Merge branch 'linux-4.14.y' of github.com:openela/kernel-lts into android13-4.14-msmnile

* 'linux-4.14.y' of github.com:openela/kernel-lts: (250 commits) LTS: Update to 4.14.356 nilfs2: fix kernel bug due to missing clearing of checked flag ocfs2: pass u64 to ocfs2_truncate_inline maybe overflow nilfs2: fix potential deadlock with newly created symlinks wifi: iwlegacy: Clear stale interrupts before resuming device wifi: mac80211: do not pass a stopped vif to the driver in .get_txpower Revert "driver core: Fix uevent_show() vs driver detach race" xhci: Fix Link TRB DMA in command ring stopped completion event usb: phy: Fix API devm_usb_put_phy() can not release the phy misc: sgi-gru: Don't disable preemption in GRU driver net: amd: mvme147: Fix probe banner message netfilter: nft_payload: sanitize offset and length before calling skb_checksum() net: skip offload for NETIF_F_IPV6_CSUM if ipv6 header contains extension net: support ip generic csum processing in skb_csum_hwoffload_help net/sched: stop qdisc_tree_reduce_backlog on TC_H_ROOT gtp: allow -1 to be specified as file description from userspace gtp: simplify error handling code in 'gtp_encap_enable()' wifi: mac80211: skip non-uploaded keys in ieee80211_iter_keys cgroup: Fix potential overflow issue when checking max_depth xfrm: validate new SA's prefixlen using SA family when sel.family is unset ... Conflicts: net/qrtr/qrtr.c Change-Id: Icfdc9be949db7ce460d7e7967511d5f42c1af5ab
2025-04-29 19:06:47 +03:00
parent 7dc0bdd773 fd5b0e89e4
commit c36d7742e0
231 changed files with 3771 additions and 772 deletions
--- a/.elts/config.yaml
+++ b/.elts/config.yaml
@@ -3,3 +3,4 @@ upstream_base: 4.19.304
 base: 4.14.336
 upstream_version: 4.19.322
 version: 4.14.355
+rc: 1
--- a/.elts/meta/4.14.356.yaml
+++ b/.elts/meta/4.14.356.yaml
@@ -0,0 +1,992 @@
+5ea681973e3c518892825457c55559b0daa1c3d3:
+  title: 'staging: iio: frequency: ad9833: Get frequency value statically'
+  mainline: 80109c32348d7b2e85def9efc3f9524fb166569d
+  upstream: a3138f0925714ea47f817257447fa0b87c8bcf28
+2253daf50c035c2cd8a8ca74b7bba17bb936fb18:
+  title: 'staging: iio: frequency: ad9833: Load clock using clock framework'
+  mainline: 8e8040c52e63546d1171c188a24aacf145a9a7e0
+  upstream: a6316b6f127a877285c83d2ed45b20e6712e6d1b
+ab37e7fbaeb484d79986ed060a4f865c05c3c248:
+  title: 'staging: iio: frequency: ad9834: Validate frequency parameter value'
+  mainline: b48aa991758999d4e8f9296c5bbe388f293ef465
+  upstream: 5edc3a45ef428501000a7b23d0e1777a548907f6
+12cd0e98282326cc494b69e74947a585afd21f53:
+  title: 'usbnet: ipheth: fix carrier detection in modes 1 and 4'
+  mainline: 67927a1b255d883881be9467508e0af9a5e0be9d
+  upstream: 32dafeb84c84a2d420de27e5e30e4ea6339e4d07
+c0360f13de3287dfab2137634c65b55e3949f325:
+  title: 'net: ethernet: use ip_hdrlen() instead of bit shift'
+  mainline: 9a039eeb71a42c8b13408a1976e300f3898e1be0
+  upstream: a81761c1ba59444fc3f644e7d8713ac35e7911c4
+71d7a71aecd5608f04ebe27edf45e296131503b1:
+  title: 'scripts: kconfig: merge_config: config files: add a trailing newline'
+  mainline: 33330bcf031818e60a816db0cfd3add9eecc3b28
+  upstream: 6a130ec2f0646a8544308b6cf983269d5a2a7fa0
+e1ebafd5c0058b061a4583c4ba60a4508b00d55f:
+  title: 'arm64: dts: rockchip: override BIOS_DISABLE signal via GPIO hog on RK3399 Puma'
+  mainline: 741f5ba7ccba5d7ae796dd11c320e28045524771
+  upstream: 4a0400793ac3961a07fcd472f7eb789d12d0db6a
+64bdfeaca4b2bca14039364e1569c9f0d399e8cf:
+  title: 'net/mlx5: Update the list of the PCI supported devices'
+  mainline: 85327a9c415057259b337805d356705d0d0f4200
+  upstream: a689f610abc8d4c8dfd775e09fd306f19cfe6509
+94fc3405a60ae7370428a02b7ffa8c1e1a0db0fb:
+  title: 'net: ftgmac100: Enable TX interrupt to avoid TX timeout'
+  mainline: fef2843bb49f414d1523ca007d088071dee0e055
+  upstream: 7f84d4613b9fdf9e14bbab867e879a0df782a163
+d3cde3469100da8f52f60b814b8cab66244d7f56:
+  title: 'net: dpaa: Pad packets to ETH_ZLEN'
+  mainline: cbd7ec083413c6a2e0c326d49e24ec7d12c7a9e0
+  upstream: cd5b9d657ecd44ad5f254c3fea3a6ab1cf0e2ef7
+e2ed6238364c4b1a6beba54d4d16c0f2dc801dc0:
+  title: 'selftests/vm: remove call to ksft_set_plan()'
+c29e4bebce862efea2d600187e150237e563b89b:
+  title: 'selftests/kcmp: remove call to ksft_set_plan()'
+a7d6bf885524c3d4063dd145fb93c2c89cc98848:
+  title: 'ASoC: allow module autoloading for table db1200_pids'
+  mainline: 0e9fdab1e8df490354562187cdbb8dec643eae2c
+  upstream: 71d74f78ae565a64eae3022020a9d4e82dace694
+ac0819d2626c52220d318ed9ea3d5b2ee4b2f1c2:
+  title: 'pinctrl: at91: make it work with current gpiolib'
+  mainline: 752f387faaae0ae2e84d3f496922524785e77d60
+  upstream: 33d615ee40f0651bb3d282a66e6f59eae6ea4ada
+fc168b848cd91fb8dd89637cb6a063670ed6b5dd:
+  title: 'microblaze: don''t treat zero reserved memory regions as error'
+  mainline: 0075df288dd8a7abfe03b3766176c393063591dd
+  upstream: a5bfdf7e4d956f3035779687eade8da23560f4bb
+0fcd4ef6d494a3de6307fa976919cd800f343df6:
+  title: 'net: ftgmac100: Ensure tx descriptor updates are visible'
+  mainline: 4186c8d9e6af57bab0687b299df10ebd47534a0a
+  upstream: 46974d97d58a2a91da16b032de0c78c4346bc1c2
+f3f9ddf39b4b25d0a99b2323cfed0659b6cffb45:
+  title: 'spi: bcm63xx: Enable module autoloading'
+  mainline: 709df70a20e990d262c473ad9899314039e8ec82
+  upstream: 1cde0480b087bd8f4e12396fcbb133ee9d9876bd
+b427f522d100d82fc9a282af7780cd140ac4e0bf:
+  title: 'x86/hyperv: Set X86_FEATURE_TSC_KNOWN_FREQ when Hyper-V provides frequency'
+  mainline: 8fcc514809de41153b43ccbe1a0cdf7f72b78e7e
+  upstream: 1da08d443212eba1f731b3f163c5b23ec1c882c1
+900f2cf495f5f7e9088364d3e4e483756bff58e3:
+  title: 'ocfs2: add bounds checking to ocfs2_xattr_find_entry()'
+  mainline: 9e3041fecdc8f78a5900c3aa51d3d756e73264d6
+  upstream: b49a786beb11ff740cb9e0c20b999c2a0e1729c2
+317e5483f3b80fb042b955d0e80c336698046cc1:
+  title: 'ocfs2: strict bound check before memcmp in ocfs2_xattr_find_entry()'
+  mainline: af77c4fc1871847b528d58b7fdafb4aa1f6a9262
+  upstream: e2b3d7a9d019d4d1a0da6c3ea64a1ff79c99c090
+c087e2303ab05433ed6981a730807bfc14dabe78:
+  title: 'gpio: prevent potential speculation leaks in gpio_device_get_desc()'
+  mainline: d795848ecce24a75dfd46481aee066ae6fe39775
+  upstream: 18504710442671b02d00e6db9804a0ad26c5a479
+fd204ed48bc3d5d4315957a2bf536d2df43c44e8:
+  title: 'USB: serial: pl2303: add device id for Macrosilicon MS3020'
+  mainline: 7d47d22444bb7dc1b6d768904a22070ef35e1fc0
+  upstream: 79efd61e1c50d79d89a48e6c01761f8f890a83dd
+90c7ddee26f4a63a9d2f173c5056eae945d345a7:
+  title: 'wifi: ath9k: fix parameter check in ath9k_init_debug()'
+  mainline: 6edb4ba6fb5b946d112259f54f4657f82eb71e89
+  upstream: ac848aff235efdd903c0c185c1cb44496c5b9bb0
+f2682fdc54e734785dd48a4850403f89e0e3cbe8:
+  title: 'wifi: ath9k: Remove error checks when creating debugfs entries'
+  mainline: f6ffe7f0184792c2f99aca6ae5b916683973d7d3
+  upstream: 0c3bbcbce030ca203963c520191ad2c5d89bf862
+a99c4727604215b66734a480a049ad9451bfef34:
+  title: 'can: bcm: Clear bo->bcm_proc_read after remove_proc_entry().'
+  mainline: 94b0818fa63555a65f6ba107080659ea6bcca63e
+  upstream: f5059fae5ed518fc56494ce5bdd4f5360de4b3bc
+ae07cf5eff7f99b3eb8927ace566f0786221dee4:
+  title: 'Bluetooth: btusb: Fix not handling ZPL/short-transfer'
+  mainline: 7b05933340f4490ef5b09e84d644d12484b05fdf
+  upstream: 2dfadca5439eca817fbb206c6003e5526d5e73df
+3bb55bc8856f2de993ef77536a774c62dc252926:
+  title: 'block, bfq: fix possible UAF for bfqq->bic with merge chain'
+  mainline: 18ad4df091dd5d067d2faa8fce1180b79f7041a7
+  upstream: a9bdd5b36887d2bacb8bc777fd18317c99fc2587
+940b968ed647a978296610464a5bfd0ee1c8b0f4:
+  title: 'block, bfq: don''t break merge chain in bfq_split_bfqq()'
+  mainline: 42c306ed723321af4003b2a41bb73728cab54f85
+  upstream: 9e813033594b141f61ff0ef0cfaaef292564b041
+086695765117a72978f0210989a2fd377a86287a:
+  title: 'spi: ppc4xx: handle irq_of_parse_and_map() errors'
+  mainline: 0f245463b01ea254ae90e1d0389e90b0e7d8dc75
+  upstream: f2a73a1f728e6fe765fc07c043a3d1670d854518
+2c79e19208b397228218de1ceb98f907ea84b720:
+  title: 'spi: ppc4xx: Avoid returning 0 when failed to parse and map IRQ'
+  mainline: 7781f1d120fec8624fc654eda900fc8748262082
+  upstream: e546902c4917656203e0e134630a873e9b6d28af
+8e6ee55dc9b2117c6e85d4e00724de05acc66e40:
+  title: 'ARM: versatile: fix OF node leak in CPUs prepare'
+  mainline: f2642d97f2105ed17b2ece0c597450f2ff95d704
+  upstream: 722d698f3e8de32a753ee1148b009406d0b3b829
+f2dbb797e5c4fbe261bac004384161a4d2df0485:
+  title: 'reset: berlin: fix OF node leak in probe() error path'
+  mainline: 5f58a88cc91075be38cec69b7cb70aaa4ba69e8b
+  upstream: 041b763798bf460307db3bd8144e3732aef52902
+115ada83f0a71ae108fe8c58a4d9f6b0ef3b3be3:
+  title: 'clocksource/drivers/qcom: Add missing iounmap() on errors in msm_dt_timer_init()'
+  mainline: ca140a0dc0a18acd4653b56db211fec9b2339986
+  upstream: 24d689791c6dbdb11b4b5208ed746f28fe651715
+1ed2f7aabb6e52fd4d1b13daeb56b5e1c6904e90:
+  title: 'hwmon: (max16065) Fix overflows seen when writing limits'
+  mainline: 744ec4477b11c42e2c8de9eb8364675ae7a0bd81
+  upstream: b665734d4772df97eaeb4d943dc104dbd9ec1e9a
+e7ee0a8fd442b2fb7586cc29d397017bc638ed50:
+  title: 'mtd: slram: insert break after errors in parsing the map'
+  mainline: 336c218dd7f0588ed8a7345f367975a00a4f003f
+  upstream: 6015f85fc8eba1ccf7db8b20a9518388fcb4fbf7
+b8dbab0d70214275e00278a332c3456de5c74031:
+  title: 'hwmon: (ntc_thermistor) fix module autoloading'
+  mainline: b6964d66a07a9003868e428a956949e17ab44d7e
+  upstream: 6f91b0464947c4119682731401e11e095d8db06d
+c02345a3444b243abae115fc9cc38d3453c8964a:
+  title: 'power: supply: max17042_battery: Fix SOC threshold calc w/ no current sense'
+  mainline: 3a3acf839b2cedf092bdd1ff65b0e9895df1656b
+  upstream: f9e9ce0f2b420b63c29e96840865640098bbafe7
+8e8bed0aecaeb206024593bc125ecb5949b10cb5:
+  title: 'fbdev: hpfb: Fix an error handling path in hpfb_dio_probe()'
+  mainline: aa578e897520f32ae12bec487f2474357d01ca9c
+  upstream: da77622151181c1d7d8ce99019c14cd5bd6453b5
+2b1444de44d853578d982acd4d0a58082334d1ba:
+  title: 'drm/amd: fix typo'
+  mainline: 229f7b1d6344ea35fff0b113e4d91128921f8937
+  upstream: f4a502c468886ffc54e436279d7f573b4d02bd5b
+28cbb9587a21b4052424ece391f8953ea3ce1d93:
+  title: 'drm/rockchip: vop: Allow 4096px width scaling'
+  mainline: 0ef968d91a20b5da581839f093f98f7a03a804f7
+  upstream: 6a512ab02cde62f147351d38ebefa250522336c4
+541940c2d6db90f0a9448686b0e0838a2a7f134b:
+  title: 'drm/radeon/evergreen_cs: fix int overflow errors in cs track offsets'
+  mainline: 3fbaf475a5b8361ebee7da18964db809e37518b7
+  upstream: ec7cf75b4e2b584e6f2b167ce998428b42522df6
+e903f2245bb193bb8a6f11804e56b0b85ae6a9a9:
+  title: 'jfs: fix out-of-bounds in dbNextAG() and diAlloc()'
+  mainline: e63866a475562810500ea7f784099bfe341e761a
+  upstream: d1017d2a0f3f16dc1db5120e7ddbe7c6680425b0
+2f418bb73f8edbe9b8afbbf59e5b2e217ab391bd:
+  title: 'ipmi: docs: don''t advertise deprecated sysfs entries'
+  mainline: 64dce81f8c373c681e62d5ffe0397c45a35d48a2
+  upstream: e4e81788a8b83f267d25b9f3b68cb4837b71bdd9
+f9d12089d914dc23b18637db0091a61a2c0ea32b:
+  title: 'drm/msm: fix %s null argument error'
+  mainline: 25b85075150fe8adddb096db8a4b950353045ee1
+  upstream: b7a63d4bac70f660d63cba66684bc03f09be50ad
+aa244feeb7d2f904f18638a7369216d4e410d44b:
+  title: 'xen: use correct end address of kernel for conflict checking'
+  mainline: fac1bceeeb04886fc2ee952672e6e6c85ce41dca
+  upstream: f38d39918cff054f4bfc466cac1c110d735eda94
+1a07c8045664899758b6c312761686e49f6d2fc0:
+  title: 'xen/swiotlb: simplify range_straddles_page_boundary()'
+  mainline: bf70726668c6116aa4976e0cc87f470be6268a2f
+  upstream: 5937434b2ca4884798571079cc71ad3a58b3c8fd
+2690899d56f2ed0cb6b24a60c02bcbf8c950d35c:
+  title: 'xen/swiotlb: add alignment check for dma buffers'
+  mainline: 9f40ec84a7976d95c34e7cc070939deb103652b0
+  upstream: 66c845af6613a62f08d1425054526cc294842914
+29e08a988cd84cd6b7afb1790e343d8290f58664:
+  title: 'selftests/bpf: Fix error compiling test_lru_map.c'
+  mainline: cacf2a5a78cd1f5f616eae043ebc6f024104b721
+  upstream: e5fa35e20078c3f08a249a15e616645a7e7068e2
+efd2f49ae3bc833b879ef4091384fe42db871bec:
+  title: 'kthread: add kthread_work tracepoints'
+  mainline: f630c7c6f10546ebff15c3a856e7949feb7a2372
+  upstream: 65c1957181a1e2cd5344e49d4e5b6e9f930092d1
+85a8b320b6eda4e743d3633d86653d16e9a859c1:
+  title: 'kthread: fix task state in kthread worker if being frozen'
+  mainline: e16c7b07784f3fb03025939c4590b9a7c64970a7
+  upstream: 6430d6a00b0d8d3de663ecc0da248f8f3557b82e
+449027e8478709334ca7d9445060ed04464b43bb:
+  title: 'jbd2: introduce/export functions jbd2_journal_submit|finish_inode_data_buffers()'
+  mainline: aa3c0c61f62d682259e3e66cdc01846290f9cd6c
+  upstream: 58a48155ce22e8e001308a41a16d8c89ee003b80
+aa5e7df17ef64ae426c4ac8fcdde231c2bba3d57:
+  title: 'ext4: clear EXT4_GROUP_INFO_WAS_TRIMMED_BIT even mount with discard'
+  mainline: 20cee68f5b44fdc2942d20f3172a262ec247b117
+  upstream: 6f44db60f9c42265e1e61596994f457f3c30d432
+179d760ab3fee99160a41a12ba49017e61c7ae34:
+  title: 'smackfs: Use rcu_assign_pointer() to ensure safe assignment in smk_set_cipso'
+  mainline: 2749749afa071f8a0e405605de9da615e771a7ce
+  upstream: 029ebd49aab06dd438c1256876730518aef7da35
+09313601d16d88eed265af9c0bd4b029c4524220:
+  title: 'ext4: avoid negative min_clusters in find_group_orlov()'
+  mainline: bb0a12c3439b10d88412fd3102df5b9a6e3cd6dc
+  upstream: 7b98a77cdad322fa3c7babf15c37659a94aa3593
+a71386889f3ee75ee1507c741298d505973cb8d8:
+  title: 'ext4: return error on ext4_find_inline_entry'
+  mainline: 4d231b91a944f3cab355fce65af5871fb5d7735b
+  upstream: ce8f41fca0b6bc69753031afea8fc01f97b5e1af
+c3afa5821f1e517165033292a44f8aeb43a8341c:
+  title: 'ext4: avoid OOB when system.data xattr changes underneath the filesystem'
+  mainline: c6b72f5d82b1017bad80f9ebf502832fc321d796
+  upstream: 5b076d37e8d99918e9294bd6b35a8bbb436819b0
+41f3f6c63ebe7984124f65fdcf0d1ef3bfff9e41:
+  title: 'nilfs2: fix potential null-ptr-deref in nilfs_btree_insert()'
+  mainline: 9403001ad65ae4f4c5de368bdda3a0636b51d51a
+  upstream: 2b78e9df10fb7f4e9d3d7a18417dd72fbbc1dfd0
+1150830d554e2921e69ebb150c3c2d07baa0216d:
+  title: 'nilfs2: determine empty node blocks as corrupted'
+  mainline: 111b812d3662f3a1b831d19208f83aa711583fe6
+  upstream: 6d7f4fac707a187882b8c610e8889c097b289082
+811f9859f37f3be1ebeb26c221fbaaa593199e99:
+  title: 'nilfs2: fix potential oob read in nilfs_btree_check_delete()'
+  mainline: f9c96351aa6718b42a9f42eaf7adce0356bdb5e8
+  upstream: f3a9859767c7aea758976f5523903d247e585129
+218417bab6747be0d5ae6e0161a5796d433d75ea:
+  title: 'perf sched timehist: Fix missing free of session in perf_sched__timehist()'
+  mainline: 6bdf5168b6fb19541b0c1862bdaa596d116c7bfb
+  upstream: 1d4d7e56c4aa834f359a29aa64f5f5c01e3453eb
+c30bffcf9b9de7aeb85e602a62c1b199e44c7b04:
+  title: 'perf sched timehist: Fixed timestamp error when unable to confirm event sched_in time'
+  mainline: 39c243411bdb8fb35777adf49ee32549633c4e12
+  upstream: d825de712b59dfd6e256c0ecad7443da652c2b22
+cfec54fd64719d252a6f53f7cf8925d439b5a440:
+  title: 'perf time-utils: Fix 32-bit nsec parsing'
+  mainline: 38e2648a81204c9fc5b4c87a8ffce93a6ed91b65
+  upstream: c062eebe3b3d98ae2ef61fe8008f2c12bfa31249
+6e0b571ed540f42734528e92a461d02f7da43a01:
+  title: 'clk: rockchip: Set parent rate for DCLK_VOP clock on RK3228'
+  mainline: 1d34b9757523c1ad547bd6d040381f62d74a3189
+  upstream: 7b9e7a258b9f4d68a9425c67bfee1e1e926d1960
+fe35dd3f675597f83ae26c6d5086a9464c8dc941:
+  title: 'drivers: media: dvb-frontends/rtl2832: fix an out-of-bounds write error'
+  mainline: 8ae06f360cfaca2b88b98ca89144548b3186aab1
+  upstream: 7065c05c6d58b9b9a98127aa14e9a5ec68173918
+f046671d18d577d0ed12e6cf37913d543be14952:
+  title: 'drivers: media: dvb-frontends/rtl2830: fix an out-of-bounds write error'
+  mainline: 46d7ebfe6a75a454a5fa28604f0ef1491f9d8d14
+  upstream: 8ffbe7d07b8e76193b151107878ddc1ccc94deb5
+526fd6e5af9933b37ab818aeb51beca91da649be:
+  title: 'PCI: xilinx-nwl: Fix register misspelling'
+  mainline: a437027ae1730b8dc379c75fa0dd7d3036917400
+  upstream: 43b361ca2c977e593319c8248e549c0863ab1730
+e2138450b0fd6eec4ec39b7c0ddc8bd2c63e1158:
+  title: 'RDMA/iwcm: Fix WARNING:at_kernel/workqueue.c:#check_flush_dependency'
+  mainline: 86dfdd8288907f03c18b7fb462e0e232c4f98d89
+  upstream: da2708a19f45b4a7278adf523837c8db21d1e2b5
+fab82568499e61ec55a0fac9781cffff4d9d6ba7:
+  title: 'pinctrl: single: fix missing error code in pcs_probe()'
+  mainline: cacd8cf79d7823b07619865e994a7916fcc8ae91
+  upstream: 4f227c4dc81187fcca9c858b070b9d3f586c9b30
+904ce6f2f61066aab8e6e20b705b8e45a6adafd3:
+  title: 'clk: ti: dra7-atl: Fix leak of of_nodes'
+  mainline: 9d6e9f10e2e031fb7bfb3030a7d1afc561a28fea
+  upstream: d6b680af89ca0bf498d105265bc32061979e87f1
+f6340536595507abf266bf00336263a0fe54b6d5:
+  title: 'pinctrl: mvebu: Fix devinit_dove_pinctrl_probe function'
+  mainline: c25478419f6fd3f74c324a21ec007cf14f2688d7
+  upstream: 856d3ea97be0dfa5d7369e071c06c9259acfff33
+c3222aec5dbf651634bac47c1137c4b0c5209b13:
+  title: 'RDMA/cxgb4: Added NULL check for lookup_atid'
+  mainline: e766e6a92410ca269161de059fff0843b8ddd65f
+  upstream: b12e25d91c7f97958341538c7dc63ee49d01548f
+a4191b6aaf636e979332330d22348c461169a8c7:
+  title: 'ntb: intel: Fix the NULL vs IS_ERR() bug for debugfs_create_dir()'
+  mainline: e229897d373a87ee09ec5cc4ecd4bb2f895fc16b
+  upstream: 20cbc281033ef5324f67f2d54bc539968f937255
+e6eedced9e6d8c218bd815ac165a299c10b37471:
+  title: 'nfsd: call cache_put if xdr_reserve_space returns NULL'
+  mainline: d078cbf5c38de83bc31f83c47dcd2184c04a50c7
+  upstream: 3e8081ebff12bec1347deaceb6bce0765cce54df
+6a591f347a7c201678a3932d5a2ebc08f6fbf50a:
+  title: 'netfilter: nf_reject_ipv6: fix nf_reject_ip6_tcphdr_put()'
+  mainline: 9c778fe48d20ef362047e3376dee56d77f8500d4
+  upstream: 872eca64c3267dbc5836b715716fc6c03a18eda7
+5489a0e446410516b104e0dbc7901cf96ca0d3e9:
+  title: 'net: qrtr: Update packets cloning when broadcasting'
+  mainline: f011b313e8ebd5b7abd8521b5119aecef403de45
+  upstream: 7f02a7d8a2890678f0bfd563eb99dd31bafc36eb
+6ada46e520db9db21909d1333f2d1f11d0ea47d8:
+  title: 'netfilter: ctnetlink: compile ctnetlink_label_size with CONFIG_NF_CONNTRACK_EVENTS'
+  mainline: e1f1ee0e9ad8cbe660f5c104e791c5f1a7cf4c31
+  upstream: b14c58e37050703568ab498404018294807209a5
+24ee879c5a39f2f8e92ef5dc6b82ad71890af0b9:
+  title: 'crypto: aead,cipher - zeroize key buffer after use'
+  mainline: 23e4099bdc3c8381992f9eb975c79196d6755210
+  upstream: 89b9b6fa4463daf820e6a5ef65c3b0c2db239513
+ad481d5cbb6fc4c2fbe847eaab398a667608aa41:
+  title: Remove *.orig pattern from .gitignore
+  mainline: 76be4f5a784533c71afbbb1b8f2963ef9e2ee258
+  upstream: e19774a171f108433e9fba98a7bfbf65ec2a18de
+2903e604526b78ba231eff10d4d32eecc84b7d13:
+  title: 'soc: versatile: integrator: fix OF node leak in probe() error path'
