata: Fix SATA_MOBILE_LPM_POLICY description in Kconfig | * 1096eb63ec soc: qcom: mdt_loader: Ensure we don't read past the ELF header | * 7d5b525070 rtc: ds1307: handle oscillator stop flag (OSF) for ds1341 | * 07dad57707 usb: musb: omap2430: fix device leak at unbind | * 95eb0d97ab NFS: Fix the setting of capabilities when automounting a new filesystem | * 51e2e0849a NFS: Fix up handling of outstanding layoutcommit in nfs_update_inode() | * 46c44bb4c0 NFSv4: Fix nfs4_bitmap_copy_adjust() | * 2cbf9f514e usb: typec: fusb302: cache PD RX state | * 0e35cac65a cdc-acm: fix race between initial clearing halt and open | * 46ce854944 USB: cdc-acm: do not log successful probe on later errors | * c7b6ea0ede mm/kmemleak: avoid deadlock by moving pr_warn() outside kmemleak_lock | * 6742e3425a mm/kmemleak: turn kmemleak_lock and object->lock to raw_spinlock_t | * 55e0bf41e9 ALSA: scarlett2: Add retry on -EPROTO from scarlett2_usb_tx() | * 550e12ef14 x86/fpu: Delay instruction pointer fixup until after warning | * 69683d17f3 mm/hmm: move pmd_to_hmm_pfn_flags() to the respective #ifdeffery | * 3f252a73e8 nfsd: handle get_client_locked() failure in nfsd4_setclientid_confirm() | * 11cfbcfeac pmdomain: governor: Consider CPU latency tolerance from pm_domain_cpu_gov | * e70f5ee4c8 tracing: Add down_write(trace_event_sem) when adding trace event | * b25dad547b usb: hub: Don't try to recover devices lost during warm reset. | * 1bd9246548 usb: hub: avoid warm port reset during USB3 disconnect | * 3dbc0ed947 x86/mce/amd: Add default names for MCA banks and blocks | * 19e7a58107 iio: hid-sensor-prox: Fix incorrect OFFSET calculation | * 44e904a1ad f2fs: fix to do sanity check on ino and xnid | * 6ae674a298 mm/zsmalloc: do not pass __GFP_MOVABLE if CONFIG_COMPACTION=n | * a773caa6b4 mm/zsmalloc.c: convert to use kmem_cache_zalloc in cache_alloc_zspage() | * 0e0d8c68f3 drm/sched: Remove optimization that causes hang when killing dependent jobs | * 35370d3b44 ice: Fix a null pointer dereference in ice_copy_and_init_pkg() | * 7262154d34 net: usbnet: Fix the wrong netif_carrier_on() call | * 4251ee9dcc net: usbnet: Avoid potential RCU stall on LINK_CHANGE event | * 607b342654 PCI/ACPI: Fix runtime PM ref imbalance on Hot-Plug Capable ports | * 8e8b5f12ee ACPI: processor: idle: Check acpi_fetch_acpi_dev() return value | * 454d732dfd comedi: Fail COMEDI_INSNLIST ioctl if n_insns is too large | * 6f38c6380c comedi: Fix initialization of data for instructions that write to subdevice | * 16ecad3f8b kbuild: Add KBUILD_CPPFLAGS to as-option invocation | * cbf2b29dce kbuild: add $(CLANG_FLAGS) to KBUILD_CPPFLAGS | * dfd69889c9 kbuild: Add CLANG_FLAGS to as-instr | * 3a1f21551f mips: Include KBUILD_CPPFLAGS in CHECKFLAGS invocation | * 678a7813ca kbuild: Update assembler calls to use proper flags and language target | * d9f193f323 ARM: 9448/1: Use an absolute path to unified.h in KBUILD_AFLAGS | * 0c1699135d usb: dwc3: Ignore late xferNotReady event to prevent halt timeout | * f93fb614d3 USB: storage: Ignore driver CD mode for Realtek multi-mode Wi-Fi dongles | * a648cc7c49 usb: storage: realtek_cr: Use correct byte order for bcs->Residue | * eb2223e2c8 USB: storage: Add unusual-devs entry for Novatek NTK96550-based camera | * deef90c5a4 usb: quirks: Add DELAY_INIT quick for another SanDisk 3.2Gen1 Flash Drive | * 04318dbada iio: proximity: isl29501: fix buffered read on big-endian systems | * 12064e1880 ftrace: Also allocate and copy hash for reading of filter files | * e4c2515a04 fpga: zynq_fpga: Fix the wrong usage of dma_map_sgtable() | * 3e3e50ce2e use uniform permission checks for all mount propagation changes | * ce750f697c move_mount: allow to add a mount into an existing group | * 70a09115da fs/buffer: fix use-after-free when call bh_read() helper | * 3fe19a2cf2 drm/amd/display: Find first CRTC and its line time in dce110_fill_display_configs | * cfed22d53c drm/amd/display: Fix fractional fb divider in set_pixel_clock_v3 | * b0e2eee120 squashfs: fix memory leak in squashfs_fill_super | * c4ebc06918 memstick: Fix deadlock by moving removing flag earlier | * 0520c89f62 media: venus: Add a check for packet size after reading from shared memory | * aca1b4f7af media: ov2659: Fix memory leaks in ov2659_probe() | * c35e7c7a00 media: usbtv: Lock resolution while streaming | * cf55b84f8d media: imx: fix a potential memory leak in imx_media_csc_scaler_device_init() | * 21950b842f media: gspca: Add bounds checking to firmware parser | * 31f339e3c6 soc/tegra: pmc: Ensure power-domains are in a known state | * f683d61151 jbd2: prevent softlockup in jbd2_log_do_checkpoint() | * f6419ccc88 PCI: endpoint: Fix configfs group removal on driver teardown | * 80ea6e6904 PCI: endpoint: Fix configfs group list head handling | * 4a389f6dc9 mtd: rawnand: fsmc: Add missing check after DMA map | * d198239d2c pwm: imx-tpm: Reset counter if CMOD is 0 | * 1d7f9ad781 wifi: brcmsmac: Remove const from tbl_ptr parameter in wlc_lcnphy_common_read_table() | * 3525cec113 zynq_fpga: use sgtable-based scatterlist wrappers | * 328cb4737c ata: libata-scsi: Fix ata_to_sense_error() status handling | * 9b12755135 ext4: fix reserved gdt blocks handling in fsmap | * 4381083b7a ext4: fix fsmap end of range reporting with bigalloc | * 0b92af41f7 ext4: check fast symlink for ea_inode correctly | * 4cddd68a2d Revert "vgacon: Add check for vc_origin address range in vgacon_scroll()" | * 8526b9684b vt: defkeymap: Map keycodes above 127 to K_HOLE | * 4a00513483 vt: keyboard: Don't process Unicode characters in K_OFF mode | * 57df8e2a67 usb: dwc3: meson-g12a: fix device leaks at unbind | * 22ac4969dc usb: gadget: udc: renesas_usb3: fix device leak at unbind | * c280a4427a usb: atm: cxacru: Merge cxacru_upload_firmware() into cxacru_heavy_init() | * d1401dee65 m68k: Fix lost column on framebuffer debug console | * 8f5a65f526 cpufreq: armada-8k: Fix off by one in armada_8k_cpufreq_free_table() | * 0b882f0065 serial: 8250: fix panic due to PSLVERR | * 17b95626ad media: uvcvideo: Do not mark valid metadata as invalid | * 9ad554217c media: uvcvideo: Fix 1-byte out-of-bounds read in uvc_parse_format() | * 9f1f4e9503 mm/kmemleak: avoid soft lockup in __kmemleak_do_cleanup() | * 8987732aaa parisc: Makefile: fix a typo in palo.conf | * 7684e16e72 btrfs: fix log tree replay failure due to file with 0 links and extents | * 0a36452487 thunderbolt: Fix copy+paste error in match_service_id() | * fe67122ba7 comedi: fix race between polling and detaching | * 5546bf7a01 misc: rtsx: usb: Ensure mmc child device is active when card is present | * defdc6eef2 drm/amdgpu: fix incorrect vm flags to map bo | * 896cbd432e scsi: lpfc: Remove redundant assignment to avoid memory leak | * f3751c1641 rtc: ds1307: remove clear of oscillator stop flag (OSF) in probe | * 579b85f893 pNFS: Fix uninited ptr deref in block/scsi layout | * 132f644825 pNFS: Handle RPC size limit for layoutcommits | * a0799e0bba pNFS: Fix disk addr range check in block/scsi layout | * bd2810033c pNFS: Fix stripe mapping in block/scsi layout | * a69c5d81d2 net: phy: smsc: add proper reset flags for LAN8710A | * a5635e801e ipmi: Fix strcpy source and destination the same | * 5b2775e515 kconfig: lxdialog: fix 'space' to (de)select options | * 0589cc9733 kconfig: gconf: fix potential memory leak in renderer_edited() | * dca7764741 kconfig: gconf: avoid hardcoding model2 in on_treeview2_cursor_changed() | * fb2ff258d4 ipmi: Use dev_warn_ratelimited() for incorrect message warnings | * 8732ba1ab7 scsi: aacraid: Stop using PCI_IRQ_AFFINITY | * ff139a1976 scsi: Fix sas_user_scan() to handle wildcard and multi-channel scans | * 1bdd93389b kconfig: nconf: Ensure null termination where strncpy is used | * 6d150a1775 kconfig: lxdialog: replace strcpy() with strncpy() in inputbox.c | * 1518eb0824 i3c: don't fail if GETHDRCAP is unsupported | * 76274030a1 PCI: pnv_php: Work around switches with broken presence detection | * da16cbdafa i3c: add missing include to internal header | * 75996055ea media: uvcvideo: Fix bandwidth issue for Alcor camera | * 7a41ecfc34 media: dvb-frontends: w7090p: fix null-ptr-deref in w7090p_tuner_write_serpar and w7090p_tuner_read_serpar | * bc07cae4f3 media: dvb-frontends: dib7090p: fix null-ptr-deref in dib7090p_rw_on_apb() | * efeb587955 media: usb: hdpvr: disable zero-length read messages | * 4407023322 media: tc358743: Increase FIFO trigger level to 374 | * bb0b1ac7f4 media: tc358743: Return an appropriate colorspace from tc358743_set_fmt | * 321cb5a31c media: tc358743: Check I2C succeeded during probe | * e0b208c4de pinctrl: stm32: Manage irq affinity settings | * 0f79837458 scsi: mpt3sas: Correctly handle ATA device errors | * 6711ce7e9d scsi: lpfc: Check for hdwq null ptr when cleaning up lpfc_vport structure | * 9bba1a9994 RDMA: hfi1: fix possible divide-by-zero in find_hw_thread_mask() | * ab18e48a50 MIPS: Don't crash in stack_top() for tasks without ABI or vDSO | * 5bdb9553fb jfs: upper bound check of tree index in dbAllocAG | * 9f896c3d01 jfs: Regular file corruption check | * 89fff8e3d6 jfs: truncate good inode pages when hard link is 0 | * 684c92bb08 scsi: bfa: Double-free fix | * 52f0795880 MIPS: vpe-mt: add missing prototypes for vpe_{alloc,start,stop,free} | * 790f6baa43 watchdog: dw_wdt: Fix default timeout | * 6ade15765e fs/orangefs: use snprintf() instead of sprintf() | * f53af99f44 scsi: libiscsi: Initialize iscsi_conn->dd_data only if memory is allocated | * 8085a7324d ext4: do not BUG when INLINE_DATA_FL lacks system.data xattr | * 9f69a595a2 cifs: Fix calling CIFSFindFirst() for root path without msearch | * 86ae9f0efc vhost: fail early when __vhost_add_used() fails | * bcef637358 net: dsa: b53: fix IP_MULTICAST_CTRL on BCM5325 | * ce72da68e8 uapi: in6: restore visibility of most IPv6 socket options | * eae64c4900 net: ncsi: Fix buffer overflow in fetching version id | * 91f81e2866 net: dsa: b53: prevent SWITCH_CTRL access on BCM5325 | * 3650c263ca net: dsa: b53: fix b53_imp_vlan_setup for BCM5325 | * 0648dbd794 net: vlan: Replace BUG() with WARN_ON_ONCE() in vlan_dev_* stubs | * 1870f42bd9 wifi: iwlegacy: Check rate_idx range after addition | * 95e9175cd9 netmem: fix skb_frag_address_safe with unreadable skbs | * 1764376ae0 wifi: rtlwifi: fix possible skb memory leak in `_rtl_pci_rx_interrupt()`. | * ecd425c509 wifi: iwlwifi: fw: Fix possible memory leak in iwl_fw_dbg_collect | * 137d67e903 wifi: iwlwifi: dvm: fix potential overflow in rs_fill_link_cmd() | * ecb68d57f3 net: fec: allow disable coalescing | * dca836a04b (powerpc/512) Fix possible `dma_unmap_single()` on uninitialized pointer | * 0c02d35d67 s390/stp: Remove udelay from stp_sync_clock() | * aaa6dc2d0f wifi: iwlwifi: mvm: fix scan request validation | * 893caa1ec5 net: thunderx: Fix format-truncation warning in bgx_acpi_match_id() | * 83ea1eb275 net: ipv4: fix incorrect MTU in broadcast routes | * 731bb6ba85 wifi: cfg80211: Fix interface type validation | * 74f58f382a rcu: Protect ->defer_qs_iw_pending from data race | * 54e755bd47 net: ag71xx: Add missing check after DMA map | * 128ed836b7 et131x: Add missing check after DMA map | * 72dff0255e be2net: Use correct byte order and format string for TCP seq and ack_seq | * 92d523fac8 s390/time: Use monotonic clock in get_cycles() | * 79d464eda4 wifi: cfg80211: reject HTC bit for management frames | * 061d24625d ktest.pl: Prevent recursion of default variable options | * f1aa0fb41b ASoC: codecs: rt5640: Retry DEVICE_ID verification | * a9310a0fa9 ALSA: usb-audio: Avoid precedence issues in mixer_quirks macros | * 04fa6f5e94 ALSA: hda/ca0132: Fix buffer overflow in add_tuning_control | * cfff555f6c platform/x86: thinkpad_acpi: Handle KCOV __init vs inline mismatches | * 1b5c6a600f pm: cpupower: Fix the snapshot-order of tsc,mperf, clock in mperf_stop() | * c41fef8b2d usb: core: usb_submit_urb: downgrade type check | * 98e92be291 ALSA: intel8x0: Fix incorrect codec index usage in mixer for ICH4 | * 1fca800607 ASoC: hdac_hdmi: Rate limit logging on connection and disconnection | * a35952fbe2 mmc: rtsx_usb_sdmmc: Fix error-path in sd_set_power_mode() | * 36bfbdadd6 ACPI: APEI: GHES: add TAINT_MACHINE_CHECK on GHES panic path | * 6783224b9d ACPI: processor: fix acpi_object initialization | * f829e4b381 PM: sleep: console: Fix the black screen issue | * f948542e64 thermal: sysfs: Return ENODATA instead of EAGAIN for reads | * 2f6af29069 PM: runtime: Clear power.needs_force_resume in pm_runtime_reinit() | * efea60c80d selftests: tracing: Use mutex_unlock for testing glob filter | * b28c1a14ac ARM: tegra: Use I/O memcpy to write to IRAM | * 4cfa95dc42 gpio: tps65912: check the return value of regmap_update_bits() | * d8e03f70c1 ASoC: soc-dapm: set bias_level if snd_soc_dapm_set_bias_level() was successed | * 3c6bf7a324 ARM: rockchip: fix kernel hang during smp initialization | * a242ace7a5 cpufreq: Exit governor when failed to start old governor | * 608ab9ff21 usb: xhci: Avoid showing errors during surprise removal | * 0913e9234c usb: xhci: Set avg_trb_len = 8 for EP0 during Address Device Command | * fcd65f3530 usb: xhci: Avoid showing warnings for dying controller | * 86b225d594 selftests/futex: Define SYS_futex on 32-bit architectures with 64-bit time_t | * c698f6d03d usb: xhci: print xhci->xhc_state when queue_command failed | * 41d4cb818a securityfs: don't pin dentries twice, once is enough... | * 1db925b747 hfs: fix not erasing deleted b-tree node issue | * 0336bfe9c2 drbd: add missing kref_get in handle_write_conflicts | * a47a7ef1ac udf: Verify partition map count | * 105036cae4 arm64: Handle KCOV __init vs inline mismatches | * bb0eea8e37 hfsplus: don't use BUG_ON() in hfsplus_create_attributes_file() | * 73f7da507d hfsplus: fix slab-out-of-bounds read in hfsplus_uni2asc() | * 032f7ed671 hfsplus: fix slab-out-of-bounds in hfsplus_bnode_read() | * e7d2dc2421 hfs: fix slab-out-of-bounds in hfs_bnode_read() | * d0194e391b sctp: linearize cloned gso packets in sctp_rcv | * 586892e341 netfilter: ctnetlink: fix refcount leak on table dump | * 7ac418e596 udp: also consider secpath when evaluating ipsec use for checksumming | * cb4b5f4a1e ACPI: processor: perflib: Move problematic pr->performance check | * bd844a24e5 ACPI: processor: perflib: Fix initial _PPC limit application | * b8cb1b57a5 Documentation: ACPI: Fix parent device references | * b4159c5a90 fs: Prevent file descriptor table allocations exceeding INT_MAX | * 944474274e sunvdc: Balance device refcount in vdc_port_mpgroup_check | * 6797a99593 NFSD: detect mismatch of file handle and delegation stateid in OPEN op | * 736881a2a0 net: dpaa: fix device leak when querying time stamp info | * aecfeb82dd net: gianfar: fix device leak when querying time stamp info | * 47d49fd07f netlink: avoid infinite retry looping in netlink_unicast() | * 799c06ad4c ALSA: usb-audio: Validate UAC3 cluster segment descriptors | * 1666207ba0 ALSA: usb-audio: Validate UAC3 power domain descriptors, too | * 6d96e0c7cf io_uring: don't use int for ABI | * dba96dfa5a usb: gadget : fix use-after-free in composite_dev_cleanup() | * 020f105387 MIPS: mm: tlb-r4k: Uniquify TLB entries on init | * 1db292bca6 USB: serial: option: add Foxconn T99W709 | * c04a2c1ca2 vsock: Do not allow binding to VMADDR_PORT_ANY | * 18f13f2a83 net/packet: fix a race in packet_set_ring() and packet_notifier() | * e4346ffec2 perf/core: Prevent VMA split of buffer mappings | * 5ffda7f3ed perf/core: Exit early on perf_mmap() fail | * db3984ebe1 perf/core: Don't leak AUX buffer refcount on allocation failure | * 8ff1aa99d2 pptp: fix pptp_xmit() error path | * 0fbf5e367d smb: client: let recv_done() cleanup before notifying the callers. | * 3697e37e01 benet: fix BUG when creating VFs | * 72f97d3cb7 net: drop UFO packets in udp_rcv_segment() | * 5dc60b2a00 ipv6: reject malicious packets in ipv6_gso_segment() | * 97b8c5d322 pptp: ensure minimal skb length in pptp_xmit() | * 7bf4c6e5a8 netpoll: prevent hanging NAPI when netcons gets enabled | * 7f8eca87fe NFS: Fix filehandle bounds checking in nfs_fh_to_dentry() | * 18834f5ee7 pci/hotplug/pnv-php: Wrap warnings in macro | * 0f28008b27 pci/hotplug/pnv-php: Improve error msg on power state change failure | * 651a71f931 usb: chipidea: udc: fix sleeping function called from invalid context | * dc0172c74b f2fs: fix to avoid out-of-boundary access in devs.path | * 15df59809c f2fs: fix to avoid panic in f2fs_evict_inode | * 37e78cad7e f2fs: fix to avoid UAF in f2fs_sync_inode_meta() | * 75024aae0e rtc: pcf8563: fix incorrect maximum clock rate handling | * 53ac364d1e rtc: hym8563: fix incorrect maximum clock rate handling | * 0a9ac7f424 rtc: ds1307: fix incorrect maximum clock rate handling | * a784d5b387 module: Restore the moduleparam prefix length check | * ebd1205fc0 bpf: Check flow_dissector ctx accesses are aligned | * 89f46981ef mtd: rawnand: atmel: set pmecc data setup time | * 2e1fcf6ee0 mtd: rawnand: atmel: Fix dma_mapping_error() address | * 9b38fb31c2 jfs: fix metapage reference count leak in dbAllocCtl | * 69373502c2 fbdev: imxfb: Check fb_add_videomode to prevent null-ptr-deref | * e4c864a14a crypto: qat - fix seq_file position update in adf_ring_next() | * 91eea098ab dmaengine: nbpfaxi: Add missing check after DMA map | * 5733fa2693 dmaengine: mv_xor: Fix missing check after DMA map and missing unmap | * 80d0535fdc fs/orangefs: Allow 2 more characters in do_c_string() | * 397098da12 soundwire: stream: restore params when prepare ports fail | * 84e68a8baa crypto: img-hash - Fix dma_unmap_sg() nents value | * 9a7c00f39b hwrng: mtk - handle devm_pm_runtime_enable errors | * 61f9762e85 watchdog: ziirave_wdt: check record length in ziirave_firm_verify() | * fc293c4a23 scsi: isci: Fix dma_unmap_sg() nents value | * 8d795569b7 scsi: mvsas: Fix dma_unmap_sg() nents value | * 0d72595728 scsi: ibmvscsi_tgt: Fix dma_unmap_sg() nents value | * 15700b2380 clk: sunxi-ng: v3s: Fix de clock definition | * e6841818e2 perf tests bp_account: Fix leaked file descriptor | * a25ab6dfa0 crypto: ccp - Fix crash when rebind ccp device for ccp.ko | * abe9813d60 pinctrl: sunxi: Fix memory leak on krealloc failure | * 05b5621bec power: supply: max14577: Handle NULL pdata when CONFIG_OF is not set | * 77e9ad7a2d clk: davinci: Add NULL check in davinci_lpsc_clk_register() | * a0d2de5561 mtd: fix possible integer overflow in erase_xfer() | * b890f3d8d1 crypto: marvell/cesa - Fix engine load inaccuracy | * 816a2c1977 PCI: rockchip-host: Fix "Unexpected Completion" log message | * 423778c85b vrf: Drop existing dst reference in vrf_ip6_input_dst | * 0577db5745 selftests: rtnetlink.sh: remove esp4_offload after test | * 66d41268ed netfilter: xt_nfacct: don't assume acct name is null-terminated | * caf0f743dd can: kvaser_usb: Assign netdev.dev_port based on device channel index | * 0fa86e3c91 can: kvaser_pciefd: Store device channel index | * 37272a327b wifi: brcmfmac: fix P2P discovery failure in P2P peer due to missing P2P IE | * ed0b809ff9 Reapply "wifi: mac80211: Update skb's control block key in ieee80211_tx_dequeue()" | * 92c6f0d476 mwl8k: Add missing check after DMA map | * 5111d4d286 wifi: rtl8xxxu: Fix RX skb size for aggregation disabled | * ad340a4b4a net/sched: Restrict conditions for adding duplicating netems to qdisc tree | * 39dd4db60a arch: powerpc: defconfig: Drop obsolete CONFIG_NET_CLS_TCINDEX | * 3584fa93d1 netfilter: nf_tables: adjust lockdep assertions handling | * 25e053cb80 drm/amd/pm/powerplay/hwmgr/smu_helper: fix order of mask and value | * aec49221d0 m68k: Don't unregister boot console needlessly | * 2cbd59d0a6 tcp: fix tcp_ofo_queue() to avoid including too much DUP SACK range | * c80832d445 iwlwifi: Add missing check for alloc_ordered_workqueue | * ee8cff4694 wifi: iwlwifi: Fix memory leak in iwl_mvm_init() | * e64732ebff wifi: rtl818x: Kill URBs before clearing tx status queue | * c3b69f0fda caif: reduce stack size, again | * 78561ada3f bpftool: Fix memory leak in dump_xx_nlmsg on realloc failure | * 6ba20ff3cd bpf, ktls: Fix data corruption when using bpf_msg_pop_data() in ktls | * 9ca96350d7 staging: nvec: Fix incorrect null termination of battery manufacturer | * 3bbdc6686a samples: mei: Fix building on musl libc | * 6e6f190207 cpufreq: Init policy->rwsem before it may be possibly used | * c1289b6fe3 ARM: dts: imx6ul-kontron-bl-common: Fix RTS polarity for RS485 interface | * d12d31cd5b usb: early: xhci-dbc: Fix early_ioremap leak | * c3bfaf9c81 Revert "vmci: Prevent the dispatching of uninitialized payloads" | * 7465f4f15f pps: fix poll support | * 2c86366ce3 vmci: Prevent the dispatching of uninitialized payloads | * 83ea0c7b8d staging: fbtft: fix potential memory leak in fbtft_framebuffer_alloc() | * 6ea0251d06 ARM: dts: vfxxx: Correctly use two tuples for timer address | * a30ce41de4 ASoC: ops: dynamically allocate struct snd_ctl_elem_value | * 0807e4ac59 hfsplus: remove mutex_lock check in hfsplus_free_extents | * eac07e80d8 ASoC: Intel: fix SND_SOC_SOF dependencies | * 02bdbb8dc0 ethernet: intel: fix building with large NR_CPUS | * e5d396f42d usb: phy: mxs: disconnect line when USB charger is attached | * 4eb4ad451e usb: chipidea: add USB PHY event | * f2b6a88c1c usb: chipidea: introduce CI_HDRC_CONTROLLER_VBUS_EVENT glue layer use | * 770809a958 usb: chipidea: udc: protect usb interrupt enable | * 4fbf6bb0f9 usb: chipidea: udc: add new API ci_hdrc_gadget_connect | * 6c77bc70f3 ALSA: hda: Add missing NVIDIA HDA codec IDs | * 451c43bb4c comedi: comedi_test: Fix possible deletion of uninitialized timers | * dd298c0b88 nilfs2: reject invalid file types when reading inodes | * cbec440699 i2c: qup: jump out of the loop in case of timeout | * 23cc07ce97 net/sched: sch_qfq: Avoid triggering might_sleep in atomic context in qfq_delete_class | * b35694ffab net: appletalk: Fix use-after-free in AARP proxy probe | * 7dc69383be net: appletalk: fix kerneldoc warnings | * 8b36f61da7 RDMA/core: Rate limit GID cache warning messages | * 7574892e25 regulator: core: fix NULL dereference on unbind due to stale coupling data | * c72cd4c92e usb: hub: Fix flushing and scheduling of delayed work that tunes runtime pm | * 042959e9b4 usb: hub: fix detection of high tier USB3 devices behind suspended hubs | * e0936ff56b net_sched: sch_sfq: reject invalid perturb period | * 8fadc871a4 net_sched: sch_sfq: move the limit validation | * 7bb9498f3d net_sched: sch_sfq: use a temporary work area for validating configuration | * e12f6013d0 net_sched: sch_sfq: don't allow 1 packet limit | * 843cacb88f net_sched: sch_sfq: handle bigger packets | * 74d5d2575f net_sched: sch_sfq: annotate data-races around q->perturb_period | * 4a1b82ee33 power: supply: bq24190: Fix use after free bug in bq24190_remove due to race condition | * 38af1d0e43 power: supply: bq24190_charger: using pm_runtime_resume_and_get instead of pm_runtime_get_sync | * b23879eadc power: supply: bq24190_charger: Fix runtime PM imbalance on error | * c7e68db993 xhci: Disable stream for xHC controller with XHCI_BROKEN_STREAMS | * 773e95c268 virtio-net: ensure the received length does not exceed allocated size | * 5e45c136ca ASoC: fsl_sai: Force a software reset when starting in consumer mode | * 3451944a8c usb: dwc3: qcom: Don't leave BCR asserted | * 4ea93e0eb9 usb: musb: fix gadget state on disconnect | * fed3570e54 net/sched: Return NULL when htb_lookup_leaf encounters an empty rbtree | * ba48d3993a net: vlan: fix VLAN 0 refcount imbalance of toggling filtering during runtime | * 8d3dd53f92 Bluetooth: L2CAP: Fix attempting to adjust outgoing MTU | * 9adf57c0d4 Bluetooth: SMP: Fix using HCI_ERROR_REMOTE_USER_TERM on timeout | * 24a855e2bb Bluetooth: SMP: If an unallowed command is received consider it a failure | * 262cd18f5f Bluetooth: Fix null-ptr-deref in l2cap_sock_resume_cb() | * 0a263ccb90 usb: net: sierra: check for no status endpoint | * aa7a22c4d6 net/sched: sch_qfq: Fix race condition on qfq_aggregate | * 04d49e2bc1 net: emaclite: Fix missing pointer increment in aligned_read() | * 4c2981bf30 comedi: Fix use of uninitialized data in insn_rw_emulate_bits() | * c1a1ddba35 comedi: Fix some signed shift left operations | * a15e9c175f comedi: das6402: Fix bit shift out of bounds | * 539bdff832 comedi: das16m1: Fix bit shift out of bounds | * a88692245c comedi: aio_iiro_16: Fix bit shift out of bounds | * 374d9b3eb4 comedi: pcl812: Fix bit shift out of bounds | * fedfd16c29 iio: adc: stm32-adc: Fix race in installing chained IRQ handler | * 14760b5248 iio: adc: max1363: Reorder mode_list[] entries | * 016f13e0ad iio: adc: max1363: Fix MAX1363_4X_CHANS/MAX1363_8X_CHANS[] | * 62e51f51d9 soc: aspeed: lpc-snoop: Don't disable channels that aren't enabled | * e4e4798204 soc: aspeed: lpc-snoop: Cleanup resources in stack-order | * 5a67142449 mmc: sdhci_am654: Workaround for Errata i2312 | * 43b52cb40d mmc: sdhci-pci: Quirk for broken command queuing on Intel GLK-based Positivo models | * 25ca57629f mmc: bcm2835: Fix dma_unmap_sg() nents value | * 6894d179bd memstick: core: Zero initialize id_reg in h_memstick_read_dev_id() | * b4c2fd8d74 isofs: Verify inode mode when loading from disk | * 84fff8e6f1 dmaengine: nbpfaxi: Fix memory corruption in probe() | * 36031c3f0f af_packet: fix soft lockup issue caused by tpacket_snd() | * aabd21a25a af_packet: fix the SO_SNDTIMEO constraint not effective on tpacked_snd() | * 02c153c61f phonet/pep: Move call to pn_skb_get_dst_sockaddr() earlier in pep_sock_accept() | * dd8e8314f2 HID: core: do not bypass hid_hw_raw_request | * 964affcebe HID: core: ensure __hid_request reserves the report ID as the first byte | * 7228e36c78 HID: core: ensure the allocated report buffer can contain the reserved report ID | * fe96b632ad pch_uart: Fix dma_sync_sg_for_device() nents value | * d3aae77584 Input: xpad - set correct controller type for Acer NGR200 | * e64ec9509c i2c: stm32: fix the device used for the DMA map | * 78b41148cf usb: gadget: configfs: Fix OOB read on empty string write | * bc5c549006 USB: serial: ftdi_sio: add support for NDI EMGUIDE GEMINI | * aad2f69c55 USB: serial: option: add Foxconn T99W640 | * d5e3bcff9b USB: serial: option: add Telit Cinterion FE910C04 (ECM) composition * b2efed2e1d Merge android11-5.4 into android11-5.4-lts Change-Id: I243bb8fda5a66059f4239ce33208b7fae6b1eac0 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
2026-10-07 12:25:00 -04:00 · 2025-09-11 13:16:31 +00:00 · 2025-09-11 13:16:31 +00:00 · c92395c2d6
commit c92395c2d6
parent 189b48ebd1 8b500987d7
427 changed files with 3863 additions and 1774 deletions
--- a/Documentation/firmware-guide/acpi/i2c-muxes.rst
+++ b/Documentation/firmware-guide/acpi/i2c-muxes.rst
@ -14,7 +14,7 @@ Consider this topology::
    |      |   | 0x70 |--CH01--> i2c client B (0x50)
    +------+   +------+

