Linux patch 4.14.2104.14-220

Signed-off-by: Mike Pagano <mpagano@gentoo.org>

2 files changed, 2123 insertions, 0 deletions

diff --git a/0000_README b/0000_README
index 35d5c39e..fef350e3 100644
--- a/0000_README
+++ b/0000_README
@@ -879,6 +879,10 @@ Patch:  1208_linux-4.14.209.patch
 From:   https://www.kernel.org
 Desc:   Linux 4.14.209
 
+Patch:  1209_linux-4.14.210.patch
+From:   https://www.kernel.org
+Desc:   Linux 4.14.210
+
 Patch:  1500_XATTR_USER_PREFIX.patch
 From:   https://bugs.gentoo.org/show_bug.cgi?id=470644
 Desc:   Support for namespace user.pax.* on tmpfs.
diff --git a/1209_linux-4.14.210.patch b/1209_linux-4.14.210.patch
new file mode 100644
index 00000000..e119a497
--- /dev/null
+++ b/1209_linux-4.14.210.patch
@@ -0,0 +1,2119 @@
+diff --git a/Makefile b/Makefile
+index 653e6472a8dc6..fa6ea54e2604a 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,7 +1,7 @@
+ # SPDX-License-Identifier: GPL-2.0
+ VERSION = 4
+ PATCHLEVEL = 14
+-SUBLEVEL = 209
++SUBLEVEL = 210
+ EXTRAVERSION =
+ NAME = Petit Gorille
+ 
+diff --git a/arch/arm64/include/asm/pgtable.h b/arch/arm64/include/asm/pgtable.h
+index 324db23b37de4..6147e58babf00 100644
+--- a/arch/arm64/include/asm/pgtable.h
++++ b/arch/arm64/include/asm/pgtable.h
+@@ -92,8 +92,6 @@ extern unsigned long empty_zero_page[PAGE_SIZE / sizeof(unsigned long)];
+ #define pte_valid(pte)		(!!(pte_val(pte) & PTE_VALID))
+ #define pte_valid_not_user(pte) \
+ 	((pte_val(pte) & (PTE_VALID | PTE_USER)) == PTE_VALID)
+-#define pte_valid_young(pte) \
+-	((pte_val(pte) & (PTE_VALID | PTE_AF)) == (PTE_VALID | PTE_AF))
+ #define pte_valid_user(pte) \
+ 	((pte_val(pte) & (PTE_VALID | PTE_USER)) == (PTE_VALID | PTE_USER))
+ 
+@@ -101,9 +99,12 @@ extern unsigned long empty_zero_page[PAGE_SIZE / sizeof(unsigned long)];
+  * Could the pte be present in the TLB? We must check mm_tlb_flush_pending
+  * so that we don't erroneously return false for pages that have been
+  * remapped as PROT_NONE but are yet to be flushed from the TLB.
++ * Note that we can't make any assumptions based on the state of the access
++ * flag, since ptep_clear_flush_young() elides a DSB when invalidating the
++ * TLB.
+  */
+ #define pte_accessible(mm, pte)	\
+-	(mm_tlb_flush_pending(mm) ? pte_present(pte) : pte_valid_young(pte))
++	(mm_tlb_flush_pending(mm) ? pte_present(pte) : pte_valid(pte))
+ 
+ /*
+  * p??_access_permitted() is true for valid user mappings (subject to the
+@@ -129,13 +130,6 @@ static inline pte_t set_pte_bit(pte_t pte, pgprot_t prot)
+ 	return pte;
+ }
+ 
+-static inline pte_t pte_wrprotect(pte_t pte)
+-{
+-	pte = clear_pte_bit(pte, __pgprot(PTE_WRITE));
+-	pte = set_pte_bit(pte, __pgprot(PTE_RDONLY));
+-	return pte;
+-}
+-
+ static inline pte_t pte_mkwrite(pte_t pte)
+ {
+ 	pte = set_pte_bit(pte, __pgprot(PTE_WRITE));
+@@ -161,6 +155,20 @@ static inline pte_t pte_mkdirty(pte_t pte)
+ 	return pte;
+ }
+ 
++static inline pte_t pte_wrprotect(pte_t pte)
++{
++	/*
++	 * If hardware-dirty (PTE_WRITE/DBM bit set and PTE_RDONLY
++	 * clear), set the PTE_DIRTY bit.
++	 */
++	if (pte_hw_dirty(pte))
++		pte = pte_mkdirty(pte);
++
++	pte = clear_pte_bit(pte, __pgprot(PTE_WRITE));
++	pte = set_pte_bit(pte, __pgprot(PTE_RDONLY));
++	return pte;
++}
++
+ static inline pte_t pte_mkold(pte_t pte)
+ {
+ 	return clear_pte_bit(pte, __pgprot(PTE_AF));
+@@ -642,12 +650,6 @@ static inline void ptep_set_wrprotect(struct mm_struct *mm, unsigned long addres
+ 	pte = READ_ONCE(*ptep);
+ 	do {
+ 		old_pte = pte;
+-		/*
+-		 * If hardware-dirty (PTE_WRITE/DBM bit set and PTE_RDONLY
+-		 * clear), set the PTE_DIRTY bit.
+-		 */
+-		if (pte_hw_dirty(pte))
+-			pte = pte_mkdirty(pte);
+ 		pte = pte_wrprotect(pte);
+ 		pte_val(pte) = cmpxchg_relaxed(&pte_val(*ptep),
+ 					       pte_val(old_pte), pte_val(pte));
+diff --git a/arch/x86/events/intel/cstate.c b/arch/x86/events/intel/cstate.c
+index 59521c71c98a4..4ebeaa3c67100 100644
+--- a/arch/x86/events/intel/cstate.c
++++ b/arch/x86/events/intel/cstate.c
+@@ -99,14 +99,14 @@
+ MODULE_LICENSE("GPL");
+ 
+ #define DEFINE_CSTATE_FORMAT_ATTR(_var, _name, _format)		\
+-static ssize_t __cstate_##_var##_show(struct kobject *kobj,	\
+-				struct kobj_attribute *attr,	\
++static ssize_t __cstate_##_var##_show(struct device *dev,	\
++				struct device_attribute *attr,	\
+ 				char *page)			\
+ {								\
+ 	BUILD_BUG_ON(sizeof(_format) >= PAGE_SIZE);		\
+ 	return sprintf(page, _format "\n");			\
+ }								\
+-static struct kobj_attribute format_attr_##_var =		\
++static struct device_attribute format_attr_##_var =		\
+ 	__ATTR(_name, 0444, __cstate_##_var##_show, NULL)
+ 
+ static ssize_t cstate_get_attr_cpumask(struct device *dev,
+diff --git a/arch/x86/events/intel/rapl.c b/arch/x86/events/intel/rapl.c
+index d36a5fac6a18b..7d3f861e31654 100644
+--- a/arch/x86/events/intel/rapl.c
++++ b/arch/x86/events/intel/rapl.c
+@@ -115,18 +115,6 @@ static const char *const rapl_domain_names[NR_RAPL_DOMAINS] __initconst = {
+  * any other bit is reserved
+  */
+ #define RAPL_EVENT_MASK	0xFFULL
+-
+-#define DEFINE_RAPL_FORMAT_ATTR(_var, _name, _format)		\
+-static ssize_t __rapl_##_var##_show(struct kobject *kobj,	\
+-				struct kobj_attribute *attr,	\
+-				char *page)			\
+-{								\
+-	BUILD_BUG_ON(sizeof(_format) >= PAGE_SIZE);		\
+-	return sprintf(page, _format "\n");			\
+-}								\
+-static struct kobj_attribute format_attr_##_var =		\
+-	__ATTR(_name, 0444, __rapl_##_var##_show, NULL)
+-
+ #define RAPL_CNTR_WIDTH 32
+ 
+ #define RAPL_EVENT_ATTR_STR(_name, v, str)					\
+@@ -548,7 +536,7 @@ static struct attribute_group rapl_pmu_events_group = {
+ 	.attrs = NULL, /* patched at runtime */
+ };
+ 
+-DEFINE_RAPL_FORMAT_ATTR(event, event, "config:0-7");
++PMU_FORMAT_ATTR(event, "config:0-7");
+ static struct attribute *rapl_formats_attr[] = {
+ 	&format_attr_event.attr,
+ 	NULL,
+diff --git a/arch/x86/events/intel/uncore.c b/arch/x86/events/intel/uncore.c
+index c56cb37b88e33..4ad93871508cd 100644
+--- a/arch/x86/events/intel/uncore.c
++++ b/arch/x86/events/intel/uncore.c
+@@ -90,8 +90,8 @@ end:
+ 	return map;
+ }
+ 
+-ssize_t uncore_event_show(struct kobject *kobj,
+-			  struct kobj_attribute *attr, char *buf)
++ssize_t uncore_event_show(struct device *dev,
++			  struct device_attribute *attr, char *buf)
+ {
+ 	struct uncore_event_desc *event =
+ 		container_of(attr, struct uncore_event_desc, attr);
+diff --git a/arch/x86/events/intel/uncore.h b/arch/x86/events/intel/uncore.h
+index 4364191e7c6b2..ae4ab89e16c7d 100644
+--- a/arch/x86/events/intel/uncore.h
++++ b/arch/x86/events/intel/uncore.h
+@@ -125,7 +125,7 @@ struct intel_uncore_box {
+ #define UNCORE_BOX_FLAG_CTL_OFFS8	1 /* event config registers are 8-byte apart */
+ 
+ struct uncore_event_desc {
+-	struct kobj_attribute attr;
++	struct device_attribute attr;
+ 	const char *config;
+ };
+ 
+@@ -137,8 +137,8 @@ struct pci2phy_map {
+ 
+ struct pci2phy_map *__find_pci2phy_map(int segment);
+ 
+-ssize_t uncore_event_show(struct kobject *kobj,
+-			  struct kobj_attribute *attr, char *buf);
++ssize_t uncore_event_show(struct device *dev,
++			  struct device_attribute *attr, char *buf);
+ 
+ #define INTEL_UNCORE_EVENT_DESC(_name, _config)			\
+ {								\
+@@ -147,14 +147,14 @@ ssize_t uncore_event_show(struct kobject *kobj,
+ }
+ 
+ #define DEFINE_UNCORE_FORMAT_ATTR(_var, _name, _format)			\
+-static ssize_t __uncore_##_var##_show(struct kobject *kobj,		\
+-				struct kobj_attribute *attr,		\
++static ssize_t __uncore_##_var##_show(struct device *dev,		\
++				struct device_attribute *attr,		\
+ 				char *page)				\
+ {									\
+ 	BUILD_BUG_ON(sizeof(_format) >= PAGE_SIZE);			\
+ 	return sprintf(page, _format "\n");				\
+ }									\
+-static struct kobj_attribute format_attr_##_var =			\
++static struct device_attribute format_attr_##_var =			\
+ 	__ATTR(_name, 0444, __uncore_##_var##_show, NULL)
+ 
+ static inline unsigned uncore_pci_box_ctl(struct intel_uncore_box *box)
+diff --git a/arch/x86/kernel/cpu/bugs.c b/arch/x86/kernel/cpu/bugs.c
+index 1dbc64bbd8668..fcea3aa19c23a 100644
+--- a/arch/x86/kernel/cpu/bugs.c
++++ b/arch/x86/kernel/cpu/bugs.c
+@@ -733,11 +733,13 @@ spectre_v2_user_select_mitigation(enum spectre_v2_mitigation_cmd v2_cmd)
+ 	if (boot_cpu_has(X86_FEATURE_IBPB)) {
+ 		setup_force_cpu_cap(X86_FEATURE_USE_IBPB);
+ 
++		spectre_v2_user_ibpb = mode;
+ 		switch (cmd) {
+ 		case SPECTRE_V2_USER_CMD_FORCE:
+ 		case SPECTRE_V2_USER_CMD_PRCTL_IBPB:
+ 		case SPECTRE_V2_USER_CMD_SECCOMP_IBPB:
+ 			static_branch_enable(&switch_mm_always_ibpb);
++			spectre_v2_user_ibpb = SPECTRE_V2_USER_STRICT;
+ 			break;
+ 		case SPECTRE_V2_USER_CMD_PRCTL:
+ 		case SPECTRE_V2_USER_CMD_AUTO:
+@@ -751,8 +753,6 @@ spectre_v2_user_select_mitigation(enum spectre_v2_mitigation_cmd v2_cmd)
+ 		pr_info("mitigation: Enabling %s Indirect Branch Prediction Barrier\n",
+ 			static_key_enabled(&switch_mm_always_ibpb) ?
