Linux patch 4.9.374.9-38

2 files changed, 1026 insertions, 0 deletions

diff --git a/0000_README b/0000_README
index 1b2c08f5..b43830fe 100644
--- a/0000_README
+++ b/0000_README
@@ -187,6 +187,10 @@ Patch:  1035_linux-4.9.36.patch
 From:   http://www.kernel.org
 Desc:   Linux 4.9.36
 
+Patch:  1036_linux-4.9.37.patch
+From:   http://www.kernel.org
+Desc:   Linux 4.9.37
+
 Patch:  1500_XATTR_USER_PREFIX.patch
 From:   https://bugs.gentoo.org/show_bug.cgi?id=470644
 Desc:   Support for namespace user.pax.* on tmpfs.
diff --git a/1036_linux-4.9.37.patch b/1036_linux-4.9.37.patch
new file mode 100644
index 00000000..eddaee91
--- /dev/null
+++ b/1036_linux-4.9.37.patch
@@ -0,0 +1,1022 @@
+diff --git a/Makefile b/Makefile
+index 4263dca12f07..342e19adbf7f 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,6 +1,6 @@
+ VERSION = 4
+ PATCHLEVEL = 9
+-SUBLEVEL = 36
++SUBLEVEL = 37
+ EXTRAVERSION =
+ NAME = Roaring Lionus
+ 
+diff --git a/arch/x86/lib/copy_user_64.S b/arch/x86/lib/copy_user_64.S
+index d376e4b48f88..04c067bafe24 100644
+--- a/arch/x86/lib/copy_user_64.S
++++ b/arch/x86/lib/copy_user_64.S
+@@ -84,7 +84,7 @@ ENTRY(copy_user_generic_unrolled)
+ 	movl %edx,%ecx
+ 	andl $63,%edx
+ 	shrl $6,%ecx
+-	jz 17f
++	jz .L_copy_short_string
+ 1:	movq (%rsi),%r8
+ 2:	movq 1*8(%rsi),%r9
+ 3:	movq 2*8(%rsi),%r10
+@@ -105,7 +105,8 @@ ENTRY(copy_user_generic_unrolled)
+ 	leaq 64(%rdi),%rdi
+ 	decl %ecx
+ 	jnz 1b
+-17:	movl %edx,%ecx
++.L_copy_short_string:
++	movl %edx,%ecx
+ 	andl $7,%edx
+ 	shrl $3,%ecx
+ 	jz 20f
+@@ -221,6 +222,8 @@ EXPORT_SYMBOL(copy_user_generic_string)
+  */
+ ENTRY(copy_user_enhanced_fast_string)
+ 	ASM_STAC
++	cmpl $64,%edx
++	jb .L_copy_short_string	/* less then 64 bytes, avoid the costly 'rep' */
+ 	movl %edx,%ecx
+ 1:	rep
+ 	movsb
+diff --git a/arch/x86/tools/relocs.c b/arch/x86/tools/relocs.c
+index 0c2fae8d929d..73eb7fd4aec4 100644
+--- a/arch/x86/tools/relocs.c
++++ b/arch/x86/tools/relocs.c
+@@ -992,11 +992,12 @@ static void emit_relocs(int as_text, int use_real_mode)
+ 		die("Segment relocations found but --realmode not specified\n");
+ 
+ 	/* Order the relocations for more efficient processing */
+-	sort_relocs(&relocs16);
+ 	sort_relocs(&relocs32);
+ #if ELF_BITS == 64
+ 	sort_relocs(&relocs32neg);
+ 	sort_relocs(&relocs64);
++#else
++	sort_relocs(&relocs16);
+ #endif
+ 
+ 	/* Print the relocations */
+diff --git a/crypto/drbg.c b/crypto/drbg.c
+index 123d211efa12..8cac3d31a5f8 100644
+--- a/crypto/drbg.c
++++ b/crypto/drbg.c
+@@ -1691,6 +1691,7 @@ static int drbg_init_sym_kernel(struct drbg_state *drbg)
+ 		return PTR_ERR(sk_tfm);
+ 	}
+ 	drbg->ctr_handle = sk_tfm;
++	init_completion(&drbg->ctr_completion);
+ 
+ 	req = skcipher_request_alloc(sk_tfm, GFP_KERNEL);
+ 	if (!req) {
+diff --git a/drivers/base/platform.c b/drivers/base/platform.c
+index c4af00385502..5eba47815bb6 100644
+--- a/drivers/base/platform.c
++++ b/drivers/base/platform.c
+@@ -856,7 +856,7 @@ static ssize_t driver_override_store(struct device *dev,
+ 				     const char *buf, size_t count)
+ {
+ 	struct platform_device *pdev = to_platform_device(dev);
+-	char *driver_override, *old = pdev->driver_override, *cp;
++	char *driver_override, *old, *cp;
+ 
+ 	if (count > PATH_MAX)
+ 		return -EINVAL;
+@@ -869,12 +869,15 @@ static ssize_t driver_override_store(struct device *dev,
+ 	if (cp)
+ 		*cp = '\0';
+ 
++	device_lock(dev);
++	old = pdev->driver_override;
+ 	if (strlen(driver_override)) {
+ 		pdev->driver_override = driver_override;
+ 	} else {
+ 		kfree(driver_override);
+ 		pdev->driver_override = NULL;
+ 	}
++	device_unlock(dev);
+ 
+ 	kfree(old);
+ 
+@@ -885,8 +888,12 @@ static ssize_t driver_override_show(struct device *dev,
+ 				    struct device_attribute *attr, char *buf)
+ {
+ 	struct platform_device *pdev = to_platform_device(dev);
++	ssize_t len;
+ 
+-	return sprintf(buf, "%s\n", pdev->driver_override);
++	device_lock(dev);
++	len = sprintf(buf, "%s\n", pdev->driver_override);
++	device_unlock(dev);
++	return len;
+ }
+ static DEVICE_ATTR_RW(driver_override);
+ 
+diff --git a/drivers/char/tpm/tpm-sysfs.c b/drivers/char/tpm/tpm-sysfs.c
+index a76ab4af9fb2..47005840c42c 100644
+--- a/drivers/char/tpm/tpm-sysfs.c
++++ b/drivers/char/tpm/tpm-sysfs.c
+@@ -35,9 +35,10 @@ static ssize_t pubek_show(struct device *dev, struct device_attribute *attr,
+ 	ssize_t err;
+ 	int i, rc;
+ 	char *str = buf;
+-
+ 	struct tpm_chip *chip = to_tpm_chip(dev);
+ 
++	memset(&tpm_cmd, 0, sizeof(tpm_cmd));
++
+ 	tpm_cmd.header.in = tpm_readpubek_header;
+ 	err = tpm_transmit_cmd(chip, &tpm_cmd, READ_PUBEK_RESULT_SIZE, 0,
+ 			       "attempting to read the PUBEK");
+diff --git a/drivers/gpu/drm/virtio/virtgpu_object.c b/drivers/gpu/drm/virtio/virtgpu_object.c
+index 1483daebe057..6f66b7347cd0 100644
+--- a/drivers/gpu/drm/virtio/virtgpu_object.c
++++ b/drivers/gpu/drm/virtio/virtgpu_object.c
+@@ -81,8 +81,10 @@ int virtio_gpu_object_create(struct virtio_gpu_device *vgdev,
+ 		return -ENOMEM;
+ 	size = roundup(size, PAGE_SIZE);