-which corresponds to the following ASL::
+which corresponds to the following ASL (in the scope of \_SB)::

    Device (SMB1)
    {
@ -24,7 +24,7 @@ which corresponds to the following ASL::
            Name (_HID, ...)
            Name (_CRS, ResourceTemplate () {
                I2cSerialBus (0x70, ControllerInitiated, I2C_SPEED,
-                            AddressingMode7Bit, "^SMB1", 0x00,
+                            AddressingMode7Bit, "\\_SB.SMB1", 0x00,
                            ResourceConsumer,,)
            }

@ -37,7 +37,7 @@ which corresponds to the following ASL::
                    Name (_HID, ...)
                    Name (_CRS, ResourceTemplate () {
                        I2cSerialBus (0x50, ControllerInitiated, I2C_SPEED,
-                                    AddressingMode7Bit, "^CH00", 0x00,
+                                    AddressingMode7Bit, "\\_SB.SMB1.CH00", 0x00,
                                    ResourceConsumer,,)
                    }
                }
@ -52,7 +52,7 @@ which corresponds to the following ASL::
                    Name (_HID, ...)
                    Name (_CRS, ResourceTemplate () {
                        I2cSerialBus (0x50, ControllerInitiated, I2C_SPEED,
-                                    AddressingMode7Bit, "^CH01", 0x00,
+                                    AddressingMode7Bit, "\\_SB.SMB1.CH01", 0x00,
                                    ResourceConsumer,,)
                    }
                }
--- a/5
+++ b/5
@ -1,7 +1,7 @@
 # SPDX-License-Identifier: GPL-2.0
 VERSION = 5
 PATCHLEVEL = 4
-SUBLEVEL = 296
+SUBLEVEL = 299
 EXTRAVERSION =
 NAME = Kleptomaniac Octopus

@ -572,8 +572,7 @@ ifneq ($(LLVM_IAS),1)
 CLANG_FLAGS	+= -no-integrated-as
 endif
 CLANG_FLAGS	+= -Werror=unknown-warning-option
-KBUILD_CFLAGS	+= $(CLANG_FLAGS)
-KBUILD_AFLAGS	+= $(CLANG_FLAGS)
+KBUILD_CPPFLAGS	+= $(CLANG_FLAGS)
 export CLANG_FLAGS
 endif

--- a/arch/arm/Makefile
+++ b/arch/arm/Makefile
@ -136,7 +136,7 @@ endif

 # Need -Uarm for gcc < 3.x
 KBUILD_CFLAGS	+=$(CFLAGS_ABI) $(CFLAGS_ISA) $(arch-y) $(tune-y) $(call cc-option,-mshort-load-bytes,$(call cc-option,-malignment-traps,)) -msoft-float -Uarm
-KBUILD_AFLAGS	+=$(CFLAGS_ABI) $(AFLAGS_ISA) $(arch-y) $(tune-y) -include asm/unified.h -msoft-float
+KBUILD_AFLAGS	+=$(CFLAGS_ABI) $(AFLAGS_ISA) $(arch-y) $(tune-y) -include $(srctree)/arch/arm/include/asm/unified.h -msoft-float

 CHECKFLAGS	+= -D__arm__

--- a/arch/arm/boot/dts/imx6ul-kontron-n6310-s.dts
+++ b/arch/arm/boot/dts/imx6ul-kontron-n6310-s.dts
@ -168,7 +168,6 @@
 	pinctrl-0 = <&pinctrl_uart2>;
 	linux,rs485-enabled-at-boot-time;
 	rs485-rx-during-tx;
-	rs485-rts-active-low;
 	uart-has-rtscts;
 	status = "okay";
 };
--- a/arch/arm/boot/dts/vfxxx.dtsi
+++ b/arch/arm/boot/dts/vfxxx.dtsi
@ -617,7 +617,7 @@

 			ftm: ftm@400b8000 {
 				compatible = "fsl,ftm-timer";
-				reg = <0x400b8000 0x1000 0x400b9000 0x1000>;
+				reg = <0x400b8000 0x1000>, <0x400b9000 0x1000>;
 				interrupts = <44 IRQ_TYPE_LEVEL_HIGH>;
 				clock-names = "ftm-evt", "ftm-src",
 					"ftm-evt-counter-en", "ftm-src-counter-en";
--- a/arch/arm/mach-rockchip/platsmp.c
+++ b/arch/arm/mach-rockchip/platsmp.c
@ -279,11 +279,6 @@ static void __init rockchip_smp_prepare_cpus(unsigned int max_cpus)
 	}

 	if (read_cpuid_part() == ARM_CPU_PART_CORTEX_A9) {
-		if (rockchip_smp_prepare_sram(node)) {
-			of_node_put(node);
-			return;
-		}
-
 		/* enable the SCU power domain */
 		pmu_set_power_domain(PMU_PWRDN_SCU, true);

@ -316,11 +311,19 @@ static void __init rockchip_smp_prepare_cpus(unsigned int max_cpus)
 		asm ("mrc p15, 1, %0, c9, c0, 2\n" : "=r" (l2ctlr));
 		ncores = ((l2ctlr >> 24) & 0x3) + 1;
 	}
-	of_node_put(node);

 	/* Make sure that all cores except the first are really off */
 	for (i = 1; i < ncores; i++)
 		pmu_set_power_domain(0 + i, false);
+
+	if (read_cpuid_part() == ARM_CPU_PART_CORTEX_A9) {
+		if (rockchip_smp_prepare_sram(node)) {
+			of_node_put(node);
+			return;
+		}
+	}
+
+	of_node_put(node);
 }

 static void __init rk3036_smp_prepare_cpus(unsigned int max_cpus)
--- a/arch/arm/mach-tegra/reset.c
+++ b/arch/arm/mach-tegra/reset.c
@ -63,7 +63,7 @@ static void __init tegra_cpu_reset_handler_enable(void)
 	BUG_ON(is_enabled);
 	BUG_ON(tegra_cpu_reset_handler_size > TEGRA_IRAM_RESET_HANDLER_SIZE);

-	memcpy(iram_base, (void *)__tegra_cpu_reset_handler_start,
+	memcpy_toio(iram_base, (void *)__tegra_cpu_reset_handler_start,
 			tegra_cpu_reset_handler_size);

 	err = call_firmware_op(set_cpu_boot_addr, 0, reset_address);
--- a/arch/arm64/include/asm/acpi.h
+++ b/arch/arm64/include/asm/acpi.h
@ -141,7 +141,7 @@ acpi_set_mailbox_entry(int cpu, struct acpi_madt_generic_interrupt *processor)
 {}
 #endif