+ 			"always-on" : "conditional");
+-
+-		spectre_v2_user_ibpb = mode;
+ 	}
+ 
+ 	/*
+diff --git a/arch/x86/kernel/cpu/intel_rdt_rdtgroup.c b/arch/x86/kernel/cpu/intel_rdt_rdtgroup.c
+index 60c63b23e3baa..bb33888151fb0 100644
+--- a/arch/x86/kernel/cpu/intel_rdt_rdtgroup.c
++++ b/arch/x86/kernel/cpu/intel_rdt_rdtgroup.c
+@@ -393,6 +393,24 @@ unlock:
+ 	return ret ?: nbytes;
+ }
+ 
++/**
++ * rdtgroup_remove - the helper to remove resource group safely
++ * @rdtgrp: resource group to remove
++ *
++ * On resource group creation via a mkdir, an extra kernfs_node reference is
++ * taken to ensure that the rdtgroup structure remains accessible for the
++ * rdtgroup_kn_unlock() calls where it is removed.
++ *
++ * Drop the extra reference here, then free the rdtgroup structure.
++ *
++ * Return: void
++ */
++static void rdtgroup_remove(struct rdtgroup *rdtgrp)
++{
++	kernfs_put(rdtgrp->kn);
++	kfree(rdtgrp);
++}
++
+ struct task_move_callback {
+ 	struct callback_head	work;
+ 	struct rdtgroup		*rdtgrp;
+@@ -415,7 +433,7 @@ static void move_myself(struct callback_head *head)
+ 	    (rdtgrp->flags & RDT_DELETED)) {
+ 		current->closid = 0;
+ 		current->rmid = 0;
+-		kfree(rdtgrp);
++		rdtgroup_remove(rdtgrp);
+ 	}
+ 
+ 	preempt_disable();
+@@ -830,7 +848,6 @@ static int rdtgroup_mkdir_info_resdir(struct rdt_resource *r, char *name,
+ 	if (IS_ERR(kn_subdir))
+ 		return PTR_ERR(kn_subdir);
+ 
+-	kernfs_get(kn_subdir);
+ 	ret = rdtgroup_kn_set_ugid(kn_subdir);
+ 	if (ret)
+ 		return ret;
+@@ -853,7 +870,6 @@ static int rdtgroup_create_info_dir(struct kernfs_node *parent_kn)
+ 	kn_info = kernfs_create_dir(parent_kn, "info", parent_kn->mode, NULL);
+ 	if (IS_ERR(kn_info))
+ 		return PTR_ERR(kn_info);
+-	kernfs_get(kn_info);
+ 
+ 	for_each_alloc_enabled_rdt_resource(r) {
+ 		fflags =  r->fflags | RF_CTRL_INFO;
+@@ -870,12 +886,6 @@ static int rdtgroup_create_info_dir(struct kernfs_node *parent_kn)
+ 			goto out_destroy;
+ 	}
+ 
+-	/*
+-	 * This extra ref will be put in kernfs_remove() and guarantees
+-	 * that @rdtgrp->kn is always accessible.
+-	 */
+-	kernfs_get(kn_info);
+-
+ 	ret = rdtgroup_kn_set_ugid(kn_info);
+ 	if (ret)
+ 		goto out_destroy;
+@@ -904,12 +914,6 @@ mongroup_create_dir(struct kernfs_node *parent_kn, struct rdtgroup *prgrp,
+ 	if (dest_kn)
+ 		*dest_kn = kn;
+ 
+-	/*
+-	 * This extra ref will be put in kernfs_remove() and guarantees
+-	 * that @rdtgrp->kn is always accessible.
+-	 */
+-	kernfs_get(kn);
+-
+ 	ret = rdtgroup_kn_set_ugid(kn);
+ 	if (ret)
+ 		goto out_destroy;
+@@ -1126,8 +1130,7 @@ void rdtgroup_kn_unlock(struct kernfs_node *kn)
+ 	if (atomic_dec_and_test(&rdtgrp->waitcount) &&
+ 	    (rdtgrp->flags & RDT_DELETED)) {
+ 		kernfs_unbreak_active_protection(kn);
+-		kernfs_put(rdtgrp->kn);
+-		kfree(rdtgrp);
++		rdtgroup_remove(rdtgrp);
+ 	} else {
+ 		kernfs_unbreak_active_protection(kn);
+ 	}
+@@ -1178,7 +1181,6 @@ static struct dentry *rdt_mount(struct file_system_type *fs_type,
+ 			dentry = ERR_PTR(ret);
+ 			goto out_info;
+ 		}
+-		kernfs_get(kn_mongrp);
+ 
+ 		ret = mkdir_mondata_all(rdtgroup_default.kn,
+ 					&rdtgroup_default, &kn_mondata);
+@@ -1186,7 +1188,6 @@ static struct dentry *rdt_mount(struct file_system_type *fs_type,
+ 			dentry = ERR_PTR(ret);
+ 			goto out_mongrp;
+ 		}
+-		kernfs_get(kn_mondata);
+ 		rdtgroup_default.mon.mon_data_kn = kn_mondata;
+ 	}
+ 
+@@ -1329,7 +1330,7 @@ static void free_all_child_rdtgrp(struct rdtgroup *rdtgrp)
+ 		if (atomic_read(&sentry->waitcount) != 0)
+ 			sentry->flags = RDT_DELETED;
+ 		else
+-			kfree(sentry);
++			rdtgroup_remove(sentry);
+ 	}
+ }
+ 
+@@ -1367,7 +1368,7 @@ static void rmdir_all_sub(void)
+ 		if (atomic_read(&rdtgrp->waitcount) != 0)
+ 			rdtgrp->flags = RDT_DELETED;
+ 		else
+-			kfree(rdtgrp);
++			rdtgroup_remove(rdtgrp);
+ 	}
+ 	/* Notify online CPUs to update per cpu storage and PQR_ASSOC MSR */
+ 	update_closid_rmid(cpu_online_mask, &rdtgroup_default);
+@@ -1461,11 +1462,6 @@ static int mkdir_mondata_subdir(struct kernfs_node *parent_kn,
+ 	if (IS_ERR(kn))
+ 		return PTR_ERR(kn);
+ 
+-	/*
+-	 * This extra ref will be put in kernfs_remove() and guarantees
+-	 * that kn is always accessible.
+-	 */
+-	kernfs_get(kn);
+ 	ret = rdtgroup_kn_set_ugid(kn);
+ 	if (ret)
+ 		goto out_destroy;
+@@ -1626,8 +1622,8 @@ static int mkdir_rdt_prepare(struct kernfs_node *parent_kn,
+ 	/*
+ 	 * kernfs_remove() will drop the reference count on "kn" which
+ 	 * will free it. But we still need it to stick around for the
+-	 * rdtgroup_kn_unlock(kn} call below. Take one extra reference
+-	 * here, which will be dropped inside rdtgroup_kn_unlock().
++	 * rdtgroup_kn_unlock(kn) call. Take one extra reference here,
++	 * which will be dropped by kernfs_put() in rdtgroup_remove().
+ 	 */
+ 	kernfs_get(kn);
+ 
+@@ -1661,6 +1657,7 @@ static int mkdir_rdt_prepare(struct kernfs_node *parent_kn,
+ out_idfree:
+ 	free_rmid(rdtgrp->mon.rmid);
+ out_destroy:
++	kernfs_put(rdtgrp->kn);
+ 	kernfs_remove(rdtgrp->kn);
+ out_free_rgrp:
+ 	kfree(rdtgrp);
+@@ -1673,7 +1670,7 @@ static void mkdir_rdt_prepare_clean(struct rdtgroup *rgrp)
+ {
+ 	kernfs_remove(rgrp->kn);
+ 	free_rmid(rgrp->mon.rmid);
+-	kfree(rgrp);
++	rdtgroup_remove(rgrp);
+ }
+ 
+ /*
+@@ -1839,11 +1836,6 @@ static int rdtgroup_rmdir_mon(struct kernfs_node *kn, struct rdtgroup *rdtgrp,
+ 	WARN_ON(list_empty(&prdtgrp->mon.crdtgrp_list));
+ 	list_del(&rdtgrp->mon.crdtgrp_list);
+ 
+-	/*
+-	 * one extra hold on this, will drop when we kfree(rdtgrp)
+-	 * in rdtgroup_kn_unlock()
+-	 */
+-	kernfs_get(kn);
+ 	kernfs_remove(rdtgrp->kn);
+ 
+ 	return 0;
+@@ -1880,11 +1872,6 @@ static int rdtgroup_rmdir_ctrl(struct kernfs_node *kn, struct rdtgroup *rdtgrp,
+ 
+ 	list_del(&rdtgrp->rdtgroup_list);
+ 
+-	/*
+-	 * one extra hold on this, will drop when we kfree(rdtgrp)
+-	 * in rdtgroup_kn_unlock()
+-	 */
+-	kernfs_get(kn);
+ 	kernfs_remove(rdtgrp->kn);
+ 
+ 	/*
+diff --git a/arch/x86/xen/spinlock.c b/arch/x86/xen/spinlock.c
+index 2527540051ff0..e22ee24396158 100644
+--- a/arch/x86/xen/spinlock.c
++++ b/arch/x86/xen/spinlock.c
+@@ -99,10 +99,20 @@ void xen_init_lock_cpu(int cpu)
+ 
+ void xen_uninit_lock_cpu(int cpu)
+ {
++	int irq;
++
+ 	if (!xen_pvspin)
+ 		return;
+ 
+-	unbind_from_irqhandler(per_cpu(lock_kicker_irq, cpu), NULL);
++	/*
++	 * When booting the kernel with 'mitigations=auto,nosmt', the secondary
++	 * CPUs are not activated, and lock_kicker_irq is not initialized.
++	 */
++	irq = per_cpu(lock_kicker_irq, cpu);
++	if (irq == -1)
++		return;
++
++	unbind_from_irqhandler(irq, NULL);
+ 	per_cpu(lock_kicker_irq, cpu) = -1;
+ 	kfree(per_cpu(irq_name, cpu));
+ 	per_cpu(irq_name, cpu) = NULL;
+diff --git a/drivers/dma/pl330.c b/drivers/dma/pl330.c
+index ff8b7042d28f4..c034f506e015a 100644
+--- a/drivers/dma/pl330.c
++++ b/drivers/dma/pl330.c
+@@ -2666,7 +2666,7 @@ pl330_prep_dma_memcpy(struct dma_chan *chan, dma_addr_t dst,
+ 	 * If burst size is smaller than bus width then make sure we only
+ 	 * transfer one at a time to avoid a burst stradling an MFIFO entry.
+ 	 */
+-	if (desc->rqcfg.brst_size * 8 < pl330->pcfg.data_bus_width)
++	if (burst * 8 < pl330->pcfg.data_bus_width)
+ 		desc->rqcfg.brst_len = 1;
+ 
+ 	desc->bytes_requested = len;
+diff --git a/drivers/dma/xilinx/xilinx_dma.c b/drivers/dma/xilinx/xilinx_dma.c
+index 2db352308e5c0..314f175cf8d05 100644
+--- a/drivers/dma/xilinx/xilinx_dma.c
++++ b/drivers/dma/xilinx/xilinx_dma.c
+@@ -422,8 +422,8 @@ struct xilinx_dma_device {
+ #define to_dma_tx_descriptor(tx) \
+ 	container_of(tx, struct xilinx_dma_tx_descriptor, async_tx)
+ #define xilinx_dma_poll_timeout(chan, reg, val, cond, delay_us, timeout_us) \
+-	readl_poll_timeout(chan->xdev->regs + chan->ctrl_offset + reg, val, \
+-			   cond, delay_us, timeout_us)
++	readl_poll_timeout_atomic(chan->xdev->regs + chan->ctrl_offset + reg, \
++				  val, cond, delay_us, timeout_us)
+ 
+ /* IO accessors */
+ static inline u32 dma_read(struct xilinx_dma_chan *chan, u32 reg)
+diff --git a/drivers/hid/hid-cypress.c b/drivers/hid/hid-cypress.c
+index 1689568b597d4..12c5d7c96527a 100644
+--- a/drivers/hid/hid-cypress.c
++++ b/drivers/hid/hid-cypress.c
+@@ -26,19 +26,17 @@
+ #define CP_2WHEEL_MOUSE_HACK		0x02
+ #define CP_2WHEEL_MOUSE_HACK_ON		0x04
+ 
++#define VA_INVAL_LOGICAL_BOUNDARY	0x08
++
+ /*
+  * Some USB barcode readers from cypress have usage min and usage max in
+  * the wrong order
+  */
+-static __u8 *cp_report_fixup(struct hid_device *hdev, __u8 *rdesc,
++static __u8 *cp_rdesc_fixup(struct hid_device *hdev, __u8 *rdesc,
+ 		unsigned int *rsize)
+ {
+-	unsigned long quirks = (unsigned long)hid_get_drvdata(hdev);
+ 	unsigned int i;
+ 
+-	if (!(quirks & CP_RDESC_SWAPPED_MIN_MAX))
+-		return rdesc;
+-
+ 	if (*rsize < 4)
+ 		return rdesc;
+ 
+@@ -51,6 +49,40 @@ static __u8 *cp_report_fixup(struct hid_device *hdev, __u8 *rdesc,
+ 	return rdesc;
+ }
+ 
++static __u8 *va_logical_boundary_fixup(struct hid_device *hdev, __u8 *rdesc,
++		unsigned int *rsize)
++{
++	/*
++	 * Varmilo VA104M (with VID Cypress and device ID 07B1) incorrectly
++	 * reports Logical Minimum of its Consumer Control device as 572
++	 * (0x02 0x3c). Fix this by setting its Logical Minimum to zero.