+  mainline: 874c5b601856adbfda10846b9770a6c66c41e229
+  upstream: 6ab18d4ada166d38046ca8eb9598a3f1fdabd2b7
+5b2fc11840b44e9989d9e931881108d56828398b:
+  title: 'USB: appledisplay: close race between probe and completion handler'
+  mainline: 8265d06b7794493d82c5c21a12d7ba43eccc30cb
+  upstream: 17720dd1be72e4cf5436883cf9d114d0c3e47d19
+7fe54b4967d33e67db68d83c1126f160341fcf3a:
+  title: 'USB: misc: cypress_cy7c63: check for short transfer'
+  mainline: 49cd2f4d747eeb3050b76245a7f72aa99dbd3310
+  upstream: 638810fe9c0c15ffaa1b4129e54f1e8affb28afd
+8265d9830ede6739edfeeac27d7d97fa2ff60f24:
+  title: 'tty: rp2: Fix reset with non forgiving PCIe host bridges'
+  mainline: f16dd10ba342c429b1e36ada545fb36d4d1f0e63
+  upstream: 279994e23d7e6d2a30f2cc7b7437fedccac0834d
+29cbc0c5c3d689694a2de42d48938385c321d073:
+  title: 'drbd: Fix atomicity violation in drbd_uuid_set_bm()'
+  mainline: 2f02b5af3a4482b216e6a466edecf6ba8450fa45
+  upstream: b674f1b49f9eaec9aac5c64a75e535aa3f359af7
+fa3bcef6588b3c2d861f5888dfe595d671bf790e:
+  title: 'drbd: Add NULL check for net_conf to prevent dereference in state validation'
+  mainline: a5e61b50c9f44c5edb6e134ede6fee8806ffafa9
+  upstream: 3b3ed68f695ee000e9c9fa536761a0554bfc1340
+722db7a1dfcd05605e4fe31285eb51416a7c5f3f:
+  title: 'ACPI: sysfs: validate return type of _STR method'
+  mainline: 4bb1e7d027413835b086aed35bc3f0713bc0f72b
+  upstream: 92fd5209fc014405f63a7db79802ca4b01dc0c05
+764b74ce49fcac9d4ce79f2382f5a72f7e4ce9ee:
+  title: 'f2fs: prevent possible int overflow in dir_block_index()'
+  mainline: 47f268f33dff4a5e31541a990dc09f116f80e61c
+  upstream: 60bffc6e6b32fb88e5c1234448de5ccf88b590f5
+6e6800bf67a4f4d90bfeac9576562c4b94f86b4f:
+  title: 'f2fs: avoid potential int overflow in sanity_check_area_boundary()'
+  mainline: 50438dbc483ca6a133d2bce9d5d6747bcee38371
+  upstream: 24dfe070d6d05d62a00c41d5d52af5a448ae7af7
+2b8c76dea7cd29cd76056aa1622f824203672a78:
+  title: 'vfs: fix race between evice_inodes() and find_inode()&iput()'
+  mainline: 88b1afbf0f6b221f6c5bb66cc80cd3b38d696687
+  upstream: 6cc13a80a26e6b48f78c725c01b91987d61563ef
+6aec9a2b2ea68124ec578150968e918b714b4951:
+  title: 'nfs: fix memory leak in error path of nfs4_do_reclaim'
+  mainline: 8f6a7c9467eaf39da4c14e5474e46190ab3fb529
+  upstream: f239240d65807113e565226b8e0a7ea13390bff3
+4d86dbe788e3493096e0ac52cb1d67da3a97f253:
+  title: 'PCI: xilinx-nwl: Use irq_data_get_irq_chip_data()'
+  mainline: e56427068a8d796bb7b8e297f2b6e947380e383f
+  upstream: d957766954641b4bbd7e359d51206c0b940988a6
+85f9e31d10684f30ee9dd7181101849d66bb46ea:
+  title: 'PCI: xilinx-nwl: Fix off-by-one in INTx IRQ handler'
+  mainline: 0199d2f2bd8cd97b310f7ed82a067247d7456029
+  upstream: ebf6629fcff1e04e43ef75bd2c2dbfb410a95870
+a221ba7b5c10912b64ef3214f340d306a7f2f716:
+  title: 'soc: versatile: realview: fix memory leak during device remove'
+  mainline: 1c4f26a41f9d052f334f6ae629e01f598ed93508
+  upstream: 0accfec683c0a3e31c8ba738be0b0014e316d6a0
+d8f64e84dd728d7c0b98963b34a5a8c3bf1cb3a9:
+  title: 'soc: versatile: realview: fix soc_dev leak during device remove'
+  mainline: c774f2564c0086c23f5269fd4691f233756bf075
+  upstream: b05605f5a42b4719918486e2624e44f3fa9e818f
+763e7b56a44b2c0b2adf924cfdbe078001aa424d:
+  title: 'usb: yurex: Replace snprintf() with the safer scnprintf() variant'
+  mainline: 86b20af11e84c26ae3fde4dcc4f490948e3f8035
+  upstream: a2ac6cb8aaa2eb23209ffa641962dd62958522a1
+4445f05310701e77940cd1105f380f29838acbe0:
+  title: 'USB: misc: yurex: fix race between read and write'
+  mainline: 93907620b308609c72ba4b95b09a6aa2658bb553
+  upstream: 1250cd9dee69ace62b9eb87230e8274b48bc9460
+a7f890cc3d58e08cf2ec730b95376b94862c6576:
+  title: 'i2c: aspeed: Update the stop sw state when the bus recovery occurs'
+  mainline: 93701d3b84ac5f3ea07259d4ced405c53d757985
+  upstream: 16cfd59341f73157ef319c588e639fc1013d94cf
+bdd844b72fada07b3849e5eea841181c97d16f3e:
+  title: 'i2c: isch: Add missed ''else'''
+  mainline: 1db4da55070d6a2754efeb3743f5312fc32f5961
+  upstream: bbe3396e96a2ee857cf2206784f06bc3f49ff240
+a8e1dbee0dfa30fe4d52939c495d469541cf5c8f:
+  title: 'usb: yurex: Fix inconsistent locking bug in yurex_read()'
+  mainline: e7d3b9f28654dbfce7e09f8028210489adaf6a33
+  upstream: 709b0b70011b577bc78406e76c4563e10579ddad
+198501d96c89d17a8ee79587f593537f2773aa07:
+  title: 'mailbox: rockchip: fix a typo in module autoloading'
+  mainline: e92d87c9c5d769e4cb1dd7c90faa38dddd7e52e3
+  upstream: ae2d6fdd49669f35ed3a1156a4aab66a37e6a450
+07726a73bd9cdc1843231a43985b5d310ee37fb2:
+  title: 'mailbox: bcm2835: Fix timeout during suspend mode'
+  mainline: dc09f007caed3b2f6a3b6bd7e13777557ae22bfd
+  upstream: 4e1e03760ee7cc4779b6306867fe0fc02921b963
+5f8a65de609aaf9a0ef037ca8110bc9a3361c6c4:
+  title: 'ceph: remove the incorrect Fw reference check when dirtying pages'
+  mainline: c08dfb1b49492c09cf13838c71897493ea3b424e
+  upstream: c26c5ec832dd9e9dcd0a0a892a485c99889b68f0
+51f85acdf26900ae9d4b89f2a92b1aeb3c84cb5a:
+  title: 'netfilter: nf_tables: prevent nf_skb_duplicated corruption'
+  mainline: 92ceba94de6fb4cee2bf40b485979c342f44a492
+  upstream: 50067d8b3f48e4cd4c9e817d3e9a5b5ff3507ca7
+d8d31cfbc82a0ae2e5ec55c7017ffbacc7f5fa4f:
+  title: 'r8152: Factor out OOB link list waits'
+  mainline: 5f71c84038d39def573744a145c573758f52a949
+  upstream: e8bed7c8845878f8c60e76f0a10d61ea2f709580
+5f9dc86cd8db3619cde8c03030791e3785d57212:
+  title: 'net: ethernet: lantiq_etop: fix memory disclosure'
+  mainline: 45c0de18ff2dc9af01236380404bbd6a46502c69
+  upstream: 905f06a34f960676e7dc77bea00f2f8fe18177ad
+e2c585677eacdc04469488dac62f2fed9e626fed:
+  title: 'ALSA: hda/generic: Unconditionally prefer preferred_dacs pairs'
+  mainline: 1c801e7f77445bc56e5e1fec6191fd4503534787
+  upstream: a66828fdf8ba3ccb30204f7e44761007a7437a3a
+3633a4341c2cea95f2294738f08398c864731ba8:
+  title: 'ALSA: hda/conexant: Fix conflicting quirk for System76 Pangolin'
+  mainline: b3ebb007060f89d5a45c9b99f06a55e36a1945b5
+  upstream: ba4ec41f6958bd5fc314b98c0ba17f5bb9a11375
+e4ca685be5fe41db336a29877df4a012f919c6ae:
+  title: 'f2fs: Require FMODE_WRITE for atomic write ioctls'
+  mainline: 4f5a100f87f32cb65d4bb1ad282a08c92f6f591e
+  upstream: 700f3a7c7fa5764c9f24bbf7c78e0b6e479fa653
+404a43ffc1ecfac85855f309721cc4000e9e9171:
+  title: 'wifi: ath9k: fix possible integer overflow in ath9k_get_et_stats()'
+  mainline: 3f66f26703093886db81f0610b97a6794511917c
+  upstream: 600f668453be81b25dcc2f20096eac2243aebdaa
+1bb884ba1941c7a5cf9cf7cc4037f3c3a6b106d4:
+  title: 'wifi: ath9k_htc: Use __skb_set_length() for resetting urb before resubmit'
+  mainline: 94745807f3ebd379f23865e6dab196f220664179
+  upstream: e6b9bf32e0695e4f374674002de0527d2a6768eb
+b8516592581c30f76def9221190dc9380f8da6c7:
+  title: 'net: hisilicon: hip04: fix OF node leak in probe()'
+  mainline: 17555297dbd5bccc93a01516117547e26a61caf1
+  upstream: 8c354ddfec8126ef58cdcde82dccc5cbb2c34e45
+3d3fbd73239ca0d6f8e2965cd98982aecbaa79e8:
+  title: 'net: hisilicon: hns_dsaf_mac: fix OF node leak in hns_mac_get_info()'
+  mainline: 5680cf8d34e1552df987e2f4bb1bff0b2a8c8b11
+  upstream: 7df217a21b74e730db216984218bde434dffc34b
+e07b666a56c1d67776a3189f4493afd19e050305:
+  title: 'net: hisilicon: hns_mdio: fix OF node leak in probe()'
+  mainline: e62beddc45f487b9969821fad3a0913d9bc18a2f
+  upstream: 963174dad7d4993ff3a4e1b43cefd296df0296b4
+165bb61dc09819ee1c5f1a33fc9709f57b6cd5e2:
+  title: 'ACPICA: Fix memory leak if acpi_ps_get_next_namepath() fails'
+  mainline: 5accb265f7a1b23e52b0ec42313d1e12895552f4
+  upstream: b017675cfbd126954d3b45afbdd6ee345a0ce368
+5d842b757d1a15ffb7abcd840bed276126302558:
+  title: 'ACPICA: Fix memory leak if acpi_ps_get_next_field() fails'
+  mainline: e6169a8ffee8a012badd8c703716e761ce851b15
+  upstream: 40fa60e0bf406ced3dfd857015dafdcd677a4929
+e6f96efbe6713164a9656bc0b4fc70d17f253486:
+  title: 'ACPI: EC: Do not release locks during operation region accesses'
+  mainline: dc171114926ec390ab90f46534545420ec03e458
+  upstream: 8d5dd2d2ef6cc87799b4ff915e561814d3c35d2c
+74270bedeea7735c0ba9518b3fee24181e0c6da2:
+  title: 'ACPICA: check null return of ACPI_ALLOCATE_ZEROED() in acpi_db_convert_to_package()'
+  mainline: a5242874488eba2b9062985bf13743c029821330
+  upstream: 4669da66ebc5b09881487f30669b0fcdb462188e
+f5ce9568dc7b5120dbf2e74500c11266592afd7a:
+  title: 'tipc: guard against string buffer overrun'
+  mainline: 6555a2a9212be6983d2319d65276484f7c5f431a
+  upstream: 8298b6e45fb4d8944f356b08e4ea3e54df5e0488
+5601f1cd6c89caede02c512aceba1122c1cb3883:
+  title: 'ipv4: Check !in_dev earlier for ioctl(SIOCSIFADDR).'
+  mainline: e3af3d3c5b26c33a7950e34e137584f6056c4319
+  upstream: 098a9b686df8c560f5f7683a1a388646aae0f023
+87987dd1f838cdbb660e1ec61ec971fd2f9ea6aa:
+  title: 'ipv4: Mask upper DSCP bits and ECN bits in NETLINK_FIB_LOOKUP family'
+  mainline: 8fed54758cd248cd311a2b5c1e180abef1866237
+  upstream: 05905659e2591368b50eaa79d94c75aeb18c46ef
+3b69e39d186eea8fc7e7be3ce493386062cfa847:
+  title: 'ACPICA: iasl: handle empty connection_node'
+  mainline: a0a2459b79414584af6c46dd8c6f866d8f1aa421
+  upstream: ea69502703bd3c38c3f016f8b6614ef0de2b94c2
+86713ec5023b52e2c29abf8d15dbd59318bc1ea0:
+  title: 'wifi: mwifiex: Fix memcpy() field-spanning write warning in mwifiex_cmd_802_11_scan_ext()'
+  mainline: 498365e52bebcbc36a93279fe7e9d6aec8479cee
+  upstream: b55c8848fdc81514ec047b2a0ec782ffe9ab5323
+62fda267887348a38a2931739e43e3c3cf22f7ab:
+  title: 'signal: Replace BUG_ON()s'
+  mainline: 7f8af7bac5380f2d95a63a6f19964e22437166e1
+  upstream: 0f9c27fbb8a52c50ff7d2659386f1f43e7fbddee
+26883705cb402fecd342e313afc02958f3c4c9e2:
+  title: 'ALSA: asihpi: Fix potential OOB array access'
+  mainline: 7b986c7430a6bb68d523dac7bfc74cbd5b44ef96
+  upstream: a6bdb691cf7b66dcd929de1a253c5c42edd2e522
+8835daf1e8994a559b89b4935218a7f9f0edefb2:
+  title: 'ALSA: hdsp: Break infinite MIDI input flush loop'
+  mainline: c01f3815453e2d5f699ccd8c8c1f93a5b8669e59
+  upstream: dc0c68e2e6e2c544b1361baa1ca230569ab6279d
+5c788f3e00af8da7b9e127980d0d782713d0ac6b:
+  title: 'fbdev: pxafb: Fix possible use after free in pxafb_task()'
+  mainline: 4a6921095eb04a900e0000da83d9475eb958e61e
+  upstream: e657fa2df4429f3805a9b3e47fb1a4a1b02a72bd
+c44e3d43c84de7db15a4743c5683c5cef64e986e:
+  title: 'power: reset: brcmstb: Do not go into infinite loop if reset fails'
+  mainline: cf8c39b00e982fa506b16f9d76657838c09150cb
+  upstream: 61a6d482734804e0a81c3951b8a0d3852085a2cc
+c9591bc1d6b4f3722215d12cc1626f04783b63bf:
+  title: 'ata: sata_sil: Rename sil_blacklist to sil_quirks'
+  mainline: 93b0f9e11ce511353c65b7f924cf5f95bd9c3aba
+  upstream: a57a97bb79d5123442068f887e5f1614ed4c752c
+ac92419af8e1b7f89db62054d06b3be6baa5bb41:
+  title: 'jfs: UBSAN: shift-out-of-bounds in dbFindBits'
+  mainline: b0b2fc815e514221f01384f39fbfbff65d897e1c
+  upstream: 830d908130d88745f0fd3ed9912cc381edf11ff1
+79bf2ab235866b9421e5606ebed6984c19f2e0ae:
+  title: 'jfs: Fix uaf in dbFreeBits'
+  mainline: d6c1b3599b2feb5c7291f5ac3a36e5fa7cedb234
+  upstream: 4ac58f7734937f3249da734ede946dfb3b1af5e4
+232dea142d9e232619aff122916b326975dd2511:
+  title: 'jfs: check if leafidx greater than num leaves per dmap tree'
+  mainline: d64ff0d2306713ff084d4b09f84ed1a8c75ecc32
+  upstream: d76b9a4c283c7535ae7c7c9b14984e75402951e1
+643f01f400ff296cd1263fcd1896e261b64ed1c6:
+  title: 'jfs: Fix uninit-value access of new_ea in ea_buffer'
+  mainline: 2b59ffad47db1c46af25ccad157bb3b25147c35c
+  upstream: 7b24d41d47a6805c45378debf8bd115675d41da8
+4e150b2ed11f1ce7bfe2e243637886862eda74d3:
+  title: 'drm/radeon/r100: Handle unknown family in r100_cp_init_microcode()'
+  mainline: c6dbab46324b1742b50dc2fb5c1fee2c28129439
+  upstream: 7d91358e819a2761a5feff67d902456aaf4e567a
+c19d34cfa203f3c75b5e25a6f657cb4a8adf372e:
+  title: 'of/irq: Refer to actual buffer size in of_irq_parse_one()'
+  mainline: 39ab331ab5d377a18fbf5a0e0b228205edfcc7f4
+  upstream: 64bf240f2dfc242d507c7f8404cd9938d61db7cc
+9d2a9cdceb4ae4c4bd1ee308052de6f10602cb15:
+  title: 'ext4: ext4_search_dir should return a proper error'
+  mainline: cd69f8f9de280e331c9e6ff689ced0a688a9ce8f
+  upstream: a15514ec9f080fe24ee71edf8b97b49ab9b8fc80
+6982e3324dbcc51b1cec4f5488fc6a0bbf7be4ad:
+  title: 'ext4: fix i_data_sem unlock order in ext4_ind_migrate()'
+  mainline: cc749e61c011c255d81b192a822db650c68b313f
+  upstream: 4192adefc9c570698821c5eb9873320eac2fcbf1
+19730760522e21af34cdab871e3908e7b7dc8521:
+  title: 'spi: s3c64xx: fix timeout counters in flush_fifo'
+  mainline: 68a16708d2503b6303d67abd43801e2ca40c208d
+  upstream: 12f47fdd4fb4c4592c9cfad6c21b3855a6bdadb8
+1fad7228e67992a1b120ff76b4887190ca32e8f6:
+  title: 'selftests: breakpoints: use remaining time to check if suspend succeed'
+  mainline: c66be905cda24fb782b91053b196bd2e966f95b7
+  upstream: 8dea5ffbd147f6708e2f70f04406d8b711873433
+e8219bced027378a40a33c1044eca3135db5e83d:
+  title: 'selftests: vDSO: fix vDSO symbols lookup for powerpc64'
+  mainline: ba83b3239e657469709d15dcea5f9b65bf9dbf34
+  upstream: 058d587e7f1520934823bae8f41db3c0b1097b59
+e9851b22b5a7211b32db852c9e6a6910230faebf:
+  title: 'i2c: xiic: Wait for TX empty to avoid missed TX NAKs'
+  mainline: 521da1e9225450bd323db5fa5bca942b1dc485b7
+  upstream: 8a6158421b417bb0841c4c7cb7a649707a1089d2
+e8c0b2c2e4064aa5e3f7fdb517265f788156fdc3:
+  title: 'spi: bcm63xx: Fix module autoloading'
+  mainline: 909f34f2462a99bf876f64c5c61c653213e32fce
+  upstream: 54feac119535e0273730720fe9a4683389f71bff
+7a6139e316c9dd16f9f3dcf8a225ddfbe487c6db:
+  title: 'perf/core: Fix small negative period being ignored'
+  mainline: 62c0b1061593d7012292f781f11145b2d46f43ab
+  upstream: 7fddba7b1bb6f1cc35269e510bc832feb3c54b11
+38e7f1b9fd9e1f67d748242d07a430c85f9024a8:
+  title: 'ALSA: core: add isascii() check to card ID generator'
+  mainline: d278a9de5e1837edbe57b2f1f95a104ff6c84846
+  upstream: 3b9b0efb330f9d2ab082b7f426993d7bac3f2c66
+9e7a4c15b80cc0547d89230298eb7d9e71afb999:
+  title: 'ext4: no need to continue when the number of entries is 1'
+  mainline: 1a00a393d6a7fb1e745a41edd09019bd6a0ad64c
+  upstream: 64c8c484242b141998f7408596ddb2dc6da4b1d3
+ffe3a60234391b1045ee3ed64896bf14da3613b3:
+  title: 'ext4: propagate errors from ext4_find_extent() in ext4_insert_range()'
+  mainline: 369c944ed1d7c3fb7b35f24e4735761153afe7b3
+  upstream: d38a882fadb0431747342637ad3a9166663e8a86
+d493509e9bd943f52ecb658bce751a5665491843:
+  title: 'ext4: fix incorrect tid assumption in __jbd2_log_wait_for_space()'
+  mainline: 972090651ee15e51abfb2160e986fa050cfc7a40
+  upstream: 330ecdae721e62cd7ee287fb3cd7f88afa26e85a
+5ddb510c87c40bf7bc87aa90c9e6689970ea7733:
+  title: 'ext4: aovid use-after-free in ext4_ext_insert_extent()'
+  mainline: a164f3a432aae62ca23d03e6d926b122ee5b860d
+  upstream: e17ebe4fdd7665c93ae9459ba40fcdfb76769ac1
+47c536f76d494c3b5e14839b5857c8f8dbba1242:
+  title: 'ext4: fix double brelse() the buffer of the extents path'
+  mainline: dcaa6c31134c0f515600111c38ed7750003e1b9c
+  upstream: d4574bda63906bf69660e001470bfe1a0ac524ae
+5a0581e18a4b83fc0931a64224872c539457d2cd:
+  title: 'ext4: fix incorrect tid assumption in ext4_wait_for_tail_page_commit()'
+  mainline: dd589b0f1445e1ea1085b98edca6e4d5dedb98d0
+  upstream: 93fd249f197eeca81bb1c744ac8aec2804afd219
+c87ca927b9e3d847d7c44ecf9f07528f1ef033e4:
+  title: 'of/irq: Support #msi-cells=<0> in of_msi_get_domain'
+  mainline: db8e81132cf051843c9a59b46fa5a071c45baeb3
+  upstream: 030de6c36c48a40f42d7d59732ee69990340e0a1
+d3355be0380a6ec95a835e359a68d4f42af056b8:
+  title: 'jbd2: stop waiting for space when jbd2_cleanup_journal_tail() returns error'
+  mainline: f5cacdc6f2bb2a9bf214469dd7112b43dd2dd68a
+  upstream: 801a35dfef6996f3d5eaa96a59caf00440d9165e
+0835b9f76d8069704f9620b14593572fb33fc20a:
+  title: 'ocfs2: fix the la space leak when unmounting an ocfs2 volume'
+  mainline: dfe6c5692fb525e5e90cefe306ee0dffae13d35f
+  upstream: 5a074861ae1b6262b50fa9780957db7d17b86672
+74930aa28c3a2c7c23718c81400a79bb362bc740:
+  title: 'ocfs2: fix uninit-value in ocfs2_get_block()'
+  mainline: 2af148ef8549a12f8025286b8825c2833ee6bcb8
+  upstream: e95da10e6fcac684895c334eca9d95e2fd10b0fe
+760f46ded0728ed84afb0a9859c89b0f92dca609:
+  title: 'ocfs2: reserve space for inline xattr before attaching reflink tree'
+  mainline: 5ca60b86f57a4d9648f68418a725b3a7de2816b0
+  upstream: 5c9807c523b4fca81d3e8e864dabc8c806402121
+a03082a35421c27be3c50fe1d15abf899546cc66:
+  title: 'ocfs2: cancel dqi_sync_work before freeing oinfo'
+  mainline: 35fccce29feb3706f649726d410122dd81b92c18
+  upstream: fc5cc716dfbdc5fd5f373ff3b51358174cf88bfc
+1ca500197bcc7e1e485788aed1dacdfb9f973ff9:
+  title: 'ocfs2: remove unreasonable unlock in ocfs2_read_blocks'
+  mainline: c03a82b4a0c935774afa01fd6d128b444fd930a1
+  upstream: 5245f109b4afb6595360d4c180d483a6d2009a59
+c3bd19a739dcaaae0cbab86f0c0b0b27eda93601:
+  title: 'ocfs2: fix null-ptr-deref when journal load failed.'
+  mainline: 5784d9fcfd43bd853654bb80c87ef293b9e8e80a
+  upstream: fd89d92c1140cee8f59de336cb37fa65e359c123
+ae8eab265d15a47a46d1c6b58a75d801814cb86c:
+  title: 'ocfs2: fix possible null-ptr-deref in ocfs2_set_buffer_uptodate'
+  mainline: 33b525cef4cff49e216e4133cc48452e11c0391e
+  upstream: 190d98bcd61117a78fe185222d162180f061a6ca
+fb101f7fce16d22e18b8bf9fa9d13373f38536e6:
+  title: 'clk: rockchip: fix error for unknown clocks'
+  mainline: 12fd64babaca4dc09d072f63eda76ba44119816a
+  upstream: 2f1e1a9047b1644d05284fc0da1d6ab9c4434cf6
+62369afcf4db28d2c18ed331f75448c97ee53bac:
+  title: 'media: uapi/linux/cec.h: cec_msg_set_reply_to: zero flags'
+  mainline: 599f6899051cb70c4e0aa9fd591b9ee220cb6f14
+  upstream: 4afab2197e530b480c4cc099255d12a08c6a1f93
+66dd5129c4b2756157ab65da5826aba26c3adc1d:
+  title: 'media: venus: fix use after free bug in venus_remove due to race condition'
+  mainline: c5a85ed88e043474161bbfe54002c89c1cb50ee2
+  upstream: 5098b9e6377577fe13d03e1d8914930f014a3314
+8eafd43568c906c485c18f684d67a19ec2e4edcd:
+  title: 'iio: magnetometer: ak8975: Fix reading for ak099xx sensors'
+  mainline: 129464e86c7445a858b790ac2d28d35f58256bbe
+  upstream: 2e78095a0cc35d6210de051accb2fe45649087cd
+f24bdf3d0d8335026c719db068c6472acbf0839d:
+  title: 'tomoyo: fallback to realpath if symlink''s pathname does not exist'
+  mainline: ada1986d07976d60bed5017aa38b7f7cf27883f7
+  upstream: 455246846468503ac739924d5b63af32c6261b31
+bd7cd397ff7943c113c695eb7cd40b4b6afc06bc:
+  title: 'Input: adp5589-keys - fix adp5589_gpio_get_value()'
+  mainline: c684771630e64bc39bddffeb65dd8a6612a6b249
+  upstream: 9ff7ae486d51c0da706a29b116d7fa399db677f5
+3fd6acda2f9ff74d3281d09cc1ce73e4ad65c469:
+  title: 'btrfs: wait for fixup workers before stopping cleaner kthread during umount'
+  mainline: 41fd1e94066a815a7ab0a7025359e9b40e4b3576
+  upstream: cd686dfff63f27d712877aef5b962fbf6b8bc264
+1acfbc7cdb47b0749f0cd34c0f2b622127307b1b:
+  title: 'gpio: davinci: fix lazy disable'
+  mainline: 3360d41f4ac490282fddc3ccc0b58679aa5c065d
+  upstream: e9b751c0d7abde1837ee1510cbdc705570107ef1
+57d9a27da5d76dde393792654826c5371b51c77b:
+  title: 'arm64: Add Cortex-715 CPU part definition'
+  mainline: 07e39e60bbf0ccd5f895568e1afca032193705c0
+  upstream: 3781b92af63e7a53805e105875d4dace65bcefef
+0a56f80bfe3292c9e87a85762ac9693abadec8c5:
+  title: 'uprobes: fix kernel info leak via "[uprobes]" vma'
+  mainline: 34820304cc2cd1804ee1f8f3504ec77813d29c8e
+  upstream: f31f92107e5a8ecc8902705122c594e979a351fe
+2c85a79aba7b7724ff506258d04032d4f1b4f503:
+  title: 'nfsd: use ktime_get_seconds() for timestamps'
+  mainline: b3f255ef6bffc18a28c3b6295357f2a3380c033f
+  upstream: f81fcf39509d30cb5f1c659099c1d8f0c2a9a57a
+2002a57e83b51260eb9de16d0935c7291c203c13:
+  title: 'nfsd: fix delegation_blocked() to block correctly for at least 30 seconds'
+  mainline: 45bb63ed20e02ae146336412889fe5450316a84f
+  upstream: ccbd18223985635b8dbb1393bacac9e1a5fa3f2f
+36949604b7d7db06dd36f3871bf9c2d6a06d8b89:
+  title: 'ext4: fix inode tree inconsistency caused by ENOMEM'
+  mainline: 3f5424790d4377839093b68c12b130077a4e4510
+  upstream: eea5a4e7fe4424245aeba77bb0f24a38a1bead16
+825559c99e1897b27fe9034af05c2d4febcf50e2:
+  title: 'tracing: Remove precision vsnprintf() check from print event'
+  mainline: 5efd3e2aef91d2d812290dcb25b2058e6f3f532c
+  upstream: f3de4b5d1ab8139aee39cc8afbd86a2cf260ad91
+c69c205a6a13dbe8ff4f2b65ce5170a4e182edae:
+  title: 'virtio_console: fix misc probe bugs'
+  mainline: b9efbe2b8f0177fa97bfab290d60858900aa196b
+  upstream: 42a7c0fd6e5b7c5db8af8ab2bab6eff2a723b168
+fe91966767513b8ae7f637bfc2c2fb68636a37dc:
+  title: 's390/facility: Disable compile time optimization for decompressor code'
+  mainline: 0147addc4fb72a39448b8873d8acdf3a0f29aa65
+  upstream: f559306a168fb92a936beaa1f020f5c45cdedac6
+cc84719d9b691915a4fde154667d84e2ad74a0c9:
+  title: 's390/mm: Add cond_resched() to cmm_alloc/free_pages()'
+  mainline: 131b8db78558120f58c5dc745ea9655f6b854162
+  upstream: a12b82d741350b89b4df55fa8a4e5c0579d919cb
+0c92a05a334ec247c1c27ecfd35705b865a2eb5d:
+  title: 'ext4: nested locking for xattr inode'
+  mainline: d1bc560e9a9c78d0b2314692847fc8661e0aeb99
+  upstream: c0f57dd0f1603ae27ef694bacde66147f9d57d32
+2ac0320e88b9c9005998c2e3b5734f7961070cc6:
+  title: 'clk: bcm: bcm53573: fix OF node leak in init'
+  mainline: f92d67e23b8caa81f6322a2bad1d633b00ca000e
+  upstream: 8ac316aed34fa1a49ebbaa93465bf8bfe73e9937
+98450b5f38eb8a75e2b40b3174bc00600347d329:
+  title: 'i2c: i801: Use a different adapter-name for IDF adapters'
+  mainline: 43457ada98c824f310adb7bd96bd5f2fcd9a3279
+  upstream: a2eb6e5a03de2ecbba68384c1c8f2a34c89ed7b8
+3df84428b103d405f250cfdf5936537dedc7c2fd:
+  title: 'media: videobuf2-core: clear memory related fields in __vb2_plane_dmabuf_put()'
+  mainline: 6a9c97ab6b7e85697e0b74e86062192a5ffffd99
+  upstream: 940e83f377cb3863bd5a4e483ef1b228fbc86812
+fffec2079f8107bb33fd1a1928239c142510aa2f:
+  title: 'usb: chipidea: udc: enable suspend interrupt after usb reset'
+  mainline: e4fdcc10092fb244218013bfe8ff01c55d54e8e4
+  upstream: 93233aa73b3ac373ffd4dd9e6fb7217a8051b760
+ca910899b554f8d476bcf4b14980f8845269e742:
+  title: 'tools/iio: Add memory allocation failure check for trigger_name'
+  mainline: 3c6b818b097dd6932859bcc3d6722a74ec5931c1
+  upstream: e0daff560940b0d370d4328b9ff9294b7f893daa
+a22a1046d7d1b88568ba8da927e821b4f0babaac:
+  title: 'driver core: bus: Return -EIO instead of 0 when show/store invalid bus attribute'
+  mainline: c0fd973c108cdc22a384854bc4b3e288a9717bb2
+  upstream: aca863154863d0a97305a089399cee1d39e852da
+ef5963eabdc48181eee93f7233f433cc2a588ea2:
+  title: 'fbdev: sisfb: Fix strbuf array overflow'
+  mainline: 9cf14f5a2746c19455ce9cb44341b5527b5e19c3
+  upstream: 433c84c8495008922534c5cafdae6ff970fb3241
+5e4b995a3aca9fdd2272546ec5667c32747443f4:
+  title: 'tcp: fix tcp_enter_recovery() to zero retrans_stamp when it''s safe'
+  mainline: b41b4cbd9655bcebcce941bef3601db8110335be
+  upstream: a58878d7106b229a2d91a647629a0a7bedccaa8a
+29037061623d008c997450f67e5b5d05f756bb7c:
+  title: 'netfilter: br_netfilter: fix panic with metadata_dst skb'
+  mainline: f9ff7665cd128012868098bbd07e28993e314fdb
+  upstream: f07131239a76cc10d5e82c19d91f53cb55727297
+648c574af6e92af84ebd54f3d8044c21ae820655:
+  title: 'Bluetooth: RFCOMM: FIX possible deadlock in rfcomm_sk_state_change'
+  mainline: 08d1914293dae38350b8088980e59fbc699a72fe
+  upstream: b77b3fb12fd483cae7c28648903b1d8a6b275f01
+55a6946bb46cdc7b528dfbd30bb2fb2376525619:
+  title: 'gpio: aspeed: Add the flush write to ensure the write complete.'
+  mainline: 1bb5a99e1f3fd27accb804aa0443a789161f843c
+  upstream: 8c4d52b80f2d9dcc5053226ddd18a3bb1177c8ed
+5a801c62a51b1c210698f59e40aa5417f071d7fc:
+  title: 'igb: Do not bring the device up after non-fatal error'
+  mainline: 330a699ecbfc9c26ec92c6310686da1230b4e7eb
+  upstream: dca2ca65a8695d9593e2cf1b40848e073ad75413
+1fde287fcb280b7ae6a4a0b3edc99dc455a5c30d:
+  title: 'net: ibm: emac: mal: fix wrong goto'
+  mainline: 08c8acc9d8f3f70d62dd928571368d5018206490
+  upstream: 4bd7823cacb21e32f3750828148ed5d18d3bf007
+cebdbf6f73b01661300d39d2064f6d5c69f24f8d:
+  title: 'ppp: fix ppp_async_encode() illegal access'
+  mainline: 40dddd4b8bd08a69471efd96107a4e1c73fabefc
+  upstream: 4151ec65abd755133ebec687218fadd2d2631167
+a5b30e4f682b2971d4455afa1b3d3531d37534e6:
+  title: 'CDC-NCM: avoid overflow in sanity checking'
+  mainline: 8d2b1a1ec9f559d30b724877da4ce592edc41fdc
+  upstream: a612395c7631918e0e10ea48b9ce5ab4340f26a6
+35af89640d1d44ff6c7973922c43c4f5b83af8b9:
+  title: 'HID: plantronics: Workaround for an unexcepted opposite volume key'
+  mainline: 87b696209007b7c4ef7bdfe39ea0253404a43770
+  upstream: b1ce11ce52359eefa7bc33be13e946a7154fd35f
+93cddf4d4c509f0ec53017297294d0a302ffd0da:
+  title: 'Revert "usb: yurex: Replace snprintf() with the safer scnprintf() variant"'
+  mainline: 71c717cd8a2e180126932cc6851ff21c1d04d69a
+  upstream: 6f8f23390160355a4a571230986d524fd3929c2a
+dc89df53f4c97dedfcb4568191037e3ebeef159d:
+  title: 'usb: xhci: Fix problem with xhci resume from suspend'
+  mainline: d44238d8254a36249d576c96473269dbe500f5e4
+  upstream: 52e998173cfed7d6953b3185f2da174712ce4a8f
+b742600e3e092e2857196e7173387925a5111631:
+  title: 'usb: storage: ignore bogus device raised by JieLi BR21 USB sound chip'
+  mainline: a6555cb1cb69db479d0760e392c175ba32426842
+  upstream: 7a8df891d679d6627d91e334a734578ca16518eb
+44dcccd712b6d2c691634dfd49fa5903ad691fc8:
+  title: 'net: Fix an unsafe loop on the list'
+  mainline: 1dae9f1187189bc09ff6d25ca97ead711f7e26f9
+  upstream: 464801a0f6ccb52b21faa33bac6014fd74cc5e10
+d669e5f7d2c8746e3ed062d73b9426fb09039573:
+  title: 'posix-clock: Fix missing timespec64 check in pc_clock_settime()'
+  mainline: d8794ac20a299b647ba9958f6d657051fc51a540
+  upstream: 29f085345cde24566efb751f39e5d367c381c584
+7d6f8b1d7746e0b3269b0e61c8d374d09a6b771b:
+  title: 'arm64: probes: Remove broken LDR (literal) uprobe support'
+  mainline: acc450aa07099d071b18174c22a1119c57da8227
+  upstream: cc86f2e9876c8b5300238cec6bf0bd8c842078ee
+ed1774c811054dd8ff235b4830782572676f7b00:
+  title: 'arm64: probes: Fix simulate_ldr*_literal()'
+  mainline: 50f813e57601c22b6f26ced3193b9b94d70a2640
+  upstream: 19f4d3a94c77295ee3a7bbac91e466955f458671
+9b9e89aeb9b0df1de45bb186662572a1b8b921e4:
+  title: 'PCI: Add function 0 DMA alias quirk for Glenfly Arise chip'
+  mainline: 9246b487ab3c3b5993aae7552b7a4c541cc14a49
+  upstream: 029efe3b57d981b0c239e50f3513838cae121578
+5a2b55312783d9a4f60898793dd5aadea0360504:
+  title: 'fat: fix uninitialized variable'
+  mainline: 963a7f4d3b90ee195b895ca06b95757fcba02d1a
+  upstream: 09b2d2a2267187336b446f4c08e6204c30688bcf
+70b388b0efb874251eee3df2059246413ee623e7:
+  title: 'KVM: Fix a data race on last_boosted_vcpu in kvm_vcpu_on_spin()'
+  mainline: 49f683b41f28918df3e51ddc0d928cb2e934ccdb
+  upstream: 11a772d5376aa6d3e2e69b5b5c585f79b60c0e17
+b291c7c1eed423874cdbc28d717d0f4944b4b0fc:
+  title: 's390/sclp_vt220: Convert newlines to CRLF instead of LFCR'
+  mainline: dee3df68ab4b00fff6bdf9fc39541729af37307c
+  upstream: ce6924fdafb09a7231ecfcea119b4e4c83023c97
+4386af4473d15479b5c96b9941faf351b614bfbb:
+  title: 'KVM: s390: Change virtual to physical address access in diag 0x258 handler'
+  mainline: cad4b3d4ab1f062708fff33f44d246853f51e966
+  upstream: a9dee098c6931dfd75abe015b04c1c66fa1507f6
+67d246dc91071f9cc960c2f6f969857bb2922c7f:
+  title: 'x86/cpufeatures: Define X86_FEATURE_AMD_IBPB_RET'
+  mainline: ff898623af2ed564300752bba83a680a1e4fec8d
+  upstream: 9e460c6c7c8b72c4c23853627789c812fd2c3cf5
+bc865c54ef9ef2e2ef7097787e63ed03b1d5b6bc:
+  title: 'drm/vmwgfx: Handle surface check failure correctly'
+  mainline: 26498b8d54373d31a621d7dec95c4bd842563b3b
+  upstream: f924af529417292c74c043c627289f56ad95a002
+76b3e6598c2a4f5ecf6ae67f03f4fb0f85f90a61:
+  title: 'iio: dac: stm32-dac-core: add missing select REGMAP_MMIO in Kconfig'
+  mainline: 27b6aa68a68105086aef9f0cb541cd688e5edea8
+  upstream: 842911035eb20561218a0742f3e54e7978799c6a
+6e6aa73932d86ce5335cdb2e50f9c9c46ad85b53:
+  title: 'iio: hid-sensors: Fix an error handling path in _hid_sensor_set_report_latency()'
+  mainline: 3a29b84cf7fbf912a6ab1b9c886746f02b74ea25
+  upstream: 485744b5bd1f15a3ce50f70af52a9d68761c57dd
+abf9b8555e8b720496841609025a6c9aa1a9188f:
+  title: 'iio: light: opt3001: add missing full-scale range value'
+  mainline: 530688e39c644543b71bdd9cb45fdfb458a28eaa
+  upstream: 4401780146a19d65df6f49d5273855f33c9c0a35
+edc69f40262617c7257c732edc12d613a9687e86:
+  title: 'Bluetooth: btusb: Fix regression with fake CSR controllers 0a12:0001'
+  mainline: 2c1dda2acc4192d826e84008d963b528e24d12bc
+  upstream: e32ae4a12628bb2c1046715f47ea7d57fc2b9cbf
+98205e0fb61135f36e438d637862d78061396814:
+  title: 'xhci: Fix incorrect stream context type macro'
+  mainline: 6599b6a6fa8060145046d0744456b6abdb3122a7
+  upstream: e76b961d32fd94c7af80bc0ea35e345f1f838c59
+14f0ba83331cb218f676f0cf81cda64c290c3ed4:
+  title: 'USB: serial: option: add support for Quectel EG916Q-GL'
+  mainline: 540eff5d7faf0c9330ec762da49df453263f7676
+  upstream: cdb2c8b31ea3ba692c9ab213369b095e794c8f39
+1128e72fca7832afc143680fe12d0c938b3270d7:
+  title: 'USB: serial: option: add Telit FN920C04 MBIM compositions'
+  mainline: 6d951576ee16430822a8dee1e5c54d160e1de87d
+  upstream: 20cc2b146a8748902a5e4f5aa70457f48174b5c4
+f3fce0c6ccd5abc38c912f3233df450af041b90c:
+  title: 'parport: Proper fix for array out-of-bounds access'
+  mainline: 02ac3a9ef3a18b58d8f3ea2b6e46de657bf6c4f9
+  upstream: 8aadef73ba3b325704ed5cfc4696a25c350182cf
+adeaa3e2c7e54bbd83852d8e302ca76d7a1f256d:
+  title: 'x86/apic: Always explicitly disarm TSC-deadline timer'
+  mainline: ffd95846c6ec6cf1f93da411ea10d504036cab42
+  upstream: e75562346cac53c7e933373a004b1829e861123a
+4ff716b2bb631baecc1eb6eca17a3d23b2850ad7:
+  title: 'nilfs2: propagate directory read errors from nilfs_find_entry()'
+  mainline: 08cfa12adf888db98879dbd735bc741360a34168
+  upstream: bb857ae1efd3138c653239ed1e7aef14e1242c81
+85ee27f8ef66432d98e386248c7d8fa90a092b9d:
+  title: 'RDMA/bnxt_re: Fix incorrect AVID type in WQE structure'
+  mainline: 9ab20f76ae9fad55ebaf36bdff04aea1c2552374
+  upstream: 3e98839514a883188710c5467cf3b62a36c7885a
+6371ff58cca7cd85a5f875a9e08b51f3bfa55a6e:
+  title: 'RDMA/cxgb4: Fix RDMA_CM_EVENT_UNREACHABLE error for iWARP'
+  mainline: c659b405b82ead335bee6eb33f9691bf718e21e8
+  upstream: 361576c9d34bd16b089864545073db383e372ba8
+093416fbc1a9209422cb76784577eae3430a207d:
+  title: 'RDMA/bnxt_re: Return more meaningful error'
+  mainline: 98647df0178df215b8239c5c365537283b2852a6
+  upstream: 8fb8f613a904d3ccf61fa824a95f2fa2c3b8f191
+e28fdf954db36a46cba23d2fe2d01635cca2063f:
+  title: 'net: ethernet: aeroflex: fix potential memory leak in greth_start_xmit_gbit()'
+  mainline: cf57b5d7a2aad456719152ecd12007fe031628a3
+  upstream: 7517c13ae14dac758e4ec0d881e463a8315bbc7d
+69215607dc1760d491ac751b05456a18b8adf01d:
+  title: 'net: systemport: fix potential memory leak in bcm_sysport_xmit()'
+  mainline: c401ed1c709948e57945485088413e1bb5e94bd1
+  upstream: 8e81ce7d0166a2249deb6d5e42f28a8b8c9ea72f
+e0a01897a0cdcee042136aa737dda898b2a2cb60:
+  title: 'Bluetooth: bnep: fix wild-memory-access in proto_unregister'
+  mainline: 64a90991ba8d4e32e3173ddd83d0b24167a5668c
+  upstream: e232728242c4e98fb30e4c6bedb6ba8b482b6301
+644ca3d02eed5d09144291c2700a14cb2183bc0d:
+  title: arm64:uprobe fix the uprobe SWBP_INSN in big-endian
+  mainline: 60f07e22a73d318cddaafa5ef41a10476807cc07
+  upstream: 8fd414d25465bb666c71b5490fa939411e49228b
+e33413f73e839b4c49efa91f2a26d4fde33361e4:
+  title: 'arm64: probes: Fix uprobes for big-endian kernels'
+  mainline: 13f8f1e05f1dc36dbba6cba0ae03354c0dafcde7
+  upstream: b6a638cb600e13f94b5464724eaa6ab7f3349ca2
+531aa0f03b79233bfcfe6e067b0b04a0e8494817:
+  title: 'jfs: Fix sanity check in dbMount'
+  mainline: 67373ca8404fe57eb1bb4b57f314cff77ce54932
+  upstream: ea462ee11dbc4eb779146313d3abf5e5187775e1
+db382d47beb9d7e9c0d27f0c5d866b67148ca799:
+  title: 'net/sun3_82586: fix potential memory leak in sun3_82586_send_packet()'
+  mainline: 2cb3f56e827abb22c4168ad0c1bbbf401bb2f3b8
+  upstream: 137010d26dc5cd47cd62fef77cbe952d31951b7a
+9f21e06d2a8bb717e49f8ef4a96672f939380c03:
+  title: 'be2net: fix potential memory leak in be_xmit()'
+  mainline: e4dd8bfe0f6a23acd305f9b892c00899089bd621
+  upstream: 941026023c256939943a47d1c66671526befbb26
+2ca8893515d6c0360b38a5ebb726322c28f2585e:
+  title: 'net: usb: usbnet: fix name regression'
+  mainline: 8a7d12d674ac6f2147c18f36d1e15f1a48060edf
+  upstream: 8f83f28d93d380fa4083f6a80fd7793f650e5278
+d792e0c744f67188b6e873a2dd188f1f03dc4f3b:
+  title: 'posix-clock: posix-clock: Fix unbalanced locking in pc_clock_settime()'
+  mainline: 6e62807c7fbb3c758d233018caf94dfea9c65dbd
+  upstream: d005400262ddaf1ca1666bbcd1acf42fe81d57ce
+9612b486b817fa6fc19b8fe9a81bd547c476e6c6:
+  title: 'nilfs2: fix kernel bug due to missing clearing of buffer delay flag'
+  mainline: 6ed469df0bfbef3e4b44fca954a781919db9f7ab
+  upstream: 033bc52f35868c2493a2d95c56ece7fc155d7cb3
+8877c26f575b56ea80275c39aeb6e9ae85aafad1:
+  title: 'arm64/uprobes: change the uprobe_opcode_t typedef to fix the sparse warning'
+  mainline: ef08c0fadd8a17ebe429b85e23952dac3263ad34
+  upstream: 974955b61fe226c0d837106738fc0fb5910d67a8
+7ca707ec81d8be129613f262fbffe9e15d327167:
+  title: 'xfrm: validate new SA''s prefixlen using SA family when sel.family is unset'
+  mainline: 3f0ab59e6537c6a8f9e1b355b48f9c05a76e8563
+  upstream: f31398570acf0f0804c644006f7bfa9067106b0a
+db7bbe2185d31a31d50702582589d967d016587e:
+  title: 'cgroup: Fix potential overflow issue when checking max_depth'
+  mainline: 3cc4e13bb1617f6a13e5e6882465984148743cf4
+  upstream: 339df130db47ae7e89fddce5729b0f0566405d1d
+38b579881e78d85e81e8625fb057a96e45b3adc6:
+  title: 'wifi: mac80211: skip non-uploaded keys in ieee80211_iter_keys'
+  mainline: 52009b419355195912a628d0a9847922e90c348c
+  upstream: c9cf9510970e5b33e5bc21377380f1cf61685ed0
+ebfd3809b08074d25f038a1300971645bbe98b5b:
+  title: 'gtp: simplify error handling code in ''gtp_encap_enable()'''
+  mainline: b289ba5e07105548b8219695e5443d807a825eb8
+  upstream: 66f635f6ae87c35bd1bda16927e9393cacd05ee4
+7f3a3eeed91e7c7bff96403270e2471fd29873b2:
+  title: 'gtp: allow -1 to be specified as file description from userspace'
+  mainline: 7515e37bce5c428a56a9b04ea7e96b3f53f17150
+  upstream: 63d8172188c759c44cae7a57eece140e0b90a2e1
+69fcd1905bea29c01c7a659aa16268f2b40ebce8:
+  title: 'net/sched: stop qdisc_tree_reduce_backlog on TC_H_ROOT'
+  mainline: 2e95c4384438adeaa772caa560244b1a2efef816
+  upstream: e7f9a6f97eb067599a74f3bcb6761976b0ed303e
+a829200ea0a4ce6e889bf23df1bfbee34daf9746:
+  title: 'net: support ip generic csum processing in skb_csum_hwoffload_help'
+  mainline: 62fafcd63139920eb25b3fbf154177ce3e6f3232
+  upstream: 2c88668d57735d4ff65ce35747c8aa6662cc5013
+d2216921d39819c8ba0f48dc6fd2c15e6290b6cd:
+  title: 'net: skip offload for NETIF_F_IPV6_CSUM if ipv6 header contains extension'
+  mainline: 04c20a9356f283da623903e81e7c6d5df7e4dc3c
+  upstream: bcefc3cd7f592a70fcbbbfd7ad1fbc69172ea78b
+51fb462970ebd4757675ab968175a3047847fa1d:
+  title: 'netfilter: nft_payload: sanitize offset and length before calling skb_checksum()'
+  mainline: d5953d680f7e96208c29ce4139a0e38de87a57fe
+  upstream: a661ed364ae6ae88c2fafa9ddc27df1af2a73701
+3551df53194d0dfd74258bea61b7f82b3b97105e:
+  title: 'net: amd: mvme147: Fix probe banner message'
+  mainline: 82c5b53140faf89c31ea2b3a0985a2f291694169
+  upstream: 34f2d9975aff5ddb9e15e4ddd58528c8fd570c4a
+5a9eb453112676da334380bda6fb9e7b126d04d9:
+  title: 'misc: sgi-gru: Don''t disable preemption in GRU driver'
+  mainline: b983b271662bd6104d429b0fd97af3333ba760bf
+  upstream: 88a0888162b375d79872fb1dece834bebea76fe3
+6fb928dc4510f0382b79a2960b0c8fae57c76a33:
+  title: 'usb: phy: Fix API devm_usb_put_phy() can not release the phy'
+  mainline: fdce49b5da6e0fb6d077986dec3e90ef2b094b50
+  upstream: 3a5693be9a47d368d39fee08325f5bf6cdd2ebaf
+b166e22b1f580bef5d1b09e00de9d718d7bb2eeb:
+  title: 'xhci: Fix Link TRB DMA in command ring stopped completion event'
+  mainline: 075919f6df5dd82ad0b1894898b315fbb3c29b84
+  upstream: d55d92597b7143f70e2db6108dac521d231ffa29
+6a8dc3623eedca5d2fe8ac115d05cdf0e7def887:
+  title: 'Revert "driver core: Fix uevent_show() vs driver detach race"'
+  mainline: 9a71892cbcdb9d1459c84f5a4c722b14354158a5
+  upstream: fe10c8367687c27172a10ba5cc849bd82077bd7d
+c2faf8e8c6c985e70a6c3174e9f1b53d440a8b51:
+  title: 'wifi: mac80211: do not pass a stopped vif to the driver in .get_txpower'
+  mainline: 393b6bc174b0dd21bb2a36c13b36e62fc3474a23
+  upstream: b0b862aa3dbcd16b3c4715259a825f48ca540088
+c7df04a616677a7c4473babee0b81900a2728200:
+  title: 'wifi: iwlegacy: Clear stale interrupts before resuming device'
+  mainline: 07c90acb071b9954e1fecb1e4f4f13d12c544b34
+  upstream: 271d282ecc15d7012e71ca82c89a6c0e13a063dd
+452c0cdb1398e3788d1af22b061acaebfa8a3915:
+  title: 'nilfs2: fix potential deadlock with newly created symlinks'
+  mainline: b3a033e3ecd3471248d474ef263aadc0059e516a
+  upstream: cc38c596e648575ce58bfc31623a6506eda4b94a
+f38c624794c3ea409b8ee122b2a9a9f7df076a25:
+  title: 'ocfs2: pass u64 to ocfs2_truncate_inline maybe overflow'
+  mainline: bc0a2f3a73fcdac651fca64df39306d1e5ebe3b0
+  upstream: 27d95867bee806cdc448d122bd99f1d8b0544035
+53f13ddee939d270ae9524040c1d9b45321fb656:
+  title: 'nilfs2: fix kernel bug due to missing clearing of checked flag'
+  mainline: 41e192ad2779cae0102879612dfe46726e4396aa
+  upstream: 994b2fa13a6c9cf3feca93090a9c337d48e3d60d
--- a/.elts/upstream/4.19.323.yaml
+++ b/.elts/upstream/4.19.323.yaml
--- a/.gitignore
+++ b/.gitignore
@@ -104,7 +104,6 @@ GTAGS
 # id-utils files
 ID