+ 	ret = drm_gem_object_init(vgdev->ddev, &bo->gem_base, size);
+-	if (ret != 0)
++	if (ret != 0) {
++		kfree(bo);
+ 		return ret;
++	}
+ 	bo->dumb = false;
+ 	virtio_gpu_init_ttm_placement(bo, pinned);
+ 
+diff --git a/drivers/infiniband/core/uverbs_cmd.c b/drivers/infiniband/core/uverbs_cmd.c
+index cb3f515a2285..01e3a37b0aef 100644
+--- a/drivers/infiniband/core/uverbs_cmd.c
++++ b/drivers/infiniband/core/uverbs_cmd.c
+@@ -2342,6 +2342,10 @@ ssize_t ib_uverbs_modify_qp(struct ib_uverbs_file *file,
+ 	if (copy_from_user(&cmd, buf, sizeof cmd))
+ 		return -EFAULT;
+ 
++	if (cmd.port_num < rdma_start_port(ib_dev) ||
++	    cmd.port_num > rdma_end_port(ib_dev))
++		return -EINVAL;
++
+ 	INIT_UDATA(&udata, buf + sizeof cmd, NULL, in_len - sizeof cmd,
+ 		   out_len);
+ 
+@@ -2882,6 +2886,10 @@ ssize_t ib_uverbs_create_ah(struct ib_uverbs_file *file,
+ 	if (copy_from_user(&cmd, buf, sizeof cmd))
+ 		return -EFAULT;
+ 
++	if (cmd.attr.port_num < rdma_start_port(ib_dev) ||
++	    cmd.attr.port_num > rdma_end_port(ib_dev))
++		return -EINVAL;
++
+ 	uobj = kmalloc(sizeof *uobj, GFP_KERNEL);
+ 	if (!uobj)
+ 		return -ENOMEM;
+diff --git a/drivers/media/media-entity.c b/drivers/media/media-entity.c
+index c68239e60487..98b067b712b3 100644
+--- a/drivers/media/media-entity.c
++++ b/drivers/media/media-entity.c
+@@ -468,7 +468,7 @@ __must_check int __media_entity_pipeline_start(struct media_entity *entity,
+ 
+ 	while ((entity_err = media_entity_graph_walk_next(graph))) {
+ 		/* don't let the stream_count go negative */
+-		if (entity->stream_count > 0) {
++		if (entity_err->stream_count > 0) {
+ 			entity_err->stream_count--;
+ 			if (entity_err->stream_count == 0)
+ 				entity_err->pipe = NULL;
+diff --git a/drivers/net/wireless/ath/ath10k/pci.c b/drivers/net/wireless/ath/ath10k/pci.c
+index 6063cf439d3d..410bcdaa9e87 100644
+--- a/drivers/net/wireless/ath/ath10k/pci.c
++++ b/drivers/net/wireless/ath/ath10k/pci.c
+@@ -3133,7 +3133,7 @@ int ath10k_pci_setup_resource(struct ath10k *ar)
+ 	setup_timer(&ar_pci->rx_post_retry, ath10k_pci_rx_replenish_retry,
+ 		    (unsigned long)ar);
+ 
+-	if (QCA_REV_6174(ar))
++	if (QCA_REV_6174(ar) || QCA_REV_9377(ar))
+ 		ath10k_pci_override_ce_config(ar);
+ 
+ 	ret = ath10k_pci_alloc_pipes(ar);
+diff --git a/drivers/net/wireless/mac80211_hwsim.c b/drivers/net/wireless/mac80211_hwsim.c
+index d3bad5779376..0fd7d7ed07ce 100644
+--- a/drivers/net/wireless/mac80211_hwsim.c
++++ b/drivers/net/wireless/mac80211_hwsim.c
+@@ -2662,7 +2662,7 @@ static int mac80211_hwsim_new_radio(struct genl_info *info,
+ 
+ 	tasklet_hrtimer_init(&data->beacon_timer,
+ 			     mac80211_hwsim_beacon,
+-			     CLOCK_MONOTONIC_RAW, HRTIMER_MODE_ABS);
++			     CLOCK_MONOTONIC, HRTIMER_MODE_ABS);
+ 
+ 	spin_lock_bh(&hwsim_radio_lock);
+ 	list_add_tail(&data->list, &hwsim_radios);
+diff --git a/drivers/pinctrl/freescale/pinctrl-mxs.c b/drivers/pinctrl/freescale/pinctrl-mxs.c
+index 41b5b07d5a2b..6852010a6d70 100644
+--- a/drivers/pinctrl/freescale/pinctrl-mxs.c
++++ b/drivers/pinctrl/freescale/pinctrl-mxs.c
+@@ -194,6 +194,16 @@ static int mxs_pinctrl_get_func_groups(struct pinctrl_dev *pctldev,
+ 	return 0;
+ }
+ 
++static void mxs_pinctrl_rmwl(u32 value, u32 mask, u8 shift, void __iomem *reg)
++{
++	u32 tmp;
++
++	tmp = readl(reg);
++	tmp &= ~(mask << shift);
++	tmp |= value << shift;
++	writel(tmp, reg);
++}
++
+ static int mxs_pinctrl_set_mux(struct pinctrl_dev *pctldev, unsigned selector,
+ 			       unsigned group)
+ {
+@@ -211,8 +221,7 @@ static int mxs_pinctrl_set_mux(struct pinctrl_dev *pctldev, unsigned selector,
+ 		reg += bank * 0x20 + pin / 16 * 0x10;
+ 		shift = pin % 16 * 2;
+ 
+-		writel(0x3 << shift, reg + CLR);
+-		writel(g->muxsel[i] << shift, reg + SET);
++		mxs_pinctrl_rmwl(g->muxsel[i], 0x3, shift, reg);
+ 	}
+ 
+ 	return 0;
+@@ -279,8 +288,7 @@ static int mxs_pinconf_group_set(struct pinctrl_dev *pctldev,
+ 			/* mA */
+ 			if (config & MA_PRESENT) {
+ 				shift = pin % 8 * 4;
+-				writel(0x3 << shift, reg + CLR);
+-				writel(ma << shift, reg + SET);
++				mxs_pinctrl_rmwl(ma, 0x3, shift, reg);
+ 			}
+ 
+ 			/* vol */
+diff --git a/drivers/pinctrl/intel/pinctrl-cherryview.c b/drivers/pinctrl/intel/pinctrl-cherryview.c
+index c43b1e9a06af..0d34d8a4ab14 100644
+--- a/drivers/pinctrl/intel/pinctrl-cherryview.c
++++ b/drivers/pinctrl/intel/pinctrl-cherryview.c
+@@ -13,6 +13,7 @@
+  * published by the Free Software Foundation.
+  */
+ 
++#include <linux/dmi.h>
+ #include <linux/kernel.h>
+ #include <linux/module.h>
+ #include <linux/init.h>
+@@ -1524,10 +1525,32 @@ static void chv_gpio_irq_handler(struct irq_desc *desc)
+ 	chained_irq_exit(chip, desc);
+ }
+ 
++/*
++ * Certain machines seem to hardcode Linux IRQ numbers in their ACPI
++ * tables. Since we leave GPIOs that are not capable of generating
++ * interrupts out of the irqdomain the numbering will be different and
++ * cause devices using the hardcoded IRQ numbers fail. In order not to
++ * break such machines we will only mask pins from irqdomain if the machine
++ * is not listed below.