++	 */
++	if (*rsize == 25 &&
++			rdesc[0] == 0x05 && rdesc[1] == 0x0c &&
++			rdesc[2] == 0x09 && rdesc[3] == 0x01 &&
++			rdesc[6] == 0x19 && rdesc[7] == 0x00 &&
++			rdesc[11] == 0x16 && rdesc[12] == 0x3c && rdesc[13] == 0x02) {
++		hid_info(hdev,
++			 "fixing up varmilo VA104M consumer control report descriptor\n");
++		rdesc[12] = 0x00;
++		rdesc[13] = 0x00;
++	}
++	return rdesc;
++}
++
++static __u8 *cp_report_fixup(struct hid_device *hdev, __u8 *rdesc,
++		unsigned int *rsize)
++{
++	unsigned long quirks = (unsigned long)hid_get_drvdata(hdev);
++
++	if (quirks & CP_RDESC_SWAPPED_MIN_MAX)
++		rdesc = cp_rdesc_fixup(hdev, rdesc, rsize);
++	if (quirks & VA_INVAL_LOGICAL_BOUNDARY)
++		rdesc = va_logical_boundary_fixup(hdev, rdesc, rsize);
++
++	return rdesc;
++}
++
+ static int cp_input_mapped(struct hid_device *hdev, struct hid_input *hi,
+ 		struct hid_field *field, struct hid_usage *usage,
+ 		unsigned long **bit, int *max)
+@@ -131,6 +163,8 @@ static const struct hid_device_id cp_devices[] = {
+ 		.driver_data = CP_RDESC_SWAPPED_MIN_MAX },
+ 	{ HID_USB_DEVICE(USB_VENDOR_ID_CYPRESS, USB_DEVICE_ID_CYPRESS_MOUSE),
+ 		.driver_data = CP_2WHEEL_MOUSE_HACK },
++	{ HID_USB_DEVICE(USB_VENDOR_ID_CYPRESS, USB_DEVICE_ID_CYPRESS_VARMILO_VA104M_07B1),
++		.driver_data = VA_INVAL_LOGICAL_BOUNDARY },
+ 	{ }
+ };
+ MODULE_DEVICE_TABLE(hid, cp_devices);
+diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h
+index a1e5e0529545b..be0707cfc0fd1 100644
+--- a/drivers/hid/hid-ids.h
++++ b/drivers/hid/hid-ids.h
+@@ -322,6 +322,8 @@
+ #define USB_DEVICE_ID_CYPRESS_BARCODE_4	0xed81
+ #define USB_DEVICE_ID_CYPRESS_TRUETOUCH	0xc001
+ 
++#define USB_DEVICE_ID_CYPRESS_VARMILO_VA104M_07B1   0X07b1
++
+ #define USB_VENDOR_ID_DATA_MODUL	0x7374
+ #define USB_VENDOR_ID_DATA_MODUL_EASYMAXTOUCH	0x1201
+ 
+@@ -694,6 +696,7 @@
+ #define USB_VENDOR_ID_LOGITECH		0x046d
+ #define USB_DEVICE_ID_LOGITECH_AUDIOHUB 0x0a0e
+ #define USB_DEVICE_ID_LOGITECH_T651	0xb00c
++#define USB_DEVICE_ID_LOGITECH_DINOVO_EDGE_KBD	0xb309
+ #define USB_DEVICE_ID_LOGITECH_C007	0xc007
+ #define USB_DEVICE_ID_LOGITECH_C077	0xc077
+ #define USB_DEVICE_ID_LOGITECH_RECEIVER	0xc101
+diff --git a/drivers/hid/hid-input.c b/drivers/hid/hid-input.c
+index 07a043ae69f12..0e63cedcc3b51 100644
+--- a/drivers/hid/hid-input.c
++++ b/drivers/hid/hid-input.c
+@@ -331,6 +331,9 @@ static const struct hid_device_id hid_battery_quirks[] = {
+ 	{ HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_ASUSTEK,
+ 		USB_DEVICE_ID_ASUSTEK_T100CHI_KEYBOARD),
+ 	  HID_BATTERY_QUIRK_IGNORE },
++	{ HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_LOGITECH,
++		USB_DEVICE_ID_LOGITECH_DINOVO_EDGE_KBD),
++	  HID_BATTERY_QUIRK_IGNORE },
+ 	{}
+ };
+ 
+diff --git a/drivers/hid/hid-sensor-hub.c b/drivers/hid/hid-sensor-hub.c
+index b5bd5cb7d5324..aa078c1dad14f 100644
+--- a/drivers/hid/hid-sensor-hub.c
++++ b/drivers/hid/hid-sensor-hub.c
+@@ -496,7 +496,8 @@ static int sensor_hub_raw_event(struct hid_device *hdev,
+ 		return 1;
+ 
+ 	ptr = raw_data;
+-	ptr++; /* Skip report id */
++	if (report->id)
++		ptr++; /* Skip report id */
+ 
+ 	spin_lock_irqsave(&pdata->lock, flags);
+ 
+diff --git a/drivers/infiniband/hw/mthca/mthca_cq.c b/drivers/infiniband/hw/mthca/mthca_cq.c
+index a6531ffe29a6f..a5694dec3f2ee 100644
+--- a/drivers/infiniband/hw/mthca/mthca_cq.c
++++ b/drivers/infiniband/hw/mthca/mthca_cq.c
+@@ -808,8 +808,10 @@ int mthca_init_cq(struct mthca_dev *dev, int nent,
+ 	}
+ 
+ 	mailbox = mthca_alloc_mailbox(dev, GFP_KERNEL);
+-	if (IS_ERR(mailbox))
++	if (IS_ERR(mailbox)) {
++		err = PTR_ERR(mailbox);
+ 		goto err_out_arm;
++	}
+ 
+ 	cq_context = mailbox->buf;
+ 
+@@ -851,9 +853,9 @@ int mthca_init_cq(struct mthca_dev *dev, int nent,
+ 	}
+ 
+ 	spin_lock_irq(&dev->cq_table.lock);
+-	if (mthca_array_set(&dev->cq_table.cq,
+-			    cq->cqn & (dev->limits.num_cqs - 1),
+-			    cq)) {
++	err = mthca_array_set(&dev->cq_table.cq,
++			      cq->cqn & (dev->limits.num_cqs - 1), cq);
++	if (err) {
+ 		spin_unlock_irq(&dev->cq_table.lock);
+ 		goto err_out_free_mr;
+ 	}
+diff --git a/drivers/input/serio/i8042.c b/drivers/input/serio/i8042.c
+index 824f4c1c1f310..0e9f248370a3f 100644
+--- a/drivers/input/serio/i8042.c
++++ b/drivers/input/serio/i8042.c
+@@ -125,6 +125,7 @@ module_param_named(unmask_kbd_data, i8042_unmask_kbd_data, bool, 0600);
+ MODULE_PARM_DESC(unmask_kbd_data, "Unconditional enable (may reveal sensitive data) of normally sanitize-filtered kbd data traffic debug log [pre-condition: i8042.debug=1 enabled]");
+ #endif
+ 
++static bool i8042_present;
+ static bool i8042_bypass_aux_irq_test;
+ static char i8042_kbd_firmware_id[128];
+ static char i8042_aux_firmware_id[128];
+@@ -345,6 +346,9 @@ int i8042_command(unsigned char *param, int command)
+ 	unsigned long flags;
+ 	int retval;
+ 
++	if (!i8042_present)
++		return -1;
++
+ 	spin_lock_irqsave(&i8042_lock, flags);
+ 	retval = __i8042_command(param, command);
+ 	spin_unlock_irqrestore(&i8042_lock, flags);
+@@ -1599,12 +1603,15 @@ static int __init i8042_init(void)
+ 
+ 	err = i8042_platform_init();
+ 	if (err)
+-		return err;
++		return (err == -ENODEV) ? 0 : err;
+ 
+ 	err = i8042_controller_check();
+ 	if (err)
+ 		goto err_platform_exit;
+ 
++	/* Set this before creating the dev to allow i8042_command to work right away */
++	i8042_present = true;
++
+ 	pdev = platform_create_bundle(&i8042_driver, i8042_probe, NULL, 0, NULL, 0);
+ 	if (IS_ERR(pdev)) {
+ 		err = PTR_ERR(pdev);
+@@ -1623,6 +1630,9 @@ static int __init i8042_init(void)
+ 
+ static void __exit i8042_exit(void)
+ {
++	if (!i8042_present)
++		return;
++
+ 	platform_device_unregister(i8042_platform_device);
+ 	platform_driver_unregister(&i8042_driver);
+ 	i8042_platform_exit();
+diff --git a/drivers/net/can/m_can/m_can.c b/drivers/net/can/m_can/m_can.c
+index 680ee8345211f..a3f2548c5548c 100644
+--- a/drivers/net/can/m_can/m_can.c
++++ b/drivers/net/can/m_can/m_can.c
+@@ -972,7 +972,7 @@ static const struct can_bittiming_const m_can_bittiming_const_31X = {
+ 	.name = KBUILD_MODNAME,
+ 	.tseg1_min = 2,		/* Time segment 1 = prop_seg + phase_seg1 */
+ 	.tseg1_max = 256,
+-	.tseg2_min = 1,		/* Time segment 2 = phase_seg2 */
++	.tseg2_min = 2,		/* Time segment 2 = phase_seg2 */
+ 	.tseg2_max = 128,
+ 	.sjw_max = 128,
+ 	.brp_min = 1,
+diff --git a/drivers/net/can/usb/gs_usb.c b/drivers/net/can/usb/gs_usb.c
+index aed8ab6d6c5b0..99c42f297afdf 100644
+--- a/drivers/net/can/usb/gs_usb.c
++++ b/drivers/net/can/usb/gs_usb.c
+@@ -71,21 +71,27 @@ enum gs_can_identify_mode {
+ };
+ 
+ /* data types passed between host and device */
++
++/* The firmware on the original USB2CAN by Geschwister Schneider
++ * Technologie Entwicklungs- und Vertriebs UG exchanges all data
++ * between the host and the device in host byte order. This is done
++ * with the struct gs_host_config::byte_order member, which is sent
++ * first to indicate the desired byte order.
++ *
++ * The widely used open source firmware candleLight doesn't support
++ * this feature and exchanges the data in little endian byte order.
++ */
+ struct gs_host_config {
+-	u32 byte_order;
++	__le32 byte_order;
+ } __packed;
+-/* All data exchanged between host and device is exchanged in host byte order,
+- * thanks to the struct gs_host_config byte_order member, which is sent first
+- * to indicate the desired byte order.