-*.orig
 *~
 \#*#

--- a/Documentation/IPMI.txt
+++ b/Documentation/IPMI.txt
@@ -516,7 +516,7 @@ at module load time (for a module) with::
 	[dbg_probe=1]

 The addresses are normal I2C addresses.  The adapter is the string
-name of the adapter, as shown in /sys/class/i2c-adapter/i2c-<n>/name.
+name of the adapter, as shown in /sys/bus/i2c/devices/i2c-<n>/name.
 It is *NOT* i2c-<n> itself.  Also, the comparison is done ignoring
 spaces, so if the name is "This is an I2C chip" you can say
 adapter_name=ThisisanI2cchip.  This is because it's hard to pass in
--- a/4
+++ b/4
@@ -1,8 +1,8 @@
 # SPDX-License-Identifier: GPL-2.0
 VERSION = 4
 PATCHLEVEL = 14
-SUBLEVEL = 355
-EXTRAVERSION = -openela
+SUBLEVEL = 356
+EXTRAVERSION = -openela-rc1
 NAME = Petit Gorille

 # *DOCUMENTATION*
--- a/arch/arm/mach-realview/platsmp-dt.c
+++ b/arch/arm/mach-realview/platsmp-dt.c
@@ -70,6 +70,7 @@ static void __init realview_smp_prepare_cpus(unsigned int max_cpus)
 		return;
 	}
 	map = syscon_node_to_regmap(np);
+	of_node_put(np);
 	if (IS_ERR(map)) {
 		pr_err("PLATSMP: No syscon regmap\n");
 		return;
--- a/arch/arm64/boot/dts/rockchip/rk3399-puma.dtsi
+++ b/arch/arm64/boot/dts/rockchip/rk3399-puma.dtsi
@@ -184,6 +184,22 @@
 	status = "okay";
 };

+&gpio3 {
+	/*
+	 * The Qseven BIOS_DISABLE signal on the RK3399-Q7 keeps the on-module
+	 * eMMC and SPI flash powered-down initially (in fact it keeps the
+	 * reset signal asserted). BIOS_DISABLE_OVERRIDE pin allows to override
+	 * that signal so that eMMC and SPI can be used regardless of the state
+	 * of the signal.
+	 */
+	bios-disable-override-hog {
+		gpios = <RK_PD5 GPIO_ACTIVE_LOW>;
+		gpio-hog;
+		line-name = "bios_disable_override";
+		output-high;
+	};
+};
+
 &gmac {
 	assigned-clocks = <&cru SCLK_RMII_SRC>;
 	assigned-clock-parents = <&clkin_gmac>;
@@ -449,9 +465,14 @@

 &pinctrl {
 	pinctrl-names = "default";
-	pinctrl-0 = <&q7_thermal_pin>;
+	pinctrl-0 = <&q7_thermal_pin &bios_disable_override_hog_pin>;

 	gpios {
+		bios_disable_override_hog_pin: bios-disable-override-hog-pin {
+			rockchip,pins =
+				<3 RK_PD5 RK_FUNC_GPIO &pcfg_pull_down>;
+		};
+
 		q7_thermal_pin: q7-thermal-pin {
 			rockchip,pins =
 				<0 RK_PA3 RK_FUNC_GPIO &pcfg_pull_up>;
--- a/arch/arm64/include/asm/cputype.h
+++ b/arch/arm64/include/asm/cputype.h
@@ -98,6 +98,7 @@
 #define ARM_CPU_PART_CORTEX_A78		0xD41
 #define ARM_CPU_PART_CORTEX_X1		0xD44
 #define ARM_CPU_PART_CORTEX_A710	0xD47
+#define ARM_CPU_PART_CORTEX_A715	0xD4D
 #define ARM_CPU_PART_CORTEX_X2		0xD48
 #define ARM_CPU_PART_NEOVERSE_N2	0xD49
 #define ARM_CPU_PART_CORTEX_A78C	0xD4B
@@ -135,6 +136,7 @@
 #define MIDR_CORTEX_A78	MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_A78)
 #define MIDR_CORTEX_X1	MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_X1)
 #define MIDR_CORTEX_A710 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_A710)
+#define MIDR_CORTEX_A715 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_A715)
 #define MIDR_CORTEX_X2 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_X2)
 #define MIDR_NEOVERSE_N2 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_NEOVERSE_N2)
 #define MIDR_CORTEX_A78C	MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_A78C)
--- a/arch/arm64/include/asm/uprobes.h
+++ b/arch/arm64/include/asm/uprobes.h
@@ -13,21 +13,19 @@
 #include <asm/insn.h>
 #include <asm/probes.h>

-#define MAX_UINSN_BYTES		AARCH64_INSN_SIZE
-
-#define UPROBE_SWBP_INSN	BRK64_OPCODE_UPROBES
+#define UPROBE_SWBP_INSN	cpu_to_le32(BRK64_OPCODE_UPROBES)
 #define UPROBE_SWBP_INSN_SIZE	AARCH64_INSN_SIZE
-#define UPROBE_XOL_SLOT_BYTES	MAX_UINSN_BYTES
+#define UPROBE_XOL_SLOT_BYTES	AARCH64_INSN_SIZE

-typedef u32 uprobe_opcode_t;
+typedef __le32 uprobe_opcode_t;

 struct arch_uprobe_task {
 };

 struct arch_uprobe {
 	union {
-		u8 insn[MAX_UINSN_BYTES];
-		u8 ixol[MAX_UINSN_BYTES];
+		__le32 insn;
+		__le32 ixol;
 	};
 	struct arch_probe_insn api;
 	bool simulate;
--- a/arch/arm64/kernel/probes/decode-insn.c
+++ b/arch/arm64/kernel/probes/decode-insn.c
@@ -104,10 +104,6 @@ arm_probe_decode_insn(probe_opcode_t insn, struct arch_probe_insn *api)
 	    aarch64_insn_is_blr(insn) ||
 	    aarch64_insn_is_ret(insn)) {
 		api->handler = simulate_br_blr_ret;
-	} else if (aarch64_insn_is_ldr_lit(insn)) {
-		api->handler = simulate_ldr_literal;
-	} else if (aarch64_insn_is_ldrsw_lit(insn)) {
-		api->handler = simulate_ldrsw_literal;
 	} else {
 		/*
 		 * Instruction cannot be stepped out-of-line and we don't
@@ -145,6 +141,17 @@ arm_kprobe_decode_insn(kprobe_opcode_t *addr, struct arch_specific_insn *asi)
 	probe_opcode_t insn = le32_to_cpu(*addr);
 	probe_opcode_t *scan_end = NULL;
 	unsigned long size = 0, offset = 0;
+	struct arch_probe_insn *api = &asi->api;
+
+	if (aarch64_insn_is_ldr_lit(insn)) {
+		api->handler = simulate_ldr_literal;
+		decoded = INSN_GOOD_NO_SLOT;
+	} else if (aarch64_insn_is_ldrsw_lit(insn)) {
+		api->handler = simulate_ldrsw_literal;
+		decoded = INSN_GOOD_NO_SLOT;
+	} else {
+		decoded = arm_probe_decode_insn(insn, &asi->api);
+	}

 	/*
 	 * If there's a symbol defined in front of and near enough to
@@ -162,7 +169,6 @@ arm_kprobe_decode_insn(kprobe_opcode_t *addr, struct arch_specific_insn *asi)
 		else
 			scan_end = addr - MAX_ATOMIC_CONTEXT_SIZE;
 	}
-	decoded = arm_probe_decode_insn(insn, &asi->api);

 	if (decoded != INSN_REJECTED && scan_end)
 		if (is_probed_address_atomic(addr - 1, scan_end))
--- a/arch/arm64/kernel/probes/simulate-insn.c
+++ b/arch/arm64/kernel/probes/simulate-insn.c
@@ -178,17 +178,15 @@ simulate_tbz_tbnz(u32 opcode, long addr, struct pt_regs *regs)
 void __kprobes
 simulate_ldr_literal(u32 opcode, long addr, struct pt_regs *regs)
 {
-	u64 *load_addr;
+	unsigned long load_addr;
 	int xn = opcode & 0x1f;
-	int disp;

-	disp = ldr_displacement(opcode);
-	load_addr = (u64 *) (addr + disp);
+	load_addr = addr + ldr_displacement(opcode);

 	if (opcode & (1 << 30))	/* x0-x30 */
-		set_x_reg(regs, xn, *load_addr);
+		set_x_reg(regs, xn, READ_ONCE(*(u64 *)load_addr));
 	else			/* w0-w30 */
-		set_w_reg(regs, xn, *load_addr);
+		set_w_reg(regs, xn, READ_ONCE(*(u32 *)load_addr));

 	instruction_pointer_set(regs, instruction_pointer(regs) + 4);
 }
@@ -196,14 +194,12 @@ simulate_ldr_literal(u32 opcode, long addr, struct pt_regs *regs)
 void __kprobes
 simulate_ldrsw_literal(u32 opcode, long addr, struct pt_regs *regs)
 {
-	s32 *load_addr;
+	unsigned long load_addr;
 	int xn = opcode & 0x1f;
-	int disp;

-	disp = ldr_displacement(opcode);
-	load_addr = (s32 *) (addr + disp);
+	load_addr = addr + ldr_displacement(opcode);

-	set_x_reg(regs, xn, *load_addr);
+	set_x_reg(regs, xn, READ_ONCE(*(s32 *)load_addr));

 	instruction_pointer_set(regs, instruction_pointer(regs) + 4);
 }
--- a/arch/arm64/kernel/probes/uprobes.c
+++ b/arch/arm64/kernel/probes/uprobes.c
@@ -45,7 +45,7 @@ int arch_uprobe_analyze_insn(struct arch_uprobe *auprobe, struct mm_struct *mm,
 	else if (!IS_ALIGNED(addr, AARCH64_INSN_SIZE))
 		return -EINVAL;

-	insn = *(probe_opcode_t *)(&auprobe->insn[0]);
+	insn = le32_to_cpu(auprobe->insn);

 	switch (arm_probe_decode_insn(insn, &auprobe->api)) {
 	case INSN_REJECTED:
@@ -111,7 +111,7 @@ bool arch_uprobe_skip_sstep(struct arch_uprobe *auprobe, struct pt_regs *regs)
 	if (!auprobe->simulate)
 		return false;

-	insn = *(probe_opcode_t *)(&auprobe->insn[0]);
+	insn = le32_to_cpu(auprobe->insn);
 	addr = instruction_pointer(regs);

 	if (auprobe->api.handler)
--- a/arch/microblaze/mm/init.c
+++ b/arch/microblaze/mm/init.c
@@ -327,11 +327,6 @@ asmlinkage void __init mmu_init(void)
 {
 	unsigned int kstart, ksize;

-	if (!memblock.reserved.cnt) {
-		pr_emerg("Error memory count\n");
-		machine_restart(NULL);
-	}
-
 	if ((u32) memblock.memory.regions[0].size < 0x400000) {
 		pr_emerg("Memory must be greater than 4MB\n");
 		machine_restart(NULL);
--- a/arch/s390/include/asm/facility.h
+++ b/arch/s390/include/asm/facility.h
@@ -53,8 +53,10 @@ static inline int test_facility(unsigned long nr)
 	unsigned long facilities_als[] = { FACILITIES_ALS };

 	if (__builtin_constant_p(nr) && nr < sizeof(facilities_als) * 8) {
-		if (__test_facility(nr, &facilities_als))
-			return 1;
+		if (__test_facility(nr, &facilities_als)) {
+			if (!__is_defined(__DECOMPRESSOR))
+				return 1;
+		}
 	}
 	return __test_facility(nr, &S390_lowcore.stfle_fac_list);
 }
--- a/arch/s390/kvm/diag.c
+++ b/arch/s390/kvm/diag.c
@@ -81,7 +81,7 @@ static int __diag_page_ref_service(struct kvm_vcpu *vcpu)
 	vcpu->stat.diagnose_258++;
 	if (vcpu->run->s.regs.gprs[rx] & 7)
 		return kvm_s390_inject_program_int(vcpu, PGM_SPECIFICATION);
-	rc = read_guest(vcpu, vcpu->run->s.regs.gprs[rx], rx, &parm, sizeof(parm));
+	rc = read_guest_real(vcpu, vcpu->run->s.regs.gprs[rx], &parm, sizeof(parm));
 	if (rc)
 		return kvm_s390_inject_prog_cond(vcpu, rc);
 	if (parm.parm_version != 2 || parm.parm_len < 5 || parm.code != 0x258)
--- a/arch/s390/mm/cmm.c
+++ b/arch/s390/mm/cmm.c
@@ -97,11 +97,12 @@ static long cmm_alloc_pages(long nr, long *counter,
 		(*counter)++;
 		spin_unlock(&cmm_lock);
 		nr--;
+		cond_resched();
 	}
 	return nr;
 }

-static long cmm_free_pages(long nr, long *counter, struct cmm_page_array **list)
+static long __cmm_free_pages(long nr, long *counter, struct cmm_page_array **list)
 {
 	struct cmm_page_array *pa;
 	unsigned long addr;
@@ -125,6 +126,21 @@ static long cmm_free_pages(long nr, long *counter, struct cmm_page_array **list)
 	return nr;
 }

+static long cmm_free_pages(long nr, long *counter, struct cmm_page_array **list)
+{
+	long inc = 0;
+
+	while (nr) {
+		inc = min(256L, nr);
+		nr -= inc;
+		inc = __cmm_free_pages(inc, counter, list);
+		if (inc)
+			break;
+		cond_resched();
+	}
+	return nr + inc;
+}
+
 static int cmm_oom_notify(struct notifier_block *self,
 			  unsigned long dummy, void *parm)
 {
--- a/arch/x86/include/asm/cpufeatures.h
+++ b/arch/x86/include/asm/cpufeatures.h
@@ -216,7 +216,7 @@
 #define X86_FEATURE_SPEC_STORE_BYPASS_DISABLE	( 7*32+23) /* "" Disable Speculative Store Bypass. */
 #define X86_FEATURE_LS_CFG_SSBD		( 7*32+24)  /* "" AMD SSBD implementation via LS_CFG MSR */
 #define X86_FEATURE_IBRS		( 7*32+25) /* Indirect Branch Restricted Speculation */
-#define X86_FEATURE_IBPB		( 7*32+26) /* Indirect Branch Prediction Barrier */
+#define X86_FEATURE_IBPB		( 7*32+26) /* "ibpb" Indirect Branch Prediction Barrier without a guaranteed RSB flush */
 #define X86_FEATURE_STIBP		( 7*32+27) /* Single Thread Indirect Branch Predictors */
 #define X86_FEATURE_ZEN			( 7*32+28) /* "" CPU is AMD family 0x17 (Zen) */
 #define X86_FEATURE_L1TF_PTEINV		( 7*32+29) /* "" L1TF workaround PTE inversion */
@@ -306,6 +306,7 @@
 #define X86_FEATURE_VIRT_SSBD		(13*32+25) /* Virtualized Speculative Store Bypass Disable */
 #define X86_FEATURE_AMD_SSB_NO		(13*32+26) /* "" Speculative Store Bypass is fixed in hardware. */
 #define X86_FEATURE_BTC_NO		(13*32+29) /* "" Not vulnerable to Branch Type Confusion */
+#define X86_FEATURE_AMD_IBPB_RET	(13*32+30) /* "" IBPB clears return address predictor */

 /* Thermal and Power Management Leaf, CPUID level 0x00000006 (EAX), word 14 */
 #define X86_FEATURE_DTHERM		(14*32+ 0) /* Digital Thermal Sensor */
--- a/arch/x86/kernel/apic/apic.c
+++ b/arch/x86/kernel/apic/apic.c
@@ -492,7 +492,19 @@ static int lapic_timer_shutdown(struct clock_event_device *evt)
 	v = apic_read(APIC_LVTT);
 	v |= (APIC_LVT_MASKED | LOCAL_TIMER_VECTOR);
 	apic_write(APIC_LVTT, v);
-	apic_write(APIC_TMICT, 0);
+
+	/*
+	 * Setting APIC_LVT_MASKED (above) should be enough to tell
+	 * the hardware that this timer will never fire. But AMD
+	 * erratum 411 and some Intel CPU behavior circa 2024 say
+	 * otherwise.  Time for belt and suspenders programming: mask
+	 * the timer _and_ zero the counter registers:
+	 */
+	if (v & APIC_LVT_TIMER_TSCDEADLINE)
+		wrmsrl(MSR_IA32_TSC_DEADLINE, 0);
+	else
+		apic_write(APIC_TMICT, 0);
+
 	return 0;
 }

--- a/arch/x86/kernel/cpu/mshyperv.c
+++ b/arch/x86/kernel/cpu/mshyperv.c
@@ -206,6 +206,7 @@ static void __init ms_hyperv_init_platform(void)
 	    ms_hyperv.misc_features & HV_FEATURE_FREQUENCY_MSRS_AVAILABLE) {
 		x86_platform.calibrate_tsc = hv_get_tsc_khz;
 		x86_platform.calibrate_cpu = hv_get_tsc_khz;
+		setup_force_cpu_cap(X86_FEATURE_TSC_KNOWN_FREQ);
 	}