++ */
++static const struct dmi_system_id chv_no_valid_mask[] = {
++	{
++		/* See https://bugzilla.kernel.org/show_bug.cgi?id=194945 */
++		.ident = "Acer Chromebook (CYAN)",
++		.matches = {
++			DMI_MATCH(DMI_SYS_VENDOR, "GOOGLE"),
++			DMI_MATCH(DMI_PRODUCT_NAME, "Edgar"),
++			DMI_MATCH(DMI_BIOS_DATE, "05/21/2016"),
++		},
++	},
++	{}
++};
++
+ static int chv_gpio_probe(struct chv_pinctrl *pctrl, int irq)
+ {
+ 	const struct chv_gpio_pinrange *range;
+ 	struct gpio_chip *chip = &pctrl->chip;
++	bool need_valid_mask = !dmi_check_system(chv_no_valid_mask);
+ 	int ret, i, offset;
+ 
+ 	*chip = chv_gpio_chip;
+@@ -1536,7 +1559,7 @@ static int chv_gpio_probe(struct chv_pinctrl *pctrl, int irq)
+ 	chip->label = dev_name(pctrl->dev);
+ 	chip->parent = pctrl->dev;
+ 	chip->base = -1;
+-	chip->irq_need_valid_mask = true;
++	chip->irq_need_valid_mask = need_valid_mask;
+ 
+ 	ret = devm_gpiochip_add_data(pctrl->dev, chip, pctrl);
+ 	if (ret) {
+@@ -1567,7 +1590,7 @@ static int chv_gpio_probe(struct chv_pinctrl *pctrl, int irq)
+ 		intsel &= CHV_PADCTRL0_INTSEL_MASK;
+ 		intsel >>= CHV_PADCTRL0_INTSEL_SHIFT;
+ 
+-		if (intsel >= pctrl->community->nirqs)
++		if (need_valid_mask && intsel >= pctrl->community->nirqs)
+ 			clear_bit(i, chip->irq_valid_mask);
+ 	}
+ 
+diff --git a/drivers/pinctrl/meson/pinctrl-meson8b.c b/drivers/pinctrl/meson/pinctrl-meson8b.c
+index 76f077f18193..f87ef5a0ee6c 100644
+--- a/drivers/pinctrl/meson/pinctrl-meson8b.c
++++ b/drivers/pinctrl/meson/pinctrl-meson8b.c
+@@ -739,8 +739,8 @@ static const char * const sdxc_c_groups[] = {
+ static const char * const nand_groups[] = {
+ 	"nand_io", "nand_io_ce0", "nand_io_ce1",
+ 	"nand_io_rb0", "nand_ale", "nand_cle",
+-	"nand_wen_clk", "nand_ren_clk", "nand_dqs0",
+-	"nand_dqs1"
++	"nand_wen_clk", "nand_ren_clk", "nand_dqs_0",
++	"nand_dqs_1"
+ };
+ 
+ static const char * const nor_groups[] = {
+diff --git a/drivers/pinctrl/qcom/pinctrl-ipq4019.c b/drivers/pinctrl/qcom/pinctrl-ipq4019.c
+index b68ae424cee2..743d1f458205 100644
+--- a/drivers/pinctrl/qcom/pinctrl-ipq4019.c
++++ b/drivers/pinctrl/qcom/pinctrl-ipq4019.c
+@@ -405,6 +405,36 @@ static const struct msm_pingroup ipq4019_groups[] = {
+ 	PINGROUP(67, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA),
+ 	PINGROUP(68, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA),
+ 	PINGROUP(69, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA),
++	PINGROUP(70, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA),
++	PINGROUP(71, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA),
++	PINGROUP(72, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA),
++	PINGROUP(73, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA),
++	PINGROUP(74, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA),
++	PINGROUP(75, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA),
++	PINGROUP(76, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA),
++	PINGROUP(77, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA),
++	PINGROUP(78, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA),
++	PINGROUP(79, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA),
++	PINGROUP(80, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA),
++	PINGROUP(81, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA),
++	PINGROUP(82, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA),
++	PINGROUP(83, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA),
++	PINGROUP(84, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA),
++	PINGROUP(85, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA),
++	PINGROUP(86, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA),
++	PINGROUP(87, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA),
++	PINGROUP(88, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA),
++	PINGROUP(89, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA),
++	PINGROUP(90, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA),
++	PINGROUP(91, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA),
++	PINGROUP(92, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA),
++	PINGROUP(93, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA),
++	PINGROUP(94, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA),
++	PINGROUP(95, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA),
++	PINGROUP(96, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA),
++	PINGROUP(97, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA),
++	PINGROUP(98, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA),
++	PINGROUP(99, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA, NA),
+ };
+ 
+ static const struct msm_pinctrl_soc_data ipq4019_pinctrl = {
+diff --git a/drivers/pinctrl/sh-pfc/core.c b/drivers/pinctrl/sh-pfc/core.c
+index cf80ce1dd7ce..4a5a0feb931b 100644
+--- a/drivers/pinctrl/sh-pfc/core.c
++++ b/drivers/pinctrl/sh-pfc/core.c
+@@ -586,6 +586,9 @@ static int sh_pfc_probe(struct platform_device *pdev)
+ 		ret = info->ops->init(pfc);
+ 		if (ret < 0)
+ 			return ret;
++
++		/* .init() may have overridden pfc->info */
++		info = pfc->info;
+ 	}
+ 
+ 	/* Enable dummy states for those platforms without pinctrl support */