+- */
+ 
+ struct gs_device_config {
+ 	u8 reserved1;
+ 	u8 reserved2;
+ 	u8 reserved3;
+ 	u8 icount;
+-	u32 sw_version;
+-	u32 hw_version;
++	__le32 sw_version;
++	__le32 hw_version;
+ } __packed;
+ 
+ #define GS_CAN_MODE_NORMAL               0
+@@ -95,26 +101,26 @@ struct gs_device_config {
+ #define GS_CAN_MODE_ONE_SHOT             BIT(3)
+ 
+ struct gs_device_mode {
+-	u32 mode;
+-	u32 flags;
++	__le32 mode;
++	__le32 flags;
+ } __packed;
+ 
+ struct gs_device_state {
+-	u32 state;
+-	u32 rxerr;
+-	u32 txerr;
++	__le32 state;
++	__le32 rxerr;
++	__le32 txerr;
+ } __packed;
+ 
+ struct gs_device_bittiming {
+-	u32 prop_seg;
+-	u32 phase_seg1;
+-	u32 phase_seg2;
+-	u32 sjw;
+-	u32 brp;
++	__le32 prop_seg;
++	__le32 phase_seg1;
++	__le32 phase_seg2;
++	__le32 sjw;
++	__le32 brp;
+ } __packed;
+ 
+ struct gs_identify_mode {
+-	u32 mode;
++	__le32 mode;
+ } __packed;
+ 
+ #define GS_CAN_FEATURE_LISTEN_ONLY      BIT(0)
+@@ -125,23 +131,23 @@ struct gs_identify_mode {
+ #define GS_CAN_FEATURE_IDENTIFY         BIT(5)
+ 
+ struct gs_device_bt_const {
+-	u32 feature;
+-	u32 fclk_can;
+-	u32 tseg1_min;
+-	u32 tseg1_max;
+-	u32 tseg2_min;
+-	u32 tseg2_max;
+-	u32 sjw_max;
+-	u32 brp_min;
+-	u32 brp_max;
+-	u32 brp_inc;
++	__le32 feature;
++	__le32 fclk_can;
++	__le32 tseg1_min;
++	__le32 tseg1_max;
++	__le32 tseg2_min;
++	__le32 tseg2_max;
++	__le32 sjw_max;
++	__le32 brp_min;
++	__le32 brp_max;
++	__le32 brp_inc;
+ } __packed;
+ 
+ #define GS_CAN_FLAG_OVERFLOW 1
+ 
+ struct gs_host_frame {
+ 	u32 echo_id;
+-	u32 can_id;
++	__le32 can_id;
+ 
+ 	u8 can_dlc;
+ 	u8 channel;
+@@ -337,13 +343,13 @@ static void gs_usb_receive_bulk_callback(struct urb *urb)
+ 		if (!skb)
+ 			return;
+ 
+-		cf->can_id = hf->can_id;
++		cf->can_id = le32_to_cpu(hf->can_id);
+ 
+ 		cf->can_dlc = get_can_dlc(hf->can_dlc);
+ 		memcpy(cf->data, hf->data, 8);
+ 
+ 		/* ERROR frames tell us information about the controller */
+-		if (hf->can_id & CAN_ERR_FLAG)
++		if (le32_to_cpu(hf->can_id) & CAN_ERR_FLAG)
+ 			gs_update_state(dev, cf);
+ 
+ 		netdev->stats.rx_packets++;
+@@ -426,11 +432,11 @@ static int gs_usb_set_bittiming(struct net_device *netdev)
+ 	if (!dbt)
+ 		return -ENOMEM;
+ 
+-	dbt->prop_seg = bt->prop_seg;
+-	dbt->phase_seg1 = bt->phase_seg1;
+-	dbt->phase_seg2 = bt->phase_seg2;
+-	dbt->sjw = bt->sjw;
+-	dbt->brp = bt->brp;
++	dbt->prop_seg = cpu_to_le32(bt->prop_seg);
++	dbt->phase_seg1 = cpu_to_le32(bt->phase_seg1);
++	dbt->phase_seg2 = cpu_to_le32(bt->phase_seg2);
++	dbt->sjw = cpu_to_le32(bt->sjw);
++	dbt->brp = cpu_to_le32(bt->brp);
+ 
+ 	/* request bit timings */
+ 	rc = usb_control_msg(interface_to_usbdev(intf),
+@@ -511,7 +517,7 @@ static netdev_tx_t gs_can_start_xmit(struct sk_buff *skb,
+ 
+ 	cf = (struct can_frame *)skb->data;
+ 
+-	hf->can_id = cf->can_id;
++	hf->can_id = cpu_to_le32(cf->can_id);
+ 	hf->can_dlc = cf->can_dlc;
+ 	memcpy(hf->data, cf->data, cf->can_dlc);
+ 
+@@ -581,6 +587,7 @@ static int gs_can_open(struct net_device *netdev)
+ 	int rc, i;
+ 	struct gs_device_mode *dm;
+ 	u32 ctrlmode;
++	u32 flags = 0;
+ 
+ 	rc = open_candev(netdev);
+ 	if (rc)
+@@ -648,24 +655,24 @@ static int gs_can_open(struct net_device *netdev)
+ 
+ 	/* flags */
+ 	ctrlmode = dev->can.ctrlmode;
+-	dm->flags = 0;
+ 
+ 	if (ctrlmode & CAN_CTRLMODE_LOOPBACK)
+-		dm->flags |= GS_CAN_MODE_LOOP_BACK;
++		flags |= GS_CAN_MODE_LOOP_BACK;
+ 	else if (ctrlmode & CAN_CTRLMODE_LISTENONLY)
+-		dm->flags |= GS_CAN_MODE_LISTEN_ONLY;
++		flags |= GS_CAN_MODE_LISTEN_ONLY;
+ 
+ 	/* Controller is not allowed to retry TX
+ 	 * this mode is unavailable on atmels uc3c hardware
+ 	 */
+ 	if (ctrlmode & CAN_CTRLMODE_ONE_SHOT)
+-		dm->flags |= GS_CAN_MODE_ONE_SHOT;
++		flags |= GS_CAN_MODE_ONE_SHOT;
+ 
+ 	if (ctrlmode & CAN_CTRLMODE_3_SAMPLES)
+-		dm->flags |= GS_CAN_MODE_TRIPLE_SAMPLE;
++		flags |= GS_CAN_MODE_TRIPLE_SAMPLE;
+ 
+ 	/* finally start device */
+-	dm->mode = GS_CAN_MODE_START;
++	dm->mode = cpu_to_le32(GS_CAN_MODE_START);
++	dm->flags = cpu_to_le32(flags);
+ 	rc = usb_control_msg(interface_to_usbdev(dev->iface),
+ 			     usb_sndctrlpipe(interface_to_usbdev(dev->iface), 0),
+ 			     GS_USB_BREQ_MODE,
+@@ -745,9 +752,9 @@ static int gs_usb_set_identify(struct net_device *netdev, bool do_identify)
+ 		return -ENOMEM;
+ 
+ 	if (do_identify)
+-		imode->mode = GS_CAN_IDENTIFY_ON;
++		imode->mode = cpu_to_le32(GS_CAN_IDENTIFY_ON);
+ 	else
+-		imode->mode = GS_CAN_IDENTIFY_OFF;
++		imode->mode = cpu_to_le32(GS_CAN_IDENTIFY_OFF);
+ 
+ 	rc = usb_control_msg(interface_to_usbdev(dev->iface),
+ 			     usb_sndctrlpipe(interface_to_usbdev(dev->iface),
+@@ -798,6 +805,7 @@ static struct gs_can *gs_make_candev(unsigned int channel,
+ 	struct net_device *netdev;
+ 	int rc;
+ 	struct gs_device_bt_const *bt_const;
++	u32 feature;
+ 
+ 	bt_const = kmalloc(sizeof(*bt_const), GFP_KERNEL);
+ 	if (!bt_const)
+@@ -838,14 +846,14 @@ static struct gs_can *gs_make_candev(unsigned int channel,
+ 
+ 	/* dev settup */
+ 	strcpy(dev->bt_const.name, "gs_usb");
+-	dev->bt_const.tseg1_min = bt_const->tseg1_min;
+-	dev->bt_const.tseg1_max = bt_const->tseg1_max;
+-	dev->bt_const.tseg2_min = bt_const->tseg2_min;
+-	dev->bt_const.tseg2_max = bt_const->tseg2_max;
+-	dev->bt_const.sjw_max = bt_const->sjw_max;
+-	dev->bt_const.brp_min = bt_const->brp_min;
+-	dev->bt_const.brp_max = bt_const->brp_max;
+-	dev->bt_const.brp_inc = bt_const->brp_inc;
++	dev->bt_const.tseg1_min = le32_to_cpu(bt_const->tseg1_min);
++	dev->bt_const.tseg1_max = le32_to_cpu(bt_const->tseg1_max);
++	dev->bt_const.tseg2_min = le32_to_cpu(bt_const->tseg2_min);
++	dev->bt_const.tseg2_max = le32_to_cpu(bt_const->tseg2_max);
++	dev->bt_const.sjw_max = le32_to_cpu(bt_const->sjw_max);
++	dev->bt_const.brp_min = le32_to_cpu(bt_const->brp_min);
++	dev->bt_const.brp_max = le32_to_cpu(bt_const->brp_max);
++	dev->bt_const.brp_inc = le32_to_cpu(bt_const->brp_inc);
+ 
+ 	dev->udev = interface_to_usbdev(intf);
+ 	dev->iface = intf;
+@@ -862,28 +870,29 @@ static struct gs_can *gs_make_candev(unsigned int channel,
+ 
+ 	/* can settup */
+ 	dev->can.state = CAN_STATE_STOPPED;
+-	dev->can.clock.freq = bt_const->fclk_can;
++	dev->can.clock.freq = le32_to_cpu(bt_const->fclk_can);
+ 	dev->can.bittiming_const = &dev->bt_const;
+ 	dev->can.do_set_bittiming = gs_usb_set_bittiming;
+ 
+ 	dev->can.ctrlmode_supported = 0;
+ 
+-	if (bt_const->feature & GS_CAN_FEATURE_LISTEN_ONLY)
++	feature = le32_to_cpu(bt_const->feature);
++	if (feature & GS_CAN_FEATURE_LISTEN_ONLY)
+ 		dev->can.ctrlmode_supported |= CAN_CTRLMODE_LISTENONLY;
+ 
+-	if (bt_const->feature & GS_CAN_FEATURE_LOOP_BACK)
++	if (feature & GS_CAN_FEATURE_LOOP_BACK)
+ 		dev->can.ctrlmode_supported |= CAN_CTRLMODE_LOOPBACK;
+ 
+-	if (bt_const->feature & GS_CAN_FEATURE_TRIPLE_SAMPLE)
++	if (feature & GS_CAN_FEATURE_TRIPLE_SAMPLE)
+ 		dev->can.ctrlmode_supported |= CAN_CTRLMODE_3_SAMPLES;
+ 
+-	if (bt_const->feature & GS_CAN_FEATURE_ONE_SHOT)
++	if (feature & GS_CAN_FEATURE_ONE_SHOT)
+ 		dev->can.ctrlmode_supported |= CAN_CTRLMODE_ONE_SHOT;
+ 
+ 	SET_NETDEV_DEV(netdev, &intf->dev);
+ 
+-	if (dconf->sw_version > 1)
+-		if (bt_const->feature & GS_CAN_FEATURE_IDENTIFY)
++	if (le32_to_cpu(dconf->sw_version) > 1)
++		if (feature & GS_CAN_FEATURE_IDENTIFY)
+ 			netdev->ethtool_ops = &gs_usb_ethtool_ops;
+ 
+ 	kfree(bt_const);
+@@ -918,7 +927,7 @@ static int gs_usb_probe(struct usb_interface *intf,
+ 	if (!hconf)
+ 		return -ENOMEM;
+ 
+-	hconf->byte_order = 0x0000beef;
++	hconf->byte_order = cpu_to_le32(0x0000beef);
+ 
+ 	/* send host config */
+ 	rc = usb_control_msg(interface_to_usbdev(intf),
+diff --git a/drivers/net/ethernet/amazon/ena/ena_netdev.c b/drivers/net/ethernet/amazon/ena/ena_netdev.c
+index d9ece9ac6f53c..938170b91f85e 100644
+--- a/drivers/net/ethernet/amazon/ena/ena_netdev.c
++++ b/drivers/net/ethernet/amazon/ena/ena_netdev.c
+@@ -2474,16 +2474,9 @@ static int ena_device_init(struct ena_com_dev *ena_dev, struct pci_dev *pdev,
+ 		goto err_mmio_read_less;
+ 	}
+ 
+-	rc = pci_set_dma_mask(pdev, DMA_BIT_MASK(dma_width));
++	rc = dma_set_mask_and_coherent(dev, DMA_BIT_MASK(dma_width));
+ 	if (rc) {
+-		dev_err(dev, "pci_set_dma_mask failed 0x%x\n", rc);
+-		goto err_mmio_read_less;
+-	}
+-
+-	rc = pci_set_consistent_dma_mask(pdev, DMA_BIT_MASK(dma_width));
+-	if (rc) {
+-		dev_err(dev, "err_pci_set_consistent_dma_mask failed 0x%x\n",
+-			rc);
++		dev_err(dev, "dma_set_mask_and_coherent failed %d\n", rc);
+ 		goto err_mmio_read_less;
+ 	}
+ 
+@@ -3141,6 +3134,12 @@ static int ena_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
+ 		return rc;
+ 	}
+ 
++	rc = dma_set_mask_and_coherent(&pdev->dev, DMA_BIT_MASK(ENA_MAX_PHYS_ADDR_SIZE_BITS));
++	if (rc) {
++		dev_err(&pdev->dev, "dma_set_mask_and_coherent failed %d\n", rc);
++		goto err_disable_device;
++	}
++
+ 	pci_set_master(pdev);
+ 
+ 	ena_dev = vzalloc(sizeof(*ena_dev));
+diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.c b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
+index e146f6a1fa80d..ea2a539e6e0f7 100644
+--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c
++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