-static inline const char *acpi_get_enable_method(int cpu)
+static __always_inline const char *acpi_get_enable_method(int cpu)
 {
 	if (acpi_psci_present())
 		return "psci";
--- a/arch/m68k/Kconfig.debug
+++ b/arch/m68k/Kconfig.debug
@ -10,7 +10,7 @@ config BOOTPARAM_STRING

 config EARLY_PRINTK
 	bool "Early printk"
-	depends on !(SUN3 || M68000 || COLDFIRE)
+	depends on MMU_MOTOROLA
 	help
          Write kernel log output directly to a serial port.
          Where implemented, output goes to the framebuffer as well.
--- a/arch/m68k/kernel/early_printk.c
+++ b/arch/m68k/kernel/early_printk.c
@ -16,25 +16,10 @@
 #include "../mvme147/mvme147.h"
 #include "../mvme16x/mvme16x.h"

-asmlinkage void __init debug_cons_nputs(const char *s, unsigned n);
-
-static void __ref debug_cons_write(struct console *c,
-				   const char *s, unsigned n)
-{
-#if !(defined(CONFIG_SUN3) || defined(CONFIG_M68000) || \
-      defined(CONFIG_COLDFIRE))
-	if (MACH_IS_MVME147)
-		mvme147_scc_write(c, s, n);
-	else if (MACH_IS_MVME16x)
-		mvme16x_cons_write(c, s, n);
-	else
-		debug_cons_nputs(s, n);
-#endif
-}
+asmlinkage void __init debug_cons_nputs(struct console *c, const char *s, unsigned int n);

 static struct console early_console_instance = {
 	.name  = "debug",
-	.write = debug_cons_write,
 	.flags = CON_PRINTBUFFER | CON_BOOT,
 	.index = -1
 };
@ -44,6 +29,12 @@ static int __init setup_early_printk(char *buf)
 	if (early_console || buf)
 		return 0;

+	if (MACH_IS_MVME147)
+		early_console_instance.write = mvme147_scc_write;
+	else if (MACH_IS_MVME16x)
+		early_console_instance.write = mvme16x_cons_write;
+	else
+		early_console_instance.write = debug_cons_nputs;
 	early_console = &early_console_instance;
 	register_console(early_console);

@ -51,20 +42,15 @@ static int __init setup_early_printk(char *buf)
 }
 early_param("earlyprintk", setup_early_printk);

-/*
- * debug_cons_nputs() defined in arch/m68k/kernel/head.S cannot be called
- * after init sections are discarded (for platforms that use it).
- */
-#if !(defined(CONFIG_SUN3) || defined(CONFIG_M68000) || \
-      defined(CONFIG_COLDFIRE))
-
 static int __init unregister_early_console(void)
 {
-	if (!early_console || MACH_IS_MVME16x)
-		return 0;
+	/*
+	 * debug_cons_nputs() defined in arch/m68k/kernel/head.S cannot be
+	 * called after init sections are discarded (for platforms that use it).
+	 */
+	if (early_console && early_console->write == debug_cons_nputs)
+		return unregister_console(early_console);

-	return unregister_console(early_console);
+	return 0;
 }
 late_initcall(unregister_early_console);
-
-#endif
--- a/arch/m68k/kernel/head.S
+++ b/arch/m68k/kernel/head.S
@ -3242,8 +3242,8 @@ func_return	putn
 *	turns around and calls the internal routines.  This routine
 *	is used by the boot console.
 *
- *	The calling parameters are:
- *		void debug_cons_nputs(const char *str, unsigned length)
+ *	The function signature is -
+ *		void debug_cons_nputs(struct console *c, const char *s, unsigned int n)
 *
 *	This routine does NOT understand variable arguments only
 *	simple strings!
@ -3252,8 +3252,8 @@ ENTRY(debug_cons_nputs)
 	moveml	%d0/%d1/%a0,%sp@-
 	movew	%sr,%sp@-
 	ori	#0x0700,%sr
-	movel	%sp@(18),%a0		/* fetch parameter */
-	movel	%sp@(22),%d1		/* fetch parameter */
+	movel	%sp@(22),%a0		/* char *s */
+	movel	%sp@(26),%d1		/* unsigned int n */
 	jra	2f
 1:
 #ifdef CONSOLE_DEBUG
@ -3379,6 +3379,7 @@ L(console_clear_loop):

 	movel	%d4,%d1				/* screen height in pixels */
 	divul	%a0@(FONT_DESC_HEIGHT),%d1	/* d1 = max num rows */
+	subql	#1,%d1				/* row range is 0 to num - 1 */

 	movel	%d0,%a2@(Lconsole_struct_num_columns)
 	movel	%d1,%a2@(Lconsole_struct_num_rows)
@ -3525,15 +3526,14 @@ func_start	console_putc,%a0/%a1/%d0-%d7
 	cmpib	#10,%d7
 	jne	L(console_not_lf)
 	movel	%a0@(Lconsole_struct_cur_row),%d0
-	addil	#1,%d0
-	movel	%d0,%a0@(Lconsole_struct_cur_row)
 	movel	%a0@(Lconsole_struct_num_rows),%d1
 	cmpl	%d1,%d0
 	jcs	1f
-	subil	#1,%d0
-	movel	%d0,%a0@(Lconsole_struct_cur_row)
 	console_scroll
+	jra	L(console_exit)
 1:
+	addql	#1,%d0
+	movel	%d0,%a0@(Lconsole_struct_cur_row)
 	jra	L(console_exit)

 L(console_not_lf):
@ -3560,12 +3560,6 @@ L(console_not_cr):
 */
 L(console_not_home):
 	movel	%a0@(Lconsole_struct_cur_column),%d0
-	addql	#1,%a0@(Lconsole_struct_cur_column)
-	movel	%a0@(Lconsole_struct_num_columns),%d1
-	cmpl	%d1,%d0
-	jcs	1f
-	console_putc	#'\n'	/* recursion is OK! */
-1:
 	movel	%a0@(Lconsole_struct_cur_row),%d1

 	/*
@ -3612,6 +3606,23 @@ L(console_do_font_scanline):
 	addq	#1,%d1
 	dbra	%d7,L(console_read_char_scanline)

+	/*
+	 *	Register usage in the code below:
+	 *	a0 = pointer to console globals
+	 *	d0 = cursor column
+	 *	d1 = cursor column limit
+	 */
+
+	lea	%pc@(L(console_globals)),%a0
+
+	movel	%a0@(Lconsole_struct_cur_column),%d0
+	addql	#1,%d0
+	movel	%d0,%a0@(Lconsole_struct_cur_column)	/* Update cursor pos */
+	movel	%a0@(Lconsole_struct_num_columns),%d1
+	cmpl	%d1,%d0
+	jcs	L(console_exit)
+	console_putc	#'\n'		/* Line wrap using tail recursion */
+
 L(console_exit):
 func_return	console_putc

--- a/arch/mips/Makefile
+++ b/arch/mips/Makefile
@ -319,7 +319,7 @@ KBUILD_CFLAGS += -fno-asynchronous-unwind-tables
 KBUILD_LDFLAGS		+= -m $(ld-emul)

 ifdef CONFIG_MIPS
-CHECKFLAGS += $(shell $(CC) $(KBUILD_CFLAGS) -dM -E -x c /dev/null | \
+CHECKFLAGS += $(shell $(CC) $(KBUILD_CPPFLAGS) $(KBUILD_CFLAGS) -dM -E -x c /dev/null | \
 	egrep -vw '__GNUC_(MINOR_|PATCHLEVEL_)?_' | \
 	sed -e "s/^\#define /-D'/" -e "s/ /'='/" -e "s/$$/'/" -e 's/\$$/&&/g')
 endif
--- a/arch/mips/include/asm/vpe.h
+++ b/arch/mips/include/asm/vpe.h
@ -126,4 +126,12 @@ void cleanup_tc(struct tc *tc);

 int __init vpe_module_init(void);
 void __exit vpe_module_exit(void);
+
+#ifdef CONFIG_MIPS_VPE_LOADER_MT
+void *vpe_alloc(void);
+int vpe_start(void *vpe, unsigned long start);
+int vpe_stop(void *vpe);
+int vpe_free(void *vpe);
+#endif /* CONFIG_MIPS_VPE_LOADER_MT */
+
 #endif /* _ASM_VPE_H */
--- a/arch/mips/kernel/process.c
+++ b/arch/mips/kernel/process.c
@ -654,18 +654,20 @@ unsigned long mips_stack_top(void)
 	top -= PAGE_SIZE;

 	/* Space for the VDSO, data page & GIC user page */
-	top -= PAGE_ALIGN(current->thread.abi->vdso->size);
-	top -= PAGE_SIZE;
-	top -= mips_gic_present() ? PAGE_SIZE : 0;
+	if (current->thread.abi) {
+		top -= PAGE_ALIGN(current->thread.abi->vdso->size);
+		top -= PAGE_SIZE;
+		top -= mips_gic_present() ? PAGE_SIZE : 0;
+
+		/* Space to randomize the VDSO base */
+		if (current->flags & PF_RANDOMIZE)
+			top -= VDSO_RANDOMIZE_SIZE;
+	}

 	/* Space for cache colour alignment */
 	if (cpu_has_dc_aliases)
 		top -= shm_align_mask + 1;

-	/* Space to randomize the VDSO base */
-	if (current->flags & PF_RANDOMIZE)
-		top -= VDSO_RANDOMIZE_SIZE;
-
 	return top;
 }

--- a/arch/mips/mm/tlb-r4k.c
+++ b/arch/mips/mm/tlb-r4k.c
@ -497,6 +497,60 @@ static int __init set_ntlb(char *str)

 __setup("ntlb=", set_ntlb);

+/* Initialise all TLB entries with unique values */
+static void r4k_tlb_uniquify(void)
+{
+	int entry = num_wired_entries();
+
+	htw_stop();
+	write_c0_entrylo0(0);
+	write_c0_entrylo1(0);
+
+	while (entry < current_cpu_data.tlbsize) {
+		unsigned long asid_mask = cpu_asid_mask(&current_cpu_data);
+		unsigned long asid = 0;
+		int idx;
+
+		/* Skip wired MMID to make ginvt_mmid work */
+		if (cpu_has_mmid)
+			asid = MMID_KERNEL_WIRED + 1;
+
+		/* Check for match before using UNIQUE_ENTRYHI */
+		do {
+			if (cpu_has_mmid) {
+				write_c0_memorymapid(asid);
+				write_c0_entryhi(UNIQUE_ENTRYHI(entry));
+			} else {
+				write_c0_entryhi(UNIQUE_ENTRYHI(entry) | asid);
+			}
+			mtc0_tlbw_hazard();
+			tlb_probe();
+			tlb_probe_hazard();
+			idx = read_c0_index();
+			/* No match or match is on current entry */
+			if (idx < 0 || idx == entry)
+				break;
+			/*
+			 * If we hit a match, we need to try again with
+			 * a different ASID.
+			 */
+			asid++;
+		} while (asid < asid_mask);
+
+		if (idx >= 0 && idx != entry)
+			panic("Unable to uniquify TLB entry %d", idx);
+
+		write_c0_index(entry);
+		mtc0_tlbw_hazard();
+		tlb_write_indexed();
+		entry++;
+	}
+
+	tlbw_use_hazard();
+	htw_start();
+	flush_micro_tlb();
+}
+
 /*
 * Configure TLB (for init or after a CPU has been powered off).
 */
@ -536,7 +590,7 @@ static void r4k_tlb_configure(void)
 	temp_tlb_entry = current_cpu_data.tlbsize - 1;

 	/* From this point on the ARC firmware is dead.	 */
-	local_flush_tlb_all();
+	r4k_tlb_uniquify();

 	/* Did I tell you that ARC SUCKS?  */
 }
--- a/arch/parisc/Makefile
+++ b/arch/parisc/Makefile
@ -134,7 +134,7 @@ palo lifimage: vmlinuz
 	fi
 	@if test ! -f "$(PALOCONF)"; then \
 		cp $(srctree)/arch/parisc/defpalo.conf $(objtree)/palo.conf; \
-		echo 'A generic palo config file ($(objree)/palo.conf) has been created for you.'; \
+		echo 'A generic palo config file ($(objtree)/palo.conf) has been created for you.'; \
 		echo 'You should check it and re-run "make palo".'; \
 		echo 'WARNING: the "lifimage" file is now placed in this directory by default!'; \
 		false; \
--- a/arch/powerpc/boot/util.S
+++ b/arch/powerpc/boot/util.S
@ -41,12 +41,12 @@ udelay:
 	srwi	r4,r4,16
 	cmpwi	0,r4,1		/* 601 ? */
 	bne	.Ludelay_not_601
-00:	li	r0,86	/* Instructions / microsecond? */
+0:	li	r0,86	/* Instructions / microsecond? */
 	mtctr	r0
 10:	addi	r0,r0,0 /* NOP */
 	bdnz	10b
 	subic.	r3,r3,1
-	bne	00b
+	bne	0b
 	blr

 .Ludelay_not_601:
--- a/arch/powerpc/configs/ppc6xx_defconfig
+++ b/arch/powerpc/configs/ppc6xx_defconfig
@ -274,7 +274,6 @@ CONFIG_NET_SCH_DSMARK=m
 CONFIG_NET_SCH_NETEM=m
 CONFIG_NET_SCH_INGRESS=m
 CONFIG_NET_CLS_BASIC=m
-CONFIG_NET_CLS_TCINDEX=m
 CONFIG_NET_CLS_ROUTE4=m
 CONFIG_NET_CLS_FW=m
 CONFIG_NET_CLS_U32=m
--- a/arch/powerpc/kernel/kvm.c
+++ b/arch/powerpc/kernel/kvm.c
@ -632,19 +632,19 @@ static void __init kvm_check_ins(u32 *inst, u32 features)
 #endif
 	}

-	switch (inst_no_rt & ~KVM_MASK_RB) {
 #ifdef CONFIG_PPC_BOOK3S_32
+	switch (inst_no_rt & ~KVM_MASK_RB) {
 	case KVM_INST_MTSRIN:
 		if (features & KVM_MAGIC_FEAT_SR) {
 			u32 inst_rb = _inst & KVM_MASK_RB;
 			kvm_patch_ins_mtsrin(inst, inst_rt, inst_rb);
 		}
 		break;
-#endif
 	}
+#endif

-	switch (_inst) {
 #ifdef CONFIG_BOOKE
+	switch (_inst) {
 	case KVM_INST_WRTEEI_0:
 		kvm_patch_ins_wrteei_0(inst);
 		break;
@ -652,8 +652,8 @@ static void __init kvm_check_ins(u32 *inst, u32 features)
 	case KVM_INST_WRTEEI_1:
 		kvm_patch_ins_wrtee(inst, 0, 1);
 		break;
-#endif
 	}
+#endif
 }

 extern u32 kvm_template_start[];
--- a/arch/powerpc/platforms/512x/mpc512x_lpbfifo.c
+++ b/arch/powerpc/platforms/512x/mpc512x_lpbfifo.c
@ -240,10 +240,8 @@ static int mpc512x_lpbfifo_kick(void)
 	dma_conf.src_addr_width = DMA_SLAVE_BUSWIDTH_4_BYTES;

 	/* Make DMA channel work with LPB FIFO data register */
-	if (dma_dev->device_config(lpbfifo.chan, &dma_conf)) {
-		ret = -EINVAL;
-		goto err_dma_prep;
-	}
+	if (dma_dev->device_config(lpbfifo.chan, &dma_conf))
+		return -EINVAL;

 	sg_init_table(&sg, 1);

--- a/arch/s390/hypfs/hypfs_dbfs.c
+++ b/arch/s390/hypfs/hypfs_dbfs.c
@ -6,6 +6,7 @@
 * Author(s): Michael Holzheu <holzheu@linux.vnet.ibm.com>
 */

+#include <linux/security.h>
 #include <linux/slab.h>
 #include "hypfs.h"

@ -64,24 +65,28 @@ static long dbfs_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
 	long rc;

 	mutex_lock(&df->lock);
-	if (df->unlocked_ioctl)
-		rc = df->unlocked_ioctl(file, cmd, arg);
-	else
-		rc = -ENOTTY;
+	rc = df->unlocked_ioctl(file, cmd, arg);
 	mutex_unlock(&df->lock);
 	return rc;
 }

-static const struct file_operations dbfs_ops = {
+static const struct file_operations dbfs_ops_ioctl = {
 	.read		= dbfs_read,
 	.llseek		= no_llseek,
 	.unlocked_ioctl = dbfs_ioctl,
 };

+static const struct file_operations dbfs_ops = {
+	.read		= dbfs_read,
+};
+
 void hypfs_dbfs_create_file(struct hypfs_dbfs_file *df)
 {
-	df->dentry = debugfs_create_file(df->name, 0400, dbfs_dir, df,
-					 &dbfs_ops);
+	const struct file_operations *fops = &dbfs_ops;
+
+	if (df->unlocked_ioctl && !security_locked_down(LOCKDOWN_DEBUGFS))
+		fops = &dbfs_ops_ioctl;
+	df->dentry = debugfs_create_file(df->name, 0400, dbfs_dir, df, fops);
 	mutex_init(&df->lock);
 }

--- a/arch/s390/include/asm/timex.h
+++ b/arch/s390/include/asm/timex.h
@ -172,13 +172,6 @@ static inline unsigned long long get_tod_clock_fast(void)
 	return get_tod_clock();
 #endif
 }
-
-static inline cycles_t get_cycles(void)
-{
-	return (cycles_t) get_tod_clock() >> 2;
-}
-#define get_cycles get_cycles
-
 int get_phys_clock(unsigned long *clock);
 void init_cpu_timer(void);
 unsigned long long monotonic_clock(void);
@ -202,6 +195,12 @@ static inline unsigned long long get_tod_clock_monotonic(void)
 	return tod;
 }

+static inline cycles_t get_cycles(void)
+{
+	return (cycles_t)get_tod_clock_monotonic() >> 2;
+}
+#define get_cycles get_cycles
+
 /**
 * tod_to_ns - convert a TOD format value to nanoseconds
 * @todval: to be converted TOD format value
--- a/arch/s390/kernel/time.c
+++ b/arch/s390/kernel/time.c
@ -642,7 +642,7 @@ static int stp_sync_clock(void *data)
 		atomic_dec(&sync->cpus);
 		/* Wait for in_sync to be set. */
 		while (READ_ONCE(sync->in_sync) == 0)
-			__udelay(1);
+			;
 	}
 	if (sync->in_sync != 1)
 		/* Didn't work. Clear per-cpu in sync bit again. */
--- a/arch/x86/kernel/cpu/mce/amd.c
+++ b/arch/x86/kernel/cpu/mce/amd.c
@ -1180,13 +1180,20 @@ static const char *get_name(unsigned int bank, struct threshold_block *b)
 	}

 	bank_type = smca_get_bank_type(bank);
-	if (bank_type >= N_SMCA_BANK_TYPES)
-		return NULL;

 	if (b && bank_type == SMCA_UMC) {
 		if (b->block < ARRAY_SIZE(smca_umc_block_names))
 			return smca_umc_block_names[b->block];
-		return NULL;
+	}
+
+	if (b && b->block) {
+		snprintf(buf_mcatype, MAX_MCATYPE_NAME_LEN, "th_block_%u", b->block);
+		return buf_mcatype;
+	}
+
+	if (bank_type >= N_SMCA_BANK_TYPES) {
+		snprintf(buf_mcatype, MAX_MCATYPE_NAME_LEN, "th_bank_%u", bank);
+		return buf_mcatype;
 	}

 	if (smca_banks[bank].hwid->count == 1)
--- a/arch/x86/kvm/lapic.c
+++ b/arch/x86/kvm/lapic.c
@ -589,6 +589,9 @@ int kvm_pv_send_ipi(struct kvm *kvm, unsigned long ipi_bitmap_low,

 	if (min > map->max_apic_id)
 		goto out;
+
+	min = array_index_nospec(min, map->max_apic_id + 1);
+
 	/* Bits above cluster_size are masked in the caller.  */
 	for_each_set_bit(i, &ipi_bitmap_low,
 		min((u32)BITS_PER_LONG, (map->max_apic_id - min + 1))) {
--- a/arch/x86/kvm/x86.c
+++ b/arch/x86/kvm/x86.c
@ -7506,8 +7506,11 @@ static void kvm_sched_yield(struct kvm *kvm, unsigned long dest_id)
 	rcu_read_lock();
 	map = rcu_dereference(kvm->arch.apic_map);