+diff --git a/drivers/pinctrl/sh-pfc/pfc-r8a7791.c b/drivers/pinctrl/sh-pfc/pfc-r8a7791.c
+index 7ca37c3019ab..baa98d7fe947 100644
+--- a/drivers/pinctrl/sh-pfc/pfc-r8a7791.c
++++ b/drivers/pinctrl/sh-pfc/pfc-r8a7791.c
+@@ -203,7 +203,7 @@ enum {
+ 
+ 	/* IPSR6 */
+ 	FN_AUDIO_CLKB, FN_STP_OPWM_0_B, FN_MSIOF1_SCK_B,
+-	FN_SCIF_CLK, FN_BPFCLK_E,
++	FN_SCIF_CLK, FN_DVC_MUTE, FN_BPFCLK_E,
+ 	FN_AUDIO_CLKC, FN_SCIFB0_SCK_C, FN_MSIOF1_SYNC_B, FN_RX2,
+ 	FN_SCIFA2_RXD, FN_FMIN_E,
+ 	FN_AUDIO_CLKOUT, FN_MSIOF1_SS1_B, FN_TX2, FN_SCIFA2_TXD,
+@@ -573,7 +573,7 @@ enum {
+ 
+ 	/* IPSR6 */
+ 	AUDIO_CLKB_MARK, STP_OPWM_0_B_MARK, MSIOF1_SCK_B_MARK,
+-	SCIF_CLK_MARK, BPFCLK_E_MARK,
++	SCIF_CLK_MARK, DVC_MUTE_MARK, BPFCLK_E_MARK,
+ 	AUDIO_CLKC_MARK, SCIFB0_SCK_C_MARK, MSIOF1_SYNC_B_MARK, RX2_MARK,
+ 	SCIFA2_RXD_MARK, FMIN_E_MARK,
+ 	AUDIO_CLKOUT_MARK, MSIOF1_SS1_B_MARK, TX2_MARK, SCIFA2_TXD_MARK,
+@@ -1010,14 +1010,17 @@ static const u16 pinmux_data[] = {
+ 	PINMUX_IPSR_MSEL(IP4_12_10, SCL2, SEL_IIC2_0),
+ 	PINMUX_IPSR_MSEL(IP4_12_10, GPS_CLK_B, SEL_GPS_1),
+ 	PINMUX_IPSR_MSEL(IP4_12_10, GLO_Q0_D, SEL_GPS_3),
++	PINMUX_IPSR_MSEL(IP4_12_10, HSCK1_E, SEL_HSCIF1_4),
+ 	PINMUX_IPSR_GPSR(IP4_15_13, SSI_WS2),
+ 	PINMUX_IPSR_MSEL(IP4_15_13, SDA2, SEL_IIC2_0),
+ 	PINMUX_IPSR_MSEL(IP4_15_13, GPS_SIGN_B, SEL_GPS_1),
+ 	PINMUX_IPSR_MSEL(IP4_15_13, RX2_E, SEL_SCIF2_4),
+ 	PINMUX_IPSR_MSEL(IP4_15_13, GLO_Q1_D, SEL_GPS_3),
++	PINMUX_IPSR_MSEL(IP4_15_13, HCTS1_N_E, SEL_HSCIF1_4),
+ 	PINMUX_IPSR_GPSR(IP4_18_16, SSI_SDATA2),
+ 	PINMUX_IPSR_MSEL(IP4_18_16, GPS_MAG_B, SEL_GPS_1),
+ 	PINMUX_IPSR_MSEL(IP4_18_16, TX2_E, SEL_SCIF2_4),
++	PINMUX_IPSR_MSEL(IP4_18_16, HRTS1_N_E, SEL_HSCIF1_4),
+ 	PINMUX_IPSR_GPSR(IP4_19, SSI_SCK34),
+ 	PINMUX_IPSR_GPSR(IP4_20, SSI_WS34),
+ 	PINMUX_IPSR_GPSR(IP4_21, SSI_SDATA3),
+@@ -1090,6 +1093,7 @@ static const u16 pinmux_data[] = {
+ 	PINMUX_IPSR_MSEL(IP6_2_0, STP_OPWM_0_B, SEL_SSP_1),
+ 	PINMUX_IPSR_MSEL(IP6_2_0, MSIOF1_SCK_B, SEL_SOF1_1),
+ 	PINMUX_IPSR_MSEL(IP6_2_0, SCIF_CLK, SEL_SCIF_0),
++	PINMUX_IPSR_GPSR(IP6_2_0, DVC_MUTE),
+ 	PINMUX_IPSR_MSEL(IP6_2_0, BPFCLK_E, SEL_FM_4),
+ 	PINMUX_IPSR_GPSR(IP6_5_3, AUDIO_CLKC),
+ 	PINMUX_IPSR_MSEL(IP6_5_3, SCIFB0_SCK_C, SEL_SCIFB_2),
+@@ -1099,7 +1103,7 @@ static const u16 pinmux_data[] = {
+ 	PINMUX_IPSR_MSEL(IP6_5_3, FMIN_E, SEL_FM_4),
+ 	PINMUX_IPSR_GPSR(IP6_7_6, AUDIO_CLKOUT),
+ 	PINMUX_IPSR_MSEL(IP6_7_6, MSIOF1_SS1_B, SEL_SOF1_1),
+-	PINMUX_IPSR_MSEL(IP6_5_3, TX2, SEL_SCIF2_0),
++	PINMUX_IPSR_MSEL(IP6_7_6, TX2, SEL_SCIF2_0),
+ 	PINMUX_IPSR_MSEL(IP6_7_6, SCIFA2_TXD, SEL_SCIFA2_0),
+ 	PINMUX_IPSR_GPSR(IP6_9_8, IRQ0),
+ 	PINMUX_IPSR_MSEL(IP6_9_8, SCIFB1_RXD_D, SEL_SCIFB1_3),
+@@ -5810,7 +5814,7 @@ static const struct pinmux_cfg_reg pinmux_config_regs[] = {
+ 		0, 0,
+ 		/* IP6_2_0 [3] */
+ 		FN_AUDIO_CLKB, FN_STP_OPWM_0_B, FN_MSIOF1_SCK_B,
+-		FN_SCIF_CLK, 0, FN_BPFCLK_E,
++		FN_SCIF_CLK, FN_DVC_MUTE, FN_BPFCLK_E,
+ 		0, 0, }
+ 	},
+ 	{ PINMUX_CFG_REG_VAR("IPSR7", 0xE606003C, 32,
+diff --git a/drivers/pinctrl/sh-pfc/pfc-r8a7794.c b/drivers/pinctrl/sh-pfc/pfc-r8a7794.c
+index ed734f560c84..ef093ac0cf2f 100644
+--- a/drivers/pinctrl/sh-pfc/pfc-r8a7794.c
++++ b/drivers/pinctrl/sh-pfc/pfc-r8a7794.c
+@@ -281,8 +281,8 @@ enum {
+ 	FN_AVB_AVTP_CAPTURE, FN_ETH_CRS_DV_B, FN_SSI_WS1, FN_SCIF1_TXD_B,
+ 	FN_IIC1_SDA_C, FN_VI1_DATA0, FN_CAN0_TX_D, FN_AVB_AVTP_MATCH,
+ 	FN_ETH_RX_ER_B, FN_SSI_SDATA1, FN_HSCIF1_HRX_B, FN_SDATA, FN_VI1_DATA1,
+-	FN_ATAG0_N, FN_ETH_RXD0_B, FN_SSI_SCK2, FN_HSCIF1_HTX_B, FN_VI1_DATA2,
+-	FN_MDATA, FN_ATAWR0_N, FN_ETH_RXD1_B,
++	FN_ATAWR0_N, FN_ETH_RXD0_B, FN_SSI_SCK2, FN_HSCIF1_HTX_B, FN_VI1_DATA2,
++	FN_MDATA, FN_ATAG0_N, FN_ETH_RXD1_B,
+ 
+ 	/* IPSR13 */
+ 	FN_SSI_WS2, FN_HSCIF1_HCTS_N_B, FN_SCIFA0_RXD_D, FN_VI1_DATA3, FN_SCKZ,
+@@ -575,8 +575,8 @@ enum {
+ 	ETH_CRS_DV_B_MARK, SSI_WS1_MARK, SCIF1_TXD_B_MARK, IIC1_SDA_C_MARK,
+ 	VI1_DATA0_MARK, CAN0_TX_D_MARK, AVB_AVTP_MATCH_MARK, ETH_RX_ER_B_MARK,
+ 	SSI_SDATA1_MARK, HSCIF1_HRX_B_MARK, VI1_DATA1_MARK, SDATA_MARK,
+-	ATAG0_N_MARK, ETH_RXD0_B_MARK, SSI_SCK2_MARK, HSCIF1_HTX_B_MARK,
+-	VI1_DATA2_MARK, MDATA_MARK, ATAWR0_N_MARK, ETH_RXD1_B_MARK,
++	ATAWR0_N_MARK, ETH_RXD0_B_MARK, SSI_SCK2_MARK, HSCIF1_HTX_B_MARK,
++	VI1_DATA2_MARK, MDATA_MARK, ATAG0_N_MARK, ETH_RXD1_B_MARK,
+ 
+ 	/* IPSR13 */
+ 	SSI_WS2_MARK, HSCIF1_HCTS_N_B_MARK, SCIFA0_RXD_D_MARK, VI1_DATA3_MARK,
+@@ -1413,13 +1413,13 @@ static const u16 pinmux_data[] = {
+ 	PINMUX_IPSR_MSEL(IP12_26_24, HSCIF1_HRX_B, SEL_HSCIF1_1),
+ 	PINMUX_IPSR_GPSR(IP12_26_24, VI1_DATA1),
+ 	PINMUX_IPSR_MSEL(IP12_26_24, SDATA, SEL_FSN_0),
+-	PINMUX_IPSR_GPSR(IP12_26_24, ATAG0_N),
++	PINMUX_IPSR_GPSR(IP12_26_24, ATAWR0_N),
+ 	PINMUX_IPSR_MSEL(IP12_26_24, ETH_RXD0_B, SEL_ETH_1),
+ 	PINMUX_IPSR_MSEL(IP12_29_27, SSI_SCK2, SEL_SSI2_0),
+ 	PINMUX_IPSR_MSEL(IP12_29_27, HSCIF1_HTX_B, SEL_HSCIF1_1),
+ 	PINMUX_IPSR_GPSR(IP12_29_27, VI1_DATA2),
+ 	PINMUX_IPSR_MSEL(IP12_29_27, MDATA, SEL_FSN_0),
+-	PINMUX_IPSR_GPSR(IP12_29_27, ATAWR0_N),
++	PINMUX_IPSR_GPSR(IP12_29_27, ATAG0_N),
+ 	PINMUX_IPSR_MSEL(IP12_29_27, ETH_RXD1_B, SEL_ETH_1),
+ 