+@@ -7212,7 +7212,8 @@ static int bnxt_init_board(struct pci_dev *pdev, struct net_device *dev)
+ 	if (dma_set_mask_and_coherent(&pdev->dev, DMA_BIT_MASK(64)) != 0 &&
+ 	    dma_set_mask_and_coherent(&pdev->dev, DMA_BIT_MASK(32)) != 0) {
+ 		dev_err(&pdev->dev, "System does not support DMA, aborting\n");
+-		goto init_err_disable;
++		rc = -EIO;
++		goto init_err_release;
+ 	}
+ 
+ 	pci_set_master(pdev);
+@@ -8233,6 +8234,7 @@ static int bnxt_init_one(struct pci_dev *pdev, const struct pci_device_id *ent)
+ 				create_singlethread_workqueue("bnxt_pf_wq");
+ 			if (!bnxt_pf_wq) {
+ 				dev_err(&pdev->dev, "Unable to create workqueue.\n");
++				rc = -ENOMEM;
+ 				goto init_err_pci_clean;
+ 			}
+ 		}
+diff --git a/drivers/net/ethernet/ibm/ibmvnic.c b/drivers/net/ethernet/ibm/ibmvnic.c
+index 8b8a0c4fbc993..9a524b0e3e7ba 100644
+--- a/drivers/net/ethernet/ibm/ibmvnic.c
++++ b/drivers/net/ethernet/ibm/ibmvnic.c
+@@ -1977,6 +1977,9 @@ static int reset_sub_crq_queues(struct ibmvnic_adapter *adapter)
+ {
+ 	int i, rc;
+ 
++	if (!adapter->tx_scrq || !adapter->rx_scrq)
++		return -EINVAL;
++
+ 	for (i = 0; i < adapter->req_tx_queues; i++) {
+ 		netdev_dbg(adapter->netdev, "Re-setting tx_scrq[%d]\n", i);
+ 		rc = reset_one_sub_crq_queue(adapter, adapter->tx_scrq[i]);
+@@ -3709,6 +3712,9 @@ static int ibmvnic_reset_crq(struct ibmvnic_adapter *adapter)
+ 	} while (rc == H_BUSY || H_IS_LONG_BUSY(rc));
+ 
+ 	/* Clean out the queue */
++	if (!crq->msgs)
++		return -EINVAL;
++
+ 	memset(crq->msgs, 0, PAGE_SIZE);
+ 	crq->cur = 0;
+ 
+diff --git a/drivers/nfc/s3fwrn5/i2c.c b/drivers/nfc/s3fwrn5/i2c.c
+index 3f09d7fd2285f..da7ca08d185e4 100644
+--- a/drivers/nfc/s3fwrn5/i2c.c
++++ b/drivers/nfc/s3fwrn5/i2c.c
+@@ -37,8 +37,8 @@ struct s3fwrn5_i2c_phy {
+ 	struct i2c_client *i2c_dev;
+ 	struct nci_dev *ndev;
+ 
+-	unsigned int gpio_en;
+-	unsigned int gpio_fw_wake;
++	int gpio_en;
++	int gpio_fw_wake;
+ 
+ 	struct mutex mutex;
+ 
+diff --git a/drivers/nvme/host/pci.c b/drivers/nvme/host/pci.c
+index 3788c053a0b19..540fab9f850dd 100644
+--- a/drivers/nvme/host/pci.c
++++ b/drivers/nvme/host/pci.c
+@@ -266,9 +266,21 @@ static void nvme_dbbuf_init(struct nvme_dev *dev,
+ 	nvmeq->dbbuf_cq_ei = &dev->dbbuf_eis[cq_idx(qid, dev->db_stride)];
+ }
+ 
++static void nvme_dbbuf_free(struct nvme_queue *nvmeq)
++{
++	if (!nvmeq->qid)
++		return;
++
++	nvmeq->dbbuf_sq_db = NULL;
++	nvmeq->dbbuf_cq_db = NULL;
++	nvmeq->dbbuf_sq_ei = NULL;
++	nvmeq->dbbuf_cq_ei = NULL;
++}
++
+ static void nvme_dbbuf_set(struct nvme_dev *dev)
+ {
+ 	struct nvme_command c;
++	unsigned int i;
+ 
+ 	if (!dev->dbbuf_dbs)
+ 		return;
+@@ -282,6 +294,9 @@ static void nvme_dbbuf_set(struct nvme_dev *dev)
+ 		dev_warn(dev->ctrl.device, "unable to set dbbuf\n");
+ 		/* Free memory and continue on */
+ 		nvme_dbbuf_dma_free(dev);
++
++		for (i = 1; i <= dev->online_queues; i++)
++			nvme_dbbuf_free(&dev->queues[i]);
+ 	}
+ }
+ 
+diff --git a/drivers/pci/bus.c b/drivers/pci/bus.c
+index bc56cf19afd39..8f78e8c15d2ec 100644
+--- a/drivers/pci/bus.c
++++ b/drivers/pci/bus.c
+@@ -324,12 +324,8 @@ void pci_bus_add_device(struct pci_dev *dev)
+ 
+ 	dev->match_driver = true;
+ 	retval = device_attach(&dev->dev);
+-	if (retval < 0 && retval != -EPROBE_DEFER) {
++	if (retval < 0 && retval != -EPROBE_DEFER)
+ 		dev_warn(&dev->dev, "device attach failed (%d)\n", retval);
+-		pci_proc_detach_device(dev);
+-		pci_remove_sysfs_dev_files(dev);
+-		return;
+-	}
+ 
+ 	dev->is_added = 1;
+ }
+diff --git a/drivers/phy/tegra/xusb.c b/drivers/phy/tegra/xusb.c
+index 11aa5902a9ac1..9c55e0f45ea8a 100644
+--- a/drivers/phy/tegra/xusb.c
++++ b/drivers/phy/tegra/xusb.c
+@@ -912,6 +912,7 @@ remove_pads:
+ reset:
+ 	reset_control_assert(padctl->rst);
+ remove:
++	platform_set_drvdata(pdev, NULL);
+ 	soc->ops->remove(padctl);
+ 	return err;
+ }
+diff --git a/drivers/platform/x86/toshiba_acpi.c b/drivers/platform/x86/toshiba_acpi.c
+index 8221e000c8c23..25955b4d80b0d 100644
+--- a/drivers/platform/x86/toshiba_acpi.c
++++ b/drivers/platform/x86/toshiba_acpi.c
+@@ -1497,7 +1497,7 @@ static ssize_t video_proc_write(struct file *file, const char __user *buf,
+ 	struct toshiba_acpi_dev *dev = PDE_DATA(file_inode(file));
+ 	char *buffer;
+ 	char *cmd;
+-	int lcd_out, crt_out, tv_out;
++	int lcd_out = -1, crt_out = -1, tv_out = -1;
+ 	int remain = count;
+ 	int value;
+ 	int ret;
+@@ -1529,7 +1529,6 @@ static ssize_t video_proc_write(struct file *file, const char __user *buf,
+ 
+ 	kfree(cmd);
+ 
+-	lcd_out = crt_out = tv_out = -1;
+ 	ret = get_video_status(dev, &video_out);
+ 	if (!ret) {
+ 		unsigned int new_video_out = video_out;
+diff --git a/drivers/scsi/libiscsi.c b/drivers/scsi/libiscsi.c
+index 662df16b07a40..f7e1af90849b3 100644
+--- a/drivers/scsi/libiscsi.c
++++ b/drivers/scsi/libiscsi.c
+@@ -571,8 +571,8 @@ static void iscsi_complete_task(struct iscsi_task *task, int state)
+ 	if (conn->task == task)
+ 		conn->task = NULL;
+ 
+-	if (conn->ping_task == task)
+-		conn->ping_task = NULL;
++	if (READ_ONCE(conn->ping_task) == task)
++		WRITE_ONCE(conn->ping_task, NULL);
+ 
+ 	/* release get from queueing */
+ 	__iscsi_put_task(task);
+@@ -781,6 +781,9 @@ __iscsi_conn_send_pdu(struct iscsi_conn *conn, struct iscsi_hdr *hdr,
+ 						   task->conn->session->age);
+ 	}
+ 
++	if (unlikely(READ_ONCE(conn->ping_task) == INVALID_SCSI_TASK))
++		WRITE_ONCE(conn->ping_task, task);
++
+ 	if (!ihost->workq) {
+ 		if (iscsi_prep_mgmt_task(conn, task))
+ 			goto free_task;
+@@ -988,8 +991,11 @@ static int iscsi_send_nopout(struct iscsi_conn *conn, struct iscsi_nopin *rhdr)
+         struct iscsi_nopout hdr;
+ 	struct iscsi_task *task;
+ 
+-	if (!rhdr && conn->ping_task)
+-		return -EINVAL;
++	if (!rhdr) {
++		if (READ_ONCE(conn->ping_task))
++			return -EINVAL;
++		WRITE_ONCE(conn->ping_task, INVALID_SCSI_TASK);
++	}
+ 
+ 	memset(&hdr, 0, sizeof(struct iscsi_nopout));
+ 	hdr.opcode = ISCSI_OP_NOOP_OUT | ISCSI_OP_IMMEDIATE;
+@@ -1004,11 +1010,12 @@ static int iscsi_send_nopout(struct iscsi_conn *conn, struct iscsi_nopin *rhdr)
+ 
+ 	task = __iscsi_conn_send_pdu(conn, (struct iscsi_hdr *)&hdr, NULL, 0);
+ 	if (!task) {
++		if (!rhdr)
++			WRITE_ONCE(conn->ping_task, NULL);
+ 		iscsi_conn_printk(KERN_ERR, conn, "Could not send nopout\n");
+ 		return -EIO;
+ 	} else if (!rhdr) {
+ 		/* only track our nops */
+-		conn->ping_task = task;
+ 		conn->last_ping = jiffies;
+ 	}
+ 
+@@ -1021,7 +1028,7 @@ static int iscsi_nop_out_rsp(struct iscsi_task *task,
+ 	struct iscsi_conn *conn = task->conn;
+ 	int rc = 0;
+ 
+-	if (conn->ping_task != task) {
++	if (READ_ONCE(conn->ping_task) != task) {
+ 		/*
+ 		 * If this is not in response to one of our
+ 		 * nops then it must be from userspace.
+@@ -1961,7 +1968,7 @@ static void iscsi_start_tx(struct iscsi_conn *conn)
+  */
+ static int iscsi_has_ping_timed_out(struct iscsi_conn *conn)
+ {
+-	if (conn->ping_task &&
++	if (READ_ONCE(conn->ping_task) &&
+ 	    time_before_eq(conn->last_recv + (conn->recv_timeout * HZ) +
+ 			   (conn->ping_timeout * HZ), jiffies))
+ 		return 1;
+@@ -2096,7 +2103,7 @@ enum blk_eh_timer_return iscsi_eh_cmd_timed_out(struct scsi_cmnd *sc)
+ 	 * Checking the transport already or nop from a cmd timeout still
+ 	 * running
+ 	 */
+-	if (conn->ping_task) {
++	if (READ_ONCE(conn->ping_task)) {
+ 		task->have_checked_conn = true;
+ 		rc = BLK_EH_RESET_TIMER;
+ 		goto done;
+diff --git a/drivers/scsi/ufs/ufshcd.c b/drivers/scsi/ufs/ufshcd.c
+index c1792f271ac5d..a3a3ee6e2a002 100644
+--- a/drivers/scsi/ufs/ufshcd.c
++++ b/drivers/scsi/ufs/ufshcd.c
+@@ -7792,11 +7792,7 @@ int ufshcd_shutdown(struct ufs_hba *hba)
+ 	if (ufshcd_is_ufs_dev_poweroff(hba) && ufshcd_is_link_off(hba))
+ 		goto out;
+ 
+-	if (pm_runtime_suspended(hba->dev)) {
+-		ret = ufshcd_runtime_resume(hba);
+-		if (ret)
+-			goto out;
+-	}
++	pm_runtime_get_sync(hba->dev);
+ 
+ 	ret = ufshcd_suspend(hba, UFS_SHUTDOWN_PM);
+ out:
+diff --git a/drivers/target/iscsi/iscsi_target.c b/drivers/target/iscsi/iscsi_target.c
+index da80c03de6ea4..d9fcef82ddf59 100644
+--- a/drivers/target/iscsi/iscsi_target.c
++++ b/drivers/target/iscsi/iscsi_target.c
+@@ -490,8 +490,7 @@ EXPORT_SYMBOL(iscsit_queue_rsp);
+ void iscsit_aborted_task(struct iscsi_conn *conn, struct iscsi_cmd *cmd)
+ {
+ 	spin_lock_bh(&conn->cmd_lock);
+-	if (!list_empty(&cmd->i_conn_node) &&
+-	    !(cmd->se_cmd.transport_state & CMD_T_FABRIC_STOP))
++	if (!list_empty(&cmd->i_conn_node))
+ 		list_del_init(&cmd->i_conn_node);
+ 	spin_unlock_bh(&conn->cmd_lock);
+ 
+@@ -4086,12 +4085,22 @@ static void iscsit_release_commands_from_conn(struct iscsi_conn *conn)
+ 	spin_lock_bh(&conn->cmd_lock);
+ 	list_splice_init(&conn->conn_cmd_list, &tmp_list);
+ 
+-	list_for_each_entry(cmd, &tmp_list, i_conn_node) {
++	list_for_each_entry_safe(cmd, cmd_tmp, &tmp_list, i_conn_node) {
+ 		struct se_cmd *se_cmd = &cmd->se_cmd;
+ 
+ 		if (se_cmd->se_tfo != NULL) {
+ 			spin_lock_irq(&se_cmd->t_state_lock);
+-			se_cmd->transport_state |= CMD_T_FABRIC_STOP;
++			if (se_cmd->transport_state & CMD_T_ABORTED) {
++				/*
++				 * LIO's abort path owns the cleanup for this,
++				 * so put it back on the list and let
++				 * aborted_task handle it.