-	if (likely(map) && dest_id <= map->max_apic_id && map->phys_map[dest_id])
-		target = map->phys_map[dest_id]->vcpu;
+	if (likely(map) && dest_id <= map->max_apic_id) {
+		dest_id = array_index_nospec(dest_id, map->max_apic_id + 1);
+		if (map->phys_map[dest_id])
+			target = map->phys_map[dest_id]->vcpu;
+	}

 	rcu_read_unlock();

@ -10391,11 +10394,18 @@ int kvm_arch_irq_bypass_add_producer(struct irq_bypass_consumer *cons,
 {
 	struct kvm_kernel_irqfd *irqfd =
 		container_of(cons, struct kvm_kernel_irqfd, consumer);
+	struct kvm *kvm = irqfd->kvm;
+	int ret;

+	spin_lock_irq(&kvm->irqfds.lock);
 	irqfd->producer = prod;

-	return kvm_x86_ops->update_pi_irte(irqfd->kvm,
+	ret = kvm_x86_ops->update_pi_irte(irqfd->kvm,
 					   prod->irq, irqfd->gsi, 1);
+
+	spin_unlock_irq(&kvm->irqfds.lock);
+
+	return ret;
 }

 void kvm_arch_irq_bypass_del_producer(struct irq_bypass_consumer *cons,
@ -10404,9 +10414,9 @@ void kvm_arch_irq_bypass_del_producer(struct irq_bypass_consumer *cons,
 	int ret;
 	struct kvm_kernel_irqfd *irqfd =
 		container_of(cons, struct kvm_kernel_irqfd, consumer);
+	struct kvm *kvm = irqfd->kvm;

 	WARN_ON(irqfd->producer != prod);
-	irqfd->producer = NULL;

 	/*
 	 * When producer of consumer is unregistered, we change back to
@ -10414,10 +10424,15 @@ void kvm_arch_irq_bypass_del_producer(struct irq_bypass_consumer *cons,
 	 * when the irq is masked/disabled or the consumer side (KVM
 	 * int this case doesn't want to receive the interrupts.
 	*/
+	spin_lock_irq(&kvm->irqfds.lock);
+	irqfd->producer = NULL;
+
 	ret = kvm_x86_ops->update_pi_irte(irqfd->kvm, prod->irq, irqfd->gsi, 0);
 	if (ret)
 		printk(KERN_INFO "irq bypass consumer (token %p) unregistration"
 		       " fails: %d\n", irqfd->consumer.token, ret);
+
+	spin_unlock_irq(&kvm->irqfds.lock);
 }

 int kvm_arch_update_irqfd_routing(struct kvm *kvm, unsigned int host_irq,
--- a/arch/x86/mm/extable.c
+++ b/arch/x86/mm/extable.c
@ -59,13 +59,12 @@ __visible bool ex_handler_fprestore(const struct exception_table_entry *fixup,
 				    unsigned long error_code,
 				    unsigned long fault_addr)
 {
-	regs->ip = ex_fixup_addr(fixup);
-
 	WARN_ONCE(1, "Bad FPU state detected at %pB, reinitializing FPU registers.",
 		  (void *)instruction_pointer(regs));

 	__copy_kernel_to_fpregs(&init_fpstate, -1);
-	return true;
+
+	return ex_handler_default(fixup, regs, trapnr, error_code, fault_addr);
 }
 EXPORT_SYMBOL_GPL(ex_handler_fprestore);

--- a/drivers/acpi/acpi_processor.c
+++ b/drivers/acpi/acpi_processor.c
@ -228,7 +228,7 @@ static inline int acpi_processor_hotadd_init(struct acpi_processor *pr)

 static int acpi_processor_get_info(struct acpi_device *device)
 {
-	union acpi_object object = { 0 };
+	union acpi_object object = { .processor = { 0 } };
 	struct acpi_buffer buffer = { sizeof(union acpi_object), &object };
 	struct acpi_processor *pr = acpi_driver_data(device);
 	int device_declaration = 0;
--- a/drivers/acpi/apei/ghes.c
+++ b/drivers/acpi/apei/ghes.c
@ -709,6 +709,8 @@ static void __ghes_panic(struct ghes *ghes,

 	__ghes_print_estatus(KERN_EMERG, ghes->generic, estatus);

+	add_taint(TAINT_MACHINE_CHECK, LOCKDEP_STILL_OK);
+
 	ghes_clear_estatus(ghes, estatus, buf_paddr, fixmap_idx);

 	if (!panic_timeout)
--- a/drivers/acpi/processor_idle.c
+++ b/drivers/acpi/processor_idle.c
@ -1230,7 +1230,9 @@ static int acpi_processor_get_lpi_info(struct acpi_processor *pr)

 	status = acpi_get_parent(handle, &pr_ahandle);
 	while (ACPI_SUCCESS(status)) {
-		acpi_bus_get_device(pr_ahandle, &d);
+		if (acpi_bus_get_device(pr_ahandle, &d))
+			break;
+
 		handle = pr_ahandle;

 		if (strcmp(acpi_device_hid(d), ACPI_PROCESSOR_CONTAINER_HID))
--- a/drivers/acpi/processor_perflib.c
+++ b/drivers/acpi/processor_perflib.c
@ -176,6 +176,9 @@ void acpi_processor_ppc_init(struct cpufreq_policy *policy)
 {
 	unsigned int cpu;

+	if (ignore_ppc == 1)
+		return;
+
 	for_each_cpu(cpu, policy->related_cpus) {
 		struct acpi_processor *pr = per_cpu(processors, cpu);
 		int ret;
@ -196,6 +199,14 @@ void acpi_processor_ppc_init(struct cpufreq_policy *policy)
 		if (ret < 0)
 			pr_err("Failed to add freq constraint for CPU%d (%d)\n",
 			       cpu, ret);
+
+		if (!pr->performance)
+			continue;
+
+		ret = acpi_processor_get_platform_limit(pr);
+		if (ret)
+			pr_err("Failed to update freq constraint for CPU%d (%d)\n",
+			       cpu, ret);
 	}
 }

--- a/drivers/ata/Kconfig
+++ b/drivers/ata/Kconfig
@ -92,22 +92,39 @@ config SATA_AHCI

 config SATA_MOBILE_LPM_POLICY
 	int "Default SATA Link Power Management policy for mobile chipsets"
-	range 0 4
+	range 0 5
 	default 0
 	depends on SATA_AHCI
 	help
 	  Select the Default SATA Link Power Management (LPM) policy to use
 	  for mobile / laptop variants of chipsets / "South Bridges".

-	  The value set has the following meanings:
-		0 => Keep firmware settings
-		1 => Maximum performance
-		2 => Medium power
-		3 => Medium power with Device Initiated PM enabled
-		4 => Minimum power
+	  Each policy combines power saving states and features:
+	   - Partial: The Phy logic is powered but is in a reduced power
+                      state. The exit latency from this state is no longer than
+                      10us).
+	   - Slumber: The Phy logic is powered but is in an even lower power
+                      state. The exit latency from this state is potentially
+		      longer, but no longer than 10ms.
+	   - DevSleep: The Phy logic may be powered down. The exit latency from
+	               this state is no longer than 20 ms, unless otherwise
+		       specified by DETO in the device Identify Device Data log.
+	   - HIPM: Host Initiated Power Management (host automatically
+		   transitions to partial and slumber).
+	   - DIPM: Device Initiated Power Management (device automatically
+		   transitions to partial and slumber).

-	  Note "Minimum power" is known to cause issues, including disk
-	  corruption, with some disks and should not be used.
+	  The possible values for the default SATA link power management
+	  policies are:
+		0 => Keep firmware settings
+		1 => No power savings (maximum performance)
+		2 => HIPM (Partial)
+		3 => HIPM (Partial) and DIPM (Partial and Slumber)
+		4 => HIPM (Partial and DevSleep) and DIPM (Partial and Slumber)
+		5 => HIPM (Slumber and DevSleep) and DIPM (Partial and Slumber)
+
+	  Excluding the value 0, higher values represent policies with higher
+	  power savings.

 config SATA_AHCI_PLATFORM
 	tristate "Platform AHCI SATA support"
--- a/drivers/ata/libata-scsi.c
+++ b/drivers/ata/libata-scsi.c
@ -984,18 +984,14 @@ static void ata_to_sense_error(unsigned id, u8 drv_stat, u8 drv_err, u8 *sk,
 		{0xFF, 0xFF, 0xFF, 0xFF}, // END mark
 	};
 	static const unsigned char stat_table[][4] = {
-		/* Must be first because BUSY means no other bits valid */
-		{0x80,		ABORTED_COMMAND, 0x47, 0x00},
-		// Busy, fake parity for now
-		{0x40,		ILLEGAL_REQUEST, 0x21, 0x04},
-		// Device ready, unaligned write command
-		{0x20,		HARDWARE_ERROR,  0x44, 0x00},
-		// Device fault, internal target failure
-		{0x08,		ABORTED_COMMAND, 0x47, 0x00},
-		// Timed out in xfer, fake parity for now
-		{0x04,		RECOVERED_ERROR, 0x11, 0x00},
-		// Recovered ECC error	  Medium error, recovered
-		{0xFF, 0xFF, 0xFF, 0xFF}, // END mark
+		/* Busy: must be first because BUSY means no other bits valid */
+		{ ATA_BUSY,	ABORTED_COMMAND, 0x00, 0x00 },
+		/* Device fault: INTERNAL TARGET FAILURE */
+		{ ATA_DF,	HARDWARE_ERROR,  0x44, 0x00 },
+		/* Corrected data error */
+		{ ATA_CORR,	RECOVERED_ERROR, 0x00, 0x00 },
+
+		{ 0xFF, 0xFF, 0xFF, 0xFF }, /* END mark */
 	};

 	/*
--- a/drivers/atm/atmtcp.c
+++ b/drivers/atm/atmtcp.c
@ -279,6 +279,19 @@ static struct atm_vcc *find_vcc(struct atm_dev *dev, short vpi, int vci)
        return NULL;
 }

+static int atmtcp_c_pre_send(struct atm_vcc *vcc, struct sk_buff *skb)
+{
+	struct atmtcp_hdr *hdr;
+
+	if (skb->len < sizeof(struct atmtcp_hdr))
+		return -EINVAL;
+
+	hdr = (struct atmtcp_hdr *)skb->data;
+	if (hdr->length == ATMTCP_HDR_MAGIC)
+		return -EINVAL;
+
+	return 0;
+}

 static int atmtcp_c_send(struct atm_vcc *vcc,struct sk_buff *skb)
 {
@ -288,9 +301,6 @@ static int atmtcp_c_send(struct atm_vcc *vcc,struct sk_buff *skb)
 	struct sk_buff *new_skb;
 	int result = 0;

-	if (skb->len < sizeof(struct atmtcp_hdr))
-		goto done;
-
 	dev = vcc->dev_data;
 	hdr = (struct atmtcp_hdr *) skb->data;
 	if (hdr->length == ATMTCP_HDR_MAGIC) {
@ -347,6 +357,7 @@ static struct atmdev_ops atmtcp_v_dev_ops = {

 static const struct atmdev_ops atmtcp_c_dev_ops = {
 	.close		= atmtcp_c_close,
+	.pre_send	= atmtcp_c_pre_send,
 	.send		= atmtcp_c_send
 };

--- a/drivers/atm/eni.c
+++ b/drivers/atm/eni.c
@ -2035,21 +2035,6 @@ static int eni_ioctl(struct atm_dev *dev,unsigned int cmd,void __user *arg)
 	return dev->phy->ioctl(dev,cmd,arg);
 }

-
-static int eni_getsockopt(struct atm_vcc *vcc,int level,int optname,
-    void __user *optval,int optlen)
-{
-	return -EINVAL;
-}
-
-
-static int eni_setsockopt(struct atm_vcc *vcc,int level,int optname,
-    void __user *optval,unsigned int optlen)
-{
-	return -EINVAL;
-}
-
-
 static int eni_send(struct atm_vcc *vcc,struct sk_buff *skb)
 {
 	enum enq_res res;
@ -2223,8 +2208,6 @@ static const struct atmdev_ops ops = {
 	.open		= eni_open,
 	.close		= eni_close,
 	.ioctl		= eni_ioctl,
-	.getsockopt	= eni_getsockopt,
-	.setsockopt	= eni_setsockopt,
 	.send		= eni_send,
 	.phy_put	= eni_phy_put,
 	.phy_get	= eni_phy_get,
--- a/drivers/atm/firestream.c
+++ b/drivers/atm/firestream.c
@ -1278,8 +1278,6 @@ static const struct atmdev_ops ops = {
 	.send =         fs_send,
 	.owner =        THIS_MODULE,
 	/* ioctl:          fs_ioctl, */
-	/* getsockopt:     fs_getsockopt, */
-	/* setsockopt:     fs_setsockopt, */
 	/* change_qos:     fs_change_qos, */

 	/* For now implement these internally here... */  
--- a/drivers/atm/fore200e.c
+++ b/drivers/atm/fore200e.c
@ -1710,31 +1710,6 @@ fore200e_getstats(struct fore200e* fore200e)
    return 0;
 }

-
-static int
-fore200e_getsockopt(struct atm_vcc* vcc, int level, int optname, void __user *optval, int optlen)
-{
-    /* struct fore200e* fore200e = FORE200E_DEV(vcc->dev); */
-
-    DPRINTK(2, "getsockopt %d.%d.%d, level = %d, optname = 0x%x, optval = 0x%p, optlen = %d\n",
-	    vcc->itf, vcc->vpi, vcc->vci, level, optname, optval, optlen);
-
-    return -EINVAL;
-}
-
-
-static int
-fore200e_setsockopt(struct atm_vcc* vcc, int level, int optname, void __user *optval, unsigned int optlen)
-{
-    /* struct fore200e* fore200e = FORE200E_DEV(vcc->dev); */
-    
-    DPRINTK(2, "setsockopt %d.%d.%d, level = %d, optname = 0x%x, optval = 0x%p, optlen = %d\n",
-	    vcc->itf, vcc->vpi, vcc->vci, level, optname, optval, optlen);
-    
-    return -EINVAL;
-}
-
-
 #if 0 /* currently unused */
 static int
 fore200e_get_oc3(struct fore200e* fore200e, struct oc3_regs* regs)
@ -3026,8 +3001,6 @@ static const struct atmdev_ops fore200e_ops = {
 	.open       = fore200e_open,
 	.close      = fore200e_close,
 	.ioctl      = fore200e_ioctl,
-	.getsockopt = fore200e_getsockopt,
-	.setsockopt = fore200e_setsockopt,
 	.send       = fore200e_send,
 	.change_qos = fore200e_change_qos,
 	.proc_read  = fore200e_proc_read,
--- a/drivers/atm/horizon.c
+++ b/drivers/atm/horizon.c
@ -2527,46 +2527,6 @@ static void hrz_close (struct atm_vcc * atm_vcc) {
  clear_bit(ATM_VF_ADDR,&atm_vcc->flags);
 }

-#if 0
-static int hrz_getsockopt (struct atm_vcc * atm_vcc, int level, int optname,
-			   void *optval, int optlen) {
-  hrz_dev * dev = HRZ_DEV(atm_vcc->dev);
-  PRINTD (DBG_FLOW|DBG_VCC, "hrz_getsockopt");
-  switch (level) {
-    case SOL_SOCKET:
-      switch (optname) {
-//	case SO_BCTXOPT:
-//	  break;
-//	case SO_BCRXOPT:
-//	  break;
-	default:
-	  return -ENOPROTOOPT;
-      };
-      break;
-  }
-  return -EINVAL;
-}
-
-static int hrz_setsockopt (struct atm_vcc * atm_vcc, int level, int optname,
-			   void *optval, unsigned int optlen) {
-  hrz_dev * dev = HRZ_DEV(atm_vcc->dev);
-  PRINTD (DBG_FLOW|DBG_VCC, "hrz_setsockopt");
-  switch (level) {
-    case SOL_SOCKET:
-      switch (optname) {
-//	case SO_BCTXOPT:
-//	  break;
-//	case SO_BCRXOPT:
-//	  break;
-	default:
-	  return -ENOPROTOOPT;
-      };
-      break;
-  }
-  return -EINVAL;
-}
-#endif
-
 #if 0
 static int hrz_ioctl (struct atm_dev * atm_dev, unsigned int cmd, void *arg) {
  hrz_dev * dev = HRZ_DEV(atm_dev);
--- a/drivers/atm/iphase.c
+++ b/drivers/atm/iphase.c
@ -2882,20 +2882,6 @@ static int ia_ioctl(struct atm_dev *dev, unsigned int cmd, void __user *arg)
   return 0;  
 }  
  
-static int ia_getsockopt(struct atm_vcc *vcc, int level, int optname,   
-	void __user *optval, int optlen)  
-{  
-	IF_EVENT(printk(">ia_getsockopt\n");)  
-	return -EINVAL;  
-}  
-  
-static int ia_setsockopt(struct atm_vcc *vcc, int level, int optname,   
-	void __user *optval, unsigned int optlen)  
-{  
-	IF_EVENT(printk(">ia_setsockopt\n");)  
-	return -EINVAL;  
-}  
-  
 static int ia_pkt_tx (struct atm_vcc *vcc, struct sk_buff *skb) {
        IADEV *iadev;
        struct dle *wr_ptr;
@ -3166,8 +3152,6 @@ static const struct atmdev_ops ops = {
 	.open		= ia_open,  
 	.close		= ia_close,  
 	.ioctl		= ia_ioctl,  
-	.getsockopt	= ia_getsockopt,  
-	.setsockopt	= ia_setsockopt,  
 	.send		= ia_send,  
 	.phy_put	= ia_phy_put,  
 	.phy_get	= ia_phy_get,  
--- a/drivers/atm/lanai.c
+++ b/drivers/atm/lanai.c
@ -2540,8 +2540,6 @@ static const struct atmdev_ops ops = {
 	.dev_close	= lanai_dev_close,
 	.open		= lanai_open,
 	.close		= lanai_close,
-	.getsockopt	= NULL,
-	.setsockopt	= NULL,
 	.send		= lanai_send,
 	.phy_put	= NULL,
 	.phy_get	= NULL,
--- a/drivers/atm/solos-pci.c
+++ b/drivers/atm/solos-pci.c
@ -1179,8 +1179,6 @@ static const struct atmdev_ops fpga_ops = {
 	.open =		popen,
 	.close =	pclose,
 	.ioctl =	NULL,
-	.getsockopt =	NULL,
-	.setsockopt =	NULL,
 	.send =		psend,
 	.send_oam =	NULL,
 	.phy_put =	NULL,
--- a/drivers/atm/zatm.c
+++ b/drivers/atm/zatm.c
@ -1515,20 +1515,6 @@ static int zatm_ioctl(struct atm_dev *dev,unsigned int cmd,void __user *arg)
 	}
 }