+ 	/* IPSR13 */
+@@ -4938,10 +4938,10 @@ static const struct pinmux_cfg_reg pinmux_config_regs[] = {
+ 		0, 0, 0, 0,
+ 		/* IP12_29_27 [3] */
+ 		FN_SSI_SCK2, FN_HSCIF1_HTX_B, FN_VI1_DATA2, FN_MDATA,
+-		FN_ATAWR0_N, FN_ETH_RXD1_B, 0, 0,
++		FN_ATAG0_N, FN_ETH_RXD1_B, 0, 0,
+ 		/* IP12_26_24 [3] */
+ 		FN_SSI_SDATA1, FN_HSCIF1_HRX_B, FN_VI1_DATA1, FN_SDATA,
+-		FN_ATAG0_N, FN_ETH_RXD0_B, 0, 0,
++		FN_ATAWR0_N, FN_ETH_RXD0_B, 0, 0,
+ 		/* IP12_23_21 [3] */
+ 		FN_SSI_WS1, FN_SCIF1_TXD_B, FN_IIC1_SDA_C, FN_VI1_DATA0,
+ 		FN_CAN0_TX_D, FN_AVB_AVTP_MATCH, FN_ETH_RX_ER_B, 0,
+diff --git a/drivers/pinctrl/sh-pfc/pfc-r8a7795.c b/drivers/pinctrl/sh-pfc/pfc-r8a7795.c
+index 84cee66b1e08..0acb0a756650 100644
+--- a/drivers/pinctrl/sh-pfc/pfc-r8a7795.c
++++ b/drivers/pinctrl/sh-pfc/pfc-r8a7795.c
+@@ -2056,7 +2056,7 @@ static const unsigned int hscif2_clk_b_pins[] = {
+ 	RCAR_GP_PIN(6, 21),
+ };
+ static const unsigned int hscif2_clk_b_mux[] = {
+-	HSCK1_B_MARK,
++	HSCK2_B_MARK,
+ };
+ static const unsigned int hscif2_ctrl_b_pins[] = {
+ 	/* RTS, CTS */
+@@ -2129,7 +2129,7 @@ static const unsigned int hscif4_ctrl_pins[] = {
+ 	RCAR_GP_PIN(1, 15), RCAR_GP_PIN(1, 14),
+ };
+ static const unsigned int hscif4_ctrl_mux[] = {
+-	HRTS4_N_MARK, HCTS3_N_MARK,
++	HRTS4_N_MARK, HCTS4_N_MARK,
+ };
+ 
+ static const unsigned int hscif4_data_b_pins[] = {
+diff --git a/drivers/pinctrl/stm32/pinctrl-stm32.c b/drivers/pinctrl/stm32/pinctrl-stm32.c
+index efc43711ff5c..a36fd4b7e996 100644
+--- a/drivers/pinctrl/stm32/pinctrl-stm32.c
++++ b/drivers/pinctrl/stm32/pinctrl-stm32.c
+@@ -798,7 +798,7 @@ static int stm32_pconf_parse_conf(struct pinctrl_dev *pctldev,
+ 		break;
+ 	case PIN_CONFIG_OUTPUT:
+ 		__stm32_gpio_set(bank, offset, arg);
+-		ret = stm32_pmx_gpio_set_direction(pctldev, NULL, pin, false);
++		ret = stm32_pmx_gpio_set_direction(pctldev, range, pin, false);
+ 		break;
+ 	default:
+ 		ret = -EINVAL;
+diff --git a/drivers/pinctrl/sunxi/pinctrl-sun8i-a83t.c b/drivers/pinctrl/sunxi/pinctrl-sun8i-a83t.c
+index 90b973e15982..a7c81e988656 100644
+--- a/drivers/pinctrl/sunxi/pinctrl-sun8i-a83t.c
++++ b/drivers/pinctrl/sunxi/pinctrl-sun8i-a83t.c
+@@ -394,7 +394,7 @@ static const struct sunxi_desc_pin sun8i_a83t_pins[] = {
+ 	SUNXI_PIN(SUNXI_PINCTRL_PIN(E, 18),
+ 		  SUNXI_FUNCTION(0x0, "gpio_in"),
+ 		  SUNXI_FUNCTION(0x1, "gpio_out"),
+-		  SUNXI_FUNCTION(0x3, "owa")),		/* DOUT */
++		  SUNXI_FUNCTION(0x3, "spdif")),	/* DOUT */
+ 	SUNXI_PIN(SUNXI_PINCTRL_PIN(E, 19),
+ 		  SUNXI_FUNCTION(0x0, "gpio_in"),
+ 		  SUNXI_FUNCTION(0x1, "gpio_out")),
+diff --git a/drivers/usb/core/quirks.c b/drivers/usb/core/quirks.c
+index 96b21b0dac1e..3116edfcdc18 100644
+--- a/drivers/usb/core/quirks.c
++++ b/drivers/usb/core/quirks.c
+@@ -223,6 +223,10 @@ static const struct usb_device_id usb_quirk_list[] = {
+ 	/* Blackmagic Design UltraStudio SDI */
+ 	{ USB_DEVICE(0x1edb, 0xbd4f), .driver_info = USB_QUIRK_NO_LPM },
+ 
++	/* Hauppauge HVR-950q */
++	{ USB_DEVICE(0x2040, 0x7200), .driver_info =
++			USB_QUIRK_CONFIG_INTF_STRINGS },
++
+ 	/* INTEL VALUE SSD */
+ 	{ USB_DEVICE(0x8086, 0xf1a5), .driver_info = USB_QUIRK_RESET_RESUME },
+ 
+diff --git a/drivers/usb/core/usb.c b/drivers/usb/core/usb.c
+index 592151461017..eaf1c3b06f02 100644
+--- a/drivers/usb/core/usb.c
++++ b/drivers/usb/core/usb.c
+@@ -279,6 +279,8 @@ static void usb_release_dev(struct device *dev)
+ 
+ 	usb_destroy_configuration(udev);
+ 	usb_release_bos_descriptor(udev);
++	if (udev->parent)
++		of_node_put(dev->of_node);
+ 	usb_put_hcd(hcd);
+ 	kfree(udev->product);
+ 	kfree(udev->manufacturer);
+diff --git a/drivers/usb/dwc3/dwc3-st.c b/drivers/usb/dwc3/dwc3-st.c
+index aaaf256f71dd..4cf5381ff991 100644
+--- a/drivers/usb/dwc3/dwc3-st.c
++++ b/drivers/usb/dwc3/dwc3-st.c
+@@ -231,7 +231,7 @@ static int st_dwc3_probe(struct platform_device *pdev)
+ 
+ 	dwc3_data->syscfg_reg_off = res->start;
+ 
+-	dev_vdbg(&pdev->dev, "glue-logic addr 0x%p, syscfg-reg offset 0x%x\n",
++	dev_vdbg(&pdev->dev, "glue-logic addr 0x%pK, syscfg-reg offset 0x%x\n",
+ 		 dwc3_data->glue_base, dwc3_data->syscfg_reg_off);
+ 
+ 	dwc3_data->rstc_pwrdn =
+diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c
+index a7e28095026d..f92c680e3937 100644
+--- a/drivers/usb/dwc3/gadget.c
++++ b/drivers/usb/dwc3/gadget.c
+@@ -1069,9 +1069,9 @@ static int __dwc3_gadget_ep_queue(struct dwc3_ep *dep, struct dwc3_request *req)
+ 		return -ESHUTDOWN;
+ 	}
+ 
+-	if (WARN(req->dep != dep, "request %p belongs to '%s'\n",
++	if (WARN(req->dep != dep, "request %pK belongs to '%s'\n",
+ 				&req->request, req->dep->name)) {
+-		dwc3_trace(trace_dwc3_gadget, "request %p belongs to '%s'",
++		dwc3_trace(trace_dwc3_gadget, "request %pK belongs to '%s'",
+ 				&req->request, req->dep->name);
+ 		return -EINVAL;
+ 	}
+@@ -1212,7 +1212,7 @@ static int dwc3_gadget_ep_dequeue(struct usb_ep *ep,
+ 			dwc3_stop_active_transfer(dwc, dep->number, true);
+ 			goto out1;
+ 		}
+-		dev_err(dwc->dev, "request %p was not queued to %s\n",
++		dev_err(dwc->dev, "request %pK was not queued to %s\n",
+ 				request, ep->name);
+ 		ret = -EINVAL;