++				 */
++				list_move_tail(&cmd->i_conn_node,
++					       &conn->conn_cmd_list);
++			} else {
++				se_cmd->transport_state |= CMD_T_FABRIC_STOP;
++			}
+ 			spin_unlock_irq(&se_cmd->t_state_lock);
+ 		}
+ 	}
+diff --git a/drivers/usb/core/config.c b/drivers/usb/core/config.c
+index 7df7faa3eed5d..88ca8129d9df0 100644
+--- a/drivers/usb/core/config.c
++++ b/drivers/usb/core/config.c
+@@ -256,6 +256,7 @@ static int usb_parse_endpoint(struct device *ddev, int cfgno,
+ 		struct usb_host_interface *ifp, int num_ep,
+ 		unsigned char *buffer, int size)
+ {
++	struct usb_device *udev = to_usb_device(ddev);
+ 	unsigned char *buffer0 = buffer;
+ 	struct usb_endpoint_descriptor *d;
+ 	struct usb_host_endpoint *endpoint;
+@@ -297,6 +298,16 @@ static int usb_parse_endpoint(struct device *ddev, int cfgno,
+ 		goto skip_to_next_endpoint_or_interface_descriptor;
+ 	}
+ 
++	/* Ignore blacklisted endpoints */
++	if (udev->quirks & USB_QUIRK_ENDPOINT_BLACKLIST) {
++		if (usb_endpoint_is_blacklisted(udev, ifp, d)) {
++			dev_warn(ddev, "config %d interface %d altsetting %d has a blacklisted endpoint with address 0x%X, skipping\n",
++					cfgno, inum, asnum,
++					d->bEndpointAddress);
++			goto skip_to_next_endpoint_or_interface_descriptor;
++		}
++	}
++
+ 	endpoint = &ifp->endpoint[ifp->desc.bNumEndpoints];
+ 	++ifp->desc.bNumEndpoints;
+ 
+diff --git a/drivers/usb/core/devio.c b/drivers/usb/core/devio.c
+index 4fb4cf8c2f14d..a334933b5d52a 100644
+--- a/drivers/usb/core/devio.c
++++ b/drivers/usb/core/devio.c
+@@ -478,11 +478,11 @@ static void snoop_urb(struct usb_device *udev,
+ 
+ 	if (userurb) {		/* Async */
+ 		if (when == SUBMIT)
+-			dev_info(&udev->dev, "userurb %pK, ep%d %s-%s, "
++			dev_info(&udev->dev, "userurb %px, ep%d %s-%s, "
+ 					"length %u\n",
+ 					userurb, ep, t, d, length);
+ 		else
+-			dev_info(&udev->dev, "userurb %pK, ep%d %s-%s, "
++			dev_info(&udev->dev, "userurb %px, ep%d %s-%s, "
+ 					"actual_length %u status %d\n",
+ 					userurb, ep, t, d, length,
+ 					timeout_or_status);
+@@ -1946,7 +1946,7 @@ static int proc_reapurb(struct usb_dev_state *ps, void __user *arg)
+ 	if (as) {
+ 		int retval;
+ 
+-		snoop(&ps->dev->dev, "reap %pK\n", as->userurb);
++		snoop(&ps->dev->dev, "reap %px\n", as->userurb);
+ 		retval = processcompl(as, (void __user * __user *)arg);
+ 		free_async(as);
+ 		return retval;
+@@ -1963,7 +1963,7 @@ static int proc_reapurbnonblock(struct usb_dev_state *ps, void __user *arg)
+ 
+ 	as = async_getcompleted(ps);
+ 	if (as) {
+-		snoop(&ps->dev->dev, "reap %pK\n", as->userurb);
++		snoop(&ps->dev->dev, "reap %px\n", as->userurb);
+ 		retval = processcompl(as, (void __user * __user *)arg);
+ 		free_async(as);
+ 	} else {
+@@ -2089,7 +2089,7 @@ static int proc_reapurb_compat(struct usb_dev_state *ps, void __user *arg)
+ 	if (as) {
+ 		int retval;
+ 
+-		snoop(&ps->dev->dev, "reap %pK\n", as->userurb);
++		snoop(&ps->dev->dev, "reap %px\n", as->userurb);
+ 		retval = processcompl_compat(as, (void __user * __user *)arg);
+ 		free_async(as);
+ 		return retval;
+@@ -2106,7 +2106,7 @@ static int proc_reapurbnonblock_compat(struct usb_dev_state *ps, void __user *ar
+ 
+ 	as = async_getcompleted(ps);
+ 	if (as) {
+-		snoop(&ps->dev->dev, "reap %pK\n", as->userurb);
++		snoop(&ps->dev->dev, "reap %px\n", as->userurb);
+ 		retval = processcompl_compat(as, (void __user * __user *)arg);
+ 		free_async(as);
+ 	} else {
+@@ -2531,7 +2531,7 @@ static long usbdev_do_ioctl(struct file *file, unsigned int cmd,
+ #endif
+ 
+ 	case USBDEVFS_DISCARDURB:
+-		snoop(&dev->dev, "%s: DISCARDURB %pK\n", __func__, p);
++		snoop(&dev->dev, "%s: DISCARDURB %px\n", __func__, p);
+ 		ret = proc_unlinkurb(ps, p);
+ 		break;
+ 
+diff --git a/drivers/usb/core/quirks.c b/drivers/usb/core/quirks.c
+index ca74b67c4450d..34d8cece6dd3b 100644
+--- a/drivers/usb/core/quirks.c
++++ b/drivers/usb/core/quirks.c
+@@ -195,6 +195,10 @@ static const struct usb_device_id usb_quirk_list[] = {
+ 	/* Guillemot Webcam Hercules Dualpix Exchange*/
+ 	{ USB_DEVICE(0x06f8, 0x3005), .driver_info = USB_QUIRK_RESET_RESUME },
+ 
++	/* Guillemot Hercules DJ Console audio card (BZ 208357) */
++	{ USB_DEVICE(0x06f8, 0xb000), .driver_info =
++			USB_QUIRK_ENDPOINT_BLACKLIST },
++
+ 	/* Midiman M-Audio Keystation 88es */
+ 	{ USB_DEVICE(0x0763, 0x0192), .driver_info = USB_QUIRK_RESET_RESUME },
+ 
+@@ -344,6 +348,40 @@ static const struct usb_device_id usb_amd_resume_quirk_list[] = {
+ 	{ }  /* terminating entry must be last */
+ };
+ 
++/*
++ * Entries for blacklisted endpoints that should be ignored when parsing
++ * configuration descriptors.
++ *
++ * Matched for devices with USB_QUIRK_ENDPOINT_BLACKLIST.
++ */
++static const struct usb_device_id usb_endpoint_blacklist[] = {
++	{ USB_DEVICE_INTERFACE_NUMBER(0x06f8, 0xb000, 5), .driver_info = 0x01 },
++	{ USB_DEVICE_INTERFACE_NUMBER(0x06f8, 0xb000, 5), .driver_info = 0x81 },
++	{ }
++};
++
++bool usb_endpoint_is_blacklisted(struct usb_device *udev,
++		struct usb_host_interface *intf,
++		struct usb_endpoint_descriptor *epd)
++{
++	const struct usb_device_id *id;
++	unsigned int address;
++
++	for (id = usb_endpoint_blacklist; id->match_flags; ++id) {
++		if (!usb_match_device(udev, id))
++			continue;
++
++		if (!usb_match_one_id_intf(udev, intf, id))
++			continue;
++
++		address = id->driver_info;
++		if (address == epd->bEndpointAddress)
++			return true;
++	}
++
++	return false;
++}
++
+ static bool usb_match_any_interface(struct usb_device *udev,
+ 				    const struct usb_device_id *id)
+ {
+diff --git a/drivers/usb/core/usb.h b/drivers/usb/core/usb.h
+index 1b5f346d93ebb..abac872220931 100644
+--- a/drivers/usb/core/usb.h
++++ b/drivers/usb/core/usb.h
+@@ -36,6 +36,9 @@ extern void usb_deauthorize_interface(struct usb_interface *);
+ extern void usb_authorize_interface(struct usb_interface *);
+ extern void usb_detect_quirks(struct usb_device *udev);
+ extern void usb_detect_interface_quirks(struct usb_device *udev);
++extern bool usb_endpoint_is_blacklisted(struct usb_device *udev,
++		struct usb_host_interface *intf,
++		struct usb_endpoint_descriptor *epd);
+ extern int usb_remove_device(struct usb_device *udev);
+ 
+ extern int usb_get_device_descriptor(struct usb_device *dev,
+diff --git a/drivers/usb/gadget/function/f_midi.c b/drivers/usb/gadget/function/f_midi.c
+index 71cf552b88281..34c0a385516ef 100644
+--- a/drivers/usb/gadget/function/f_midi.c
++++ b/drivers/usb/gadget/function/f_midi.c
+@@ -1303,7 +1303,7 @@ static struct usb_function *f_midi_alloc(struct usb_function_instance *fi)
+ 	midi->id = kstrdup(opts->id, GFP_KERNEL);
+ 	if (opts->id && !midi->id) {
+ 		status = -ENOMEM;
+-		goto setup_fail;
++		goto midi_free;
+ 	}
+ 	midi->in_ports = opts->in_ports;
+ 	midi->out_ports = opts->out_ports;
+@@ -1315,7 +1315,7 @@ static struct usb_function *f_midi_alloc(struct usb_function_instance *fi)
+ 
+ 	status = kfifo_alloc(&midi->in_req_fifo, midi->qlen, GFP_KERNEL);
+ 	if (status)
+-		goto setup_fail;
++		goto midi_free;
+ 
+ 	spin_lock_init(&midi->transmit_lock);
+ 
+@@ -1331,9 +1331,13 @@ static struct usb_function *f_midi_alloc(struct usb_function_instance *fi)
+ 
+ 	return &midi->func;
+ 
++midi_free:
++	if (midi)
++		kfree(midi->id);
++	kfree(midi);
+ setup_fail:
+ 	mutex_unlock(&opts->lock);
+-	kfree(midi);
++
+ 	return ERR_PTR(status);
+ }
+ 
+diff --git a/drivers/usb/gadget/legacy/inode.c b/drivers/usb/gadget/legacy/inode.c
+index e431a8bc3a9d2..e9f7f2660cd1e 100644
+--- a/drivers/usb/gadget/legacy/inode.c
++++ b/drivers/usb/gadget/legacy/inode.c
+@@ -2044,6 +2044,9 @@ gadgetfs_fill_super (struct super_block *sb, void *opts, int silent)
+ 	return 0;
+ 
+ Enomem:
++	kfree(CHIP);
++	CHIP = NULL;
++
+ 	return -ENOMEM;
+ }
+ 
+diff --git a/drivers/video/fbdev/hyperv_fb.c b/drivers/video/fbdev/hyperv_fb.c
+index 2fd49b2358f8b..f3938c5278832 100644
+--- a/drivers/video/fbdev/hyperv_fb.c
++++ b/drivers/video/fbdev/hyperv_fb.c
+@@ -712,7 +712,12 @@ static int hvfb_getmem(struct hv_device *hdev, struct fb_info *info)
+ 		goto err1;
+ 	}
+ 
+-	fb_virt = ioremap(par->mem->start, screen_fb_size);
++	/*
++	 * Map the VRAM cacheable for performance. This is also required for
++	 * VM Connect to display properly for ARM64 Linux VM, as the host also
++	 * maps the VRAM cacheable.
++	 */
++	fb_virt = ioremap_cache(par->mem->start, screen_fb_size);
+ 	if (!fb_virt)
+ 		goto err2;
+ 
+diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c
+index e985e820724e1..c5ae2f4a7ec32 100644
+--- a/fs/btrfs/inode.c
++++ b/fs/btrfs/inode.c
+@@ -5584,11 +5584,14 @@ no_delete:
+ }
+ 
+ /*
+- * this returns the key found in the dir entry in the location pointer.
+- * If no dir entries were found, location->objectid is 0.
++ * Return the key found in the dir entry in the location pointer, fill @type
++ * with BTRFS_FT_*, and return 0.
++ *
++ * If no dir entries were found, returns -ENOENT.
++ * If found a corrupted location in dir entry, returns -EUCLEAN.