 #ifdef CONFIG_X86_LOCAL_APIC
--- a/arch/x86/xen/setup.c
+++ b/arch/x86/xen/setup.c
@@ -862,7 +862,7 @@ char * __init xen_memory_setup(void)
 	 * to relocating (and even reusing) pages with kernel text or data.
 	 */
 	if (xen_is_e820_reserved(__pa_symbol(_text),
-			__pa_symbol(__bss_stop) - __pa_symbol(_text))) {
+				 __pa_symbol(_end) - __pa_symbol(_text))) {
 		xen_raw_console_write("Xen hypervisor allocated kernel memory conflicts with E820 map\n");
 		BUG();
 	}
--- a/block/bfq-iosched.c
+++ b/block/bfq-iosched.c
@@ -4405,7 +4405,7 @@ bfq_split_bfqq(struct bfq_io_cq *bic, struct bfq_queue *bfqq)
 {
 	bfq_log_bfqq(bfqq->bfqd, bfqq, "splitting queue");

-	if (bfqq_process_refs(bfqq) == 1) {
+	if (bfqq_process_refs(bfqq) == 1 && !bfqq->new_bfqq) {
 		bfqq->pid = current->pid;
 		bfq_clear_bfqq_coop(bfqq);
 		bfq_clear_bfqq_split_coop(bfqq);
@@ -4524,7 +4524,8 @@ static void bfq_prepare_request(struct request *rq, struct bio *bio)
 	 * addition, if the queue has also just been split, we have to
 	 * resume its state.
 	 */
-	if (likely(bfqq != &bfqd->oom_bfqq) && bfqq_process_refs(bfqq) == 1) {
+	if (likely(bfqq != &bfqd->oom_bfqq) && !bfqq->new_bfqq &&
+	    bfqq_process_refs(bfqq) == 1) {
 		bfqq->bic = bic;
 		if (split) {
 			/*
--- a/crypto/aead.c
+++ b/crypto/aead.c
@@ -45,8 +45,7 @@ static int setkey_unaligned(struct crypto_aead *tfm, const u8 *key,
 	alignbuffer = (u8 *)ALIGN((unsigned long)buffer, alignmask + 1);
 	memcpy(alignbuffer, key, keylen);
 	ret = crypto_aead_alg(tfm)->setkey(tfm, alignbuffer, keylen);
-	memset(alignbuffer, 0, keylen);
-	kfree(buffer);
+	kzfree(buffer);
 	return ret;
 }

--- a/crypto/cipher.c
+++ b/crypto/cipher.c
@@ -37,8 +37,7 @@ static int setkey_unaligned(struct crypto_tfm *tfm, const u8 *key,
 	alignbuffer = (u8 *)ALIGN((unsigned long)buffer, alignmask + 1);
 	memcpy(alignbuffer, key, keylen);
 	ret = cia->cia_setkey(tfm, alignbuffer, keylen);
-	memset(alignbuffer, 0, keylen);
-	kfree(buffer);
+	kzfree(buffer);
 	return ret;

 }
--- a/drivers/acpi/acpica/dbconvert.c
+++ b/drivers/acpi/acpica/dbconvert.c
@@ -206,6 +206,8 @@ acpi_status acpi_db_convert_to_package(char *string, union acpi_object *object)
 	elements =
 	    ACPI_ALLOCATE_ZEROED(DB_DEFAULT_PKG_ELEMENTS *
 				 sizeof(union acpi_object));
+	if (!elements)
+		return (AE_NO_MEMORY);

 	this = string;
 	for (i = 0; i < (DB_DEFAULT_PKG_ELEMENTS - 1); i++) {
--- a/drivers/acpi/acpica/exprep.c
+++ b/drivers/acpi/acpica/exprep.c
@@ -471,6 +471,9 @@ acpi_status acpi_ex_prep_field_value(struct acpi_create_field_info *info)

 		if (info->connection_node) {
 			second_desc = info->connection_node->object;
+			if (second_desc == NULL) {
+				break;
+			}
 			if (!(second_desc->common.flags & AOPOBJ_DATA_VALID)) {
 				status =
 				    acpi_ds_get_buffer_arguments(second_desc);
--- a/drivers/acpi/acpica/psargs.c
+++ b/drivers/acpi/acpica/psargs.c
@@ -59,6 +59,8 @@ acpi_ps_get_next_package_length(struct acpi_parse_state *parser_state);
 static union acpi_parse_object *acpi_ps_get_next_field(struct acpi_parse_state
 						       *parser_state);

+static void acpi_ps_free_field_list(union acpi_parse_object *start);
+
 /*******************************************************************************
 *
 * FUNCTION:    acpi_ps_get_next_package_length
@@ -717,6 +719,39 @@ static union acpi_parse_object *acpi_ps_get_next_field(struct acpi_parse_state
 	return_PTR(field);
 }

+/*******************************************************************************
+ *
+ * FUNCTION:    acpi_ps_free_field_list
+ *
+ * PARAMETERS:  start               - First Op in field list
+ *
+ * RETURN:      None.
+ *
+ * DESCRIPTION: Free all Op objects inside a field list.
+ *
+ ******************************************************************************/
+
+static void acpi_ps_free_field_list(union acpi_parse_object *start)
+{
+	union acpi_parse_object *cur = start;
+	union acpi_parse_object *next;
+	union acpi_parse_object *arg;
+
+	while (cur) {
+		next = cur->common.next;
+
+		/* AML_INT_CONNECTION_OP can have a single argument */
+
+		arg = acpi_ps_get_arg(cur, 0);
+		if (arg) {
+			acpi_ps_free_op(arg);
+		}
+
+		acpi_ps_free_op(cur);
+		cur = next;
+	}
+}
+
 /*******************************************************************************
 *
 * FUNCTION:    acpi_ps_get_next_arg
@@ -785,6 +820,10 @@ acpi_ps_get_next_arg(struct acpi_walk_state *walk_state,
 			while (parser_state->aml < parser_state->pkg_end) {
 				field = acpi_ps_get_next_field(parser_state);
 				if (!field) {
+					if (arg) {
+						acpi_ps_free_field_list(arg);
+					}
+
 					return_ACPI_STATUS(AE_NO_MEMORY);
 				}

@@ -854,6 +893,10 @@ acpi_ps_get_next_arg(struct acpi_walk_state *walk_state,
 			    acpi_ps_get_next_namepath(walk_state, parser_state,
 						      arg,
 						      ACPI_NOT_METHOD_CALL);
+			if (ACPI_FAILURE(status)) {
+				acpi_ps_free_op(arg);
+				return_ACPI_STATUS(status);
+			}
 		} else {
 			/* Single complex argument, nothing returned */

@@ -888,6 +931,10 @@ acpi_ps_get_next_arg(struct acpi_walk_state *walk_state,
 			    acpi_ps_get_next_namepath(walk_state, parser_state,
 						      arg,
 						      ACPI_POSSIBLE_METHOD_CALL);
+			if (ACPI_FAILURE(status)) {
+				acpi_ps_free_op(arg);
+				return_ACPI_STATUS(status);
+			}

 			if (arg->common.aml_opcode == AML_INT_METHODCALL_OP) {

--- a/drivers/acpi/device_sysfs.c
+++ b/drivers/acpi/device_sysfs.c
@@ -539,8 +539,9 @@ int acpi_device_setup_files(struct acpi_device *dev)
 	 * If device has _STR, 'description' file is created
 	 */
 	if (acpi_has_method(dev->handle, "_STR")) {
-		status = acpi_evaluate_object(dev->handle, "_STR",
-					NULL, &buffer);
+		status = acpi_evaluate_object_typed(dev->handle, "_STR",
+						    NULL, &buffer,
+						    ACPI_TYPE_BUFFER);
 		if (ACPI_FAILURE(status))
 			buffer.pointer = NULL;
 		dev->pnp.str_obj = buffer.pointer;
--- a/drivers/acpi/ec.c
+++ b/drivers/acpi/ec.c
@@ -807,6 +807,9 @@ static int acpi_ec_transaction_unlocked(struct acpi_ec *ec,
 	unsigned long tmp;
 	int ret = 0;

+	if (t->rdata)
+		memset(t->rdata, 0, t->rlen);
+
 	/* start transaction */
 	spin_lock_irqsave(&ec->lock, tmp);
 	/* Enable GPE for command processing (IBF=0/OBF=1) */
@@ -843,8 +846,6 @@ static int acpi_ec_transaction(struct acpi_ec *ec, struct transaction *t)

 	if (!ec || (!t) || (t->wlen && !t->wdata) || (t->rlen && !t->rdata))
 		return -EINVAL;
-	if (t->rdata)
-		memset(t->rdata, 0, t->rlen);

 	mutex_lock(&ec->mutex);
 	if (ec->global_lock) {
@@ -871,7 +872,7 @@ static int acpi_ec_burst_enable(struct acpi_ec *ec)
 				.wdata = NULL, .rdata = &d,
 				.wlen = 0, .rlen = 1};

-	return acpi_ec_transaction(ec, &t);
+	return acpi_ec_transaction_unlocked(ec, &t);
 }

 static int acpi_ec_burst_disable(struct acpi_ec *ec)
@@ -881,7 +882,7 @@ static int acpi_ec_burst_disable(struct acpi_ec *ec)
 				.wlen = 0, .rlen = 0};

 	return (acpi_ec_read_status(ec) & ACPI_EC_FLAG_BURST) ?
-				acpi_ec_transaction(ec, &t) : 0;
+				acpi_ec_transaction_unlocked(ec, &t) : 0;
 }

 static int acpi_ec_read(struct acpi_ec *ec, u8 address, u8 *data)
@@ -897,6 +898,19 @@ static int acpi_ec_read(struct acpi_ec *ec, u8 address, u8 *data)
 	return result;
 }

+static int acpi_ec_read_unlocked(struct acpi_ec *ec, u8 address, u8 *data)
+{
+	int result;
+	u8 d;
+	struct transaction t = {.command = ACPI_EC_COMMAND_READ,
+				.wdata = &address, .rdata = &d,
+				.wlen = 1, .rlen = 1};
+
+	result = acpi_ec_transaction_unlocked(ec, &t);
+	*data = d;
+	return result;
+}
+
 static int acpi_ec_write(struct acpi_ec *ec, u8 address, u8 data)
 {
 	u8 wdata[2] = { address, data };
@@ -907,6 +921,16 @@ static int acpi_ec_write(struct acpi_ec *ec, u8 address, u8 data)
 	return acpi_ec_transaction(ec, &t);
 }

+static int acpi_ec_write_unlocked(struct acpi_ec *ec, u8 address, u8 data)
+{
+	u8 wdata[2] = { address, data };
+	struct transaction t = {.command = ACPI_EC_COMMAND_WRITE,
+				.wdata = wdata, .rdata = NULL,
+				.wlen = 2, .rlen = 0};
+
+	return acpi_ec_transaction_unlocked(ec, &t);
+}
+
 int ec_read(u8 addr, u8 *val)
 {
 	int err;
@@ -1302,6 +1326,7 @@ acpi_ec_space_handler(u32 function, acpi_physical_address address,
 	struct acpi_ec *ec = handler_context;
 	int result = 0, i, bytes = bits / 8;
 	u8 *value = (u8 *)value64;
+	u32 glk;

 	if ((address > 0xFF) || !value || !handler_context)
 		return AE_BAD_PARAMETER;
@@ -1309,13 +1334,25 @@ acpi_ec_space_handler(u32 function, acpi_physical_address address,
 	if (function != ACPI_READ && function != ACPI_WRITE)
 		return AE_BAD_PARAMETER;

+	mutex_lock(&ec->mutex);
+
+	if (ec->global_lock) {
+		acpi_status status;
+
+		status = acpi_acquire_global_lock(ACPI_EC_UDELAY_GLK, &glk);
+		if (ACPI_FAILURE(status)) {
+			result = -ENODEV;
+			goto unlock;
+		}
+	}
+
 	if (ec->busy_polling || bits > 8)
 		acpi_ec_burst_enable(ec);

 	for (i = 0; i < bytes; ++i, ++address, ++value) {
 		result = (function == ACPI_READ) ?
-			acpi_ec_read(ec, address, value) :
-			acpi_ec_write(ec, address, *value);
+			acpi_ec_read_unlocked(ec, address, value) :
+			acpi_ec_write_unlocked(ec, address, *value);
 		if (result < 0)
 			break;
 	}
@@ -1323,6 +1360,12 @@ acpi_ec_space_handler(u32 function, acpi_physical_address address,
 	if (ec->busy_polling || bits > 8)
 		acpi_ec_burst_disable(ec);

+	if (ec->global_lock)
+		acpi_release_global_lock(glk);
+
+unlock:
+	mutex_unlock(&ec->mutex);
+
 	switch (result) {
 	case -EINVAL:
 		return AE_BAD_PARAMETER;
--- a/drivers/ata/sata_sil.c
+++ b/drivers/ata/sata_sil.c
@@ -144,7 +144,7 @@ static const struct pci_device_id sil_pci_tbl[] = {
 static const struct sil_drivelist {
 	const char *product;
 	unsigned int quirk;
-} sil_blacklist [] = {
+} sil_quirks[] = {
 	{ "ST320012AS",		SIL_QUIRK_MOD15WRITE },
 	{ "ST330013AS",		SIL_QUIRK_MOD15WRITE },
 	{ "ST340017AS",		SIL_QUIRK_MOD15WRITE },
@@ -617,8 +617,8 @@ static void sil_thaw(struct ata_port *ap)
 *	list, and apply the fixups to only the specific
 *	devices/hosts/firmwares that need it.
 *
- *	20040111 - Seagate drives affected by the Mod15Write bug are blacklisted
- *	The Maxtor quirk is in the blacklist, but I'm keeping the original
+ *	20040111 - Seagate drives affected by the Mod15Write bug are quirked
+ *	The Maxtor quirk is in sil_quirks, but I'm keeping the original
 *	pessimistic fix for the following reasons...
 *	- There seems to be less info on it, only one device gleaned off the
 *	Windows	driver, maybe only one is affected.  More info would be greatly
@@ -637,9 +637,9 @@ static void sil_dev_config(struct ata_device *dev)

 	ata_id_c_string(dev->id, model_num, ATA_ID_PROD, sizeof(model_num));

-	for (n = 0; sil_blacklist[n].product; n++)
-		if (!strcmp(sil_blacklist[n].product, model_num)) {
-			quirks = sil_blacklist[n].quirk;
+	for (n = 0; sil_quirks[n].product; n++)
+		if (!strcmp(sil_quirks[n].product, model_num)) {
+			quirks = sil_quirks[n].quirk;
 			break;
 		}

--- a/drivers/base/bus.c
+++ b/drivers/base/bus.c
@@ -105,7 +105,8 @@ static ssize_t bus_attr_show(struct kobject *kobj, struct attribute *attr,
 {
 	struct bus_attribute *bus_attr = to_bus_attr(attr);
 	struct subsys_private *subsys_priv = to_subsys_private(kobj);
-	ssize_t ret = 0;
+	/* return -EIO for reading a bus attribute without show() */
+	ssize_t ret = -EIO;

 	if (bus_attr->show)
 		ret = bus_attr->show(subsys_priv->bus, buf);
@@ -117,7 +118,8 @@ static ssize_t bus_attr_store(struct kobject *kobj, struct attribute *attr,
 {
 	struct bus_attribute *bus_attr = to_bus_attr(attr);
 	struct subsys_private *subsys_priv = to_subsys_private(kobj);
-	ssize_t ret = 0;
+	/* return -EIO for writing a bus attribute without store() */
+	ssize_t ret = -EIO;

 	if (bus_attr->store)
 		ret = bus_attr->store(subsys_priv->bus, buf, count);
--- a/drivers/base/core.c
+++ b/drivers/base/core.c
@@ -27,7 +27,6 @@
 #include <linux/mutex.h>
 #include <linux/pm_runtime.h>
 #include <linux/netdevice.h>
-#include <linux/rcupdate.h>
 #include <linux/sched/signal.h>
 #include <linux/sysfs.h>

@@ -906,7 +905,6 @@ static int dev_uevent(struct kset *kset, struct kobject *kobj,
 		      struct kobj_uevent_env *env)
 {
 	struct device *dev = kobj_to_dev(kobj);
-	struct device_driver *driver;
 	int retval = 0;

 	/* add device node properties if present */
@@ -935,12 +933,8 @@ static int dev_uevent(struct kset *kset, struct kobject *kobj,
 	if (dev->type && dev->type->name)
 		add_uevent_var(env, "DEVTYPE=%s", dev->type->name);

-	/* Synchronize with module_remove_driver() */
-	rcu_read_lock();
-	driver = READ_ONCE(dev->driver);
-	if (driver)
-		add_uevent_var(env, "DRIVER=%s", driver->name);
-	rcu_read_unlock();
+	if (dev->driver)
+		add_uevent_var(env, "DRIVER=%s", dev->driver->name);

 	/* Add common DT information about the device */
 	of_device_uevent(dev, env);
@@ -1010,8 +1004,11 @@ static ssize_t uevent_show(struct device *dev, struct device_attribute *attr,
 	if (!env)
 		return -ENOMEM;

+	/* Synchronize with really_probe() */
+	device_lock(dev);
 	/* let the kset specific function add its keys */
 	retval = kset->uevent_ops->uevent(kset, &dev->kobj, env);
+	device_unlock(dev);
 	if (retval)
 		goto out;

--- a/drivers/base/module.c
+++ b/drivers/base/module.c
@@ -9,7 +9,6 @@
 #include <linux/errno.h>
 #include <linux/slab.h>
 #include <linux/string.h>
-#include <linux/rcupdate.h>
 #include "base.h"

 static char *make_driver_name(struct device_driver *drv)
@@ -80,9 +79,6 @@ void module_remove_driver(struct device_driver *drv)
 	if (!drv)
 		return;

-	/* Synchronize with dev_uevent() */
-	synchronize_rcu();
-
 	sysfs_remove_link(&drv->p->kobj, "module");

 	if (drv->owner)
--- a/drivers/block/drbd/drbd_main.c
+++ b/drivers/block/drbd/drbd_main.c
@@ -3537,10 +3537,12 @@ void drbd_uuid_new_current(struct drbd_device *device) __must_hold(local)
 void drbd_uuid_set_bm(struct drbd_device *device, u64 val) __must_hold(local)
 {
 	unsigned long flags;
-	if (device->ldev->md.uuid[UI_BITMAP] == 0 && val == 0)
-		return;
-
 	spin_lock_irqsave(&device->ldev->md.uuid_lock, flags);
+	if (device->ldev->md.uuid[UI_BITMAP] == 0 && val == 0) {
+		spin_unlock_irqrestore(&device->ldev->md.uuid_lock, flags);
+		return;
+	}
+
 	if (val == 0) {
 		drbd_uuid_move_history(device);
 		device->ldev->md.uuid[UI_HISTORY_START] = device->ldev->md.uuid[UI_BITMAP];
--- a/drivers/block/drbd/drbd_state.c
+++ b/drivers/block/drbd/drbd_state.c
@@ -888,7 +888,7 @@ is_valid_state(struct drbd_device *device, union drbd_state ns)
 		  ns.disk == D_OUTDATED)
 		rv = SS_CONNECTED_OUTDATES;

-	else if ((ns.conn == C_VERIFY_S || ns.conn == C_VERIFY_T) &&
+	else if (nc && (ns.conn == C_VERIFY_S || ns.conn == C_VERIFY_T) &&
 		 (nc->verify_alg[0] == 0))
 		rv = SS_NO_VERIFY_ALG;

--- a/drivers/bluetooth/btusb.c
+++ b/drivers/bluetooth/btusb.c
@@ -729,7 +729,15 @@ static int btusb_submit_intr_urb(struct hci_dev *hdev, gfp_t mem_flags)
 	if (!urb)
 		return -ENOMEM;

-	size = le16_to_cpu(data->intr_ep->wMaxPacketSize);
+	if (le16_to_cpu(data->udev->descriptor.idVendor)  == 0x0a12 &&
+	    le16_to_cpu(data->udev->descriptor.idProduct) == 0x0001)
+		/* Fake CSR devices don't seem to support sort-transter */
+		size = le16_to_cpu(data->intr_ep->wMaxPacketSize);
+	else
+		/* Use maximum HCI Event size so the USB stack handles
+		 * ZPL/short-transfer automatically.
+		 */
+		size = HCI_MAX_EVENT_SIZE;

 	buf = kmalloc(size, mem_flags);
 	if (!buf) {
--- a/drivers/char/virtio_console.c
+++ b/drivers/char/virtio_console.c
@@ -2091,25 +2091,27 @@ static int virtcons_probe(struct virtio_device *vdev)
 		multiport = true;
 	}

-	err = init_vqs(portdev);
-	if (err < 0) {
-		dev_err(&vdev->dev, "Error %d initializing vqs\n", err);
-		goto free_chrdev;
-	}
-
 	spin_lock_init(&portdev->ports_lock);
 	INIT_LIST_HEAD(&portdev->ports);
 	INIT_LIST_HEAD(&portdev->list);

-	virtio_device_ready(portdev->vdev);
-
 	INIT_WORK(&portdev->config_work, &config_work_handler);
 	INIT_WORK(&portdev->control_work, &control_work_handler);

 	if (multiport) {
 		spin_lock_init(&portdev->c_ivq_lock);
 		spin_lock_init(&portdev->c_ovq_lock);
+	}

+	err = init_vqs(portdev);
+	if (err < 0) {
+		dev_err(&vdev->dev, "Error %d initializing vqs\n", err);
+		goto free_chrdev;
+	}
+
+	virtio_device_ready(portdev->vdev);
+
+	if (multiport) {
 		err = fill_queue(portdev->c_ivq, &portdev->c_ivq_lock);
 		if (err < 0) {
 			dev_err(&vdev->dev,
--- a/drivers/clk/bcm/clk-bcm53573-ilp.c
+++ b/drivers/clk/bcm/clk-bcm53573-ilp.c
@@ -115,7 +115,7 @@ static void bcm53573_ilp_init(struct device_node *np)
 		goto err_free_ilp;
 	}

-	ilp->regmap = syscon_node_to_regmap(of_get_parent(np));
+	ilp->regmap = syscon_node_to_regmap(np->parent);
 	if (IS_ERR(ilp->regmap)) {
 		err = PTR_ERR(ilp->regmap);
 		goto err_free_ilp;
--- a/drivers/clk/rockchip/clk-rk3228.c
+++ b/drivers/clk/rockchip/clk-rk3228.c
@@ -415,7 +415,7 @@ static struct rockchip_clk_branch rk3228_clk_branches[] __initdata = {
 			RK2928_CLKSEL_CON(29), 0, 3, DFLAGS),
 	DIV(0, "sclk_vop_pre", "sclk_vop_src", 0,
 			RK2928_CLKSEL_CON(27), 8, 8, DFLAGS),
-	MUX(DCLK_VOP, "dclk_vop", mux_dclk_vop_p, 0,
+	MUX(DCLK_VOP, "dclk_vop", mux_dclk_vop_p, CLK_SET_RATE_PARENT | CLK_SET_RATE_NO_REPARENT,
 			RK2928_CLKSEL_CON(27), 1, 1, MFLAGS),

 	FACTOR(0, "xin12m", "xin24m", 0, 1, 2),
--- a/drivers/clk/rockchip/clk.c
+++ b/drivers/clk/rockchip/clk.c
@@ -436,12 +436,13 @@ void __init rockchip_clk_register_branches(
 				      struct rockchip_clk_branch *list,
 				      unsigned int nr_clk)
 {
-	struct clk *clk = NULL;
+	struct clk *clk;
 	unsigned int idx;
 	unsigned long flags;

 	for (idx = 0; idx < nr_clk; idx++, list++) {
 		flags = list->flags;
+		clk = NULL;