+ 		goto out0;
+diff --git a/drivers/usb/host/xhci-hub.c b/drivers/usb/host/xhci-hub.c
+index 1d41637a53e5..ff544f20872c 100644
+--- a/drivers/usb/host/xhci-hub.c
++++ b/drivers/usb/host/xhci-hub.c
+@@ -1348,6 +1348,9 @@ int xhci_bus_suspend(struct usb_hcd *hcd)
+ 				t2 |= PORT_WKOC_E | PORT_WKCONN_E;
+ 				t2 &= ~PORT_WKDISC_E;
+ 			}
++			if ((xhci->quirks & XHCI_U2_DISABLE_WAKE) &&
++			    (hcd->speed < HCD_USB3))
++				t2 &= ~PORT_WAKE_BITS;
+ 		} else
+ 			t2 &= ~PORT_WAKE_BITS;
+ 
+diff --git a/drivers/usb/host/xhci-pci.c b/drivers/usb/host/xhci-pci.c
+index 69864ba38698..672751ed2ba1 100644
+--- a/drivers/usb/host/xhci-pci.c
++++ b/drivers/usb/host/xhci-pci.c
+@@ -54,6 +54,11 @@
+ #define PCI_DEVICE_ID_INTEL_APL_XHCI			0x5aa8
+ #define PCI_DEVICE_ID_INTEL_DNV_XHCI			0x19d0
+ 
++#define PCI_DEVICE_ID_AMD_PROMONTORYA_4			0x43b9
++#define PCI_DEVICE_ID_AMD_PROMONTORYA_3			0x43ba
++#define PCI_DEVICE_ID_AMD_PROMONTORYA_2			0x43bb
++#define PCI_DEVICE_ID_AMD_PROMONTORYA_1			0x43bc
++
+ static const char hcd_name[] = "xhci_hcd";
+ 
+ static struct hc_driver __read_mostly xhci_pci_hc_driver;
+@@ -135,6 +140,13 @@ static void xhci_pci_quirks(struct device *dev, struct xhci_hcd *xhci)
+ 	if (pdev->vendor == PCI_VENDOR_ID_AMD)
+ 		xhci->quirks |= XHCI_TRUST_TX_LENGTH;
+ 
++	if ((pdev->vendor == PCI_VENDOR_ID_AMD) &&
++		((pdev->device == PCI_DEVICE_ID_AMD_PROMONTORYA_4) ||
++		(pdev->device == PCI_DEVICE_ID_AMD_PROMONTORYA_3) ||
++		(pdev->device == PCI_DEVICE_ID_AMD_PROMONTORYA_2) ||
++		(pdev->device == PCI_DEVICE_ID_AMD_PROMONTORYA_1)))
++		xhci->quirks |= XHCI_U2_DISABLE_WAKE;
++
+ 	if (pdev->vendor == PCI_VENDOR_ID_INTEL) {
+ 		xhci->quirks |= XHCI_LPM_SUPPORT;
+ 		xhci->quirks |= XHCI_INTEL_HOST;
+diff --git a/drivers/usb/host/xhci.h b/drivers/usb/host/xhci.h
+index 328fe06752ec..8336e07dc5f9 100644
+--- a/drivers/usb/host/xhci.h
++++ b/drivers/usb/host/xhci.h
+@@ -1660,6 +1660,7 @@ struct xhci_hcd {
+ /* For controller with a broken Port Disable implementation */
+ #define XHCI_BROKEN_PORT_PED	(1 << 25)
+ #define XHCI_LIMIT_ENDPOINT_INTERVAL_7	(1 << 26)
++#define XHCI_U2_DISABLE_WAKE	(1 << 27)
+ 
+ 	unsigned int		num_active_eps;
+ 	unsigned int		limit_active_eps;
+diff --git a/drivers/usb/serial/cp210x.c b/drivers/usb/serial/cp210x.c
+index 8bb48751028c..84b444f69c9b 100644
+--- a/drivers/usb/serial/cp210x.c
++++ b/drivers/usb/serial/cp210x.c
+@@ -135,6 +135,7 @@ static const struct usb_device_id id_table[] = {
+ 	{ USB_DEVICE(0x10C4, 0x8977) },	/* CEL MeshWorks DevKit Device */
+ 	{ USB_DEVICE(0x10C4, 0x8998) }, /* KCF Technologies PRN */
+ 	{ USB_DEVICE(0x10C4, 0x8A2A) }, /* HubZ dual ZigBee and Z-Wave dongle */
++	{ USB_DEVICE(0x10C4, 0x8A5E) }, /* CEL EM3588 ZigBee USB Stick Long Range */
+ 	{ USB_DEVICE(0x10C4, 0xEA60) }, /* Silicon Labs factory default */
+ 	{ USB_DEVICE(0x10C4, 0xEA61) }, /* Silicon Labs factory default */
+ 	{ USB_DEVICE(0x10C4, 0xEA70) }, /* Silicon Labs factory default */
+diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c
+index 3bf61acfc26b..ebe51f11105d 100644
+--- a/drivers/usb/serial/option.c
++++ b/drivers/usb/serial/option.c
+@@ -1877,6 +1877,10 @@ static const struct usb_device_id option_ids[] = {
+ 	  .driver_info = (kernel_ulong_t)&four_g_w100_blacklist
+ 	},
+ 	{ USB_DEVICE_INTERFACE_CLASS(LONGCHEER_VENDOR_ID, SPEEDUP_PRODUCT_SU9800, 0xff) },
++	{ USB_DEVICE_INTERFACE_CLASS(LONGCHEER_VENDOR_ID, 0x9801, 0xff),
++	  .driver_info = (kernel_ulong_t)&net_intf3_blacklist },
++	{ USB_DEVICE_INTERFACE_CLASS(LONGCHEER_VENDOR_ID, 0x9803, 0xff),
++	  .driver_info = (kernel_ulong_t)&net_intf4_blacklist },
+ 	{ USB_DEVICE(LONGCHEER_VENDOR_ID, ZOOM_PRODUCT_4597) },
+ 	{ USB_DEVICE(LONGCHEER_VENDOR_ID, IBALL_3_5G_CONNECT) },
+ 	{ USB_DEVICE(HAIER_VENDOR_ID, HAIER_PRODUCT_CE100) },
+diff --git a/drivers/usb/serial/qcserial.c b/drivers/usb/serial/qcserial.c
+index fd509ed6cf70..652b4334b26d 100644
+--- a/drivers/usb/serial/qcserial.c
++++ b/drivers/usb/serial/qcserial.c
+@@ -158,6 +158,7 @@ static const struct usb_device_id id_table[] = {
+ 	{DEVICE_SWI(0x1199, 0x9056)},	/* Sierra Wireless Modem */
+ 	{DEVICE_SWI(0x1199, 0x9060)},	/* Sierra Wireless Modem */
+ 	{DEVICE_SWI(0x1199, 0x9061)},	/* Sierra Wireless Modem */
++	{DEVICE_SWI(0x1199, 0x9063)},	/* Sierra Wireless EM7305 */
+ 	{DEVICE_SWI(0x1199, 0x9070)},	/* Sierra Wireless MC74xx */
+ 	{DEVICE_SWI(0x1199, 0x9071)},	/* Sierra Wireless MC74xx */
+ 	{DEVICE_SWI(0x1199, 0x9078)},	/* Sierra Wireless EM74xx */
+diff --git a/drivers/usb/usbip/stub_main.c b/drivers/usb/usbip/stub_main.c
+index 44ab43fc4fcc..af10f7b131a4 100644
+--- a/drivers/usb/usbip/stub_main.c
++++ b/drivers/usb/usbip/stub_main.c
+@@ -262,7 +262,11 @@ void stub_device_cleanup_urbs(struct stub_device *sdev)
+ 		kmem_cache_free(stub_priv_cache, priv);
+ 
+ 		kfree(urb->transfer_buffer);
++		urb->transfer_buffer = NULL;
++
+ 		kfree(urb->setup_packet);
++		urb->setup_packet = NULL;
++
+ 		usb_free_urb(urb);
+ 	}
+ }
+diff --git a/drivers/usb/usbip/stub_tx.c b/drivers/usb/usbip/stub_tx.c
+index 6b1e8c3f0e4b..be50cef645d8 100644
+--- a/drivers/usb/usbip/stub_tx.c