-
-static int zatm_getsockopt(struct atm_vcc *vcc,int level,int optname,
-    void __user *optval,int optlen)
-{
-	return -EINVAL;
-}
-
-
-static int zatm_setsockopt(struct atm_vcc *vcc,int level,int optname,
-    void __user *optval,unsigned int optlen)
-{
-	return -EINVAL;
-}
-
 static int zatm_send(struct atm_vcc *vcc,struct sk_buff *skb)
 {
 	int error;
@ -1582,8 +1568,6 @@ static const struct atmdev_ops ops = {
 	.open		= zatm_open,
 	.close		= zatm_close,
 	.ioctl		= zatm_ioctl,
-	.getsockopt	= zatm_getsockopt,
-	.setsockopt	= zatm_setsockopt,
 	.send		= zatm_send,
 	.phy_put	= zatm_phy_put,
 	.phy_get	= zatm_phy_get,
--- a/drivers/base/power/domain_governor.c
+++ b/drivers/base/power/domain_governor.c
@ -8,6 +8,7 @@
 #include <linux/pm_domain.h>
 #include <linux/pm_qos.h>
 #include <linux/hrtimer.h>
+#include <linux/cpu.h>
 #include <linux/cpuidle.h>
 #include <linux/cpumask.h>
 #include <linux/ktime.h>
@ -254,6 +255,8 @@ static bool cpu_power_down_ok(struct dev_pm_domain *pd)
 	struct generic_pm_domain *genpd = pd_to_genpd(pd);
 	struct cpuidle_device *dev;
 	ktime_t domain_wakeup, next_hrtimer;
+	struct device *cpu_dev;
+	s64 cpu_constraint, global_constraint;
 	s64 idle_duration_ns;
 	int cpu, i;

@ -264,6 +267,7 @@ static bool cpu_power_down_ok(struct dev_pm_domain *pd)
 	if (!(genpd->flags & GENPD_FLAG_CPU_DOMAIN))
 		return true;

+	global_constraint = pm_qos_request(PM_QOS_CPU_DMA_LATENCY);
 	/*
 	 * Find the next wakeup for any of the online CPUs within the PM domain
 	 * and its subdomains. Note, we only need the genpd->cpus, as it already
@ -277,8 +281,16 @@ static bool cpu_power_down_ok(struct dev_pm_domain *pd)
 			if (ktime_before(next_hrtimer, domain_wakeup))
 				domain_wakeup = next_hrtimer;
 		}
+
+		cpu_dev = get_cpu_device(cpu);
+		if (cpu_dev) {
+			cpu_constraint = dev_pm_qos_raw_resume_latency(cpu_dev);
+			if (cpu_constraint < global_constraint)
+				global_constraint = cpu_constraint;
+		}
 	}

+	global_constraint *= NSEC_PER_USEC;
 	/* The minimum idle duration is from now - until the next wakeup. */
 	idle_duration_ns = ktime_to_ns(ktime_sub(domain_wakeup, ktime_get()));
 	if (idle_duration_ns <= 0)
@ -291,8 +303,10 @@ static bool cpu_power_down_ok(struct dev_pm_domain *pd)
 	 */
 	i = genpd->state_idx;
 	do {
-		if (idle_duration_ns >= (genpd->states[i].residency_ns +
-		    genpd->states[i].power_off_latency_ns)) {
+		if ((idle_duration_ns >= (genpd->states[i].residency_ns +
+		    genpd->states[i].power_off_latency_ns)) &&
+		    (global_constraint >= (genpd->states[i].power_on_latency_ns +
+		    genpd->states[i].power_off_latency_ns))) {
 			genpd->state_idx = i;
 			return true;
 		}
--- a/drivers/block/drbd/drbd_receiver.c
+++ b/drivers/block/drbd/drbd_receiver.c
@ -2531,7 +2531,11 @@ static int handle_write_conflicts(struct drbd_device *device,
 			peer_req->w.cb = superseded ? e_send_superseded :
 						   e_send_retry_write;
 			list_add_tail(&peer_req->w.list, &device->done_ee);
-			queue_work(connection->ack_sender, &peer_req->peer_device->send_acks_work);
+			/* put is in drbd_send_acks_wf() */
+			kref_get(&device->kref);
+			if (!queue_work(connection->ack_sender,
+					&peer_req->peer_device->send_acks_work))
+				kref_put(&device->kref, drbd_destroy_device);

 			err = -ENOENT;
 			goto out;
--- a/drivers/block/sunvdc.c
+++ b/drivers/block/sunvdc.c
@ -967,8 +967,10 @@ static bool vdc_port_mpgroup_check(struct vio_dev *vdev)
 	dev = device_find_child(vdev->dev.parent, &port_data,
 				vdc_device_probed);

-	if (dev)
+	if (dev) {
+		put_device(dev);
 		return true;
+	}

 	return false;
 }
--- a/drivers/char/hw_random/mtk-rng.c
+++ b/drivers/char/hw_random/mtk-rng.c
@ -149,7 +149,9 @@ static int mtk_rng_probe(struct platform_device *pdev)
 	dev_set_drvdata(&pdev->dev, priv);
 	pm_runtime_set_autosuspend_delay(&pdev->dev, RNG_AUTOSUSPEND_TIMEOUT);
 	pm_runtime_use_autosuspend(&pdev->dev);
-	devm_pm_runtime_enable(&pdev->dev);
+	ret = devm_pm_runtime_enable(&pdev->dev);
+	if (ret)
+		return ret;

 	dev_info(&pdev->dev, "registered RNG driver\n");

--- a/drivers/char/ipmi/ipmi_msghandler.c
+++ b/drivers/char/ipmi/ipmi_msghandler.c
@ -4302,10 +4302,10 @@ free_msg:
 		 * The NetFN and Command in the response is not even
 		 * marginally correct.
 		 */
-		dev_warn(intf->si_dev,
-			 "BMC returned incorrect response, expected netfn %x cmd %x, got netfn %x cmd %x\n",
-			 (msg->data[0] >> 2) | 1, msg->data[1],
-			 msg->rsp[0] >> 2, msg->rsp[1]);
+		dev_warn_ratelimited(intf->si_dev,
+				     "BMC returned incorrect response, expected netfn %x cmd %x, got netfn %x cmd %x\n",
+				     (msg->data[0] >> 2) | 1, msg->data[1],
+				     msg->rsp[0] >> 2, msg->rsp[1]);

 		/* Generate an error response for the message. */
 		msg->rsp[0] = msg->data[0] | (1 << 2);
--- a/drivers/char/ipmi/ipmi_watchdog.c
+++ b/drivers/char/ipmi/ipmi_watchdog.c
@ -1192,14 +1192,8 @@ static struct ipmi_smi_watcher smi_watcher = {
 	.smi_gone = ipmi_smi_gone
 };

-static int action_op(const char *inval, char *outval)
+static int action_op_set_val(const char *inval)
 {
-	if (outval)
-		strcpy(outval, action);
-
-	if (!inval)
-		return 0;
-
 	if (strcmp(inval, "reset") == 0)
 		action_val = WDOG_TIMEOUT_RESET;
 	else if (strcmp(inval, "none") == 0)
@ -1210,18 +1204,26 @@ static int action_op(const char *inval, char *outval)
 		action_val = WDOG_TIMEOUT_POWER_DOWN;
 	else
 		return -EINVAL;
-	strcpy(action, inval);
 	return 0;
 }

-static int preaction_op(const char *inval, char *outval)
+static int action_op(const char *inval, char *outval)
 {
+	int rv;
+
 	if (outval)
-		strcpy(outval, preaction);
+		strcpy(outval, action);

 	if (!inval)
 		return 0;
+	rv = action_op_set_val(inval);
+	if (!rv)
+		strcpy(action, inval);
+	return rv;
+}

+static int preaction_op_set_val(const char *inval)
+{
 	if (strcmp(inval, "pre_none") == 0)
 		preaction_val = WDOG_PRETIMEOUT_NONE;
 	else if (strcmp(inval, "pre_smi") == 0)
@ -1234,18 +1236,26 @@ static int preaction_op(const char *inval, char *outval)
 		preaction_val = WDOG_PRETIMEOUT_MSG_INT;
 	else
 		return -EINVAL;
-	strcpy(preaction, inval);
 	return 0;
 }

-static int preop_op(const char *inval, char *outval)
+static int preaction_op(const char *inval, char *outval)
 {
+	int rv;
+
 	if (outval)
-		strcpy(outval, preop);
+		strcpy(outval, preaction);

 	if (!inval)
 		return 0;
+	rv = preaction_op_set_val(inval);
+	if (!rv)
+		strcpy(preaction, inval);
+	return 0;
+}

+static int preop_op_set_val(const char *inval)
+{
 	if (strcmp(inval, "preop_none") == 0)
 		preop_val = WDOG_PREOP_NONE;
 	else if (strcmp(inval, "preop_panic") == 0)
@ -1254,7 +1264,22 @@ static int preop_op(const char *inval, char *outval)
 		preop_val = WDOG_PREOP_GIVE_DATA;
 	else
 		return -EINVAL;
-	strcpy(preop, inval);
+	return 0;
+}
+
+static int preop_op(const char *inval, char *outval)
+{
+	int rv;
+
+	if (outval)
+		strcpy(outval, preop);
+
+	if (!inval)
+		return 0;
+
+	rv = preop_op_set_val(inval);
+	if (!rv)
+		strcpy(preop, inval);
 	return 0;
 }

@ -1291,18 +1316,18 @@ static int __init ipmi_wdog_init(void)
 {
 	int rv;

-	if (action_op(action, NULL)) {
+	if (action_op_set_val(action)) {
 		action_op("reset", NULL);
 		pr_info("Unknown action '%s', defaulting to reset\n", action);
 	}

-	if (preaction_op(preaction, NULL)) {
+	if (preaction_op_set_val(preaction)) {
 		preaction_op("pre_none", NULL);
 		pr_info("Unknown preaction '%s', defaulting to none\n",
 			preaction);
 	}

-	if (preop_op(preop, NULL)) {
+	if (preop_op_set_val(preop)) {
 		preop_op("preop_none", NULL);
 		pr_info("Unknown preop '%s', defaulting to none\n", preop);
 	}
--- a/drivers/clk/davinci/psc.c
+++ b/drivers/clk/davinci/psc.c
@ -278,6 +278,11 @@ davinci_lpsc_clk_register(struct device *dev, const char *name,

 	lpsc->pm_domain.name = devm_kasprintf(dev, GFP_KERNEL, "%s: %s",
 					      best_dev_name(dev), name);
+	if (!lpsc->pm_domain.name) {
+		clk_hw_unregister(&lpsc->hw);
+		kfree(lpsc);
+		return ERR_PTR(-ENOMEM);
+	}
 	lpsc->pm_domain.attach_dev = davinci_psc_genpd_attach_dev;
 	lpsc->pm_domain.detach_dev = davinci_psc_genpd_detach_dev;
 	lpsc->pm_domain.flags = GENPD_FLAG_PM_CLK;
--- a/drivers/clk/sunxi-ng/ccu-sun8i-v3s.c
+++ b/drivers/clk/sunxi-ng/ccu-sun8i-v3s.c
@ -334,8 +334,7 @@ static SUNXI_CCU_GATE(dram_ohci_clk,	"dram-ohci",	"dram",

 static const char * const de_parents[] = { "pll-video", "pll-periph0" };
 static SUNXI_CCU_M_WITH_MUX_GATE(de_clk, "de", de_parents,
-				 0x104, 0, 4, 24, 2, BIT(31),
-				 CLK_SET_RATE_PARENT);
+				 0x104, 0, 4, 24, 3, BIT(31), 0);

 static const char * const tcon_parents[] = { "pll-video" };
 static SUNXI_CCU_M_WITH_MUX_GATE(tcon_clk, "tcon", tcon_parents,
--- a/drivers/cpufreq/armada-8k-cpufreq.c
+++ b/drivers/cpufreq/armada-8k-cpufreq.c
@ -96,7 +96,7 @@ static void armada_8k_cpufreq_free_table(struct freq_table *freq_tables)
 {
 	int opps_index, nb_cpus = num_possible_cpus();

-	for (opps_index = 0 ; opps_index <= nb_cpus; opps_index++) {
+	for (opps_index = 0 ; opps_index < nb_cpus; opps_index++) {
 		int i;

 		/* If cpu_dev is NULL then we reached the end of the array */
--- a/drivers/cpufreq/cpufreq.c
+++ b/drivers/cpufreq/cpufreq.c
@ -1230,6 +1230,8 @@ static struct cpufreq_policy *cpufreq_policy_alloc(unsigned int cpu)
 		goto err_free_real_cpus;
 	}

+	init_rwsem(&policy->rwsem);
+
 	freq_constraints_init(&policy->constraints);

 	policy->nb_min.notifier_call = cpufreq_notifier_min;
@ -1252,7 +1254,6 @@ static struct cpufreq_policy *cpufreq_policy_alloc(unsigned int cpu)
 	}

 	INIT_LIST_HEAD(&policy->policy_list);
-	init_rwsem(&policy->rwsem);
 	spin_lock_init(&policy->transition_lock);
 	init_waitqueue_head(&policy->transition_wait);
 	INIT_WORK(&policy->update, handle_update);
@ -2501,10 +2502,12 @@ static int cpufreq_set_policy(struct cpufreq_policy *policy,
 	pr_debug("starting governor %s failed\n", policy->governor->name);
 	if (old_gov) {
 		policy->governor = old_gov;
-		if (cpufreq_init_governor(policy))
+		if (cpufreq_init_governor(policy)) {
 			policy->governor = NULL;
-		else
-			cpufreq_start_governor(policy);
+		} else if (cpufreq_start_governor(policy)) {
+			cpufreq_exit_governor(policy);
+			policy->governor = NULL;
+		}
 	}

 	return ret;
--- a/drivers/crypto/ccp/ccp-debugfs.c
+++ b/drivers/crypto/ccp/ccp-debugfs.c
@ -319,5 +319,8 @@ void ccp5_debugfs_setup(struct ccp_device *ccp)

 void ccp5_debugfs_destroy(void)
 {
+	mutex_lock(&ccp_debugfs_lock);
 	debugfs_remove_recursive(ccp_debugfs_dir);
+	ccp_debugfs_dir = NULL;
+	mutex_unlock(&ccp_debugfs_lock);
 }
--- a/drivers/crypto/img-hash.c
+++ b/drivers/crypto/img-hash.c
@ -434,7 +434,7 @@ static int img_hash_write_via_dma_stop(struct img_hash_dev *hdev)
 	struct img_hash_request_ctx *ctx = ahash_request_ctx(hdev->req);

 	if (ctx->flags & DRIVER_FLAGS_SG)
-		dma_unmap_sg(hdev->dev, ctx->sg, ctx->dma_ct, DMA_TO_DEVICE);
+		dma_unmap_sg(hdev->dev, ctx->sg, 1, DMA_TO_DEVICE);

 	return 0;
 }
--- a/drivers/crypto/marvell/cipher.c
+++ b/drivers/crypto/marvell/cipher.c
@ -73,9 +73,12 @@ mv_cesa_skcipher_dma_cleanup(struct skcipher_request *req)
 static inline void mv_cesa_skcipher_cleanup(struct skcipher_request *req)
 {
 	struct mv_cesa_skcipher_req *creq = skcipher_request_ctx(req);
+	struct mv_cesa_engine *engine = creq->base.engine;

 	if (mv_cesa_req_get_type(&creq->base) == CESA_DMA_REQ)
 		mv_cesa_skcipher_dma_cleanup(req);
+
+	atomic_sub(req->cryptlen, &engine->load);
 }

 static void mv_cesa_skcipher_std_step(struct skcipher_request *req)
@ -202,7 +205,6 @@ mv_cesa_skcipher_complete(struct crypto_async_request *req)
 	struct mv_cesa_engine *engine = creq->base.engine;
 	unsigned int ivsize;

-	atomic_sub(skreq->cryptlen, &engine->load);
 	ivsize = crypto_skcipher_ivsize(crypto_skcipher_reqtfm(skreq));

 	if (mv_cesa_req_get_type(&creq->base) == CESA_DMA_REQ) {
--- a/drivers/crypto/marvell/hash.c
+++ b/drivers/crypto/marvell/hash.c
@ -107,9 +107,12 @@ static inline void mv_cesa_ahash_dma_cleanup(struct ahash_request *req)
 static inline void mv_cesa_ahash_cleanup(struct ahash_request *req)
 {
 	struct mv_cesa_ahash_req *creq = ahash_request_ctx(req);
+	struct mv_cesa_engine *engine = creq->base.engine;

 	if (mv_cesa_req_get_type(&creq->base) == CESA_DMA_REQ)
 		mv_cesa_ahash_dma_cleanup(req);
+
+	atomic_sub(req->nbytes, &engine->load);
 }

 static void mv_cesa_ahash_last_cleanup(struct ahash_request *req)
@ -363,8 +366,6 @@ static void mv_cesa_ahash_complete(struct crypto_async_request *req)
 			}
 		}
 	}
-
-	atomic_sub(ahashreq->nbytes, &engine->load);
 }

 static void mv_cesa_ahash_prepare(struct crypto_async_request *req,
--- a/drivers/crypto/qat/qat_common/adf_transport_debug.c
+++ b/drivers/crypto/qat/qat_common/adf_transport_debug.c
@ -75,8 +75,10 @@ static void *adf_ring_next(struct seq_file *sfile, void *v, loff_t *pos)
 	struct adf_etr_ring_data *ring = sfile->private;

 	if (*pos >= (ADF_SIZE_TO_RING_SIZE_IN_BYTES(ring->ring_size) /
-		     ADF_MSG_SIZE_TO_BYTES(ring->msg_size)))
+		     ADF_MSG_SIZE_TO_BYTES(ring->msg_size))) {
+		(*pos)++;
 		return NULL;
+	}

 	return ring->base_addr +
 		(ADF_MSG_SIZE_TO_BYTES(ring->msg_size) * (*pos)++);
--- a/drivers/dma/mediatek/mtk-cqdma.c
+++ b/drivers/dma/mediatek/mtk-cqdma.c
@ -421,15 +421,11 @@ static struct virt_dma_desc *mtk_cqdma_find_active_desc(struct dma_chan *c,
 {
 	struct mtk_cqdma_vchan *cvc = to_cqdma_vchan(c);
 	struct virt_dma_desc *vd;
-	unsigned long flags;

-	spin_lock_irqsave(&cvc->pc->lock, flags);
 	list_for_each_entry(vd, &cvc->pc->queue, node)
 		if (vd->tx.cookie == cookie) {
-			spin_unlock_irqrestore(&cvc->pc->lock, flags);
 			return vd;
 		}
-	spin_unlock_irqrestore(&cvc->pc->lock, flags);

 	list_for_each_entry(vd, &cvc->vc.desc_issued, node)
 		if (vd->tx.cookie == cookie)
@ -453,9 +449,11 @@ static enum dma_status mtk_cqdma_tx_status(struct dma_chan *c,
 	if (ret == DMA_COMPLETE || !txstate)
 		return ret;