 		/* catch simple muxes */
 		switch (list->branch_type) {
--- a/drivers/clk/ti/clk-dra7-atl.c
+++ b/drivers/clk/ti/clk-dra7-atl.c
@@ -257,6 +257,7 @@ static int of_dra7_atl_clk_probe(struct platform_device *pdev)
 		}

 		clk = of_clk_get_from_provider(&clkspec);
+		of_node_put(clkspec.np);
 		if (IS_ERR(clk)) {
 			pr_err("%s: failed to get atl clock %d from provider\n",
 			       __func__, i);
--- a/drivers/clocksource/qcom-timer.c
+++ b/drivers/clocksource/qcom-timer.c
@@ -242,6 +242,7 @@ static int __init msm_dt_timer_init(struct device_node *np)
 	}

 	if (of_property_read_u32(np, "clock-frequency", &freq)) {
+		iounmap(cpu0_base);
 		pr_err("Unknown frequency\n");
 		return -EINVAL;
 	}
@@ -252,7 +253,11 @@ static int __init msm_dt_timer_init(struct device_node *np)
 	freq /= 4;
 	writel_relaxed(DGT_CLK_CTL_DIV_4, source_base + DGT_CLK_CTL);

-	return msm_timer_init(freq, 32, irq, !!percpu_offset);
+	ret = msm_timer_init(freq, 32, irq, !!percpu_offset);
+	if (ret)
+		iounmap(cpu0_base);
+
+	return ret;
 }
 TIMER_OF_DECLARE(kpss_timer, "qcom,kpss-timer", msm_dt_timer_init);
 TIMER_OF_DECLARE(scss_timer, "qcom,scss-timer", msm_dt_timer_init);
--- a/drivers/gpio/gpio-aspeed.c
+++ b/drivers/gpio/gpio-aspeed.c
@@ -230,6 +230,8 @@ static void __aspeed_gpio_set(struct gpio_chip *gc, unsigned int offset,
 		reg &= ~GPIO_BIT(offset);

 	iowrite32(reg, addr);
+	/* Flush write */
+	ioread32(addr);
 }

 static void aspeed_gpio_set(struct gpio_chip *gc, unsigned int offset,
--- a/drivers/gpio/gpio-davinci.c
+++ b/drivers/gpio/gpio-davinci.c
@@ -263,7 +263,7 @@ err:
 * serve as EDMA event triggers.
 */

-static void gpio_irq_disable(struct irq_data *d)
+static void gpio_irq_mask(struct irq_data *d)
 {
 	struct davinci_gpio_regs __iomem *g = irq2regs(d);
 	u32 mask = (u32) irq_data_get_irq_handler_data(d);
@@ -272,7 +272,7 @@ static void gpio_irq_disable(struct irq_data *d)
 	writel_relaxed(mask, &g->clr_rising);
 }

-static void gpio_irq_enable(struct irq_data *d)
+static void gpio_irq_unmask(struct irq_data *d)
 {
 	struct davinci_gpio_regs __iomem *g = irq2regs(d);
 	u32 mask = (u32) irq_data_get_irq_handler_data(d);
@@ -298,8 +298,8 @@ static int gpio_irq_type(struct irq_data *d, unsigned trigger)

 static struct irq_chip gpio_irqchip = {
 	.name		= "GPIO",
-	.irq_enable	= gpio_irq_enable,
-	.irq_disable	= gpio_irq_disable,
+	.irq_unmask	= gpio_irq_unmask,
+	.irq_mask	= gpio_irq_mask,
 	.irq_set_type	= gpio_irq_type,
 	.flags		= IRQCHIP_SET_TYPE_MASKED | IRQCHIP_SKIP_SET_WAKE,
 };
--- a/drivers/gpio/gpiolib.c
+++ b/drivers/gpio/gpiolib.c
@@ -3,6 +3,7 @@
 #include <linux/module.h>
 #include <linux/interrupt.h>
 #include <linux/irq.h>
+#include <linux/nospec.h>
 #include <linux/spinlock.h>
 #include <linux/list.h>
 #include <linux/device.h>
@@ -133,7 +134,7 @@ struct gpio_desc *gpiochip_get_desc(struct gpio_chip *chip,
 	if (hwnum >= gdev->ngpio)
 		return ERR_PTR(-EINVAL);

-	return &gdev->descs[hwnum];
+	return &gdev->descs[array_index_nospec(hwnum, gdev->ngpio)];
 }

 /**
--- a/drivers/gpu/drm/amd/include/atombios.h
+++ b/drivers/gpu/drm/amd/include/atombios.h
@@ -4099,7 +4099,7 @@ typedef struct  _ATOM_LCD_MODE_CONTROL_CAP
 typedef struct _ATOM_FAKE_EDID_PATCH_RECORD
 {
  UCHAR ucRecordType;
-  UCHAR ucFakeEDIDLength;       // = 128 means EDID lenght is 128 bytes, otherwise the EDID length = ucFakeEDIDLength*128
+  UCHAR ucFakeEDIDLength;       // = 128 means EDID length is 128 bytes, otherwise the EDID length = ucFakeEDIDLength*128
  UCHAR ucFakeEDIDString[1];    // This actually has ucFakeEdidLength elements.
 } ATOM_FAKE_EDID_PATCH_RECORD;

--- a/drivers/gpu/drm/msm/mdp/mdp5/mdp5_smp.c
+++ b/drivers/gpu/drm/msm/mdp/mdp5/mdp5_smp.c
@@ -363,7 +363,7 @@ void mdp5_smp_dump(struct mdp5_smp *smp, struct drm_printer *p)

 			drm_printf(p, "%s:%d\t%d\t%s\n",
 				pipe2name(pipe), j, inuse,
-				plane ? plane->name : NULL);
+				plane ? plane->name : "(null)");

 			total += inuse;
 		}
--- a/drivers/gpu/drm/radeon/evergreen_cs.c
+++ b/drivers/gpu/drm/radeon/evergreen_cs.c
@@ -396,7 +396,7 @@ static int evergreen_cs_track_validate_cb(struct radeon_cs_parser *p, unsigned i
 	struct evergreen_cs_track *track = p->track;
 	struct eg_surface surf;
 	unsigned pitch, slice, mslice;
-	unsigned long offset;
+	u64 offset;
 	int r;

 	mslice = G_028C6C_SLICE_MAX(track->cb_color_view[id]) + 1;
@@ -434,14 +434,14 @@ static int evergreen_cs_track_validate_cb(struct radeon_cs_parser *p, unsigned i
 		return r;
 	}

-	offset = track->cb_color_bo_offset[id] << 8;
+	offset = (u64)track->cb_color_bo_offset[id] << 8;
 	if (offset & (surf.base_align - 1)) {
-		dev_warn(p->dev, "%s:%d cb[%d] bo base %ld not aligned with %ld\n",
+		dev_warn(p->dev, "%s:%d cb[%d] bo base %llu not aligned with %ld\n",
 			 __func__, __LINE__, id, offset, surf.base_align);
 		return -EINVAL;
 	}

-	offset += surf.layer_size * mslice;
+	offset += (u64)surf.layer_size * mslice;
 	if (offset > radeon_bo_size(track->cb_color_bo[id])) {
 		/* old ddx are broken they allocate bo with w*h*bpp but
 		 * program slice with ALIGN(h, 8), catch this and patch
@@ -449,14 +449,14 @@ static int evergreen_cs_track_validate_cb(struct radeon_cs_parser *p, unsigned i
 		 */
 		if (!surf.mode) {
 			uint32_t *ib = p->ib.ptr;
-			unsigned long tmp, nby, bsize, size, min = 0;
+			u64 tmp, nby, bsize, size, min = 0;

 			/* find the height the ddx wants */
 			if (surf.nby > 8) {
 				min = surf.nby - 8;
 			}
 			bsize = radeon_bo_size(track->cb_color_bo[id]);
-			tmp = track->cb_color_bo_offset[id] << 8;
+			tmp = (u64)track->cb_color_bo_offset[id] << 8;
 			for (nby = surf.nby; nby > min; nby--) {
 				size = nby * surf.nbx * surf.bpe * surf.nsamples;
 				if ((tmp + size * mslice) <= bsize) {
@@ -468,7 +468,7 @@ static int evergreen_cs_track_validate_cb(struct radeon_cs_parser *p, unsigned i
 				slice = ((nby * surf.nbx) / 64) - 1;
 				if (!evergreen_surface_check(p, &surf, "cb")) {
 					/* check if this one works */
-					tmp += surf.layer_size * mslice;
+					tmp += (u64)surf.layer_size * mslice;
 					if (tmp <= bsize) {
 						ib[track->cb_color_slice_idx[id]] = slice;
 						goto old_ddx_ok;
@@ -477,9 +477,9 @@ static int evergreen_cs_track_validate_cb(struct radeon_cs_parser *p, unsigned i
 			}
 		}
 		dev_warn(p->dev, "%s:%d cb[%d] bo too small (layer size %d, "
-			 "offset %d, max layer %d, bo size %ld, slice %d)\n",
+			 "offset %llu, max layer %d, bo size %ld, slice %d)\n",
 			 __func__, __LINE__, id, surf.layer_size,
-			track->cb_color_bo_offset[id] << 8, mslice,
+			(u64)track->cb_color_bo_offset[id] << 8, mslice,
 			radeon_bo_size(track->cb_color_bo[id]), slice);
 		dev_warn(p->dev, "%s:%d problematic surf: (%d %d) (%d %d %d %d %d %d %d)\n",
 			 __func__, __LINE__, surf.nbx, surf.nby,
@@ -563,7 +563,7 @@ static int evergreen_cs_track_validate_stencil(struct radeon_cs_parser *p)
 	struct evergreen_cs_track *track = p->track;
 	struct eg_surface surf;
 	unsigned pitch, slice, mslice;
-	unsigned long offset;
+	u64 offset;
 	int r;

 	mslice = G_028008_SLICE_MAX(track->db_depth_view) + 1;
@@ -609,18 +609,18 @@ static int evergreen_cs_track_validate_stencil(struct radeon_cs_parser *p)
 		return r;
 	}

-	offset = track->db_s_read_offset << 8;
+	offset = (u64)track->db_s_read_offset << 8;
 	if (offset & (surf.base_align - 1)) {
-		dev_warn(p->dev, "%s:%d stencil read bo base %ld not aligned with %ld\n",
+		dev_warn(p->dev, "%s:%d stencil read bo base %llu not aligned with %ld\n",
 			 __func__, __LINE__, offset, surf.base_align);
 		return -EINVAL;
 	}
-	offset += surf.layer_size * mslice;
+	offset += (u64)surf.layer_size * mslice;
 	if (offset > radeon_bo_size(track->db_s_read_bo)) {
 		dev_warn(p->dev, "%s:%d stencil read bo too small (layer size %d, "
-			 "offset %ld, max layer %d, bo size %ld)\n",
+			 "offset %llu, max layer %d, bo size %ld)\n",
 			 __func__, __LINE__, surf.layer_size,
-			(unsigned long)track->db_s_read_offset << 8, mslice,
+			(u64)track->db_s_read_offset << 8, mslice,
 			radeon_bo_size(track->db_s_read_bo));
 		dev_warn(p->dev, "%s:%d stencil invalid (0x%08x 0x%08x 0x%08x 0x%08x)\n",
 			 __func__, __LINE__, track->db_depth_size,
@@ -628,18 +628,18 @@ static int evergreen_cs_track_validate_stencil(struct radeon_cs_parser *p)
 		return -EINVAL;
 	}

-	offset = track->db_s_write_offset << 8;
+	offset = (u64)track->db_s_write_offset << 8;
 	if (offset & (surf.base_align - 1)) {
-		dev_warn(p->dev, "%s:%d stencil write bo base %ld not aligned with %ld\n",
+		dev_warn(p->dev, "%s:%d stencil write bo base %llu not aligned with %ld\n",
 			 __func__, __LINE__, offset, surf.base_align);
 		return -EINVAL;
 	}
-	offset += surf.layer_size * mslice;
+	offset += (u64)surf.layer_size * mslice;
 	if (offset > radeon_bo_size(track->db_s_write_bo)) {
 		dev_warn(p->dev, "%s:%d stencil write bo too small (layer size %d, "
-			 "offset %ld, max layer %d, bo size %ld)\n",
+			 "offset %llu, max layer %d, bo size %ld)\n",
 			 __func__, __LINE__, surf.layer_size,
-			(unsigned long)track->db_s_write_offset << 8, mslice,
+			(u64)track->db_s_write_offset << 8, mslice,
 			radeon_bo_size(track->db_s_write_bo));
 		return -EINVAL;
 	}
@@ -660,7 +660,7 @@ static int evergreen_cs_track_validate_depth(struct radeon_cs_parser *p)
 	struct evergreen_cs_track *track = p->track;
 	struct eg_surface surf;
 	unsigned pitch, slice, mslice;
-	unsigned long offset;
+	u64 offset;
 	int r;

 	mslice = G_028008_SLICE_MAX(track->db_depth_view) + 1;
@@ -707,34 +707,34 @@ static int evergreen_cs_track_validate_depth(struct radeon_cs_parser *p)
 		return r;
 	}

-	offset = track->db_z_read_offset << 8;
+	offset = (u64)track->db_z_read_offset << 8;
 	if (offset & (surf.base_align - 1)) {
-		dev_warn(p->dev, "%s:%d stencil read bo base %ld not aligned with %ld\n",
+		dev_warn(p->dev, "%s:%d stencil read bo base %llu not aligned with %ld\n",
 			 __func__, __LINE__, offset, surf.base_align);
 		return -EINVAL;
 	}
-	offset += surf.layer_size * mslice;
+	offset += (u64)surf.layer_size * mslice;
 	if (offset > radeon_bo_size(track->db_z_read_bo)) {
 		dev_warn(p->dev, "%s:%d depth read bo too small (layer size %d, "
-			 "offset %ld, max layer %d, bo size %ld)\n",
+			 "offset %llu, max layer %d, bo size %ld)\n",
 			 __func__, __LINE__, surf.layer_size,
-			(unsigned long)track->db_z_read_offset << 8, mslice,
+			(u64)track->db_z_read_offset << 8, mslice,
 			radeon_bo_size(track->db_z_read_bo));
 		return -EINVAL;
 	}

-	offset = track->db_z_write_offset << 8;
+	offset = (u64)track->db_z_write_offset << 8;
 	if (offset & (surf.base_align - 1)) {
-		dev_warn(p->dev, "%s:%d stencil write bo base %ld not aligned with %ld\n",
+		dev_warn(p->dev, "%s:%d stencil write bo base %llu not aligned with %ld\n",
 			 __func__, __LINE__, offset, surf.base_align);
 		return -EINVAL;
 	}
-	offset += surf.layer_size * mslice;
+	offset += (u64)surf.layer_size * mslice;
 	if (offset > radeon_bo_size(track->db_z_write_bo)) {
 		dev_warn(p->dev, "%s:%d depth write bo too small (layer size %d, "
-			 "offset %ld, max layer %d, bo size %ld)\n",
+			 "offset %llu, max layer %d, bo size %ld)\n",
 			 __func__, __LINE__, surf.layer_size,
-			(unsigned long)track->db_z_write_offset << 8, mslice,
+			(u64)track->db_z_write_offset << 8, mslice,
 			radeon_bo_size(track->db_z_write_bo));
 		return -EINVAL;
 	}
--- a/drivers/gpu/drm/radeon/r100.c
+++ b/drivers/gpu/drm/radeon/r100.c
@@ -999,45 +999,65 @@ static int r100_cp_init_microcode(struct radeon_device *rdev)

 	DRM_DEBUG_KMS("\n");

-	if ((rdev->family == CHIP_R100) || (rdev->family == CHIP_RV100) ||
-	    (rdev->family == CHIP_RV200) || (rdev->family == CHIP_RS100) ||
-	    (rdev->family == CHIP_RS200)) {
+	switch (rdev->family) {
+	case CHIP_R100:
+	case CHIP_RV100:
+	case CHIP_RV200:
+	case CHIP_RS100:
+	case CHIP_RS200:
 		DRM_INFO("Loading R100 Microcode\n");
 		fw_name = FIRMWARE_R100;
-	} else if ((rdev->family == CHIP_R200) ||
-		   (rdev->family == CHIP_RV250) ||
-		   (rdev->family == CHIP_RV280) ||
-		   (rdev->family == CHIP_RS300)) {
+		break;
+
+	case CHIP_R200:
+	case CHIP_RV250:
+	case CHIP_RV280:
+	case CHIP_RS300:
 		DRM_INFO("Loading R200 Microcode\n");
 		fw_name = FIRMWARE_R200;
-	} else if ((rdev->family == CHIP_R300) ||
-		   (rdev->family == CHIP_R350) ||
-		   (rdev->family == CHIP_RV350) ||
-		   (rdev->family == CHIP_RV380) ||
-		   (rdev->family == CHIP_RS400) ||
-		   (rdev->family == CHIP_RS480)) {
+		break;
+
+	case CHIP_R300:
+	case CHIP_R350:
+	case CHIP_RV350:
+	case CHIP_RV380:
+	case CHIP_RS400:
+	case CHIP_RS480:
 		DRM_INFO("Loading R300 Microcode\n");
 		fw_name = FIRMWARE_R300;
-	} else if ((rdev->family == CHIP_R420) ||
-		   (rdev->family == CHIP_R423) ||
-		   (rdev->family == CHIP_RV410)) {
+		break;
+
+	case CHIP_R420:
+	case CHIP_R423:
+	case CHIP_RV410:
 		DRM_INFO("Loading R400 Microcode\n");
 		fw_name = FIRMWARE_R420;
-	} else if ((rdev->family == CHIP_RS690) ||
-		   (rdev->family == CHIP_RS740)) {
+		break;
+
+	case CHIP_RS690:
+	case CHIP_RS740:
 		DRM_INFO("Loading RS690/RS740 Microcode\n");
 		fw_name = FIRMWARE_RS690;
-	} else if (rdev->family == CHIP_RS600) {
+		break;
+
+	case CHIP_RS600:
 		DRM_INFO("Loading RS600 Microcode\n");
 		fw_name = FIRMWARE_RS600;
-	} else if ((rdev->family == CHIP_RV515) ||
-		   (rdev->family == CHIP_R520) ||
-		   (rdev->family == CHIP_RV530) ||
-		   (rdev->family == CHIP_R580) ||
-		   (rdev->family == CHIP_RV560) ||
-		   (rdev->family == CHIP_RV570)) {
+		break;
+
+	case CHIP_RV515:
+	case CHIP_R520:
+	case CHIP_RV530:
+	case CHIP_R580:
+	case CHIP_RV560:
+	case CHIP_RV570:
 		DRM_INFO("Loading R500 Microcode\n");
 		fw_name = FIRMWARE_R520;
+		break;
+
+	default:
+		DRM_ERROR("Unsupported Radeon family %u\n", rdev->family);
+		return -EINVAL;
 	}

 	err = request_firmware(&rdev->me_fw, fw_name, rdev->dev);
--- a/drivers/gpu/drm/rockchip/rockchip_drm_vop.c
+++ b/drivers/gpu/drm/rockchip/rockchip_drm_vop.c
@@ -320,8 +320,8 @@ static void scl_vop_cal_scl_fac(struct vop *vop, const struct vop_win_data *win,
 	uint32_t val;
 	int vskiplines = 0;

-	if (dst_w > 3840) {
-		DRM_DEV_ERROR(vop->dev, "Maximum dst width (3840) exceeded\n");
+	if (dst_w > 4096) {
+		DRM_DEV_ERROR(vop->dev, "Maximum dst width (4096) exceeded\n");
 		return;
 	}

--- a/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c
@@ -1486,6 +1486,7 @@ static struct drm_framebuffer *vmw_kms_fb_create(struct drm_device *dev,
 		DRM_ERROR("Surface size cannot exceed %dx%d",
 			dev_priv->texture_max_width,
 			dev_priv->texture_max_height);
+		ret = -EINVAL;
 		goto err_out;
 	}

--- a/drivers/hid/hid-ids.h
+++ b/drivers/hid/hid-ids.h
@@ -867,6 +867,8 @@
 #define USB_DEVICE_ID_PLANTRONICS_BLACKWIRE_3220_SERIES	0xc056
 #define USB_DEVICE_ID_PLANTRONICS_BLACKWIRE_3215_SERIES	0xc057
 #define USB_DEVICE_ID_PLANTRONICS_BLACKWIRE_3225_SERIES	0xc058
+#define USB_DEVICE_ID_PLANTRONICS_BLACKWIRE_3325_SERIES	0x430c
+#define USB_DEVICE_ID_PLANTRONICS_ENCOREPRO_500_SERIES		0x431e

 #define USB_VENDOR_ID_PANASONIC		0x04da
 #define USB_DEVICE_ID_PANABOARD_UBT780	0x1044
--- a/drivers/hid/hid-plantronics.c
+++ b/drivers/hid/hid-plantronics.c
@@ -41,8 +41,10 @@
 			    (usage->hid & HID_USAGE_PAGE) == HID_UP_CONSUMER)

 #define PLT_QUIRK_DOUBLE_VOLUME_KEYS BIT(0)
+#define PLT_QUIRK_FOLLOWED_OPPOSITE_VOLUME_KEYS BIT(1)

 #define PLT_DOUBLE_KEY_TIMEOUT 5 /* ms */
+#define PLT_FOLLOWED_OPPOSITE_KEY_TIMEOUT 220 /* ms */

 struct plt_drv_data {
 	unsigned long device_type;
@@ -140,6 +142,21 @@ static int plantronics_event(struct hid_device *hdev, struct hid_field *field,

 		drv_data->last_volume_key_ts = cur_ts;
 	}
+	if (drv_data->quirks & PLT_QUIRK_FOLLOWED_OPPOSITE_VOLUME_KEYS) {
+		unsigned long prev_ts, cur_ts;
+
+		/* Usages are filtered in plantronics_usages. */
+
+		if (!value) /* Handle key presses only. */
+			return 0;
+
+		prev_ts = drv_data->last_volume_key_ts;
+		cur_ts = jiffies;
+		if (jiffies_to_msecs(cur_ts - prev_ts) <= PLT_FOLLOWED_OPPOSITE_KEY_TIMEOUT)
+			return 1; /* Ignore the followed opposite volume key. */
+
+		drv_data->last_volume_key_ts = cur_ts;
+	}

 	return 0;
 }
@@ -213,6 +230,12 @@ static const struct hid_device_id plantronics_devices[] = {
 	{ HID_USB_DEVICE(USB_VENDOR_ID_PLANTRONICS,
 					 USB_DEVICE_ID_PLANTRONICS_BLACKWIRE_3225_SERIES),
 		.driver_data = PLT_QUIRK_DOUBLE_VOLUME_KEYS },
+	{ HID_USB_DEVICE(USB_VENDOR_ID_PLANTRONICS,
+					 USB_DEVICE_ID_PLANTRONICS_BLACKWIRE_3325_SERIES),
+		.driver_data = PLT_QUIRK_FOLLOWED_OPPOSITE_VOLUME_KEYS },
+	{ HID_USB_DEVICE(USB_VENDOR_ID_PLANTRONICS,
+					 USB_DEVICE_ID_PLANTRONICS_ENCOREPRO_500_SERIES),
+		.driver_data = PLT_QUIRK_FOLLOWED_OPPOSITE_VOLUME_KEYS },
 	{ HID_USB_DEVICE(USB_VENDOR_ID_PLANTRONICS, HID_ANY_ID) },
 	{ }
 };
--- a/drivers/hwmon/max16065.c
+++ b/drivers/hwmon/max16065.c
@@ -117,9 +117,10 @@ static inline int LIMIT_TO_MV(int limit, int range)
 	return limit * range / 256;
 }

-static inline int MV_TO_LIMIT(int mv, int range)
+static inline int MV_TO_LIMIT(unsigned long mv, int range)
 {
-	return clamp_val(DIV_ROUND_CLOSEST(mv * 256, range), 0, 255);
+	mv = clamp_val(mv, 0, ULONG_MAX / 256);
+	return DIV_ROUND_CLOSEST(clamp_val(mv * 256, 0, range * 255), range);
 }

 static inline int ADC_TO_CURR(int adc, int gain)
--- a/drivers/hwmon/ntc_thermistor.c
+++ b/drivers/hwmon/ntc_thermistor.c
@@ -57,6 +57,7 @@ static const struct platform_device_id ntc_thermistor_id[] = {
 	{ "ncp15xh103", TYPE_NCPXXXH103 },
 	{ },
 };
+MODULE_DEVICE_TABLE(platform, ntc_thermistor_id);

 /*
 * A compensation table should be sorted by the values of .ohm
--- a/drivers/i2c/busses/i2c-aspeed.c
+++ b/drivers/i2c/busses/i2c-aspeed.c
@@ -157,6 +157,13 @@ struct aspeed_i2c_bus {

 static int aspeed_i2c_reset(struct aspeed_i2c_bus *bus);