++++ b/drivers/usb/usbip/stub_tx.c
+@@ -28,7 +28,11 @@ static void stub_free_priv_and_urb(struct stub_priv *priv)
+ 	struct urb *urb = priv->urb;
+ 
+ 	kfree(urb->setup_packet);
++	urb->setup_packet = NULL;
++
+ 	kfree(urb->transfer_buffer);
++	urb->transfer_buffer = NULL;
++
+ 	list_del(&priv->list);
+ 	kmem_cache_free(stub_priv_cache, priv);
+ 	usb_free_urb(urb);
+diff --git a/fs/ceph/dir.c b/fs/ceph/dir.c
+index 1afa11191000..aca0d884de73 100644
+--- a/fs/ceph/dir.c
++++ b/fs/ceph/dir.c
+@@ -315,7 +315,7 @@ static int ceph_readdir(struct file *file, struct dir_context *ctx)
+ 	struct ceph_mds_client *mdsc = fsc->mdsc;
+ 	int i;
+ 	int err;
+-	u32 ftype;
++	unsigned frag = -1;
+ 	struct ceph_mds_reply_info_parsed *rinfo;
+ 
+ 	dout("readdir %p file %p pos %llx\n", inode, file, ctx->pos);
+@@ -362,7 +362,6 @@ static int ceph_readdir(struct file *file, struct dir_context *ctx)
+ 	/* do we have the correct frag content buffered? */
+ 	if (need_send_readdir(fi, ctx->pos)) {
+ 		struct ceph_mds_request *req;
+-		unsigned frag;
+ 		int op = ceph_snap(inode) == CEPH_SNAPDIR ?
+ 			CEPH_MDS_OP_LSSNAP : CEPH_MDS_OP_READDIR;
+ 
+@@ -373,8 +372,11 @@ static int ceph_readdir(struct file *file, struct dir_context *ctx)
+ 		}
+ 
+ 		if (is_hash_order(ctx->pos)) {
+-			frag = ceph_choose_frag(ci, fpos_hash(ctx->pos),
+-						NULL, NULL);
++			/* fragtree isn't always accurate. choose frag
++			 * based on previous reply when possible. */
++			if (frag == (unsigned)-1)
++				frag = ceph_choose_frag(ci, fpos_hash(ctx->pos),
++							NULL, NULL);
+ 		} else {
+ 			frag = fpos_frag(ctx->pos);
+ 		}
+@@ -497,6 +499,7 @@ static int ceph_readdir(struct file *file, struct dir_context *ctx)
+ 		struct ceph_mds_reply_dir_entry *rde = rinfo->dir_entries + i;
+ 		struct ceph_vino vino;
+ 		ino_t ino;
++		u32 ftype;
+ 
+ 		BUG_ON(rde->offset < ctx->pos);
+ 
+@@ -519,15 +522,17 @@ static int ceph_readdir(struct file *file, struct dir_context *ctx)
+ 		ctx->pos++;
+ 	}
+ 
++	ceph_mdsc_put_request(fi->last_readdir);
++	fi->last_readdir = NULL;
++
+ 	if (fi->next_offset > 2) {
+-		ceph_mdsc_put_request(fi->last_readdir);
+-		fi->last_readdir = NULL;
++		frag = fi->frag;
+ 		goto more;
+ 	}
+ 
+ 	/* more frags? */
+ 	if (!ceph_frag_is_rightmost(fi->frag)) {
+-		unsigned frag = ceph_frag_next(fi->frag);
++		frag = ceph_frag_next(fi->frag);
+ 		if (is_hash_order(ctx->pos)) {
+ 			loff_t new_pos = ceph_make_fpos(ceph_frag_value(frag),
+ 							fi->next_offset, true);
+diff --git a/fs/fcntl.c b/fs/fcntl.c
+index 350a2c8cfd28..1493ceb0477d 100644
+--- a/fs/fcntl.c
++++ b/fs/fcntl.c
+@@ -741,16 +741,10 @@ static int __init fcntl_init(void)
+ 	 * Exceptions: O_NONBLOCK is a two bit define on parisc; O_NDELAY
+ 	 * is defined as O_NONBLOCK on some platforms and not on others.
+ 	 */
+-	BUILD_BUG_ON(21 - 1 /* for O_RDONLY being 0 */ != HWEIGHT32(
+-		O_RDONLY	| O_WRONLY	| O_RDWR	|
+-		O_CREAT		| O_EXCL	| O_NOCTTY	|
+-		O_TRUNC		| O_APPEND	| /* O_NONBLOCK	| */
+-		__O_SYNC	| O_DSYNC	| FASYNC	|
+-		O_DIRECT	| O_LARGEFILE	| O_DIRECTORY	|
+-		O_NOFOLLOW	| O_NOATIME	| O_CLOEXEC	|
+-		__FMODE_EXEC	| O_PATH	| __O_TMPFILE	|
+-		__FMODE_NONOTIFY
+-		));
++	BUILD_BUG_ON(21 - 1 /* for O_RDONLY being 0 */ !=
++		HWEIGHT32(
++			(VALID_OPEN_FLAGS & ~(O_NONBLOCK | O_NDELAY)) |
++			__FMODE_EXEC | __FMODE_NONOTIFY));
+ 
+ 	fasync_cache = kmem_cache_create("fasync_cache",
+ 		sizeof(struct fasync_struct), 0, SLAB_PANIC, NULL);
+diff --git a/fs/gfs2/glock.c b/fs/gfs2/glock.c
+index 6528724ad6e5..7bff6f46f5da 100644
+--- a/fs/gfs2/glock.c
++++ b/fs/gfs2/glock.c
+@@ -80,9 +80,9 @@ static struct rhashtable_params ht_parms = {
+ 
+ static struct rhashtable gl_hash_table;
+ 
+-void gfs2_glock_free(struct gfs2_glock *gl)
++static void gfs2_glock_dealloc(struct rcu_head *rcu)
+ {
+-	struct gfs2_sbd *sdp = gl->gl_name.ln_sbd;
++	struct gfs2_glock *gl = container_of(rcu, struct gfs2_glock, gl_rcu);
+ 
+ 	if (gl->gl_ops->go_flags & GLOF_ASPACE) {
+ 		kmem_cache_free(gfs2_glock_aspace_cachep, gl);
+@@ -90,6 +90,13 @@ void gfs2_glock_free(struct gfs2_glock *gl)
+ 		kfree(gl->gl_lksb.sb_lvbptr);
+ 		kmem_cache_free(gfs2_glock_cachep, gl);
+ 	}
++}
++
++void gfs2_glock_free(struct gfs2_glock *gl)
++{
++	struct gfs2_sbd *sdp = gl->gl_name.ln_sbd;
++
++	call_rcu(&gl->gl_rcu, gfs2_glock_dealloc);
+ 	if (atomic_dec_and_test(&sdp->sd_glock_disposal))
+ 		wake_up(&sdp->sd_glock_wait);
+ }
+diff --git a/fs/gfs2/incore.h b/fs/gfs2/incore.h
+index 51519c2836b5..a04bf9533d9e 100644
+--- a/fs/gfs2/incore.h
++++ b/fs/gfs2/incore.h
+@@ -370,6 +370,7 @@ struct gfs2_glock {
+ 			loff_t end;
+ 		} gl_vm;
+ 	};
++	struct rcu_head gl_rcu;
+ 	struct rhash_head gl_node;
+ };
+ 
+diff --git a/fs/open.c b/fs/open.c
+index d3ed8171e8e0..a6c6244f4993 100644
+--- a/fs/open.c
++++ b/fs/open.c
+@@ -902,6 +902,12 @@ static inline int build_open_flags(int flags, umode_t mode, struct open_flags *o
+ 	int lookup_flags = 0;
+ 	int acc_mode = ACC_MODE(flags);
+ 
++	/*
++	 * Clear out all open flags we don't know about so that we don't report
++	 * them in fcntl(F_GETFD) or similar interfaces.