-	spin_lock_irqsave(&cvc->vc.lock, flags);
+	spin_lock_irqsave(&cvc->pc->lock, flags);
+	spin_lock(&cvc->vc.lock);
 	vd = mtk_cqdma_find_active_desc(c, cookie);
-	spin_unlock_irqrestore(&cvc->vc.lock, flags);
+	spin_unlock(&cvc->vc.lock);
+	spin_unlock_irqrestore(&cvc->pc->lock, flags);

 	if (vd) {
 		cvd = to_cqdma_vdesc(vd);
--- a/drivers/dma/mv_xor.c
+++ b/drivers/dma/mv_xor.c
@ -1061,8 +1061,16 @@ mv_xor_channel_add(struct mv_xor_device *xordev,
 	 */
 	mv_chan->dummy_src_addr = dma_map_single(dma_dev->dev,
 		mv_chan->dummy_src, MV_XOR_MIN_BYTE_COUNT, DMA_FROM_DEVICE);
+	if (dma_mapping_error(dma_dev->dev, mv_chan->dummy_src_addr))
+		return ERR_PTR(-ENOMEM);
+
 	mv_chan->dummy_dst_addr = dma_map_single(dma_dev->dev,
 		mv_chan->dummy_dst, MV_XOR_MIN_BYTE_COUNT, DMA_TO_DEVICE);
+	if (dma_mapping_error(dma_dev->dev, mv_chan->dummy_dst_addr)) {
+		ret = -ENOMEM;
+		goto err_unmap_src;
+	}
+

 	/* allocate coherent memory for hardware descriptors
 	 * note: writecombine gives slightly better performance, but
@ -1071,8 +1079,10 @@ mv_xor_channel_add(struct mv_xor_device *xordev,
 	mv_chan->dma_desc_pool_virt =
 	  dma_alloc_wc(&pdev->dev, MV_XOR_POOL_SIZE, &mv_chan->dma_desc_pool,
 		       GFP_KERNEL);
-	if (!mv_chan->dma_desc_pool_virt)
-		return ERR_PTR(-ENOMEM);
+	if (!mv_chan->dma_desc_pool_virt) {
+		ret = -ENOMEM;
+		goto err_unmap_dst;
+	}

 	/* discover transaction capabilites from the platform data */
 	dma_dev->cap_mask = cap_mask;
@ -1156,6 +1166,13 @@ err_free_irq:
 err_free_dma:
 	dma_free_coherent(&pdev->dev, MV_XOR_POOL_SIZE,
 			  mv_chan->dma_desc_pool_virt, mv_chan->dma_desc_pool);
+err_unmap_dst:
+	dma_unmap_single(dma_dev->dev, mv_chan->dummy_dst_addr,
+			 MV_XOR_MIN_BYTE_COUNT, DMA_TO_DEVICE);
+err_unmap_src:
+	dma_unmap_single(dma_dev->dev, mv_chan->dummy_src_addr,
+			 MV_XOR_MIN_BYTE_COUNT, DMA_FROM_DEVICE);
+
 	return ERR_PTR(ret);
 }

--- a/drivers/dma/nbpfaxi.c
+++ b/drivers/dma/nbpfaxi.c
@ -705,6 +705,9 @@ static int nbpf_desc_page_alloc(struct nbpf_channel *chan)
 		list_add_tail(&ldesc->node, &lhead);
 		ldesc->hwdesc_dma_addr = dma_map_single(dchan->device->dev,
 					hwdesc, sizeof(*hwdesc), DMA_TO_DEVICE);
+		if (dma_mapping_error(dchan->device->dev,
+				      ldesc->hwdesc_dma_addr))
+			goto unmap_error;

 		dev_dbg(dev, "%s(): mapped 0x%p to %pad\n", __func__,
 			hwdesc, &ldesc->hwdesc_dma_addr);
@ -731,6 +734,16 @@ static int nbpf_desc_page_alloc(struct nbpf_channel *chan)
 	spin_unlock_irq(&chan->lock);

 	return ARRAY_SIZE(dpage->desc);
+
+unmap_error:
+	while (i--) {
+		ldesc--; hwdesc--;
+
+		dma_unmap_single(dchan->device->dev, ldesc->hwdesc_dma_addr,
+				 sizeof(hwdesc), DMA_TO_DEVICE);
+	}
+
+	return -ENOMEM;
 }

 static void nbpf_desc_put(struct nbpf_desc *desc)
@ -1349,7 +1362,7 @@ static int nbpf_probe(struct platform_device *pdev)
 	if (irqs == 1) {
 		eirq = irqbuf[0];

-		for (i = 0; i <= num_channels; i++)
+		for (i = 0; i < num_channels; i++)
 			nbpf->chan[i].irq = irqbuf[0];
 	} else {
 		eirq = platform_get_irq_byname(pdev, "error");
@ -1359,16 +1372,15 @@ static int nbpf_probe(struct platform_device *pdev)
 		if (irqs == num_channels + 1) {
 			struct nbpf_channel *chan;

-			for (i = 0, chan = nbpf->chan; i <= num_channels;
+			for (i = 0, chan = nbpf->chan; i < num_channels;
 			     i++, chan++) {
 				/* Skip the error IRQ */
 				if (irqbuf[i] == eirq)
 					i++;
+				if (i >= ARRAY_SIZE(irqbuf))
+					return -EINVAL;
 				chan->irq = irqbuf[i];
 			}
-
-			if (chan != nbpf->chan + num_channels)
-				return -EINVAL;
 		} else {
 			/* 2 IRQs and more than one channel */
 			if (irqbuf[0] == eirq)
@ -1376,7 +1388,7 @@ static int nbpf_probe(struct platform_device *pdev)
 			else
 				irq = irqbuf[0];

-			for (i = 0; i <= num_channels; i++)
+			for (i = 0; i < num_channels; i++)
 				nbpf->chan[i].irq = irq;
 		}
 	}
--- a/drivers/fpga/zynq-fpga.c
+++ b/drivers/fpga/zynq-fpga.c
@ -405,12 +405,12 @@ static int zynq_fpga_ops_write(struct fpga_manager *mgr, struct sg_table *sgt)
 		}
 	}

-	priv->dma_nelms =
-	    dma_map_sg(mgr->dev.parent, sgt->sgl, sgt->nents, DMA_TO_DEVICE);
-	if (priv->dma_nelms == 0) {
+	err = dma_map_sgtable(mgr->dev.parent, sgt, DMA_TO_DEVICE, 0);
+	if (err) {
 		dev_err(&mgr->dev, "Unable to DMA map (TO_DEVICE)\n");
-		return -ENOMEM;
+		return err;
 	}
+	priv->dma_nelms = sgt->nents;

 	/* enable clock */
 	err = clk_enable(priv->clk);
@ -478,7 +478,7 @@ out_clk:
 	clk_disable(priv->clk);

 out_free:
-	dma_unmap_sg(mgr->dev.parent, sgt->sgl, sgt->nents, DMA_TO_DEVICE);
+	dma_unmap_sgtable(mgr->dev.parent, sgt, DMA_TO_DEVICE, 0);
 	return err;
 }

--- a/drivers/gpio/gpio-pca953x.c
+++ b/drivers/gpio/gpio-pca953x.c
@ -1199,6 +1199,9 @@ static int pca953x_suspend(struct device *dev)
 	struct pca953x_chip *chip = dev_get_drvdata(dev);

 	mutex_lock(&chip->i2c_lock);
+	/* Disable IRQ to prevent early triggering while regmap "cache only" is on */
+	if (chip->client->irq > 0)
+		disable_irq(chip->client->irq);
 	regcache_cache_only(chip->regmap, true);
 	mutex_unlock(&chip->i2c_lock);

@ -1224,6 +1227,8 @@ static int pca953x_resume(struct device *dev)
 	}

 	mutex_lock(&chip->i2c_lock);
+	if (chip->client->irq > 0)
+		enable_irq(chip->client->irq);
 	regcache_cache_only(chip->regmap, false);
 	regcache_mark_dirty(chip->regmap);
 	ret = pca953x_regcache_sync(dev);
--- a/drivers/gpio/gpio-tps65912.c
+++ b/drivers/gpio/gpio-tps65912.c
@ -49,10 +49,13 @@ static int tps65912_gpio_direction_output(struct gpio_chip *gc,
 					  unsigned offset, int value)
 {
 	struct tps65912_gpio *gpio = gpiochip_get_data(gc);
+	int ret;

 	/* Set the initial value */
-	regmap_update_bits(gpio->tps->regmap, TPS65912_GPIO1 + offset,
-			   GPIO_SET_MASK, value ? GPIO_SET_MASK : 0);
+	ret = regmap_update_bits(gpio->tps->regmap, TPS65912_GPIO1 + offset,
+				 GPIO_SET_MASK, value ? GPIO_SET_MASK : 0);
+	if (ret)
+		return ret;

 	return regmap_update_bits(gpio->tps->regmap, TPS65912_GPIO1 + offset,
 				  GPIO_CFG_MASK, GPIO_CFG_MASK);
--- a/drivers/gpu/drm/amd/amdgpu/dce_v10_0.c
+++ b/drivers/gpu/drm/amd/amdgpu/dce_v10_0.c
@ -1445,17 +1445,12 @@ static int dce_v10_0_audio_init(struct amdgpu_device *adev)

 static void dce_v10_0_audio_fini(struct amdgpu_device *adev)
 {
-	int i;
-
 	if (!amdgpu_audio)
 		return;

 	if (!adev->mode_info.audio.enabled)
 		return;

-	for (i = 0; i < adev->mode_info.audio.num_pins; i++)
-		dce_v10_0_audio_enable(adev, &adev->mode_info.audio.pin[i], false);
-
 	adev->mode_info.audio.enabled = false;
 }

--- a/drivers/gpu/drm/amd/amdgpu/dce_v11_0.c
+++ b/drivers/gpu/drm/amd/amdgpu/dce_v11_0.c
@ -1487,17 +1487,12 @@ static int dce_v11_0_audio_init(struct amdgpu_device *adev)

 static void dce_v11_0_audio_fini(struct amdgpu_device *adev)
 {
-	int i;
-
 	if (!amdgpu_audio)
 		return;

 	if (!adev->mode_info.audio.enabled)
 		return;

-	for (i = 0; i < adev->mode_info.audio.num_pins; i++)
-		dce_v11_0_audio_enable(adev, &adev->mode_info.audio.pin[i], false);
-
 	adev->mode_info.audio.enabled = false;
 }

--- a/drivers/gpu/drm/amd/amdgpu/dce_v6_0.c
+++ b/drivers/gpu/drm/amd/amdgpu/dce_v6_0.c
@ -1358,17 +1358,12 @@ static int dce_v6_0_audio_init(struct amdgpu_device *adev)

 static void dce_v6_0_audio_fini(struct amdgpu_device *adev)
 {
-	int i;
-
 	if (!amdgpu_audio)
 		return;

 	if (!adev->mode_info.audio.enabled)
 		return;

-	for (i = 0; i < adev->mode_info.audio.num_pins; i++)
-		dce_v6_0_audio_enable(adev, &adev->mode_info.audio.pin[i], false);
-
 	adev->mode_info.audio.enabled = false;
 }

--- a/drivers/gpu/drm/amd/amdgpu/dce_v8_0.c
+++ b/drivers/gpu/drm/amd/amdgpu/dce_v8_0.c
@ -1408,17 +1408,12 @@ static int dce_v8_0_audio_init(struct amdgpu_device *adev)

 static void dce_v8_0_audio_fini(struct amdgpu_device *adev)
 {
-	int i;
-
 	if (!amdgpu_audio)
 		return;

 	if (!adev->mode_info.audio.enabled)
 		return;

-	for (i = 0; i < adev->mode_info.audio.num_pins; i++)
-		dce_v8_0_audio_enable(adev, &adev->mode_info.audio.pin[i], false);
-
 	adev->mode_info.audio.enabled = false;
 }

--- a/drivers/gpu/drm/amd/display/dc/bios/command_table.c
+++ b/drivers/gpu/drm/amd/display/dc/bios/command_table.c
@ -992,7 +992,7 @@ static enum bp_result set_pixel_clock_v3(
 	allocation.sPCLKInput.usFbDiv =
 			cpu_to_le16((uint16_t)bp_params->feedback_divider);
 	allocation.sPCLKInput.ucFracFbDiv =
-			(uint8_t)bp_params->fractional_feedback_divider;
+			(uint8_t)(bp_params->fractional_feedback_divider / 100000);
 	allocation.sPCLKInput.ucPostDiv =
 			(uint8_t)bp_params->pixel_clock_post_divider;

--- a/drivers/gpu/drm/amd/display/dc/clk_mgr/dce110/dce110_clk_mgr.c
+++ b/drivers/gpu/drm/amd/display/dc/clk_mgr/dce110/dce110_clk_mgr.c
@ -120,9 +120,12 @@ void dce110_fill_display_configs(
 	const struct dc_state *context,
 	struct dm_pp_display_configuration *pp_display_cfg)
 {
+	struct dc *dc = context->clk_mgr->ctx->dc;
 	int j;
 	int num_cfgs = 0;

+	pp_display_cfg->crtc_index = dc->res_pool->res_cap->num_timing_generator;
+
 	for (j = 0; j < context->stream_count; j++) {
 		int k;

@ -164,6 +167,23 @@ void dce110_fill_display_configs(
 		cfg->v_refresh /= stream->timing.h_total;
 		cfg->v_refresh = (cfg->v_refresh + stream->timing.v_total / 2)
 							/ stream->timing.v_total;
+
+		/* Find first CRTC index and calculate its line time.
+		 * This is necessary for DPM on SI GPUs.
+		 */
+		if (cfg->pipe_idx < pp_display_cfg->crtc_index) {
+			const struct dc_crtc_timing *timing =
+				&context->streams[0]->timing;
+
+			pp_display_cfg->crtc_index = cfg->pipe_idx;
+			pp_display_cfg->line_time_in_us =
+				timing->h_total * 10000 / timing->pix_clk_100hz;
+		}
+	}
+
+	if (!num_cfgs) {
+		pp_display_cfg->crtc_index = 0;
+		pp_display_cfg->line_time_in_us = 0;
 	}

 	pp_display_cfg->display_count = num_cfgs;
@ -231,16 +251,6 @@ void dce11_pplib_apply_display_requirements(

 	dce110_fill_display_configs(context, pp_display_cfg);

-	/* TODO: is this still applicable?*/
-	if (pp_display_cfg->display_count == 1) {
-		const struct dc_crtc_timing *timing =
-			&context->streams[0]->timing;
-
-		pp_display_cfg->crtc_index =
-			pp_display_cfg->disp_configs[0].pipe_idx;
-		pp_display_cfg->line_time_in_us = timing->h_total * 10000 / timing->pix_clk_100hz;
-	}
-
 	if (memcmp(&dc->current_state->pp_display_cfg, pp_display_cfg, sizeof(*pp_display_cfg)) !=  0)
 		dm_pp_apply_display_requirements(dc->ctx, pp_display_cfg);
 }
--- a/drivers/gpu/drm/amd/powerplay/hwmgr/smu_helper.c
+++ b/drivers/gpu/drm/amd/powerplay/hwmgr/smu_helper.c
@ -148,7 +148,7 @@ int phm_wait_on_indirect_register(struct pp_hwmgr *hwmgr,
 	}

 	cgs_write_register(hwmgr->device, indirect_port, index);
-	return phm_wait_on_register(hwmgr, indirect_port + 1, mask, value);
+	return phm_wait_on_register(hwmgr, indirect_port + 1, value, mask);
 }

 int phm_wait_for_register_unequal(struct pp_hwmgr *hwmgr,
--- a/drivers/gpu/drm/scheduler/sched_entity.c
+++ b/drivers/gpu/drm/scheduler/sched_entity.c
@ -327,19 +327,6 @@ void drm_sched_entity_destroy(struct drm_sched_entity *entity)
 }
 EXPORT_SYMBOL(drm_sched_entity_destroy);

-/**
- * drm_sched_entity_clear_dep - callback to clear the entities dependency
- */
-static void drm_sched_entity_clear_dep(struct dma_fence *f,
-				       struct dma_fence_cb *cb)
-{
-	struct drm_sched_entity *entity =
-		container_of(cb, struct drm_sched_entity, cb);
-
-	entity->dependency = NULL;
-	dma_fence_put(f);
-}
-
 /**
 * drm_sched_entity_clear_dep - callback to clear the entities dependency and
 * wake up scheduler
@ -350,7 +337,8 @@ static void drm_sched_entity_wakeup(struct dma_fence *f,
 	struct drm_sched_entity *entity =
 		container_of(cb, struct drm_sched_entity, cb);

-	drm_sched_entity_clear_dep(f, cb);
+	entity->dependency = NULL;
+	dma_fence_put(f);
 	drm_sched_wakeup(entity->rq->sched);
 }

@ -426,13 +414,6 @@ static bool drm_sched_entity_add_dependency_cb(struct drm_sched_entity *entity)
 		fence = dma_fence_get(&s_fence->scheduled);
 		dma_fence_put(entity->dependency);
 		entity->dependency = fence;
-		if (!dma_fence_add_callback(fence, &entity->cb,
-					    drm_sched_entity_clear_dep))
-			return true;
-
-		/* Ignore it when it is already scheduled */
-		dma_fence_put(fence);
-		return false;
 	}

 	if (!dma_fence_add_callback(entity->dependency, &entity->cb,
--- a/drivers/hid/hid-asus.c
+++ b/drivers/hid/hid-asus.c
@ -1035,7 +1035,13 @@ static int asus_probe(struct hid_device *hdev, const struct hid_device_id *id)
 		return ret;
 	}

-	if (!drvdata->input) {
+	/*
+	 * Check that input registration succeeded. Checking that
+	 * HID_CLAIMED_INPUT is set prevents a UAF when all input devices
+	 * were freed during registration due to no usages being mapped,
+	 * leaving drvdata->input pointing to freed memory.
+	 */
+	if (!drvdata->input || !(hdev->claimed & HID_CLAIMED_INPUT)) {
 		hid_err(hdev, "Asus input not registered\n");
 		ret = -ENOMEM;
 		goto err_stop_hw;
--- a/drivers/hid/hid-core.c
+++ b/drivers/hid/hid-core.c
@ -1649,9 +1649,12 @@ u8 *hid_alloc_report_buf(struct hid_report *report, gfp_t flags)
 	/*
 	 * 7 extra bytes are necessary to achieve proper functionality
 	 * of implement() working on 8 byte chunks
+	 * 1 extra byte for the report ID if it is null (not used) so
+	 * we can reserve that extra byte in the first position of the buffer
+	 * when sending it to .raw_request()
 	 */

-	u32 len = hid_report_len(report) + 7;
+	u32 len = hid_report_len(report) + 7 + (report->id == 0);

 	return kzalloc(len, flags);
 }
@ -1714,7 +1717,7 @@ static struct hid_report *hid_get_report(struct hid_report_enum *report_enum,
 int __hid_request(struct hid_device *hid, struct hid_report *report,
 		int reqtype)
 {
-	char *buf;
+	char *buf, *data_buf;
 	int ret;
 	u32 len;