+  */
+ static int btrfs_inode_by_name(struct inode *dir, struct dentry *dentry,
+-			       struct btrfs_key *location)
++			       struct btrfs_key *location, u8 *type)
+ {
+ 	const char *name = dentry->d_name.name;
+ 	int namelen = dentry->d_name.len;
+@@ -5603,27 +5606,29 @@ static int btrfs_inode_by_name(struct inode *dir, struct dentry *dentry,
+ 
+ 	di = btrfs_lookup_dir_item(NULL, root, path, btrfs_ino(BTRFS_I(dir)),
+ 			name, namelen, 0);
+-	if (IS_ERR(di))
++	if (!di) {
++		ret = -ENOENT;
++		goto out;
++	}
++	if (IS_ERR(di)) {
+ 		ret = PTR_ERR(di);
+-
+-	if (IS_ERR_OR_NULL(di))
+-		goto out_err;
++		goto out;
++	}
+ 
+ 	btrfs_dir_item_key_to_cpu(path->nodes[0], di, location);
+ 	if (location->type != BTRFS_INODE_ITEM_KEY &&
+ 	    location->type != BTRFS_ROOT_ITEM_KEY) {
++		ret = -EUCLEAN;
+ 		btrfs_warn(root->fs_info,
+ "%s gets something invalid in DIR_ITEM (name %s, directory ino %llu, location(%llu %u %llu))",
+ 			   __func__, name, btrfs_ino(BTRFS_I(dir)),
+ 			   location->objectid, location->type, location->offset);
+-		goto out_err;
+ 	}
++	if (!ret)
++		*type = btrfs_dir_type(path->nodes[0], di);
+ out:
+ 	btrfs_free_path(path);
+ 	return ret;
+-out_err:
+-	location->objectid = 0;
+-	goto out;
+ }
+ 
+ /*
+@@ -5907,6 +5912,11 @@ static struct inode *new_simple_dir(struct super_block *s,
+ 	return inode;
+ }
+ 
++static inline u8 btrfs_inode_type(struct inode *inode)
++{
++	return btrfs_type_by_mode[(inode->i_mode & S_IFMT) >> S_SHIFT];
++}
++
+ struct inode *btrfs_lookup_dentry(struct inode *dir, struct dentry *dentry)
+ {
+ 	struct btrfs_fs_info *fs_info = btrfs_sb(dir->i_sb);
+@@ -5914,21 +5924,31 @@ struct inode *btrfs_lookup_dentry(struct inode *dir, struct dentry *dentry)
+ 	struct btrfs_root *root = BTRFS_I(dir)->root;
+ 	struct btrfs_root *sub_root = root;
+ 	struct btrfs_key location;
++	u8 di_type = 0;
+ 	int index;
+ 	int ret = 0;
+ 
+ 	if (dentry->d_name.len > BTRFS_NAME_LEN)
+ 		return ERR_PTR(-ENAMETOOLONG);
+ 
+-	ret = btrfs_inode_by_name(dir, dentry, &location);
++	ret = btrfs_inode_by_name(dir, dentry, &location, &di_type);
+ 	if (ret < 0)
+ 		return ERR_PTR(ret);
+ 
+-	if (location.objectid == 0)
+-		return ERR_PTR(-ENOENT);
+-
+ 	if (location.type == BTRFS_INODE_ITEM_KEY) {
+ 		inode = btrfs_iget(dir->i_sb, &location, root, NULL);
++		if (IS_ERR(inode))
++			return inode;
++
++		/* Do extra check against inode mode with di_type */
++		if (btrfs_inode_type(inode) != di_type) {
++			btrfs_crit(fs_info,
++"inode mode mismatch with dir: inode mode=0%o btrfs type=%u dir type=%u",
++				  inode->i_mode, btrfs_inode_type(inode),
++				  di_type);
++			iput(inode);
++			return ERR_PTR(-EUCLEAN);
++		}
+ 		return inode;
+ 	}
+ 
+@@ -6546,11 +6566,6 @@ fail:
+ 	return ERR_PTR(ret);
+ }
+ 
+-static inline u8 btrfs_inode_type(struct inode *inode)
+-{
+-	return btrfs_type_by_mode[(inode->i_mode & S_IFMT) >> S_SHIFT];
+-}
+-
+ /*
+  * utility function to add 'inode' into 'parent_inode' with
+  * a give name and a given sequence number.
+@@ -7162,6 +7177,14 @@ again:
+ 	extent_start = found_key.offset;
+ 	if (found_type == BTRFS_FILE_EXTENT_REG ||
+ 	    found_type == BTRFS_FILE_EXTENT_PREALLOC) {
++		/* Only regular file could have regular/prealloc extent */
++		if (!S_ISREG(inode->vfs_inode.i_mode)) {
++			ret = -EUCLEAN;
++			btrfs_crit(fs_info,
++		"regular/prealloc extent found for non-regular inode %llu",
++				   btrfs_ino(inode));
++			goto out;
++		}
+ 		extent_end = extent_start +
+ 		       btrfs_file_extent_num_bytes(leaf, item);
+ 
+diff --git a/fs/btrfs/qgroup.c b/fs/btrfs/qgroup.c
+index 39a00b57ff016..53f6bb5d0b72c 100644
+--- a/fs/btrfs/qgroup.c
++++ b/fs/btrfs/qgroup.c
+@@ -424,13 +424,13 @@ next2:
+ 			break;
+ 	}
+ out:
++	btrfs_free_path(path);
+ 	fs_info->qgroup_flags |= flags;
+ 	if (!(fs_info->qgroup_flags & BTRFS_QGROUP_STATUS_FLAG_ON))
+ 		clear_bit(BTRFS_FS_QUOTA_ENABLED, &fs_info->flags);
+ 	else if (fs_info->qgroup_flags & BTRFS_QGROUP_STATUS_FLAG_RESCAN &&
+ 		 ret >= 0)
+ 		ret = qgroup_rescan_init(fs_info, rescan_progress, 0);
+-	btrfs_free_path(path);
+ 
+ 	if (ret < 0) {
+ 		ulist_free(fs_info->qgroup_ulist);
+diff --git a/fs/btrfs/tests/inode-tests.c b/fs/btrfs/tests/inode-tests.c
+index 8c91d03cc82d8..94b139e92ff3d 100644
+--- a/fs/btrfs/tests/inode-tests.c
++++ b/fs/btrfs/tests/inode-tests.c
+@@ -245,6 +245,7 @@ static noinline int test_btrfs_get_extent(u32 sectorsize, u32 nodesize)
+ 		return ret;
+ 	}
+ 
++	inode->i_mode = S_IFREG;
+ 	BTRFS_I(inode)->location.type = BTRFS_INODE_ITEM_KEY;
+ 	BTRFS_I(inode)->location.objectid = BTRFS_FIRST_FREE_OBJECTID;
+ 	BTRFS_I(inode)->location.offset = 0;
+diff --git a/fs/btrfs/volumes.c b/fs/btrfs/volumes.c
+index 3d92feff249a0..3b3c65b7d0c19 100644
+--- a/fs/btrfs/volumes.c
++++ b/fs/btrfs/volumes.c
+@@ -6406,6 +6406,13 @@ static int btrfs_check_chunk_valid(struct btrfs_fs_info *fs_info,
+ 		return -EIO;
+ 	}
+ 
++	if (!is_power_of_2(type & BTRFS_BLOCK_GROUP_PROFILE_MASK) &&
++	    (type & BTRFS_BLOCK_GROUP_PROFILE_MASK) != 0) {
++		btrfs_err(fs_info,
++		"invalid chunk profile flag: 0x%llx, expect 0 or 1 bit set",
++			  type & BTRFS_BLOCK_GROUP_PROFILE_MASK);
++		return -EUCLEAN;
++	}
+ 	if ((type & BTRFS_BLOCK_GROUP_TYPE_MASK) == 0) {
+ 		btrfs_err(fs_info, "missing chunk type flag: 0x%llx", type);
+ 		return -EIO;
+diff --git a/fs/efivarfs/inode.c b/fs/efivarfs/inode.c
+index 71fccccf317e8..5decb3e06563f 100644
+--- a/fs/efivarfs/inode.c
++++ b/fs/efivarfs/inode.c
+@@ -10,6 +10,7 @@
+ #include <linux/efi.h>
+ #include <linux/fs.h>
+ #include <linux/ctype.h>
++#include <linux/kmemleak.h>
+ #include <linux/slab.h>
+ #include <linux/uuid.h>
+ 
+@@ -104,6 +105,7 @@ static int efivarfs_create(struct inode *dir, struct dentry *dentry,
+ 	var->var.VariableName[i] = '\0';
+ 
+ 	inode->i_private = var;
++	kmemleak_ignore(var);
+ 
+ 	err = efivar_entry_add(var, &efivarfs_list);
+ 	if (err)
+diff --git a/fs/efivarfs/super.c b/fs/efivarfs/super.c
+index 7808a26bd33fa..834615f13f3e3 100644
+--- a/fs/efivarfs/super.c
++++ b/fs/efivarfs/super.c
+@@ -23,7 +23,6 @@ LIST_HEAD(efivarfs_list);
+ static void efivarfs_evict_inode(struct inode *inode)
+ {
+ 	clear_inode(inode);
+-	kfree(inode->i_private);
+ }
+ 
+ static const struct super_operations efivarfs_ops = {
+diff --git a/fs/proc/self.c b/fs/proc/self.c
+index 398cdf9a9f0c6..eba167e1700ef 100644
+--- a/fs/proc/self.c
++++ b/fs/proc/self.c
+@@ -15,6 +15,13 @@ static const char *proc_self_get_link(struct dentry *dentry,
+ 	pid_t tgid = task_tgid_nr_ns(current, ns);
+ 	char *name;
+ 
++	/*
++	 * Not currently supported. Once we can inherit all of struct pid,
++	 * we can allow this.
++	 */
++	if (current->flags & PF_KTHREAD)
++		return ERR_PTR(-EOPNOTSUPP);
++
+ 	if (!tgid)
+ 		return ERR_PTR(-ENOENT);
+ 	/* 11 for max length of signed int in decimal + NULL term */
+diff --git a/include/linux/usb/quirks.h b/include/linux/usb/quirks.h
+index b6ce4c2eb40bd..fe878f253b209 100644
+--- a/include/linux/usb/quirks.h
++++ b/include/linux/usb/quirks.h
+@@ -60,4 +60,7 @@
+ /* Device needs a pause after every control message. */
+ #define USB_QUIRK_DELAY_CTRL_MSG		BIT(13)
+ 
++/* device has blacklisted endpoints */
++#define USB_QUIRK_ENDPOINT_BLACKLIST		BIT(15)
++
+ #endif /* __LINUX_USB_QUIRKS_H */
+diff --git a/include/scsi/libiscsi.h b/include/scsi/libiscsi.h
+index c9bd935f4fd1c..1ee0f30ae190b 100644
+--- a/include/scsi/libiscsi.h
++++ b/include/scsi/libiscsi.h
+@@ -145,6 +145,9 @@ struct iscsi_task {
+ 	void			*dd_data;	/* driver/transport data */
+ };
+ 
++/* invalid scsi_task pointer */
++#define	INVALID_SCSI_TASK	(struct iscsi_task *)-1l
++
+ static inline int iscsi_task_has_unsol_data(struct iscsi_task *task)
+ {
+ 	return task->unsol_r2t.data_length > task->unsol_r2t.sent;
+diff --git a/include/uapi/linux/wireless.h b/include/uapi/linux/wireless.h
+index a2c006a364e0b..24f3371ad8262 100644
+--- a/include/uapi/linux/wireless.h
++++ b/include/uapi/linux/wireless.h
+@@ -74,7 +74,11 @@
+ #include <linux/socket.h>		/* for "struct sockaddr" et al	*/
+ #include <linux/if.h>			/* for IFNAMSIZ and co... */
+ 
+-#include <stddef.h>                     /* for offsetof */
++#ifdef __KERNEL__
++#	include <linux/stddef.h>	/* for offsetof */
++#else
++#	include <stddef.h>		/* for offsetof */
++#endif
+ 
+ /***************************** VERSION *****************************/
+ /*
+diff --git a/mm/huge_memory.c b/mm/huge_memory.c
+index 51068ef1dff5a..5d9dd24d99c8b 100644
+--- a/mm/huge_memory.c
++++ b/mm/huge_memory.c
+@@ -688,7 +688,6 @@ int do_huge_pmd_anonymous_page(struct vm_fault *vmf)
+ 			transparent_hugepage_use_zero_page()) {
+ 		pgtable_t pgtable;
+ 		struct page *zero_page;
+-		bool set;
+ 		int ret;
+ 		pgtable = pte_alloc_one(vma->vm_mm, haddr);
+ 		if (unlikely(!pgtable))
+@@ -701,25 +700,25 @@ int do_huge_pmd_anonymous_page(struct vm_fault *vmf)
+ 		}
+ 		vmf->ptl = pmd_lock(vma->vm_mm, vmf->pmd);
+ 		ret = 0;
+-		set = false;