++	 */
++	flags &= VALID_OPEN_FLAGS;
++
+ 	if (flags & (O_CREAT | __O_TMPFILE))
+ 		op->mode = (mode & S_IALLUGO) | S_IFREG;
+ 	else
+diff --git a/include/linux/fcntl.h b/include/linux/fcntl.h
+index 76ce329e656d..1b48d9c9a561 100644
+--- a/include/linux/fcntl.h
++++ b/include/linux/fcntl.h
+@@ -3,6 +3,12 @@
+ 
+ #include <uapi/linux/fcntl.h>
+ 
++/* list of all valid flags for the open/openat flags argument: */
++#define VALID_OPEN_FLAGS \
++	(O_RDONLY | O_WRONLY | O_RDWR | O_CREAT | O_EXCL | O_NOCTTY | O_TRUNC | \
++	 O_APPEND | O_NDELAY | O_NONBLOCK | O_NDELAY | __O_SYNC | O_DSYNC | \
++	 FASYNC	| O_DIRECT | O_LARGEFILE | O_DIRECTORY | O_NOFOLLOW | \
++	 O_NOATIME | O_CLOEXEC | O_PATH | __O_TMPFILE)
+ 
+ #ifndef force_o_largefile
+ #define force_o_largefile() (BITS_PER_LONG != 32)
+diff --git a/include/linux/usb/hcd.h b/include/linux/usb/hcd.h
+index 66fc13705ab7..492034126876 100644
+--- a/include/linux/usb/hcd.h
++++ b/include/linux/usb/hcd.h
+@@ -561,9 +561,9 @@ extern void usb_ep0_reinit(struct usb_device *);
+ 	((USB_DIR_IN|USB_TYPE_STANDARD|USB_RECIP_INTERFACE)<<8)
+ 
+ #define EndpointRequest \
+-	((USB_DIR_IN|USB_TYPE_STANDARD|USB_RECIP_INTERFACE)<<8)
++	((USB_DIR_IN|USB_TYPE_STANDARD|USB_RECIP_ENDPOINT)<<8)
+ #define EndpointOutRequest \
+-	((USB_DIR_OUT|USB_TYPE_STANDARD|USB_RECIP_INTERFACE)<<8)
++	((USB_DIR_OUT|USB_TYPE_STANDARD|USB_RECIP_ENDPOINT)<<8)
+ 
+ /* class requests from the USB 2.0 hub spec, table 11-15 */
+ /* GetBusState and SetHubDescriptor are optional, omitted */
+diff --git a/kernel/sysctl.c b/kernel/sysctl.c
+index c1095cdc0fe2..265e0d0216e3 100644
+--- a/kernel/sysctl.c
++++ b/kernel/sysctl.c
+@@ -2146,9 +2146,12 @@ static int do_proc_douintvec_conv(bool *negp, unsigned long *lvalp,
+ 	if (write) {
+ 		if (*negp)
+ 			return -EINVAL;
++		if (*lvalp > UINT_MAX)
++			return -EINVAL;
+ 		*valp = *lvalp;
+ 	} else {
+ 		unsigned int val = *valp;
++		*negp = false;
+ 		*lvalp = (unsigned long)val;
+ 	}
+ 	return 0;
+diff --git a/kernel/trace/trace_kprobe.c b/kernel/trace/trace_kprobe.c
+index 8d2b4d8fd714..5ff45cae4ac4 100644
+--- a/kernel/trace/trace_kprobe.c
++++ b/kernel/trace/trace_kprobe.c
+@@ -667,30 +667,25 @@ static int create_trace_kprobe(int argc, char **argv)
+ 		pr_info("Probe point is not specified.\n");
+ 		return -EINVAL;
+ 	}
+-	if (isdigit(argv[1][0])) {
+-		if (is_return) {
+-			pr_info("Return probe point must be a symbol.\n");
+-			return -EINVAL;
+-		}
+-		/* an address specified */
+-		ret = kstrtoul(&argv[1][0], 0, (unsigned long *)&addr);
+-		if (ret) {
+-			pr_info("Failed to parse address.\n");
+-			return ret;
+-		}
+-	} else {
++
++	/* try to parse an address. if that fails, try to read the
++	 * input as a symbol. */
++	if (kstrtoul(argv[1], 0, (unsigned long *)&addr)) {
+ 		/* a symbol specified */
+ 		symbol = argv[1];
+ 		/* TODO: support .init module functions */
+ 		ret = traceprobe_split_symbol_offset(symbol, &offset);
+ 		if (ret) {
+-			pr_info("Failed to parse symbol.\n");
++			pr_info("Failed to parse either an address or a symbol.\n");
+ 			return ret;
+ 		}
+ 		if (offset && is_return) {
+ 			pr_info("Return probe must be used without offset.\n");
+ 			return -EINVAL;
+ 		}
++	} else if (is_return) {
++		pr_info("Return probe point must be a symbol.\n");
++		return -EINVAL;
+ 	}
+ 	argc -= 2; argv += 2;
+ 
+diff --git a/security/keys/encrypted-keys/encrypted.c b/security/keys/encrypted-keys/encrypted.c
+index 56c458dd16a2..8d9330aba77e 100644
+--- a/security/keys/encrypted-keys/encrypted.c
++++ b/security/keys/encrypted-keys/encrypted.c
+@@ -437,7 +437,7 @@ static struct skcipher_request *init_skcipher_req(const u8 *key,
+ static struct key *request_master_key(struct encrypted_key_payload *epayload,
+ 				      const u8 **master_key, size_t *master_keylen)
+ {
+-	struct key *mkey = NULL;
++	struct key *mkey = ERR_PTR(-EINVAL);
+ 
+ 	if (!strncmp(epayload->master_desc, KEY_TRUSTED_PREFIX,
+ 		     KEY_TRUSTED_PREFIX_LEN)) {
+diff --git a/sound/soc/codecs/rt286.c b/sound/soc/codecs/rt286.c
+index 9c365a7f758d..7899a2cdeb42 100644
+--- a/sound/soc/codecs/rt286.c
++++ b/sound/soc/codecs/rt286.c
+@@ -1108,6 +1108,13 @@ static const struct dmi_system_id force_combo_jack_table[] = {
+ 			DMI_MATCH(DMI_PRODUCT_NAME, "Kabylake Client platform")
+ 		}
+ 	},
++	{
++		.ident = "Thinkpad Helix 2nd",
++		.matches = {
++			DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
++			DMI_MATCH(DMI_PRODUCT_VERSION, "ThinkPad Helix 2nd")
++		}
++	},
+ 
+ 	{ }
+ };