@ -1722,13 +1725,19 @@ int __hid_request(struct hid_device *hid, struct hid_report *report,
 	if (!buf)
 		return -ENOMEM;

+	data_buf = buf;
 	len = hid_report_len(report);

-	if (reqtype == HID_REQ_SET_REPORT)
-		hid_output_report(report, buf);
+	if (report->id == 0) {
+		/* reserve the first byte for the report ID */
+		data_buf++;
+		len++;
+	}

-	ret = hid->ll_driver->raw_request(hid, report->id, buf, len,
-					  report->type, reqtype);
+	if (reqtype == HID_REQ_SET_REPORT)
+		hid_output_report(report, data_buf);
+
+	ret = hid_hw_raw_request(hid, report->id, buf, len, report->type, reqtype);
 	if (ret < 0) {
 		dbg_hid("unable to complete request: %d\n", ret);
 		goto out;
--- a/drivers/hid/hid-ntrig.c
+++ b/drivers/hid/hid-ntrig.c
@ -144,6 +144,9 @@ static void ntrig_report_version(struct hid_device *hdev)
 	struct usb_device *usb_dev = hid_to_usb_dev(hdev);
 	unsigned char *data = kmalloc(8, GFP_KERNEL);

+	if (!hid_is_usb(hdev))
+		return;
+
 	if (!data)
 		goto err_free;

--- a/drivers/hid/wacom_wac.c
+++ b/drivers/hid/wacom_wac.c
@ -684,6 +684,7 @@ static bool wacom_is_art_pen(int tool_id)
 	case 0x885:	/* Intuos3 Marker Pen */
 	case 0x804:	/* Intuos4/5 13HD/24HD Marker Pen */
 	case 0x10804:	/* Intuos4/5 13HD/24HD Art Pen */
+	case 0x204:     /* Art Pen 2 */
 		is_art_pen = true;
 		break;
 	}
--- a/drivers/i2c/busses/i2c-qup.c
+++ b/drivers/i2c/busses/i2c-qup.c
@ -449,8 +449,10 @@ static int qup_i2c_bus_active(struct qup_i2c_dev *qup, int len)
 		if (!(status & I2C_STATUS_BUS_ACTIVE))
 			break;

-		if (time_after(jiffies, timeout))
+		if (time_after(jiffies, timeout)) {
 			ret = -ETIMEDOUT;
+			break;
+		}

 		usleep_range(len, len * 2);
 	}
--- a/drivers/i2c/busses/i2c-stm32.c
+++ b/drivers/i2c/busses/i2c-stm32.c
@ -98,7 +98,6 @@ int stm32_i2c_prep_dma_xfer(struct device *dev, struct stm32_i2c_dma *dma,
 			    void *dma_async_param)
 {
 	struct dma_async_tx_descriptor *txdesc;
-	struct device *chan_dev;
 	int ret;

 	if (rd_wr) {
@ -112,11 +111,10 @@ int stm32_i2c_prep_dma_xfer(struct device *dev, struct stm32_i2c_dma *dma,
 	}

 	dma->dma_len = len;
-	chan_dev = dma->chan_using->device->dev;

-	dma->dma_buf = dma_map_single(chan_dev, buf, dma->dma_len,
+	dma->dma_buf = dma_map_single(dev, buf, dma->dma_len,
 				      dma->dma_data_dir);
-	if (dma_mapping_error(chan_dev, dma->dma_buf)) {
+	if (dma_mapping_error(dev, dma->dma_buf)) {
 		dev_err(dev, "DMA mapping failed\n");
 		return -EINVAL;
 	}
@ -146,7 +144,7 @@ int stm32_i2c_prep_dma_xfer(struct device *dev, struct stm32_i2c_dma *dma,
 	return 0;

 err:
-	dma_unmap_single(chan_dev, dma->dma_buf, dma->dma_len,
+	dma_unmap_single(dev, dma->dma_buf, dma->dma_len,
 			 dma->dma_data_dir);
 	return ret;
 }
--- a/drivers/i2c/busses/i2c-stm32f7.c
+++ b/drivers/i2c/busses/i2c-stm32f7.c
@ -632,10 +632,10 @@ static void stm32f7_i2c_dma_callback(void *arg)
 {
 	struct stm32f7_i2c_dev *i2c_dev = (struct stm32f7_i2c_dev *)arg;
 	struct stm32_i2c_dma *dma = i2c_dev->dma;
-	struct device *dev = dma->chan_using->device->dev;

 	stm32f7_i2c_disable_dma_req(i2c_dev);
-	dma_unmap_single(dev, dma->dma_buf, dma->dma_len, dma->dma_data_dir);
+	dma_unmap_single(i2c_dev->dev, dma->dma_buf, dma->dma_len,
+			 dma->dma_data_dir);
 	complete(&dma->dma_complete);
 }

--- a/drivers/i3c/internals.h
+++ b/drivers/i3c/internals.h
@ -9,6 +9,7 @@
 #define I3C_INTERNALS_H

 #include <linux/i3c/master.h>
+#include <linux/io.h>

 extern struct bus_type i3c_bus_type;

--- a/drivers/i3c/master.c
+++ b/drivers/i3c/master.c
@ -1243,7 +1243,7 @@ static int i3c_master_retrieve_dev_info(struct i3c_dev_desc *dev)

 	if (dev->info.bcr & I3C_BCR_HDR_CAP) {
 		ret = i3c_master_gethdrcap_locked(master, &dev->info);
-		if (ret)
+		if (ret && ret != -ENOTSUPP)
 			return ret;
 	}

--- a/drivers/iio/adc/max1363.c
+++ b/drivers/iio/adc/max1363.c
@ -505,10 +505,10 @@ static const struct iio_event_spec max1363_events[] = {
 	MAX1363_CHAN_U(1, _s1, 1, bits, ev_spec, num_ev_spec),		\
 	MAX1363_CHAN_U(2, _s2, 2, bits, ev_spec, num_ev_spec),		\
 	MAX1363_CHAN_U(3, _s3, 3, bits, ev_spec, num_ev_spec),		\
-	MAX1363_CHAN_B(0, 1, d0m1, 4, bits, ev_spec, num_ev_spec),	\
-	MAX1363_CHAN_B(2, 3, d2m3, 5, bits, ev_spec, num_ev_spec),	\
-	MAX1363_CHAN_B(1, 0, d1m0, 6, bits, ev_spec, num_ev_spec),	\
-	MAX1363_CHAN_B(3, 2, d3m2, 7, bits, ev_spec, num_ev_spec),	\
+	MAX1363_CHAN_B(0, 1, d0m1, 12, bits, ev_spec, num_ev_spec),	\
+	MAX1363_CHAN_B(2, 3, d2m3, 13, bits, ev_spec, num_ev_spec),	\
+	MAX1363_CHAN_B(1, 0, d1m0, 18, bits, ev_spec, num_ev_spec),	\
+	MAX1363_CHAN_B(3, 2, d3m2, 19, bits, ev_spec, num_ev_spec),	\
 	IIO_CHAN_SOFT_TIMESTAMP(8)					\
 	}

@ -526,23 +526,23 @@ static const struct iio_chan_spec max1363_channels[] =
 /* Applies to max1236, max1237 */
 static const enum max1363_modes max1236_mode_list[] = {
 	_s0, _s1, _s2, _s3,
-	s0to1, s0to2, s0to3,
+	s0to1, s0to2, s2to3, s0to3,
 	d0m1, d2m3, d1m0, d3m2,
 	d0m1to2m3, d1m0to3m2,
-	s2to3,
 };

 /* Applies to max1238, max1239 */
 static const enum max1363_modes max1238_mode_list[] = {
 	_s0, _s1, _s2, _s3, _s4, _s5, _s6, _s7, _s8, _s9, _s10, _s11,
 	s0to1, s0to2, s0to3, s0to4, s0to5, s0to6,
+	s6to7, s6to8, s6to9, s6to10, s6to11,
 	s0to7, s0to8, s0to9, s0to10, s0to11,
 	d0m1, d2m3, d4m5, d6m7, d8m9, d10m11,
 	d1m0, d3m2, d5m4, d7m6, d9m8, d11m10,
-	d0m1to2m3, d0m1to4m5, d0m1to6m7, d0m1to8m9, d0m1to10m11,
-	d1m0to3m2, d1m0to5m4, d1m0to7m6, d1m0to9m8, d1m0to11m10,
-	s6to7, s6to8, s6to9, s6to10, s6to11,
-	d6m7to8m9, d6m7to10m11, d7m6to9m8, d7m6to11m10,
+	d0m1to2m3, d0m1to4m5, d0m1to6m7, d6m7to8m9,
+	d0m1to8m9, d6m7to10m11, d0m1to10m11, d1m0to3m2,
+	d1m0to5m4, d1m0to7m6, d7m6to9m8, d1m0to9m8,
+	d7m6to11m10, d1m0to11m10,
 };

 #define MAX1363_12X_CHANS(bits) {				\
@ -578,16 +578,15 @@ static const struct iio_chan_spec max1238_channels[] = MAX1363_12X_CHANS(12);

 static const enum max1363_modes max11607_mode_list[] = {
 	_s0, _s1, _s2, _s3,
-	s0to1, s0to2, s0to3,
-	s2to3,
+	s0to1, s0to2, s2to3,
+	s0to3,
 	d0m1, d2m3, d1m0, d3m2,
 	d0m1to2m3, d1m0to3m2,
 };

 static const enum max1363_modes max11608_mode_list[] = {
 	_s0, _s1, _s2, _s3, _s4, _s5, _s6, _s7,
-	s0to1, s0to2, s0to3, s0to4, s0to5, s0to6, s0to7,
-	s6to7,
+	s0to1, s0to2, s0to3, s0to4, s0to5, s0to6, s6to7, s0to7,
 	d0m1, d2m3, d4m5, d6m7,
 	d1m0, d3m2, d5m4, d7m6,
 	d0m1to2m3, d0m1to4m5, d0m1to6m7,
@ -603,14 +602,14 @@ static const enum max1363_modes max11608_mode_list[] = {
 	MAX1363_CHAN_U(5, _s5, 5, bits, NULL, 0),	\
 	MAX1363_CHAN_U(6, _s6, 6, bits, NULL, 0),	\
 	MAX1363_CHAN_U(7, _s7, 7, bits, NULL, 0),	\
-	MAX1363_CHAN_B(0, 1, d0m1, 8, bits, NULL, 0),	\
-	MAX1363_CHAN_B(2, 3, d2m3, 9, bits, NULL, 0),	\
-	MAX1363_CHAN_B(4, 5, d4m5, 10, bits, NULL, 0),	\
-	MAX1363_CHAN_B(6, 7, d6m7, 11, bits, NULL, 0),	\
-	MAX1363_CHAN_B(1, 0, d1m0, 12, bits, NULL, 0),	\
-	MAX1363_CHAN_B(3, 2, d3m2, 13, bits, NULL, 0),	\
-	MAX1363_CHAN_B(5, 4, d5m4, 14, bits, NULL, 0),	\
-	MAX1363_CHAN_B(7, 6, d7m6, 15, bits, NULL, 0),	\
+	MAX1363_CHAN_B(0, 1, d0m1, 12, bits, NULL, 0),	\
+	MAX1363_CHAN_B(2, 3, d2m3, 13, bits, NULL, 0),	\
+	MAX1363_CHAN_B(4, 5, d4m5, 14, bits, NULL, 0),	\
+	MAX1363_CHAN_B(6, 7, d6m7, 15, bits, NULL, 0),	\
+	MAX1363_CHAN_B(1, 0, d1m0, 18, bits, NULL, 0),	\
+	MAX1363_CHAN_B(3, 2, d3m2, 19, bits, NULL, 0),	\
+	MAX1363_CHAN_B(5, 4, d5m4, 20, bits, NULL, 0),	\
+	MAX1363_CHAN_B(7, 6, d7m6, 21, bits, NULL, 0),	\
 	IIO_CHAN_SOFT_TIMESTAMP(16)			\
 }
 static const struct iio_chan_spec max11602_channels[] = MAX1363_8X_CHANS(8);
--- a/drivers/iio/adc/stm32-adc-core.c
+++ b/drivers/iio/adc/stm32-adc-core.c
@ -393,10 +393,9 @@ static int stm32_adc_irq_probe(struct platform_device *pdev,
 		return -ENOMEM;
 	}

-	for (i = 0; i < priv->cfg->num_irqs; i++) {
-		irq_set_chained_handler(priv->irq[i], stm32_adc_irq_handler);
-		irq_set_handler_data(priv->irq[i], priv);
-	}
+	for (i = 0; i < priv->cfg->num_irqs; i++)
+		irq_set_chained_handler_and_data(priv->irq[i],
+						 stm32_adc_irq_handler, priv);

 	return 0;
 }
--- a/drivers/iio/chemical/pms7003.c
+++ b/drivers/iio/chemical/pms7003.c
@ -5,7 +5,6 @@
 * Copyright (c) Tomasz Duszynski <tduszyns@gmail.com>
 */

-#include <asm/unaligned.h>
 #include <linux/completion.h>
 #include <linux/device.h>
 #include <linux/errno.h>
@ -19,6 +18,8 @@
 #include <linux/module.h>
 #include <linux/mutex.h>
 #include <linux/serdev.h>
+#include <linux/types.h>
+#include <asm/unaligned.h>

 #define PMS7003_DRIVER_NAME "pms7003"

@ -76,7 +77,7 @@ struct pms7003_state {
 	/* Used to construct scan to push to the IIO buffer */
 	struct {
 		u16 data[3]; /* PM1, PM2P5, PM10 */
-		s64 ts;
+		aligned_s64 ts;
 	} scan;
 };

--- a/drivers/iio/light/hid-sensor-prox.c
+++ b/drivers/iio/light/hid-sensor-prox.c
@ -103,8 +103,7 @@ static int prox_read_raw(struct iio_dev *indio_dev,
 		ret_type = prox_state->scale_precision;
 		break;
 	case IIO_CHAN_INFO_OFFSET:
-		*val = hid_sensor_convert_exponent(
-				prox_state->prox_attr.unit_expo);
+		*val = 0;
 		ret_type = IIO_VAL_INT;
 		break;
 	case IIO_CHAN_INFO_SAMP_FREQ:
--- a/drivers/iio/light/opt3001.c
+++ b/drivers/iio/light/opt3001.c
@ -691,8 +691,9 @@ static irqreturn_t opt3001_irq(int irq, void *_iio)
 	struct opt3001 *opt = iio_priv(iio);
 	int ret;
 	bool wake_result_ready_queue = false;
+	bool ok_to_ignore_lock = opt->ok_to_ignore_lock;

-	if (!opt->ok_to_ignore_lock)
+	if (!ok_to_ignore_lock)
 		mutex_lock(&opt->lock);

 	ret = i2c_smbus_read_word_swapped(opt->client, OPT3001_CONFIGURATION);
@ -729,7 +730,7 @@ static irqreturn_t opt3001_irq(int irq, void *_iio)
 	}

 out:
-	if (!opt->ok_to_ignore_lock)
+	if (!ok_to_ignore_lock)
 		mutex_unlock(&opt->lock);

 	if (wake_result_ready_queue)
--- a/drivers/iio/proximity/isl29501.c
+++ b/drivers/iio/proximity/isl29501.c
@ -938,12 +938,18 @@ static irqreturn_t isl29501_trigger_handler(int irq, void *p)
 	struct iio_dev *indio_dev = pf->indio_dev;
 	struct isl29501_private *isl29501 = iio_priv(indio_dev);
 	const unsigned long *active_mask = indio_dev->active_scan_mask;
-	u32 buffer[4] __aligned(8) = {}; /* 1x16-bit + naturally aligned ts */
+	u32 value;
+	struct {
+		u16 data;
+		aligned_s64 ts;
+	} scan = { };

-	if (test_bit(ISL29501_DISTANCE_SCAN_INDEX, active_mask))
-		isl29501_register_read(isl29501, REG_DISTANCE, buffer);
+	if (test_bit(ISL29501_DISTANCE_SCAN_INDEX, active_mask)) {
+		isl29501_register_read(isl29501, REG_DISTANCE, &value);
+		scan.data = value;
+	}

-	iio_push_to_buffers_with_timestamp(indio_dev, buffer, pf->timestamp);
+	iio_push_to_buffers_with_timestamp(indio_dev, &scan, pf->timestamp);
 	iio_trigger_notify_done(indio_dev->trig);

 	return IRQ_HANDLED;
--- a/drivers/infiniband/core/cache.c
+++ b/drivers/infiniband/core/cache.c
@ -578,8 +578,8 @@ static int __ib_cache_gid_add(struct ib_device *ib_dev, u8 port,
 out_unlock:
 	mutex_unlock(&table->lock);
 	if (ret)
-		pr_warn("%s: unable to add gid %pI6 error=%d\n",
-			__func__, gid->raw, ret);
+		pr_warn_ratelimited("%s: unable to add gid %pI6 error=%d\n",
+				    __func__, gid->raw, ret);
 	return ret;
 }

--- a/drivers/infiniband/hw/hfi1/affinity.c
+++ b/drivers/infiniband/hw/hfi1/affinity.c
@ -1009,31 +1009,35 @@ static void find_hw_thread_mask(uint hw_thread_no, cpumask_var_t hw_thread_mask,
 				struct hfi1_affinity_node_list *affinity)
 {
 	int possible, curr_cpu, i;
-	uint num_cores_per_socket = node_affinity.num_online_cpus /
+	uint num_cores_per_socket;
+
+	cpumask_copy(hw_thread_mask, &affinity->proc.mask);
+
+	if (affinity->num_core_siblings == 0)
+		return;
+
+	num_cores_per_socket = node_affinity.num_online_cpus /
 					affinity->num_core_siblings /
 						node_affinity.num_online_nodes;

-	cpumask_copy(hw_thread_mask, &affinity->proc.mask);
-	if (affinity->num_core_siblings > 0) {
-		/* Removing other siblings not needed for now */
-		possible = cpumask_weight(hw_thread_mask);
-		curr_cpu = cpumask_first(hw_thread_mask);
-		for (i = 0;
-		     i < num_cores_per_socket * node_affinity.num_online_nodes;
-		     i++)
-			curr_cpu = cpumask_next(curr_cpu, hw_thread_mask);
+	/* Removing other siblings not needed for now */
+	possible = cpumask_weight(hw_thread_mask);
+	curr_cpu = cpumask_first(hw_thread_mask);
+	for (i = 0;
+	     i < num_cores_per_socket * node_affinity.num_online_nodes;
+	     i++)
+		curr_cpu = cpumask_next(curr_cpu, hw_thread_mask);