+ 		if (pmd_none(*vmf->pmd)) {
+ 			ret = check_stable_address_space(vma->vm_mm);
+ 			if (ret) {
+ 				spin_unlock(vmf->ptl);
++				pte_free(vma->vm_mm, pgtable);
+ 			} else if (userfaultfd_missing(vma)) {
+ 				spin_unlock(vmf->ptl);
++				pte_free(vma->vm_mm, pgtable);
+ 				ret = handle_userfault(vmf, VM_UFFD_MISSING);
+ 				VM_BUG_ON(ret & VM_FAULT_FALLBACK);
+ 			} else {
+ 				set_huge_zero_page(pgtable, vma->vm_mm, vma,
+ 						   haddr, vmf->pmd, zero_page);
+ 				spin_unlock(vmf->ptl);
+-				set = true;
+ 			}
+-		} else
++		} else {
+ 			spin_unlock(vmf->ptl);
+-		if (!set)
+ 			pte_free(vma->vm_mm, pgtable);
++		}
+ 		return ret;
+ 	}
+ 	gfp = alloc_hugepage_direct_gfpmask(vma);
+diff --git a/net/batman-adv/log.c b/net/batman-adv/log.c
+index 4ef4bde2cc2d3..b61ce96ae1d3d 100644
+--- a/net/batman-adv/log.c
++++ b/net/batman-adv/log.c
+@@ -195,6 +195,7 @@ static const struct file_operations batadv_log_fops = {
+ 	.read           = batadv_log_read,
+ 	.poll           = batadv_log_poll,
+ 	.llseek         = no_llseek,
++	.owner          = THIS_MODULE,
+ };
+ 
+ int batadv_debug_log_setup(struct batadv_priv *bat_priv)
+diff --git a/sound/pci/hda/patch_hdmi.c b/sound/pci/hda/patch_hdmi.c
+index 75bdcede04e63..21d9b7d96eb0f 100644
+--- a/sound/pci/hda/patch_hdmi.c
++++ b/sound/pci/hda/patch_hdmi.c
+@@ -339,13 +339,13 @@ static int hdmi_eld_ctl_info(struct snd_kcontrol *kcontrol,
+ 	if (!per_pin) {
+ 		/* no pin is bound to the pcm */
+ 		uinfo->count = 0;
+-		mutex_unlock(&spec->pcm_lock);
+-		return 0;
++		goto unlock;
+ 	}
+ 	eld = &per_pin->sink_eld;
+ 	uinfo->count = eld->eld_valid ? eld->eld_size : 0;
+-	mutex_unlock(&spec->pcm_lock);
+ 
++ unlock:
++	mutex_unlock(&spec->pcm_lock);
+ 	return 0;
+ }
+ 
+@@ -357,6 +357,7 @@ static int hdmi_eld_ctl_get(struct snd_kcontrol *kcontrol,
+ 	struct hdmi_spec_per_pin *per_pin;
+ 	struct hdmi_eld *eld;
+ 	int pcm_idx;
++	int err = 0;
+ 
+ 	pcm_idx = kcontrol->private_value;
+ 	mutex_lock(&spec->pcm_lock);
+@@ -365,16 +366,15 @@ static int hdmi_eld_ctl_get(struct snd_kcontrol *kcontrol,
+ 		/* no pin is bound to the pcm */
+ 		memset(ucontrol->value.bytes.data, 0,
+ 		       ARRAY_SIZE(ucontrol->value.bytes.data));
+-		mutex_unlock(&spec->pcm_lock);
+-		return 0;
++		goto unlock;
+ 	}
+-	eld = &per_pin->sink_eld;
+ 
++	eld = &per_pin->sink_eld;
+ 	if (eld->eld_size > ARRAY_SIZE(ucontrol->value.bytes.data) ||
+ 	    eld->eld_size > ELD_MAX_SIZE) {
+-		mutex_unlock(&spec->pcm_lock);
+ 		snd_BUG();
+-		return -EINVAL;
++		err = -EINVAL;
++		goto unlock;
+ 	}
+ 
+ 	memset(ucontrol->value.bytes.data, 0,
+@@ -382,9 +382,10 @@ static int hdmi_eld_ctl_get(struct snd_kcontrol *kcontrol,
+ 	if (eld->eld_valid)
+ 		memcpy(ucontrol->value.bytes.data, eld->eld_buffer,
+ 		       eld->eld_size);
+-	mutex_unlock(&spec->pcm_lock);
+ 
+-	return 0;
++ unlock:
++	mutex_unlock(&spec->pcm_lock);
++	return err;
+ }
+ 
+ static const struct snd_kcontrol_new eld_bytes_ctl = {
+@@ -1209,8 +1210,8 @@ static int hdmi_pcm_open(struct hda_pcm_stream *hinfo,
+ 	pin_idx = hinfo_to_pin_index(codec, hinfo);
+ 	if (!spec->dyn_pcm_assign) {
+ 		if (snd_BUG_ON(pin_idx < 0)) {
+-			mutex_unlock(&spec->pcm_lock);
+-			return -EINVAL;
++			err = -EINVAL;
++			goto unlock;
+ 		}
+ 	} else {
+ 		/* no pin is assigned to the PCM
+@@ -1218,16 +1219,13 @@ static int hdmi_pcm_open(struct hda_pcm_stream *hinfo,
+ 		 */
+ 		if (pin_idx < 0) {
+ 			err = hdmi_pcm_open_no_pin(hinfo, codec, substream);
+-			mutex_unlock(&spec->pcm_lock);
+-			return err;
++			goto unlock;
+ 		}
+ 	}
+ 
+ 	err = hdmi_choose_cvt(codec, pin_idx, &cvt_idx);
+-	if (err < 0) {
+-		mutex_unlock(&spec->pcm_lock);
+-		return err;
+-	}
++	if (err < 0)
++		goto unlock;
+ 
+ 	per_cvt = get_cvt(spec, cvt_idx);
+ 	/* Claim converter */
+@@ -1264,12 +1262,11 @@ static int hdmi_pcm_open(struct hda_pcm_stream *hinfo,
+ 			per_cvt->assigned = 0;
+ 			hinfo->nid = 0;
+ 			snd_hda_spdif_ctls_unassign(codec, pcm_idx);
+-			mutex_unlock(&spec->pcm_lock);
+-			return -ENODEV;
++			err = -ENODEV;
++			goto unlock;
+ 		}
+ 	}
+ 
+-	mutex_unlock(&spec->pcm_lock);
+ 	/* Store the updated parameters */
+ 	runtime->hw.channels_min = hinfo->channels_min;
+ 	runtime->hw.channels_max = hinfo->channels_max;
+@@ -1278,7 +1275,9 @@ static int hdmi_pcm_open(struct hda_pcm_stream *hinfo,
+ 
+ 	snd_pcm_hw_constraint_step(substream->runtime, 0,
+ 				   SNDRV_PCM_HW_PARAM_CHANNELS, 2);
+-	return 0;
++ unlock:
++	mutex_unlock(&spec->pcm_lock);
++	return err;
+ }
+ 
+ /*
+@@ -1876,7 +1875,7 @@ static int generic_hdmi_playback_pcm_prepare(struct hda_pcm_stream *hinfo,
+ 	struct snd_pcm_runtime *runtime = substream->runtime;
+ 	bool non_pcm;
+ 	int pinctl;
+-	int err;
++	int err = 0;
+ 
+ 	mutex_lock(&spec->pcm_lock);
+ 	pin_idx = hinfo_to_pin_index(codec, hinfo);
+@@ -1888,13 +1887,12 @@ static int generic_hdmi_playback_pcm_prepare(struct hda_pcm_stream *hinfo,
+ 		pin_cvt_fixup(codec, NULL, cvt_nid);
+ 		snd_hda_codec_setup_stream(codec, cvt_nid,
+ 					stream_tag, 0, format);
+-		mutex_unlock(&spec->pcm_lock);
+-		return 0;
++		goto unlock;
+ 	}
+ 
+ 	if (snd_BUG_ON(pin_idx < 0)) {
+-		mutex_unlock(&spec->pcm_lock);
+-		return -EINVAL;
++		err = -EINVAL;
++		goto unlock;
+ 	}
+ 	per_pin = get_pin(spec, pin_idx);
+ 	pin_nid = per_pin->pin_nid;
+@@ -1933,6 +1931,7 @@ static int generic_hdmi_playback_pcm_prepare(struct hda_pcm_stream *hinfo,
+ 	/* snd_hda_set_dev_select() has been called before */
+ 	err = spec->ops.setup_stream(codec, cvt_nid, pin_nid,
+ 				 stream_tag, format);
++ unlock:
+ 	mutex_unlock(&spec->pcm_lock);
+ 	return err;
+ }
+@@ -1954,32 +1953,34 @@ static int hdmi_pcm_close(struct hda_pcm_stream *hinfo,
+ 	struct hdmi_spec_per_cvt *per_cvt;
+ 	struct hdmi_spec_per_pin *per_pin;
+ 	int pinctl;
++	int err = 0;
+ 
++	mutex_lock(&spec->pcm_lock);
+ 	if (hinfo->nid) {
+ 		pcm_idx = hinfo_to_pcm_index(codec, hinfo);
+-		if (snd_BUG_ON(pcm_idx < 0))
+-			return -EINVAL;
++		if (snd_BUG_ON(pcm_idx < 0)) {
++			err = -EINVAL;
++			goto unlock;
++		}
+ 		cvt_idx = cvt_nid_to_cvt_index(codec, hinfo->nid);
+-		if (snd_BUG_ON(cvt_idx < 0))
+-			return -EINVAL;
++		if (snd_BUG_ON(cvt_idx < 0)) {
++			err = -EINVAL;
++			goto unlock;
++		}
+ 		per_cvt = get_cvt(spec, cvt_idx);
+-
+ 		snd_BUG_ON(!per_cvt->assigned);
+ 		per_cvt->assigned = 0;
+ 		hinfo->nid = 0;
+ 
+-		mutex_lock(&spec->pcm_lock);
+ 		snd_hda_spdif_ctls_unassign(codec, pcm_idx);
+ 		clear_bit(pcm_idx, &spec->pcm_in_use);
+ 		pin_idx = hinfo_to_pin_index(codec, hinfo);
+-		if (spec->dyn_pcm_assign && pin_idx < 0) {
+-			mutex_unlock(&spec->pcm_lock);
+-			return 0;
+-		}
++		if (spec->dyn_pcm_assign && pin_idx < 0)
++			goto unlock;
+ 
+ 		if (snd_BUG_ON(pin_idx < 0)) {
+-			mutex_unlock(&spec->pcm_lock);
+-			return -EINVAL;
++			err = -EINVAL;
++			goto unlock;
+ 		}
+ 		per_pin = get_pin(spec, pin_idx);
+ 
+@@ -1998,10 +1999,12 @@ static int hdmi_pcm_close(struct hda_pcm_stream *hinfo,
+ 		per_pin->setup = false;
+ 		per_pin->channels = 0;
+ 		mutex_unlock(&per_pin->lock);
+-		mutex_unlock(&spec->pcm_lock);
+ 	}
+ 
+-	return 0;
++unlock:
++	mutex_unlock(&spec->pcm_lock);
++
++	return err;
+ }
+ 
+ static const struct hda_pcm_ops generic_ops = {
+diff --git a/tools/perf/util/dwarf-aux.c b/tools/perf/util/dwarf-aux.c
+index 289ef63208fb6..7514aa9c68c99 100644
+--- a/tools/perf/util/dwarf-aux.c
++++ b/tools/perf/util/dwarf-aux.c
+@@ -332,6 +332,7 @@ bool die_is_func_def(Dwarf_Die *dw_die)
+ int die_entrypc(Dwarf_Die *dw_die, Dwarf_Addr *addr)
+ {
+ 	Dwarf_Addr base, end;
++	Dwarf_Attribute attr;
+ 
+ 	if (!addr)
+ 		return -EINVAL;
+@@ -339,6 +340,13 @@ int die_entrypc(Dwarf_Die *dw_die, Dwarf_Addr *addr)
+ 	if (dwarf_entrypc(dw_die, addr) == 0)
+ 		return 0;
+ 
++	/*
++	 *  Since the dwarf_ranges() will return 0 if there is no
++	 * DW_AT_ranges attribute, we should check it first.
++	 */
++	if (!dwarf_attr(dw_die, DW_AT_ranges, &attr))
++		return -ENOENT;
++
+ 	return dwarf_ranges(dw_die, 0, &base, addr, &end) < 0 ? -ENOENT : 0;
+ }
+ 
+diff --git a/tools/perf/util/event.c b/tools/perf/util/event.c
+index a19e840db54a0..70cada80d1853 100644
+--- a/tools/perf/util/event.c
++++ b/tools/perf/util/event.c
+@@ -794,11 +794,13 @@ int perf_event__synthesize_kernel_mmap(struct perf_tool *tool,
+ 	int err;
+ 	union perf_event *event;
+ 
+-	if (symbol_conf.kptr_restrict)
+-		return -1;
+ 	if (map == NULL)
+ 		return -1;
+ 
++	kmap = map__kmap(map);
++	if (!kmap->ref_reloc_sym)
++		return -1;
++
+ 	/*
+ 	 * We should get this from /sys/kernel/sections/.text, but till that is
+ 	 * available use this, and after it is use this as a fallback for older
+@@ -822,7 +824,6 @@ int perf_event__synthesize_kernel_mmap(struct perf_tool *tool,
+ 		event->header.misc = PERF_RECORD_MISC_GUEST_KERNEL;
+ 	}
+ 
+-	kmap = map__kmap(map);
+ 	size = snprintf(event->mmap.filename, sizeof(event->mmap.filename),
+ 			"%s%s", mmap_name, kmap->ref_reloc_sym->name) + 1;
+ 	size = PERF_ALIGN(size, sizeof(u64));