+/* precondition: bus.lock has been acquired. */
+static void aspeed_i2c_do_stop(struct aspeed_i2c_bus *bus)
+{
+	bus->master_state = ASPEED_I2C_MASTER_STOP;
+	writel(ASPEED_I2CD_M_STOP_CMD, bus->base + ASPEED_I2C_CMD_REG);
+}
+
 static int aspeed_i2c_recover_bus(struct aspeed_i2c_bus *bus)
 {
 	unsigned long time_left, flags;
@@ -174,7 +181,7 @@ static int aspeed_i2c_recover_bus(struct aspeed_i2c_bus *bus)
 			command);

 		reinit_completion(&bus->cmd_complete);
-		writel(ASPEED_I2CD_M_STOP_CMD, bus->base + ASPEED_I2C_CMD_REG);
+		aspeed_i2c_do_stop(bus);
 		spin_unlock_irqrestore(&bus->lock, flags);

 		time_left = wait_for_completion_timeout(
@@ -351,13 +358,6 @@ static void aspeed_i2c_do_start(struct aspeed_i2c_bus *bus)
 	writel(command, bus->base + ASPEED_I2C_CMD_REG);
 }

-/* precondition: bus.lock has been acquired. */
-static void aspeed_i2c_do_stop(struct aspeed_i2c_bus *bus)
-{
-	bus->master_state = ASPEED_I2C_MASTER_STOP;
-	writel(ASPEED_I2CD_M_STOP_CMD, bus->base + ASPEED_I2C_CMD_REG);
-}
-
 /* precondition: bus.lock has been acquired. */
 static void aspeed_i2c_next_msg_or_stop(struct aspeed_i2c_bus *bus)
 {
--- a/drivers/i2c/busses/i2c-i801.c
+++ b/drivers/i2c/busses/i2c-i801.c
@@ -1665,8 +1665,15 @@ static int i801_probe(struct pci_dev *dev, const struct pci_device_id *id)

 	i801_add_tco(priv);

+	/*
+	 * adapter.name is used by platform code to find the main I801 adapter
+	 * to instantiante i2c_clients, do not change.
+	 */
 	snprintf(priv->adapter.name, sizeof(priv->adapter.name),
-		"SMBus I801 adapter at %04lx", priv->smba);
+		 "SMBus %s adapter at %04lx",
+		 (priv->features & FEATURE_IDF) ? "I801 IDF" : "I801",
+		 priv->smba);
+
 	err = i2c_add_adapter(&priv->adapter);
 	if (err) {
 		platform_device_unregister(priv->tco_pdev);
--- a/drivers/i2c/busses/i2c-isch.c
+++ b/drivers/i2c/busses/i2c-isch.c
@@ -107,8 +107,7 @@ static int sch_transaction(void)
 	if (retries > MAX_RETRIES) {
 		dev_err(&sch_adapter.dev, "SMBus Timeout!\n");
 		result = -ETIMEDOUT;
-	}
-	if (temp & 0x04) {
+	} else if (temp & 0x04) {
 		result = -EIO;
 		dev_dbg(&sch_adapter.dev, "Bus collision! SMBus may be "
 			"locked until next hard reset. (sorry!)\n");
--- a/drivers/i2c/busses/i2c-xiic.c
+++ b/drivers/i2c/busses/i2c-xiic.c
@@ -504,14 +504,17 @@ static irqreturn_t xiic_process(int irq, void *dev_id)
 			goto out;
 		}

-		xiic_fill_tx_fifo(i2c);
-
-		/* current message sent and there is space in the fifo */
-		if (!xiic_tx_space(i2c) && xiic_tx_fifo_space(i2c) >= 2) {
+		if (xiic_tx_space(i2c)) {
+			xiic_fill_tx_fifo(i2c);
+		} else {
+			/* current message fully written */
 			dev_dbg(i2c->adap.dev.parent,
 				"%s end of message sent, nmsgs: %d\n",
 				__func__, i2c->nmsgs);
-			if (i2c->nmsgs > 1) {
+			/* Don't move onto the next message until the TX FIFO empties,
+			 * to ensure that a NAK is not missed.
+			 */
+			if (i2c->nmsgs > 1 && (pend & XIIC_INTR_TX_EMPTY_MASK)) {
 				i2c->nmsgs--;
 				i2c->tx_msg++;
 				xfer_more = 1;
@@ -522,11 +525,7 @@ static irqreturn_t xiic_process(int irq, void *dev_id)
 					"%s Got TX IRQ but no more to do...\n",
 					__func__);
 			}
-		} else if (!xiic_tx_space(i2c) && (i2c->nmsgs == 1))
-			/* current frame is sent and is last,
-			 * make sure to disable tx half
-			 */
-			xiic_irq_dis(i2c, XIIC_INTR_TX_HALF_MASK);
+		}
 	}
 out:
 	dev_dbg(i2c->adap.dev.parent, "%s clr: 0x%x\n", __func__, clr);
--- a/drivers/iio/common/hid-sensors/hid-sensor-trigger.c
+++ b/drivers/iio/common/hid-sensors/hid-sensor-trigger.c
@@ -46,7 +46,7 @@ static ssize_t _hid_sensor_set_report_latency(struct device *dev,
 	latency = integer * 1000 + fract / 1000;
 	ret = hid_sensor_set_report_latency(attrb, latency);
 	if (ret < 0)
-		return len;
+		return ret;

 	attrb->latency_ms = hid_sensor_get_report_latency(attrb);

--- a/drivers/iio/dac/Kconfig
+++ b/drivers/iio/dac/Kconfig
@@ -299,6 +299,7 @@ config STM32_DAC

 config STM32_DAC_CORE
 	tristate
+	select REGMAP_MMIO

 config VF610_DAC
 	tristate "Vybrid vf610 DAC driver"
--- a/drivers/iio/light/opt3001.c
+++ b/drivers/iio/light/opt3001.c
@@ -145,6 +145,10 @@ static const struct opt3001_scale opt3001_scales[] = {
 		.val = 20966,
 		.val2 = 400000,
 	},
+	{
+		.val = 41932,
+		.val2 = 800000,
+	},
 	{
 		.val = 83865,
 		.val2 = 600000,
--- a/drivers/iio/magnetometer/ak8975.c
+++ b/drivers/iio/magnetometer/ak8975.c
@@ -673,22 +673,8 @@ static int ak8975_start_read_axis(struct ak8975_data *data,
 	if (ret < 0)
 		return ret;

-	/* This will be executed only for non-interrupt based waiting case */
-	if (ret & data->def->ctrl_masks[ST1_DRDY]) {
-		ret = i2c_smbus_read_byte_data(client,
-					       data->def->ctrl_regs[ST2]);
-		if (ret < 0) {
-			dev_err(&client->dev, "Error in reading ST2\n");
-			return ret;
-		}
-		if (ret & (data->def->ctrl_masks[ST2_DERR] |
-			   data->def->ctrl_masks[ST2_HOFL])) {
-			dev_err(&client->dev, "ST2 status error 0x%x\n", ret);
-			return -EINVAL;
-		}
-	}
-
-	return 0;
+	/* Return with zero if the data is ready. */
+	return !data->def->ctrl_regs[ST1_DRDY];
 }

 /* Retrieve raw flux value for one of the x, y, or z axis.  */
@@ -715,6 +701,20 @@ static int ak8975_read_axis(struct iio_dev *indio_dev, int index, int *val)
 	if (ret < 0)
 		goto exit;

+	/* Read out ST2 for release lock on measurment data. */
+	ret = i2c_smbus_read_byte_data(client, data->def->ctrl_regs[ST2]);
+	if (ret < 0) {
+		dev_err(&client->dev, "Error in reading ST2\n");
+		goto exit;
+	}
+
+	if (ret & (data->def->ctrl_masks[ST2_DERR] |
+		   data->def->ctrl_masks[ST2_HOFL])) {
+		dev_err(&client->dev, "ST2 status error 0x%x\n", ret);
+		ret = -EINVAL;
+		goto exit;
+	}
+
 	mutex_unlock(&data->lock);

 	pm_runtime_mark_last_busy(&data->client->dev);
--- a/drivers/infiniband/core/iwcm.c
+++ b/drivers/infiniband/core/iwcm.c
@@ -1178,7 +1178,7 @@ static int __init iw_cm_init(void)
 	if (ret)
 		return ret;

-	iwcm_wq = alloc_ordered_workqueue("iw_cm_wq", 0);
+	iwcm_wq = alloc_ordered_workqueue("iw_cm_wq", WQ_MEM_RECLAIM);
 	if (!iwcm_wq)
 		goto err_alloc;

--- a/drivers/infiniband/hw/bnxt_re/qplib_fp.h
+++ b/drivers/infiniband/hw/bnxt_re/qplib_fp.h
@@ -128,7 +128,7 @@ struct bnxt_qplib_swqe {
 			};
 			u32		q_key;
 			u32		dst_qp;
-			u16		avid;
+			u32		avid;
 		} send;

 		/* Send Raw Ethernet and QP1 */
--- a/drivers/infiniband/hw/bnxt_re/qplib_rcfw.c
+++ b/drivers/infiniband/hw/bnxt_re/qplib_rcfw.c
@@ -237,7 +237,7 @@ int bnxt_qplib_rcfw_send_message(struct bnxt_qplib_rcfw *rcfw,
 		/* failed with status */
 		dev_err(&rcfw->pdev->dev, "QPLIB: cmdq[%#x]=%#x status %#x",
 			cookie, opcode, evnt->status);
-		rc = -EFAULT;
+		rc = -EIO;
 	}

 	return rc;
--- a/drivers/infiniband/hw/cxgb4/cm.c
+++ b/drivers/infiniband/hw/cxgb4/cm.c
@@ -1184,6 +1184,8 @@ static int act_establish(struct c4iw_dev *dev, struct sk_buff *skb)
 	int ret;

 	ep = lookup_atid(t, atid);
+	if (!ep)
+		return -EINVAL;

 	pr_debug("%s ep %p tid %u snd_isn %u rcv_isn %u\n", __func__, ep, tid,
 		 be32_to_cpu(req->snd_isn), be32_to_cpu(req->rcv_isn));
@@ -2021,7 +2023,7 @@ static int import_ep(struct c4iw_ep *ep, int iptype, __u8 *peer_ip,
 	err = -ENOMEM;
 	if (n->dev->flags & IFF_LOOPBACK) {
 		if (iptype == 4)
-			pdev = ip_dev_find(&init_net, *(__be32 *)peer_ip);
+			pdev = __ip_dev_find(&init_net, *(__be32 *)peer_ip, false);
 		else if (IS_ENABLED(CONFIG_IPV6))
 			for_each_netdev(&init_net, pdev) {
 				if (ipv6_chk_addr(&init_net,
@@ -2036,12 +2038,12 @@ static int import_ep(struct c4iw_ep *ep, int iptype, __u8 *peer_ip,
 			err = -ENODEV;
 			goto out;
 		}
+		if (is_vlan_dev(pdev))
+			pdev = vlan_dev_real_dev(pdev);
 		ep->l2t = cxgb4_l2t_get(cdev->rdev.lldi.l2t,
 					n, pdev, rt_tos2priority(tos));
-		if (!ep->l2t) {
-			dev_put(pdev);
+		if (!ep->l2t)
 			goto out;
-		}
 		ep->mtu = pdev->mtu;
 		ep->tx_chan = cxgb4_port_chan(pdev);
 		ep->smac_idx = cxgb4_tp_smt_idx(adapter_type,
@@ -2055,7 +2057,6 @@ static int import_ep(struct c4iw_ep *ep, int iptype, __u8 *peer_ip,
 		ep->rss_qid = cdev->rdev.lldi.rxq_ids[
 			cxgb4_port_idx(pdev) * step];
 		set_tcp_window(ep, (struct port_info *)netdev_priv(pdev));
-		dev_put(pdev);
 	} else {
 		pdev = get_real_dev(n->dev);
 		ep->l2t = cxgb4_l2t_get(cdev->rdev.lldi.l2t,
@@ -2216,6 +2217,9 @@ static int act_open_rpl(struct c4iw_dev *dev, struct sk_buff *skb)
 	int ret = 0;

 	ep = lookup_atid(t, atid);
+	if (!ep)
+		return -EINVAL;
+
 	la = (struct sockaddr_in *)&ep->com.local_addr;
 	ra = (struct sockaddr_in *)&ep->com.remote_addr;
 	la6 = (struct sockaddr_in6 *)&ep->com.local_addr;
--- a/drivers/input/keyboard/adp5589-keys.c
+++ b/drivers/input/keyboard/adp5589-keys.c
@@ -390,10 +390,17 @@ static int adp5589_gpio_get_value(struct gpio_chip *chip, unsigned off)
 	struct adp5589_kpad *kpad = gpiochip_get_data(chip);
 	unsigned int bank = kpad->var->bank(kpad->gpiomap[off]);
 	unsigned int bit = kpad->var->bit(kpad->gpiomap[off]);
+	int val;

-	return !!(adp5589_read(kpad->client,
-			       kpad->var->reg(ADP5589_GPI_STATUS_A) + bank) &
-			       bit);
+	mutex_lock(&kpad->gpio_lock);
+	if (kpad->dir[bank] & bit)
+		val = kpad->dat_out[bank];
+	else
+		val = adp5589_read(kpad->client,
+				   kpad->var->reg(ADP5589_GPI_STATUS_A) + bank);
+	mutex_unlock(&kpad->gpio_lock);
+
+	return !!(val & bit);
 }

 static void adp5589_gpio_set_value(struct gpio_chip *chip,
--- a/drivers/mailbox/bcm2835-mailbox.c
+++ b/drivers/mailbox/bcm2835-mailbox.c
@@ -152,7 +152,8 @@ static int bcm2835_mbox_probe(struct platform_device *pdev)
 	spin_lock_init(&mbox->lock);

 	ret = devm_request_irq(dev, irq_of_parse_and_map(dev->of_node, 0),
-			       bcm2835_mbox_irq, 0, dev_name(dev), mbox);
+			       bcm2835_mbox_irq, IRQF_NO_SUSPEND, dev_name(dev),
+			       mbox);
 	if (ret) {
 		dev_err(dev, "Failed to register a mailbox IRQ handler: %d\n",
 			ret);
--- a/drivers/mailbox/rockchip-mailbox.c
+++ b/drivers/mailbox/rockchip-mailbox.c
@@ -167,7 +167,7 @@ static const struct of_device_id rockchip_mbox_of_match[] = {
 	{ .compatible = "rockchip,rk3368-mailbox", .data = &rk3368_drv_data},
 	{ },
 };
-MODULE_DEVICE_TABLE(of, rockchp_mbox_of_match);
+MODULE_DEVICE_TABLE(of, rockchip_mbox_of_match);

 static int rockchip_mbox_probe(struct platform_device *pdev)
 {
--- a/drivers/media/dvb-frontends/rtl2830.c
+++ b/drivers/media/dvb-frontends/rtl2830.c
@@ -619,7 +619,7 @@ static int rtl2830_pid_filter(struct dvb_frontend *fe, u8 index, u16 pid, int on
 		index, pid, onoff);

 	/* skip invalid PIDs (0x2000) */
-	if (pid > 0x1fff || index > 32)
+	if (pid > 0x1fff || index >= 32)
 		return 0;

 	if (onoff)
--- a/drivers/media/dvb-frontends/rtl2832.c
+++ b/drivers/media/dvb-frontends/rtl2832.c
@@ -995,7 +995,7 @@ static int rtl2832_pid_filter(struct dvb_frontend *fe, u8 index, u16 pid,
 		index, pid, onoff, dev->slave_ts);

 	/* skip invalid PIDs (0x2000) */
-	if (pid > 0x1fff || index > 32)
+	if (pid > 0x1fff || index >= 32)
 		return 0;

 	if (onoff)
--- a/drivers/media/platform/qcom/venus/core.c
+++ b/drivers/media/platform/qcom/venus/core.c
@@ -263,6 +263,7 @@ static int venus_remove(struct platform_device *pdev)
 	struct device *dev = core->dev;
 	int ret;

+	cancel_delayed_work_sync(&core->work);
 	ret = pm_runtime_get_sync(dev);
 	WARN_ON(ret < 0);

--- a/drivers/media/v4l2-core/videobuf2-core.c
+++ b/drivers/media/v4l2-core/videobuf2-core.c
@@ -275,6 +275,10 @@ static void __vb2_plane_dmabuf_put(struct vb2_buffer *vb, struct vb2_plane *p)
 	p->mem_priv = NULL;
 	p->dbuf = NULL;
 	p->dbuf_mapped = 0;
+	p->bytesused = 0;
+	p->length = 0;
+	p->m.fd = 0;
+	p->data_offset = 0;
 }

 /**
@@ -1149,10 +1153,6 @@ static int __prepare_dmabuf(struct vb2_buffer *vb, const void *pb)

 		/* Release previously acquired memory if present */
 		__vb2_plane_dmabuf_put(vb, &vb->planes[plane]);
-		vb->planes[plane].bytesused = 0;
-		vb->planes[plane].length = 0;
-		vb->planes[plane].m.fd = 0;
-		vb->planes[plane].data_offset = 0;

 		/* Acquire each plane's memory */
 		mem_priv = call_ptr_memop(vb, attach_dmabuf,
--- a/drivers/misc/sgi-gru/grukservices.c
+++ b/drivers/misc/sgi-gru/grukservices.c
@@ -270,7 +270,6 @@ static int gru_get_cpu_resources(int dsr_bytes, void **cb, void **dsr)
 	int lcpu;

 	BUG_ON(dsr_bytes > GRU_NUM_KERNEL_DSR_BYTES);
-	preempt_disable();
 	bs = gru_lock_kernel_context(-1);
 	lcpu = uv_blade_processor_id();
 	*cb = bs->kernel_cb + lcpu * GRU_HANDLE_STRIDE;
@@ -284,7 +283,6 @@ static int gru_get_cpu_resources(int dsr_bytes, void **cb, void **dsr)
 static void gru_free_cpu_resources(void *cb, void *dsr)
 {
 	gru_unlock_kernel_context(uv_numa_blade_id());
-	preempt_enable();
 }

 /*
--- a/drivers/misc/sgi-gru/grumain.c
+++ b/drivers/misc/sgi-gru/grumain.c
@@ -954,10 +954,8 @@ int gru_fault(struct vm_fault *vmf)

 again:
 	mutex_lock(&gts->ts_ctxlock);
-	preempt_disable();

 	if (gru_check_context_placement(gts)) {
-		preempt_enable();
 		mutex_unlock(&gts->ts_ctxlock);
 		gru_unload_context(gts, 1);
 		return VM_FAULT_NOPAGE;
@@ -966,7 +964,6 @@ again:
 	if (!gts->ts_gru) {
 		STAT(load_user_context);
 		if (!gru_assign_gru_context(gts)) {
-			preempt_enable();
 			mutex_unlock(&gts->ts_ctxlock);
 			set_current_state(TASK_INTERRUPTIBLE);
 			schedule_timeout(GRU_ASSIGN_DELAY);  /* true hack ZZZ */
@@ -982,7 +979,6 @@ again:
 				vma->vm_page_prot);
 	}

-	preempt_enable();
 	mutex_unlock(&gts->ts_ctxlock);

 	return VM_FAULT_NOPAGE;
--- a/drivers/misc/sgi-gru/grutlbpurge.c
+++ b/drivers/misc/sgi-gru/grutlbpurge.c
@@ -78,7 +78,6 @@ static struct gru_tlb_global_handle *get_lock_tgh_handle(struct gru_state
 	struct gru_tlb_global_handle *tgh;
 	int n;

-	preempt_disable();
 	if (uv_numa_blade_id() == gru->gs_blade_id)
 		n = get_on_blade_tgh(gru);
 	else
@@ -92,7 +91,6 @@ static struct gru_tlb_global_handle *get_lock_tgh_handle(struct gru_state
 static void get_unlock_tgh_handle(struct gru_tlb_global_handle *tgh)
 {
 	unlock_tgh_handle(tgh);
-	preempt_enable();
 }

 /*
--- a/drivers/mtd/devices/slram.c
+++ b/drivers/mtd/devices/slram.c
@@ -299,10 +299,12 @@ static int __init init_slram(void)
 		T("slram: devname = %s\n", devname);
 		if ((!map) || (!(devstart = strsep(&map, ",")))) {
 			E("slram: No devicestart specified.\n");
+			break;
 		}
 		T("slram: devstart = %s\n", devstart);
 		if ((!map) || (!(devlength = strsep(&map, ",")))) {
 			E("slram: No devicelength / -end specified.\n");
+			break;
 		}
 		T("slram: devlength = %s\n", devlength);
 		if (parse_cmdline(devname, devstart, devlength) != 0) {
--- a/drivers/net/ethernet/aeroflex/greth.c
+++ b/drivers/net/ethernet/aeroflex/greth.c
@@ -488,7 +488,7 @@ greth_start_xmit_gbit(struct sk_buff *skb, struct net_device *dev)

 	if (unlikely(skb->len > MAX_FRAME_SIZE)) {
 		dev->stats.tx_errors++;
-		goto out;
+		goto len_error;
 	}

 	/* Save skb pointer. */
@@ -579,6 +579,7 @@ frag_map_error:
 map_error:
 	if (net_ratelimit())
 		dev_warn(greth->dev, "Could not create TX DMA mapping\n");
+len_error:
 	dev_kfree_skb(skb);
 out:
 	return err;
--- a/drivers/net/ethernet/amd/mvme147.c
+++ b/drivers/net/ethernet/amd/mvme147.c
@@ -105,10 +105,6 @@ struct net_device * __init mvme147lance_probe(int unit)
 	address = address >> 8;
 	dev->dev_addr[3] = address&0xff;

-	printk("%s: MVME147 at 0x%08lx, irq %d, Hardware Address %pM\n",
-	       dev->name, dev->base_addr, MVME147_LANCE_IRQ,
-	       dev->dev_addr);
-
 	lp = netdev_priv(dev);
 	lp->ram = __get_dma_pages(GFP_ATOMIC, 3);	/* 32K */
 	if (!lp->ram) {
@@ -138,6 +134,9 @@ struct net_device * __init mvme147lance_probe(int unit)
 		return ERR_PTR(err);
 	}

+	netdev_info(dev, "MVME147 at 0x%08lx, irq %d, Hardware Address %pM\n",
+		    dev->base_addr, MVME147_LANCE_IRQ, dev->dev_addr);
+
 	return dev;
 }

--- a/drivers/net/ethernet/broadcom/bcmsysport.c
+++ b/drivers/net/ethernet/broadcom/bcmsysport.c
@@ -1243,6 +1243,7 @@ static netdev_tx_t bcm_sysport_xmit(struct sk_buff *skb,
 		netif_err(priv, tx_err, dev, "DMA map failed at %p (len=%d)\n",
 			  skb->data, skb_len);
 		ret = NETDEV_TX_OK;
+		dev_kfree_skb_any(skb);
 		goto out;
 	}

--- a/drivers/net/ethernet/emulex/benet/be_main.c
+++ b/drivers/net/ethernet/emulex/benet/be_main.c
@@ -1379,10 +1379,8 @@ static netdev_tx_t be_xmit(struct sk_buff *skb, struct net_device *netdev)
 	be_get_wrb_params_from_skb(adapter, skb, &wrb_params);

 	wrb_cnt = be_xmit_enqueue(adapter, txo, skb, &wrb_params);
-	if (unlikely(!wrb_cnt)) {
-		dev_kfree_skb_any(skb);
-		goto drop;
-	}
+	if (unlikely(!wrb_cnt))
+		goto drop_skb;

 	/* if os2bmc is enabled and if the pkt is destined to bmc,
 	 * enqueue the pkt a 2nd time with mgmt bit set.
@@ -1391,7 +1389,7 @@ static netdev_tx_t be_xmit(struct sk_buff *skb, struct net_device *netdev)
 		BE_WRB_F_SET(wrb_params.features, OS2BMC, 1);
 		wrb_cnt = be_xmit_enqueue(adapter, txo, skb, &wrb_params);
 		if (unlikely(!wrb_cnt))
-			goto drop;
+			goto drop_skb;
 		else
 			skb_get(skb);
 	}
@@ -1405,6 +1403,8 @@ static netdev_tx_t be_xmit(struct sk_buff *skb, struct net_device *netdev)
 		be_xmit_flush(adapter, txo);

 	return NETDEV_TX_OK;
+drop_skb:
+	dev_kfree_skb_any(skb);
 drop:
 	tx_stats(txo)->tx_drv_drops++;
 	/* Flush the already enqueued tx requests */
--- a/drivers/net/ethernet/faraday/ftgmac100.c
+++ b/drivers/net/ethernet/faraday/ftgmac100.c
@@ -574,7 +574,7 @@ static bool ftgmac100_rx_packet(struct ftgmac100 *priv, int *processed)
 	(*processed)++;
 	return true;