-		for (; i < possible; i++) {
-			cpumask_clear_cpu(curr_cpu, hw_thread_mask);
-			curr_cpu = cpumask_next(curr_cpu, hw_thread_mask);
-		}
-
-		/* Identifying correct HW threads within physical cores */
-		cpumask_shift_left(hw_thread_mask, hw_thread_mask,
-				   num_cores_per_socket *
-				   node_affinity.num_online_nodes *
-				   hw_thread_no);
+	for (; i < possible; i++) {
+		cpumask_clear_cpu(curr_cpu, hw_thread_mask);
+		curr_cpu = cpumask_next(curr_cpu, hw_thread_mask);
 	}
+
+	/* Identifying correct HW threads within physical cores */
+	cpumask_shift_left(hw_thread_mask, hw_thread_mask,
+			   num_cores_per_socket *
+			   node_affinity.num_online_nodes *
+			   hw_thread_no);
 }

 int hfi1_get_proc_affinity(int node)
--- a/drivers/input/joystick/xpad.c
+++ b/drivers/input/joystick/xpad.c
@ -142,12 +142,12 @@ static const struct xpad_device {
 	{ 0x046d, 0xca88, "Logitech Compact Controller for Xbox", 0, XTYPE_XBOX },
 	{ 0x046d, 0xca8a, "Logitech Precision Vibration Feedback Wheel", 0, XTYPE_XBOX },
 	{ 0x046d, 0xcaa3, "Logitech DriveFx Racing Wheel", 0, XTYPE_XBOX360 },
+	{ 0x0502, 0x1305, "Acer NGR200", 0, XTYPE_XBOX360 },
 	{ 0x056e, 0x2004, "Elecom JC-U3613M", 0, XTYPE_XBOX360 },
 	{ 0x05fd, 0x1007, "Mad Catz Controller (unverified)", 0, XTYPE_XBOX },
 	{ 0x05fd, 0x107a, "InterAct 'PowerPad Pro' X-Box pad (Germany)", 0, XTYPE_XBOX },
 	{ 0x05fe, 0x3030, "Chic Controller", 0, XTYPE_XBOX },
 	{ 0x05fe, 0x3031, "Chic Controller", 0, XTYPE_XBOX },
-	{ 0x0502, 0x1305, "Acer NGR200", 0, XTYPE_XBOX },
 	{ 0x062a, 0x0020, "Logic3 Xbox GamePad", 0, XTYPE_XBOX },
 	{ 0x062a, 0x0033, "Competition Pro Steering Wheel", 0, XTYPE_XBOX },
 	{ 0x06a3, 0x0200, "Saitek Racing Wheel", 0, XTYPE_XBOX },
--- a/drivers/isdn/mISDN/dsp_hwec.c
+++ b/drivers/isdn/mISDN/dsp_hwec.c
@ -51,14 +51,14 @@ void dsp_hwec_enable(struct dsp *dsp, const char *arg)
 		goto _do;

 	{
-		char *dup, *tok, *name, *val;
+		char *dup, *next, *tok, *name, *val;
 		int tmp;

-		dup = kstrdup(arg, GFP_ATOMIC);
+		dup = next = kstrdup(arg, GFP_ATOMIC);
 		if (!dup)
 			return;

-		while ((tok = strsep(&dup, ","))) {
+		while ((tok = strsep(&next, ","))) {
 			if (!strlen(tok))
 				continue;
 			name = strsep(&tok, "=");
--- a/drivers/media/dvb-frontends/dib7000p.c
+++ b/drivers/media/dvb-frontends/dib7000p.c
@ -2198,6 +2198,8 @@ static int w7090p_tuner_write_serpar(struct i2c_adapter *i2c_adap, struct i2c_ms
 	struct dib7000p_state *state = i2c_get_adapdata(i2c_adap);
 	u8 n_overflow = 1;
 	u16 i = 1000;
+	if (msg[0].len < 3)
+		return -EOPNOTSUPP;
 	u16 serpar_num = msg[0].buf[0];

 	while (n_overflow == 1 && i) {
@ -2217,6 +2219,8 @@ static int w7090p_tuner_read_serpar(struct i2c_adapter *i2c_adap, struct i2c_msg
 	struct dib7000p_state *state = i2c_get_adapdata(i2c_adap);
 	u8 n_overflow = 1, n_empty = 1;
 	u16 i = 1000;
+	if (msg[0].len < 1 || msg[1].len < 2)
+		return -EOPNOTSUPP;
 	u16 serpar_num = msg[0].buf[0];
 	u16 read_word;

@ -2261,8 +2265,12 @@ static int dib7090p_rw_on_apb(struct i2c_adapter *i2c_adap,
 	u16 word;

 	if (num == 1) {		/* write */
+		if (msg[0].len < 3)
+			return -EOPNOTSUPP;
 		dib7000p_write_word(state, apb_address, ((msg[0].buf[1] << 8) | (msg[0].buf[2])));
 	} else {
+		if (msg[1].len < 2)
+			return -EOPNOTSUPP;
 		word = dib7000p_read_word(state, apb_address);
 		msg[1].buf[0] = (word >> 8) & 0xff;
 		msg[1].buf[1] = (word) & 0xff;
--- a/drivers/media/i2c/ov2659.c
+++ b/drivers/media/i2c/ov2659.c
@ -1432,14 +1432,15 @@ static int ov2659_probe(struct i2c_client *client)
 				     V4L2_CID_TEST_PATTERN,
 				     ARRAY_SIZE(ov2659_test_pattern_menu) - 1,
 				     0, 0, ov2659_test_pattern_menu);
-	ov2659->sd.ctrl_handler = &ov2659->ctrls;

 	if (ov2659->ctrls.error) {
 		dev_err(&client->dev, "%s: control initialization error %d\n",
 			__func__, ov2659->ctrls.error);
+		v4l2_ctrl_handler_free(&ov2659->ctrls);
 		return  ov2659->ctrls.error;
 	}

+	ov2659->sd.ctrl_handler = &ov2659->ctrls;
 	sd = &ov2659->sd;
 	client->flags |= I2C_CLIENT_SCCB;
 #ifdef CONFIG_VIDEO_V4L2_SUBDEV_API
--- a/drivers/media/i2c/tc358743.c
+++ b/drivers/media/i2c/tc358743.c
@ -110,7 +110,7 @@ static inline struct tc358743_state *to_state(struct v4l2_subdev *sd)

 /* --------------- I2C --------------- */

-static void i2c_rd(struct v4l2_subdev *sd, u16 reg, u8 *values, u32 n)
+static int i2c_rd(struct v4l2_subdev *sd, u16 reg, u8 *values, u32 n)
 {
 	struct tc358743_state *state = to_state(sd);
 	struct i2c_client *client = state->i2c_client;
@ -136,6 +136,7 @@ static void i2c_rd(struct v4l2_subdev *sd, u16 reg, u8 *values, u32 n)
 		v4l2_err(sd, "%s: reading register 0x%x from 0x%x failed\n",
 				__func__, reg, client->addr);
 	}
+	return err != ARRAY_SIZE(msgs);
 }

 static void i2c_wr(struct v4l2_subdev *sd, u16 reg, u8 *values, u32 n)
@ -192,15 +193,24 @@ static void i2c_wr(struct v4l2_subdev *sd, u16 reg, u8 *values, u32 n)
 	}
 }

-static noinline u32 i2c_rdreg(struct v4l2_subdev *sd, u16 reg, u32 n)
+static noinline u32 i2c_rdreg_err(struct v4l2_subdev *sd, u16 reg, u32 n,
+				  int *err)
 {
+	int error;
 	__le32 val = 0;

-	i2c_rd(sd, reg, (u8 __force *)&val, n);
+	error = i2c_rd(sd, reg, (u8 __force *)&val, n);
+	if (err)
+		*err = error;

 	return le32_to_cpu(val);
 }

+static inline u32 i2c_rdreg(struct v4l2_subdev *sd, u16 reg, u32 n)
+{
+	return i2c_rdreg_err(sd, reg, n, NULL);
+}
+
 static noinline void i2c_wrreg(struct v4l2_subdev *sd, u16 reg, u32 val, u32 n)
 {
 	__le32 raw = cpu_to_le32(val);
@ -229,6 +239,13 @@ static u16 i2c_rd16(struct v4l2_subdev *sd, u16 reg)
 	return i2c_rdreg(sd, reg, 2);
 }

+static int i2c_rd16_err(struct v4l2_subdev *sd, u16 reg, u16 *value)
+{
+	int err;
+	*value = i2c_rdreg_err(sd, reg, 2, &err);
+	return err;
+}
+
 static void i2c_wr16(struct v4l2_subdev *sd, u16 reg, u16 val)
 {
 	i2c_wrreg(sd, reg, val, 2);
@ -1668,12 +1685,23 @@ static int tc358743_enum_mbus_code(struct v4l2_subdev *sd,
 	return 0;
 }

+static u32 tc358743_g_colorspace(u32 code)
+{
+	switch (code) {
+	case MEDIA_BUS_FMT_RGB888_1X24:
+		return V4L2_COLORSPACE_SRGB;
+	case MEDIA_BUS_FMT_UYVY8_1X16:
+		return V4L2_COLORSPACE_SMPTE170M;
+	default:
+		return 0;
+	}
+}
+
 static int tc358743_get_fmt(struct v4l2_subdev *sd,
 		struct v4l2_subdev_pad_config *cfg,
 		struct v4l2_subdev_format *format)
 {
 	struct tc358743_state *state = to_state(sd);
-	u8 vi_rep = i2c_rd8(sd, VI_REP);

 	if (format->pad != 0)
 		return -EINVAL;
@ -1683,23 +1711,7 @@ static int tc358743_get_fmt(struct v4l2_subdev *sd,
 	format->format.height = state->timings.bt.height;
 	format->format.field = V4L2_FIELD_NONE;

-	switch (vi_rep & MASK_VOUT_COLOR_SEL) {
-	case MASK_VOUT_COLOR_RGB_FULL:
-	case MASK_VOUT_COLOR_RGB_LIMITED:
-		format->format.colorspace = V4L2_COLORSPACE_SRGB;
-		break;
-	case MASK_VOUT_COLOR_601_YCBCR_LIMITED:
-	case MASK_VOUT_COLOR_601_YCBCR_FULL:
-		format->format.colorspace = V4L2_COLORSPACE_SMPTE170M;
-		break;
-	case MASK_VOUT_COLOR_709_YCBCR_FULL:
-	case MASK_VOUT_COLOR_709_YCBCR_LIMITED:
-		format->format.colorspace = V4L2_COLORSPACE_REC709;
-		break;
-	default:
-		format->format.colorspace = 0;
-		break;
-	}
+	format->format.colorspace = tc358743_g_colorspace(format->format.code);

 	return 0;
 }
@ -1713,19 +1725,14 @@ static int tc358743_set_fmt(struct v4l2_subdev *sd,
 	u32 code = format->format.code; /* is overwritten by get_fmt */
 	int ret = tc358743_get_fmt(sd, cfg, format);

-	format->format.code = code;
+	if (code == MEDIA_BUS_FMT_RGB888_1X24 ||
+	    code == MEDIA_BUS_FMT_UYVY8_1X16)
+		format->format.code = code;
+	format->format.colorspace = tc358743_g_colorspace(format->format.code);

 	if (ret)
 		return ret;

-	switch (code) {
-	case MEDIA_BUS_FMT_RGB888_1X24:
-	case MEDIA_BUS_FMT_UYVY8_1X16:
-		break;
-	default:
-		return -EINVAL;
-	}
-
 	if (format->which == V4L2_SUBDEV_FORMAT_TRY)
 		return 0;

@ -1952,8 +1959,19 @@ static int tc358743_probe_of(struct tc358743_state *state)
 	state->pdata.refclk_hz = clk_get_rate(refclk);
 	state->pdata.ddc5v_delay = DDC5V_DELAY_100_MS;
 	state->pdata.enable_hdcp = false;
-	/* A FIFO level of 16 should be enough for 2-lane 720p60 at 594 MHz. */
-	state->pdata.fifo_level = 16;
+	/*
+	 * Ideally the FIFO trigger level should be set based on the input and
+	 * output data rates, but the calculations required are buried in
+	 * Toshiba's register settings spreadsheet.
+	 * A value of 16 works with a 594Mbps data rate for 720p60 (using 2
+	 * lanes) and 1080p60 (using 4 lanes), but fails when the data rate
+	 * is increased, or a lower pixel clock is used that result in CSI
+	 * reading out faster than the data is arriving.
+	 *
+	 * A value of 374 works with both those modes at 594Mbps, and with most
+	 * modes on 972Mbps.
+	 */
+	state->pdata.fifo_level = 374;
 	/*
 	 * The PLL input clock is obtained by dividing refclk by pll_prd.
 	 * It must be between 6 MHz and 40 MHz, lower frequency is better.
@ -2041,6 +2059,7 @@ static int tc358743_probe(struct i2c_client *client)
 	struct tc358743_platform_data *pdata = client->dev.platform_data;
 	struct v4l2_subdev *sd;
 	u16 irq_mask = MASK_HDMI_MSK | MASK_CSI_MSK;
+	u16 chipid;
 	int err;

 	if (!i2c_check_functionality(client->adapter, I2C_FUNC_SMBUS_BYTE_DATA))
@ -2072,7 +2091,8 @@ static int tc358743_probe(struct i2c_client *client)
 	sd->flags |= V4L2_SUBDEV_FL_HAS_DEVNODE | V4L2_SUBDEV_FL_HAS_EVENTS;

 	/* i2c access */
-	if ((i2c_rd16(sd, CHIPID) & MASK_CHIPID) != 0) {
+	if (i2c_rd16_err(sd, CHIPID, &chipid) ||
+	    (chipid & MASK_CHIPID) != 0) {
 		v4l2_info(sd, "not a TC358743 on address 0x%x\n",
 			  client->addr << 1);
 		return -ENODEV;
--- a/drivers/media/platform/qcom/camss/camss.c
+++ b/drivers/media/platform/qcom/camss/camss.c
@ -888,7 +888,7 @@ static int camss_probe(struct platform_device *pdev)
 	ret = v4l2_device_register(camss->dev, &camss->v4l2_dev);
 	if (ret < 0) {
 		dev_err(dev, "Failed to register V4L2 device: %d\n", ret);
-		goto err_cleanup;
+		goto err_media_device_cleanup;
 	}

 	ret = camss_register_entities(camss);
@ -945,6 +945,8 @@ err_register_subdevs:
 	camss_unregister_entities(camss);
 err_register_entities:
 	v4l2_device_unregister(&camss->v4l2_dev);
+err_media_device_cleanup:
+	media_device_cleanup(&camss->media_dev);
 err_cleanup:
 	v4l2_async_notifier_cleanup(&camss->notifier);
 err_free:
--- a/drivers/media/platform/qcom/venus/core.c
+++ b/drivers/media/platform/qcom/venus/core.c
@ -267,13 +267,13 @@ static int venus_probe(struct platform_device *pdev)
 	mutex_init(&core->lock);
 	INIT_DELAYED_WORK(&core->work, venus_sys_error_handler);

-	ret = devm_request_threaded_irq(dev, core->irq, hfi_isr, hfi_isr_thread,
-					IRQF_TRIGGER_HIGH | IRQF_ONESHOT,
-					"venus", core);
+	ret = hfi_create(core, &venus_core_ops);
 	if (ret)
 		return ret;

-	ret = hfi_create(core, &venus_core_ops);
+	ret = devm_request_threaded_irq(dev, core->irq, hfi_isr, hfi_isr_thread,
+					IRQF_TRIGGER_HIGH | IRQF_ONESHOT,
+					"venus", core);
 	if (ret)
 		return ret;

--- a/drivers/media/platform/qcom/venus/core.h
+++ b/drivers/media/platform/qcom/venus/core.h
@ -16,6 +16,8 @@

 #define VIDC_CLKS_NUM_MAX	4

+#define VENUS_MAX_FPS			240
+
 struct freq_tbl {
 	unsigned int load;
 	unsigned long freq;
--- a/drivers/media/platform/qcom/venus/hfi_venus.c
+++ b/drivers/media/platform/qcom/venus/hfi_venus.c
@ -240,6 +240,7 @@ static int venus_write_queue(struct venus_hfi_device *hdev,
 static int venus_read_queue(struct venus_hfi_device *hdev,
 			    struct iface_queue *queue, void *pkt, u32 *tx_req)
 {
+	struct hfi_pkt_hdr *pkt_hdr = NULL;
 	struct hfi_queue_header *qhdr;
 	u32 dwords, new_rd_idx;
 	u32 rd_idx, wr_idx, type, qsize;
@ -305,6 +306,9 @@ static int venus_read_queue(struct venus_hfi_device *hdev,
 			memcpy(pkt, rd_ptr, len);
 			memcpy(pkt + len, queue->qmem.kva, new_rd_idx << 2);
 		}
+		pkt_hdr = (struct hfi_pkt_hdr *)(pkt);
+		if ((pkt_hdr->size >> 2) != dwords)
+			return -EINVAL;
 	} else {
 		/* bad packet received, dropping */
 		new_rd_idx = qhdr->write_idx;
@ -1604,6 +1608,7 @@ void venus_hfi_destroy(struct venus_core *core)
 	mutex_destroy(&hdev->lock);
 	kfree(hdev);
 	core->priv = NULL;
+	disable_irq(core->irq);
 	core->ops = NULL;
 }

--- a/drivers/media/platform/qcom/venus/vdec.c
+++ b/drivers/media/platform/qcom/venus/vdec.c
@ -418,11 +418,10 @@ static int vdec_s_parm(struct file *file, void *fh, struct v4l2_streamparm *a)
 	us_per_frame = timeperframe->numerator * (u64)USEC_PER_SEC;
 	do_div(us_per_frame, timeperframe->denominator);

-	if (!us_per_frame)
-		return -EINVAL;
-
+	us_per_frame = clamp(us_per_frame, 1, USEC_PER_SEC);
 	fps = (u64)USEC_PER_SEC;
 	do_div(fps, us_per_frame);
+	fps = min(VENUS_MAX_FPS, fps);

 	inst->fps = fps;
 	inst->timeperframe = *timeperframe;
--- a/drivers/media/usb/gspca/vicam.c
+++ b/drivers/media/usb/gspca/vicam.c
@ -227,6 +227,7 @@ static int sd_init(struct gspca_dev *gspca_dev)
 	const struct ihex_binrec *rec;
 	const struct firmware *fw;
 	u8 *firmware_buf;
+	int len;

 	ret = request_ihex_firmware(&fw, VICAM_FIRMWARE,
 				    &gspca_dev->dev->dev);
@ -241,9 +242,14 @@ static int sd_init(struct gspca_dev *gspca_dev)
 		goto exit;
 	}
 	for (rec = (void *)fw->data; rec; rec = ihex_next_binrec(rec)) {
-		memcpy(firmware_buf, rec->data, be16_to_cpu(rec->len));
+		len = be16_to_cpu(rec->len);
+		if (len > PAGE_SIZE) {
+			ret = -EINVAL;
+			break;
+		}
+		memcpy(firmware_buf, rec->data, len);
 		ret = vicam_control_msg(gspca_dev, 0xff, 0, 0, firmware_buf,
-					be16_to_cpu(rec->len));
+					len);
 		if (ret < 0)
 			break;
 	}
--- a/drivers/media/usb/hdpvr/hdpvr-i2c.c
+++ b/drivers/media/usb/hdpvr/hdpvr-i2c.c
@ -165,10 +165,16 @@ static const struct i2c_algorithm hdpvr_algo = {
 	.functionality = hdpvr_functionality,
 };

+/* prevent invalid 0-length usb_control_msg */
+static const struct i2c_adapter_quirks hdpvr_quirks = {
+	.flags = I2C_AQ_NO_ZERO_LEN_READ,
+};
+
 static const struct i2c_adapter hdpvr_i2c_adapter_template = {
 	.name   = "Hauppauge HD PVR I2C",
 	.owner  = THIS_MODULE,
 	.algo   = &hdpvr_algo,
+	.quirks = &hdpvr_quirks,
 };

 static int hdpvr_activate_ir(struct hdpvr_device *dev)
--- a/Show more
+++ b/Show more