- drop:
+drop:
 	/* Clean rxdes0 (which resets own bit) */
 	rxdes->rxdes0 = cpu_to_le32(status & priv->rxdes0_edorr_mask);
 	priv->rx_pointer = ftgmac100_next_rx_pointer(priv, pointer);
@@ -658,6 +658,11 @@ static bool ftgmac100_tx_complete_packet(struct ftgmac100 *priv)
 	ftgmac100_free_tx_packet(priv, pointer, skb, txdes, ctl_stat);
 	txdes->txdes0 = cpu_to_le32(ctl_stat & priv->txdes0_edotr_mask);

+	/* Ensure the descriptor config is visible before setting the tx
+	 * pointer.
+	 */
+	smp_wmb();
+
 	priv->tx_clean_pointer = ftgmac100_next_tx_pointer(priv, pointer);

 	return true;
@@ -811,6 +816,11 @@ static netdev_tx_t ftgmac100_hard_start_xmit(struct sk_buff *skb,
 	dma_wmb();
 	first->txdes0 = cpu_to_le32(f_ctl_stat);

+	/* Ensure the descriptor config is visible before setting the tx
+	 * pointer.
+	 */
+	smp_wmb();
+
 	/* Update next TX pointer */
 	priv->tx_pointer = pointer;

@@ -831,7 +841,7 @@ static netdev_tx_t ftgmac100_hard_start_xmit(struct sk_buff *skb,

 	return NETDEV_TX_OK;

- dma_err:
+dma_err:
 	if (net_ratelimit())
 		netdev_err(netdev, "map tx fragment failed\n");

@@ -853,7 +863,7 @@ static netdev_tx_t ftgmac100_hard_start_xmit(struct sk_buff *skb,
 	 * last fragment, so we know ftgmac100_free_tx_packet()
 	 * hasn't freed the skb yet.
 	 */
- drop:
+drop:
 	/* Drop the packet */
 	dev_kfree_skb_any(skb);
 	netdev->stats.tx_dropped++;
@@ -1439,7 +1449,7 @@ static void ftgmac100_reset_task(struct work_struct *work)
 	ftgmac100_init_all(priv, true);

 	netdev_dbg(netdev, "Reset done !\n");
- bail:
+bail:
 	if (priv->mii_bus)
 		mutex_unlock(&priv->mii_bus->mdio_lock);
 	if (netdev->phydev)
@@ -1510,15 +1520,15 @@ static int ftgmac100_open(struct net_device *netdev)

 	return 0;

- err_ncsi:
+err_ncsi:
 	napi_disable(&priv->napi);
 	netif_stop_queue(netdev);
- err_alloc:
+err_alloc:
 	ftgmac100_free_buffers(priv);
 	free_irq(netdev->irq, netdev);
- err_irq:
+err_irq:
 	netif_napi_del(&priv->napi);
- err_hw:
+err_hw:
 	iowrite32(0, priv->base + FTGMAC100_OFFSET_IER);
 	ftgmac100_free_rings(priv);
 	return err;
--- a/drivers/net/ethernet/faraday/ftgmac100.h
+++ b/drivers/net/ethernet/faraday/ftgmac100.h
@@ -97,7 +97,7 @@
 			    FTGMAC100_INT_RPKT_BUF)

 /* All the interrupts we care about */
-#define FTGMAC100_INT_ALL (FTGMAC100_INT_RPKT_BUF  |  \
+#define FTGMAC100_INT_ALL (FTGMAC100_INT_RXTX  |  \
 			   FTGMAC100_INT_BAD)

 /*
--- a/drivers/net/ethernet/freescale/dpaa/dpaa_eth.c
+++ b/drivers/net/ethernet/freescale/dpaa/dpaa_eth.c
@@ -2040,11 +2040,11 @@ static netdev_tx_t
 dpaa_start_xmit(struct sk_buff *skb, struct net_device *net_dev)
 {
 	const int queue_mapping = skb_get_queue_mapping(skb);
-	bool nonlinear = skb_is_nonlinear(skb);
 	struct rtnl_link_stats64 *percpu_stats;
 	struct dpaa_percpu_priv *percpu_priv;
 	struct dpaa_priv *priv;
 	struct qm_fd fd;
+	bool nonlinear;
 	int offset = 0;
 	int err = 0;

@@ -2054,6 +2054,13 @@ dpaa_start_xmit(struct sk_buff *skb, struct net_device *net_dev)

 	qm_fd_clear_fd(&fd);

+	/* Packet data is always read as 32-bit words, so zero out any part of
+	 * the skb which might be sent if we have to pad the packet
+	 */
+	if (__skb_put_padto(skb, ETH_ZLEN, false))
+		goto enomem;
+
+	nonlinear = skb_is_nonlinear(skb);
 	if (!nonlinear) {
 		/* We're going to store the skb backpointer at the beginning
 		 * of the data buffer, so we need a privately owned skb
--- a/drivers/net/ethernet/hisilicon/hip04_eth.c
+++ b/drivers/net/ethernet/hisilicon/hip04_eth.c
@@ -861,6 +861,7 @@ static int hip04_mac_probe(struct platform_device *pdev)
 	priv->tx_coalesce_timer.function = tx_done;

 	priv->map = syscon_node_to_regmap(arg.np);
+	of_node_put(arg.np);
 	if (IS_ERR(priv->map)) {
 		dev_warn(d, "no syscon hisilicon,hip04-ppe\n");
 		ret = PTR_ERR(priv->map);
--- a/drivers/net/ethernet/hisilicon/hns/hns_dsaf_mac.c
+++ b/drivers/net/ethernet/hisilicon/hns/hns_dsaf_mac.c
@@ -942,6 +942,7 @@ static int hns_mac_get_info(struct hns_mac_cb *mac_cb)
 			mac_cb->cpld_ctrl = NULL;
 		} else {
 			syscon = syscon_node_to_regmap(cpld_args.np);
+			of_node_put(cpld_args.np);
 			if (IS_ERR_OR_NULL(syscon)) {
 				dev_dbg(mac_cb->dev, "no cpld-syscon found!\n");
 				mac_cb->cpld_ctrl = NULL;
--- a/drivers/net/ethernet/hisilicon/hns_mdio.c
+++ b/drivers/net/ethernet/hisilicon/hns_mdio.c
@@ -508,6 +508,7 @@ static int hns_mdio_probe(struct platform_device *pdev)
 						MDIO_SC_RESET_ST;
 				}
 			}
+			of_node_put(reg_args.np);
 		} else {
 			dev_warn(&pdev->dev, "find syscon ret = %#x\n", ret);
 			mdio_dev->subctrl_vbase = NULL;
--- a/drivers/net/ethernet/i825xx/sun3_82586.c
+++ b/drivers/net/ethernet/i825xx/sun3_82586.c
@@ -1013,6 +1013,7 @@ static int sun3_82586_send_packet(struct sk_buff *skb, struct net_device *dev)
 	if(skb->len > XMIT_BUFF_SIZE)
 	{
 		printk("%s: Sorry, max. framelength is %d bytes. The length of your frame is %d bytes.\n",dev->name,XMIT_BUFF_SIZE,skb->len);
+		dev_kfree_skb(skb);
 		return NETDEV_TX_OK;
 	}

--- a/drivers/net/ethernet/ibm/emac/mal.c
+++ b/drivers/net/ethernet/ibm/emac/mal.c
@@ -581,7 +581,7 @@ static int mal_probe(struct platform_device *ofdev)
 		printk(KERN_ERR "%pOF: Support for 405EZ not enabled!\n",
 				ofdev->dev.of_node);
 		err = -ENODEV;
-		goto fail;
+		goto fail_unmap;
 #endif
 	}

--- a/drivers/net/ethernet/intel/igb/igb_main.c
+++ b/drivers/net/ethernet/intel/igb/igb_main.c
@@ -8349,6 +8349,10 @@ static void igb_io_resume(struct pci_dev *pdev)
 	struct igb_adapter *adapter = netdev_priv(netdev);

 	if (netif_running(netdev)) {
+		if (!test_bit(__IGB_DOWN, &adapter->state)) {
+			dev_dbg(&pdev->dev, "Resuming from non-fatal error, do nothing.\n");
+			return;
+		}
 		if (igb_up(adapter)) {
 			dev_err(&pdev->dev, "igb_up failed after reset\n");
 			return;
--- a/drivers/net/ethernet/jme.c
+++ b/drivers/net/ethernet/jme.c
@@ -964,15 +964,13 @@ jme_udpsum(struct sk_buff *skb)
 	if (skb->protocol != htons(ETH_P_IP))
 		return csum;
 	skb_set_network_header(skb, ETH_HLEN);
-	if ((ip_hdr(skb)->protocol != IPPROTO_UDP) ||
-	    (skb->len < (ETH_HLEN +
-			(ip_hdr(skb)->ihl << 2) +
-			sizeof(struct udphdr)))) {
+
+	if (ip_hdr(skb)->protocol != IPPROTO_UDP ||
+	    skb->len < (ETH_HLEN + ip_hdrlen(skb) + sizeof(struct udphdr))) {
 		skb_reset_network_header(skb);
 		return csum;
 	}
-	skb_set_transport_header(skb,
-			ETH_HLEN + (ip_hdr(skb)->ihl << 2));
+	skb_set_transport_header(skb, ETH_HLEN + ip_hdrlen(skb));
 	csum = udp_hdr(skb)->check;
 	skb_reset_transport_header(skb);
 	skb_reset_network_header(skb);
--- a/drivers/net/ethernet/lantiq_etop.c
+++ b/drivers/net/ethernet/lantiq_etop.c
@@ -477,7 +477,9 @@ ltq_etop_tx(struct sk_buff *skb, struct net_device *dev)
 	unsigned long flags;
 	u32 byte_offset;

-	len = skb->len < ETH_ZLEN ? ETH_ZLEN : skb->len;
+	if (skb_put_padto(skb, ETH_ZLEN))
+		return NETDEV_TX_OK;
+	len = skb->len;

 	if ((desc->ctl & (LTQ_DMA_OWN | LTQ_DMA_C)) || ch->skb[ch->dma.desc]) {
 		netdev_err(dev, "tx ring full\n");
--- a/drivers/net/ethernet/mellanox/mlx5/core/main.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/main.c
@@ -1574,6 +1574,8 @@ static const struct pci_device_id mlx5_core_pci_table[] = {
 	{ PCI_VDEVICE(MELLANOX, 0x101a), MLX5_PCI_DEV_IS_VF},	/* ConnectX-5 Ex VF */
 	{ PCI_VDEVICE(MELLANOX, 0x101b) },			/* ConnectX-6 */
 	{ PCI_VDEVICE(MELLANOX, 0x101c), MLX5_PCI_DEV_IS_VF},	/* ConnectX-6 VF */
+	{ PCI_VDEVICE(MELLANOX, 0x101d) },			/* ConnectX-6 Dx */
+	{ PCI_VDEVICE(MELLANOX, 0x101e), MLX5_PCI_DEV_IS_VF},	/* ConnectX Family mlx5Gen Virtual Function */
 	{ PCI_VDEVICE(MELLANOX, 0xa2d2) },			/* BlueField integrated ConnectX-5 network controller */
 	{ PCI_VDEVICE(MELLANOX, 0xa2d3), MLX5_PCI_DEV_IS_VF},	/* BlueField integrated ConnectX-5 network controller VF */
 	{ PCI_VDEVICE(MELLANOX, 0xa2d6) },			/* BlueField-2 integrated ConnectX-6 Dx network controller */
--- a/drivers/net/gtp.c
+++ b/drivers/net/gtp.c
@@ -852,31 +852,32 @@ static int gtp_encap_enable(struct gtp_dev *gtp, struct nlattr *data[])
 	unsigned int role = GTP_ROLE_GGSN;

 	if (data[IFLA_GTP_FD0]) {
-		u32 fd0 = nla_get_u32(data[IFLA_GTP_FD0]);
+		int fd0 = nla_get_u32(data[IFLA_GTP_FD0]);

-		sk0 = gtp_encap_enable_socket(fd0, UDP_ENCAP_GTP0, gtp);
-		if (IS_ERR(sk0))
-			return PTR_ERR(sk0);
+		if (fd0 >= 0) {
+			sk0 = gtp_encap_enable_socket(fd0, UDP_ENCAP_GTP0, gtp);
+			if (IS_ERR(sk0))
+				return PTR_ERR(sk0);
+		}
 	}

 	if (data[IFLA_GTP_FD1]) {
-		u32 fd1 = nla_get_u32(data[IFLA_GTP_FD1]);
+		int fd1 = nla_get_u32(data[IFLA_GTP_FD1]);

-		sk1u = gtp_encap_enable_socket(fd1, UDP_ENCAP_GTP1U, gtp);
-		if (IS_ERR(sk1u)) {
-			if (sk0)
+		if (fd1 >= 0) {
+			sk1u = gtp_encap_enable_socket(fd1, UDP_ENCAP_GTP1U, gtp);
+			if (IS_ERR(sk1u)) {
 				gtp_encap_disable_sock(sk0);
-			return PTR_ERR(sk1u);
+				return PTR_ERR(sk1u);
+			}
 		}
 	}

 	if (data[IFLA_GTP_ROLE]) {
 		role = nla_get_u32(data[IFLA_GTP_ROLE]);
 		if (role > GTP_ROLE_SGSN) {
-			if (sk0)
-				gtp_encap_disable_sock(sk0);
-			if (sk1u)
-				gtp_encap_disable_sock(sk1u);
+			gtp_encap_disable_sock(sk0);
+			gtp_encap_disable_sock(sk1u);
 			return -EINVAL;
 		}
 	}
--- a/drivers/net/ppp/ppp_async.c
+++ b/drivers/net/ppp/ppp_async.c
@@ -555,7 +555,7 @@ ppp_async_encode(struct asyncppp *ap)
 	 * and 7 (code-reject) must be sent as though no options
 	 * had been negotiated.
 	 */
-	islcp = proto == PPP_LCP && 1 <= data[2] && data[2] <= 7;
+	islcp = proto == PPP_LCP && count >= 3 && 1 <= data[2] && data[2] <= 7;

 	if (i == 0) {
 		if (islcp)
--- a/drivers/net/usb/cdc_ncm.c
+++ b/drivers/net/usb/cdc_ncm.c
@@ -1709,10 +1709,10 @@ int cdc_ncm_rx_fixup(struct usbnet *dev, struct sk_buff *skb_in)
 {
 	struct sk_buff *skb;
 	struct cdc_ncm_ctx *ctx = (struct cdc_ncm_ctx *)dev->data[0];
-	int len;
+	unsigned int len;
 	int nframes;
 	int x;
-	int offset;
+	unsigned int offset;
 	union {
 		struct usb_cdc_ncm_ndp16 *ndp16;
 		struct usb_cdc_ncm_ndp32 *ndp32;
@@ -1784,8 +1784,8 @@ next_ndp:
 			break;
 		}

-		/* sanity checking */
-		if (((offset + len) > skb_in->len) ||
+		/* sanity checking - watch out for integer wrap*/
+		if ((offset > skb_in->len) || (len > skb_in->len - offset) ||
 				(len > ctx->rx_max) || (len < ETH_HLEN)) {
 			netif_dbg(dev, rx_err, dev->net,
 				  "invalid frame detected (ignored) offset[%u]=%u, length=%u, skb=%p\n",
--- a/drivers/net/usb/ipheth.c
+++ b/drivers/net/usb/ipheth.c
@@ -307,13 +307,14 @@ static int ipheth_carrier_set(struct ipheth_device *dev)
 			0x02, /* index */
 			dev->ctrl_buf, IPHETH_CTRL_BUF_SIZE,
 			IPHETH_CTRL_TIMEOUT);
-	if (retval < 0) {
+	if (retval <= 0) {
 		dev_err(&dev->intf->dev, "%s: usb_control_msg: %d\n",
 			__func__, retval);
 		return retval;
 	}

-	if (dev->ctrl_buf[0] == IPHETH_CARRIER_ON) {
+	if ((retval == 1 && dev->ctrl_buf[0] == IPHETH_CARRIER_ON) ||
+	    (retval >= 2 && dev->ctrl_buf[1] == IPHETH_CARRIER_ON)) {
 		netif_carrier_on(dev->net);
 		if (dev->tx_urb->status != -EINPROGRESS)
 			netif_wake_queue(dev->net);
--- a/drivers/net/usb/r8152.c
+++ b/drivers/net/usb/r8152.c
@@ -3001,11 +3001,23 @@ static void r8152b_hw_phy_cfg(struct r8152 *tp)
 	set_bit(PHY_RESET, &tp->flags);
 }

-static void r8152b_exit_oob(struct r8152 *tp)
+static void wait_oob_link_list_ready(struct r8152 *tp)
 {
 	u32 ocp_data;
 	int i;

+	for (i = 0; i < 1000; i++) {
+		ocp_data = ocp_read_byte(tp, MCU_TYPE_PLA, PLA_OOB_CTRL);
+		if (ocp_data & LINK_LIST_READY)
+			break;
+		usleep_range(1000, 2000);
+	}
+}
+
+static void r8152b_exit_oob(struct r8152 *tp)
+{
+	u32 ocp_data;
+
 	ocp_data = ocp_read_dword(tp, MCU_TYPE_PLA, PLA_RCR);
 	ocp_data &= ~RCR_ACPT_ALL;
 	ocp_write_dword(tp, MCU_TYPE_PLA, PLA_RCR, ocp_data);
@@ -3023,23 +3035,13 @@ static void r8152b_exit_oob(struct r8152 *tp)
 	ocp_data &= ~MCU_BORW_EN;
 	ocp_write_word(tp, MCU_TYPE_PLA, PLA_SFF_STS_7, ocp_data);

-	for (i = 0; i < 1000; i++) {
-		ocp_data = ocp_read_byte(tp, MCU_TYPE_PLA, PLA_OOB_CTRL);
-		if (ocp_data & LINK_LIST_READY)
-			break;
-		usleep_range(1000, 2000);
-	}
+	wait_oob_link_list_ready(tp);

 	ocp_data = ocp_read_word(tp, MCU_TYPE_PLA, PLA_SFF_STS_7);
 	ocp_data |= RE_INIT_LL;
 	ocp_write_word(tp, MCU_TYPE_PLA, PLA_SFF_STS_7, ocp_data);

-	for (i = 0; i < 1000; i++) {
-		ocp_data = ocp_read_byte(tp, MCU_TYPE_PLA, PLA_OOB_CTRL);
-		if (ocp_data & LINK_LIST_READY)
-			break;
-		usleep_range(1000, 2000);
-	}
+	wait_oob_link_list_ready(tp);

 	rtl8152_nic_reset(tp);

@@ -3081,7 +3083,6 @@ static void r8152b_exit_oob(struct r8152 *tp)
 static void r8152b_enter_oob(struct r8152 *tp)
 {
 	u32 ocp_data;
-	int i;

 	ocp_data = ocp_read_byte(tp, MCU_TYPE_PLA, PLA_OOB_CTRL);
 	ocp_data &= ~NOW_IS_OOB;
@@ -3093,23 +3094,13 @@ static void r8152b_enter_oob(struct r8152 *tp)

 	rtl_disable(tp);

-	for (i = 0; i < 1000; i++) {
-		ocp_data = ocp_read_byte(tp, MCU_TYPE_PLA, PLA_OOB_CTRL);
-		if (ocp_data & LINK_LIST_READY)
-			break;
-		usleep_range(1000, 2000);
-	}
+	wait_oob_link_list_ready(tp);

 	ocp_data = ocp_read_word(tp, MCU_TYPE_PLA, PLA_SFF_STS_7);
 	ocp_data |= RE_INIT_LL;
 	ocp_write_word(tp, MCU_TYPE_PLA, PLA_SFF_STS_7, ocp_data);

-	for (i = 0; i < 1000; i++) {
-		ocp_data = ocp_read_byte(tp, MCU_TYPE_PLA, PLA_OOB_CTRL);
-		if (ocp_data & LINK_LIST_READY)
-			break;
-		usleep_range(1000, 2000);
-	}
+	wait_oob_link_list_ready(tp);

 	ocp_write_word(tp, MCU_TYPE_PLA, PLA_RMS, RTL8152_RMS);

@@ -3382,7 +3373,6 @@ static void r8153b_hw_phy_cfg(struct r8152 *tp)
 static void r8153_first_init(struct r8152 *tp)
 {
 	u32 ocp_data;
-	int i;

 	rxdy_gated_en(tp, true);
 	r8153_teredo_off(tp);
@@ -3402,23 +3392,13 @@ static void r8153_first_init(struct r8152 *tp)
 	ocp_data &= ~MCU_BORW_EN;
 	ocp_write_word(tp, MCU_TYPE_PLA, PLA_SFF_STS_7, ocp_data);

-	for (i = 0; i < 1000; i++) {
-		ocp_data = ocp_read_byte(tp, MCU_TYPE_PLA, PLA_OOB_CTRL);
-		if (ocp_data & LINK_LIST_READY)
-			break;
-		usleep_range(1000, 2000);
-	}
+	wait_oob_link_list_ready(tp);

 	ocp_data = ocp_read_word(tp, MCU_TYPE_PLA, PLA_SFF_STS_7);
 	ocp_data |= RE_INIT_LL;
 	ocp_write_word(tp, MCU_TYPE_PLA, PLA_SFF_STS_7, ocp_data);

-	for (i = 0; i < 1000; i++) {
-		ocp_data = ocp_read_byte(tp, MCU_TYPE_PLA, PLA_OOB_CTRL);
-		if (ocp_data & LINK_LIST_READY)
-			break;
-		usleep_range(1000, 2000);
-	}
+	wait_oob_link_list_ready(tp);

 	rtl_rx_vlan_en(tp, tp->netdev->features & NETIF_F_HW_VLAN_CTAG_RX);

@@ -3443,7 +3423,6 @@ static void r8153_first_init(struct r8152 *tp)
 static void r8153_enter_oob(struct r8152 *tp)
 {
 	u32 ocp_data;
-	int i;

 	ocp_data = ocp_read_byte(tp, MCU_TYPE_PLA, PLA_OOB_CTRL);
 	ocp_data &= ~NOW_IS_OOB;
@@ -3452,23 +3431,13 @@ static void r8153_enter_oob(struct r8152 *tp)
 	rtl_disable(tp);
 	rtl_reset_bmu(tp);

-	for (i = 0; i < 1000; i++) {
-		ocp_data = ocp_read_byte(tp, MCU_TYPE_PLA, PLA_OOB_CTRL);
-		if (ocp_data & LINK_LIST_READY)
-			break;
-		usleep_range(1000, 2000);
-	}
+	wait_oob_link_list_ready(tp);

 	ocp_data = ocp_read_word(tp, MCU_TYPE_PLA, PLA_SFF_STS_7);
 	ocp_data |= RE_INIT_LL;
 	ocp_write_word(tp, MCU_TYPE_PLA, PLA_SFF_STS_7, ocp_data);

-	for (i = 0; i < 1000; i++) {
-		ocp_data = ocp_read_byte(tp, MCU_TYPE_PLA, PLA_OOB_CTRL);
-		if (ocp_data & LINK_LIST_READY)
-			break;
-		usleep_range(1000, 2000);
-	}
+	wait_oob_link_list_ready(tp);

 	ocp_data = tp->netdev->mtu + VLAN_ETH_HLEN + ETH_FCS_LEN;
 	ocp_write_word(tp, MCU_TYPE_PLA, PLA_RMS, ocp_data);
--- a/drivers/net/usb/usbnet.c
+++ b/drivers/net/usb/usbnet.c
@@ -1836,7 +1836,8 @@ usbnet_probe (struct usb_interface *udev, const struct usb_device_id *prod)
 		// can rename the link if it knows better.
 		if ((dev->driver_info->flags & FLAG_ETHER) != 0 &&
 		    ((dev->driver_info->flags & FLAG_POINTTOPOINT) == 0 ||
-		     (net->dev_addr [0] & 0x02) == 0))
+		     /* somebody touched it*/
+		     !is_zero_ether_addr(net->dev_addr)))
 			strscpy(net->name, "eth%d", sizeof(net->name));
 		/* WLAN devices should always be named "wlan%d" */
 		if ((dev->driver_info->flags & FLAG_WLAN) != 0)
--- a/Show More
+++ b/Show More